Based on a survey of the top 100 companies listed on the Italian Stock Exchange, this
study investigates internal auditing and risk assessment practices in large Italian
companies. The analysis of the survey answers indicates the existence of three
different approaches to internal auditing in the Italian context. Some companies
(25 per cent) have a small internal audit department, carrying out traditional assurance
activities. The internal auditor is still perceived as an inspector. These companies do
not integrate the COSO methodology into their audit process, and have a control
system entirely based on hard variables. The annual audit planning generally follows
an audit-cycle approach. This model is often found in smaller companies.