An internal audit is the system checking itself. Done well it is one of the most useful things a management system does, because it finds the gaps before a client, a regulator or a certification body does. Done as a box-ticking exercise, it is wasted effort that fools no one.