In essence internal audit is a form of management audit only. It may be conducted by an employee of the company or may be conducted by a third party such as a CA firm. In case it is performed by a third pary than independence of the internal auditor is ensured. A number of companies have internal audit teams consisted of the employees of the same company. Over and above that those companies hire the services of CA firms for third party internal audit.
Even under CARO internal audit is not compulsory. What CARO requires is that the Statutory auditor must give an opinion on the internal controls within the organisation whether the same are commensurate to the size of the organisation and whether adequate internal audit is being conducted.. It does not compel any company to go for internal audit.
However for large companies it is better to go for it. Because all the companies doing large businesses do have certain internal controls in the form of procedures, principles, etc. Someone needs to verify whether the same are adequate and whether in actual practice the same are being followed or not. If there is no internal audit, management is its own judge as regards internal controls being instituted by itself. Looks absurd. Again as regards the employees who r required to follow the controls, they are their own watch dogs!!!! Again absurd and risky.... So internal audit even though not compulsory, its advisable.
Even Venture capital/ PE firms while providing private equity verify whether the company has adequate internal controls and does it has an internal audit done or not... In case of M & A also the same is verified by the purchaser... Hence before we loose a deal due to adequacy of internal controls it is better to go for internal audit and to get an opinion from experienced auditors regarding adequacy of the internal controls and whether they are actually followed in practice or not...