From external to internal audit