An audit institution is a public body established to examine, independently or with defined statutory authority, how public organisations manage resources, comply with laws and rules, report financial information and, depending on its mandate, perform their functions. At the highest level, such an institution may be a supreme audit institution, commonly abbreviated SAI.
INTOSAI defines an SAI as a public body of a state or supranational organisation that exercises the highest public sector auditing function and performs its functions independently and objectively, with audit and jurisdictional responsibilities varying according to national legal frameworks. Examples of institutional forms include courts of audit, audit offices, auditor general offices and boards or collegiate audit institutions. An audit institution is therefore not simply a private accounting firm working for government. It is part of the public accountability architecture and usually has a legally defined mandate to examine public finances or public administration. Its precise powers depend on constitutional and statutory arrangements.
The principal purpose of an audit institution is to provide independent evidence about public resource management and public administration. Financial audit can examine whether financial statements are presented fairly under the applicable reporting framework. Compliance audit can examine whether government actions and transactions comply with laws, regulations, budget authority and other requirements. Performance audit can examine economy, efficiency and effectiveness where the institution has that mandate.
Some audit institutions also conduct specialised investigations or exercise judicial or quasi judicial functions, although this is not universal. INTOSAI emphasises that the audit and jurisdictional responsibilities of SAIs vary according to national legal frameworks. This variation explains why one country's audit institution may have powers that another country's auditor does not possess. The common feature is independent public sector auditing rather than a universally identical organisational structure or set of legal powers.
Independence is fundamental to an audit institution because it must be able to examine organisations that may control its budget, appointments or access to information. INTOSAI's Lima Declaration states that supreme audit institutions can perform their tasks objectively and effectively only if they are independent of audited entities and protected against outside influence. Independence can have legal, organisational, functional, financial and operational dimensions. Legal independence concerns whether the institution's mandate and status are protected by constitutional or statutory rules.
Functional independence concerns freedom to determine audit priorities, methods and reporting within its mandate. Financial independence concerns whether adequate resources are available without allowing an audited body to control the institution's finances. Personal independence concerns protections for the head and senior members against improper removal or interference. Formal legal guarantees are important but do not automatically establish practical independence, which can also depend on institutional culture, professional norms and relationships with other accountability bodies.
An audit institution normally operates through a cycle of planning, risk assessment, evidence gathering, analysis, reporting and follow up. Auditors may examine financial records, contracts, payment systems, internal controls, administrative procedures, performance information and other evidence relevant to the audit mandate. Audit evidence can include documents, electronic records, interviews, physical inspections, data analysis and confirmations. Professional auditing standards establish principles for obtaining sufficient and appropriate evidence and forming conclusions.
The institution then produces an audit report or other formal output describing findings, conclusions and recommendations where appropriate. In parliamentary systems, reports may be submitted to the legislature and considered by a public accounts committee or comparable body. Follow up can assess whether audited organisations implemented recommendations. This process creates a link between technical audit work and wider accountability because evidence produced by auditors can inform legislative scrutiny, administrative correction and public understanding of government performance.
Audit institutions are distinct from internal audit functions even though both can examine public sector operations. Internal audit normally operates within an organisation and provides management or governing bodies with assurance and advice concerning risk, controls and performance. External audit is conducted by an entity sufficiently independent of management to provide outside assurance.
The OECD explains that managers are primarily responsible for internal control, while internal auditors and other assurance functions contribute independent assessment, and supreme audit institutions perform external audit functions over public expenditure and related areas. Internal and external auditors can therefore complement each other. Internal audit may provide continuous risk based assurance within departments, while an external audit institution can provide independent scrutiny to parliament and the public. Cooperation can reduce duplication and improve coverage, but cooperation must not compromise the external auditor's independence or turn it into a management function.
Audit institutions also contribute to transparency and public accountability through publication of audit reports and findings. Their reports can identify weaknesses in financial management, internal control, procurement, programme administration or performance and can provide recommendations for improvement. Public reporting is particularly important because audit findings may otherwise remain confined to relationships between auditors and government departments.
INTOSAI describes the mission of the organisation as supporting public sector accountability, public transparency and good governance, while the OECD describes independent SAIs as a cornerstone of sound public governance. Nevertheless, an audit institution is not normally responsible for making government policy. Its role is to examine the implementation and management of public functions according to its legal mandate and professional standards. Recommendations can inform policymakers, but responsibility for policy choices normally remains with the relevant democratic or administrative authorities. This distinction protects the audit function from becoming a substitute for political decision making.
The effectiveness of an audit institution depends on more than the existence of an audit law. It requires qualified personnel, reliable access to records, adequate funding, appropriate technology, professional standards, clear reporting channels and protection against interference. The OECD's 2026 work on SAI independence highlights that legal safeguards can be insufficient when practical constraints affect budget autonomy, information access or freedom from interference. Credibility also depends on methodological quality and impartial reporting.
An audit institution must be able to reach conclusions based on evidence rather than political preference, while audited bodies must have appropriate opportunities to respond to factual findings. The relationship between auditors, legislatures, executives, courts, civil society and the public forms a wider accountability ecosystem. Strong audit institutions therefore depend upon institutional arrangements that ensure their findings are credible and capable of being considered and acted upon by other parts of the governance system.
The historical development of modern audit institutions is closely connected with the principle that public officials should not have unchecked control over public money. The Lima Declaration of 1977 became a major international reference point for independent external government audit, and INTOSAI identifies it as the Magna Carta of external government audit. Modern audit institutions vary greatly in structure because some are headed by an auditor general while others operate as collegiate bodies or courts of audit.
Their common purpose is independent scrutiny of public resources and administration. A common misconception is that an audit institution only searches for fraud. Fraud detection can be relevant, but auditing also examines financial reporting, legality, controls, performance and governance. Another misconception is that an audit report itself automatically imposes punishment. In many systems the auditor reports findings while another institution, such as parliament, a regulator or a court, determines subsequent action. An audit institution is therefore best understood as an independent evidence and oversight institution within the wider architecture of public accountability.
