Internal audit is one of the most misunderstood and most underutilised financial management tools available to GP practices in England. Many practice managers and GP partners associate the term with large NHS trusts or corporate organisations, assuming it has no relevance to a partnership of three to eight GPs running a surgery with twelve staff. That assumption is increasingly costly in 2026, as NHS England’s governance expectations for primary care have intensified significantly alongside the introduction of five new access and demand metrics, the structural changes of the 2026/27 GP contract, and the ongoing pressure on ICBs to demonstrate value from primary care investment.
Internal audit is not the same as your year-end accounts or your annual external audit. It is not a compliance exercise carried out by your accountant once a year. Done correctly, it is an independent, ongoing assessment of whether your practice’s financial controls, operational processes, and governance arrangements are working as they should and whether the risks facing your practice are being identified and managed before they become problems.
This guide explains what GP practice internal audit actually involves, why it matters more in 2026 than it ever has before, what NHS England expects from well-governed practices, and how a specialist internal audit function protects your practice’s income, reputation, and financial sustainability.
What Internal Audit Is and What It Is Not
Before exploring why internal audit matters for GP practices, it is worth being precise about what it involves because the term is frequently confused with other forms of assurance and review.
What internal audit is:
Internal audit is an independent, objective assessment of a practice’s internal controls, financial processes, risk management arrangements, and governance framework. Its purpose is to provide assurance to the partners, the practice manager, and where relevant to commissioners that the practice’s systems are working as intended and that risks are being appropriately managed.
In a GP practice context, internal audit examines whether your financial controls prevent fraud and error, whether your NHS income claims are being submitted correctly and completely, whether your payroll processes comply with current employment law, whether your purchasing and expenditure controls are appropriate, and whether your management information the numbers you use to make decisions can be relied upon.
What internal audit is not:
Internal audit is not the same as your annual accounts which are a historic picture of what happened, not an assessment of whether your controls are working. It is not the same as an external audit, which is an independent opinion on whether your accounts show a true and fair view. It is not a one-off exercise it is an ongoing programme of assurance that reviews different areas of the practice on a planned cycle. And it is not a witch-hunt for fraud its primary purpose is to identify weaknesses in systems before they lead to loss, error, or reputational damage.
Key Point: The distinction that matters most for GP partners is this your year-end accounts tell you what happened. Internal audit tells you whether your controls will prevent the wrong things from happening in the future. Both are essential, but they serve entirely different purposes. A practice with clean year-end accounts but weak internal controls is still at significant risk of fraud, income loss, and governance failure.
Why Internal Audit Matters More Than Ever for GP Practices in 2026
The case for GP practice internal audit has strengthened considerably in 2026, driven by four simultaneous developments that together create a governance environment where weak financial controls carry greater risk than at any previous point in the NHS primary care landscape.
Development 1 Five New Access and Demand Metrics
The 2026/27 GP contract introduced five new access and demand metrics that NHS England will collect at practice level. These metrics measure how effectively practices are responding to patient demand including same-day urgent access compliance and will be used by ICBs to assess contract performance. For practices, this means NHS England now has greater visibility of operational performance than ever before. Practices with poor record-keeping, inconsistent appointment recording, or data quality issues face a higher risk of adverse contract performance assessments based on inaccurate data. Internal audit of your data quality and recording processes is the most effective way to ensure the metrics accurately reflect your actual performance rather than your administrative gaps.
Development 2 The GP Reimbursement Scheme and ARRS Funding Complexity
The 2026/27 contract replaced the Capacity and Access Payment with the new practice-level GP Reimbursement Scheme, adding a new income stream with its own eligibility conditions, documentation requirements, and audit trail obligations. Combined with the existing Additional Roles Reimbursement Scheme which requires practices to demonstrate that funded roles are being used as intended and that employment costs are correctly categorised the reimbursement landscape is now significantly more complex. As detailed in our GP contract 2026/27 guide, incorrect categorisation of ARRS employment costs or inadequate documentation of GP Reimbursement Scheme activity creates both a financial recovery risk and a contract compliance risk. Internal audit of your reimbursement claims and supporting records is the most effective protection against these risks.
Development 3 MTD for Income Tax Now Live
Making Tax Digital for Income Tax is now live from 6 April 2026 for qualifying sole traders and landlords with income above £50,000. GP partners should check whether they have qualifying self-employment or property income within the current rules, and should monitor HMRC’s future timetable for partnership mandation. GP practices should still review digital record-keeping, bookkeeping accuracy, partner income reporting and quarterly financial visibility as part of internal audit readiness.
Development 4 Employer NIC Increase and Payroll Complexity
The April 2026 employer NIC changes rate increase to 15%, secondary threshold drop to £5,000, DDRB pay award implementation, National Living Wage rise, and holiday pay calculation reforms have created the most complex payroll environment for GP practices in many years. As covered in our employer NIC guide and GP practice holiday pay guide, errors in any of these areas generate real financial liabilities including Employment Tribunal claims for holiday pay underpayment and HMRC compliance checks for NMW breaches. An internal audit of your payroll controls covering all April 2026 changes is the most reliable way to identify and correct errors before they become formal disputes.
What NHS England Expects from Well-Governed GP Practices
NHS England’s framework for assessing GP practice governance has evolved significantly over the past three years, and in 2026 it is more explicit than ever about what good governance looks like in primary care. Understanding these expectations and being able to demonstrate compliance with them is not just a governance obligation. It is a practical protection for your practice’s contract and income.
The Well-Led Domain
CQC’s well-led inspection domain which assesses whether a practice is effectively led, managed, and governed explicitly includes financial governance as a component of good leadership. Inspectors assess whether the practice has sound financial controls, whether risks are identified and managed proactively, and whether the leadership team has access to reliable financial information to support decision-making. A practice that cannot demonstrate these things at inspection faces a lower well-led rating, which directly affects the CQC rating that patients, staff, and commissioners see.
ICB Oversight and Contract Compliance
Integrated Care Boards are under increasing pressure from NHS England to demonstrate that primary care funding is being used appropriately and effectively. In 2026/27, ICBs are expected to carry out more active oversight of GP contracts particularly in relation to the new GP Reimbursement Scheme and ARRS compliance. Practices that maintain robust internal audit programmes and can produce clear documentation of their governance arrangements are significantly better placed in ICB oversight reviews than those that cannot.
NHS Counter Fraud Authority
The NHS Counter Fraud Authority (NHSCFA) actively investigates financial irregularities in primary care, including incorrect NHS income claims, false expense claims, and payroll fraud. GP practices are within scope of NHSCFA investigations. While the vast majority of practices have no fraudulent intent, weaknesses in internal controls can allow innocent errors to accumulate into patterns that attract NHSCFA scrutiny. A functioning internal audit programme is the most effective deterrent to and defence against NHSCFA investigation.
The Primary Care Network Governance Layer
Most GP practices operate within a Primary Care Network, which adds an additional governance layer. PCN governance arrangements including the management of any residual PCN-level funding, shared staffing arrangements, and collaborative service delivery create financial relationships between practices that require their own internal controls. Internal audit of your practice’s PCN-related financial flows ensures that money moving between the practice and the PCN is correctly accounted for and that shared arrangements do not create unintended liabilities. Our healthcare accounting team regularly identifies PCN accounting errors in practices that have never had a formal review of these flows.
The Key Areas of GP Practice Internal Audit in 2026
A well-designed internal audit programme for a GP practice covers several distinct areas on a planned cycle. Not all areas require the same frequency of review — higher-risk areas should be reviewed more often, lower-risk areas less frequently. Here is a summary of the key areas and why each matters.
NHS Income Claims and Reconciliation
This is typically the highest-priority area for GP practice internal audit. NHS income flows through multiple mechanisms Global Sum, QOF, Enhanced Services, ARRS, GP Reimbursement Scheme, vaccination programmes and each has its own claim submission process, payment timing, and reconciliation requirements. Internal audit of NHS income verifies that all income entitlements are being claimed, that claims are being submitted correctly and on time, that the income received matches the income due, and that any overpayments or clawbacks are being correctly identified and accounted for.
Common findings in this area include unclaimed Enhanced Service income where the service has been delivered but not submitted, QOF accruals that are materially different from the eventual payment due to incorrect achievement data, and ARRS reimbursement claims that do not correctly reflect the employment on costs eligible for reimbursement. Each of these represents real income that the practice is losing not through fraud, but through administrative gaps that internal audit identifies and closes. OurGP practice accounting team combines income reconciliation with the internal audit function to ensure every pound of NHS entitlement is captured.
Payroll Controls
Payroll is the largest expenditure item in most GP practices and the area of greatest financial risk from both error and fraud. Internal audit of payroll controls examines whether the payroll is authorised by an appropriate individual, whether starters and leavers are processed promptly and correctly, whether pay rates are correctly applied (including April 2026 changes to NLW, DDRB pay award, and holiday pay calculations), whether PAYE and NIC deductions are accurate, whether the Employment Allowance is being correctly claimed, and whether payroll costs are correctly allocated between practice-funded and ARRS-funded staff.
A particular area of risk in 2026 is the interaction between the DDRB pay award and holiday pay calculations. As covered in our holiday pay compliance guide, failure to update holiday pay calculations for the 3.5% pay award from 1 April 2026 creates a systematic underpayment that generates Employment Tribunal risk. Internal audit of payroll immediately identifies whether this update has been correctly implemented across all relevant staff categories.
Purchasing and Expenditure Controls
Who in your practice can authorise expenditure? Up to what limit? Does any single person have the ability to both raise an order and authorise its payment? Are all suppliers on your system legitimate? Are invoices being checked against orders before payment is made? These are the fundamental questions of purchasing control, and their answers determine whether your practice is vulnerable to fraudulent invoices, fictitious suppliers, or unauthorised expenditure.
Internal audit of purchasing controls typically includes a review of the authorisation framework, a sample check of invoices and payments, a check of supplier details against staff records (to identify potential conflicts of interest), and a review of any cash expenditure or petty cash. For most GP practices, purchasing controls are significantly weaker than payroll controls partly because the amounts involved are smaller and partly because the focus on NHS income claims and payroll has historically left purchasing as a lower priority.
Cash and Bank Controls
Do two people check the bank reconciliation? Is the person who makes payments different from the person who reconciles the bank? Are all bank accounts used by the practice known to all partners? Are online banking authorisation limits appropriate? These controls are fundamental to preventing both internal fraud and external cyber fraud which has increased significantly in frequency in the healthcare sector over the past three years.
Internal audit of cash and bank controls examines the segregation of duties in the payment process, the frequency and quality of bank reconciliation, the controls around online banking access, and whether the practice has appropriate controls over petty cash and any income received in cash (for example, prescription charge income for dispensing practices). Our bookkeeping for healthcare team frequently identifies single points of control failure in GP practice bank processes that create avoidable fraud risk.
Contract and Regulatory Compliance
Are all staff DBS-checked and on the appropriate register? Are clinical staff indemnity arrangements in place and current? Are CQC registration conditions being met? Are locum engagement arrangements correctly assessed for IR35 as required? As detailed in our IR35 guide, the responsibility for IR35 status determination sits with the GP practice as a public sector body and incorrect assessments generate employer NIC and income tax liabilities. Internal audit of contract compliance reviews the status of all regulatory registrations, staff compliance records, and locum arrangements to identify any gaps before they become enforcement issues.
Financial Reporting and Management Information
Are your monthly management accounts being produced? Are they produced within a reasonable timeframe after month-end? Do they accurately reflect the practice’s income and expenditure position? Are partners reviewing them? Are decisions being made on the basis of accurate financial information? Many GP practices either do not produce regular management accounts or produce them infrequently and at a level of detail that does not support meaningful decision-making. Internal audit of financial reporting examines both the quality of the management information produced and whether it is being used effectively by the practice leadership.
How Often Should GP Practice Internal Audit Be Carried Out?
The frequency of internal audit review depends on the size of the practice, the complexity of its income streams, and the risk profile of specific areas. As a general framework:
Annual review as a minimum for all practices: NHS income reconciliation, payroll controls, purchasing controls, bank controls, and contract compliance should be reviewed at least annually.
Quarterly review for higher-risk or higher-complexity practices: Practices with multiple ARRS-funded roles, GP Reimbursement Scheme income, complex PCN financial arrangements, or practices that have recently experienced staff changes in key financial roles should review higher-risk areas quarterly.
Triggered reviews following specific events: Any significant change in the practice a new partner, a new practice manager, a new payroll system, a significant change in NHS contract, a CQC inspection should trigger a targeted internal audit review of the areas most affected by the change.
Post-April 2026 immediate review: Given the volume of simultaneous changes that took effect on 1 April 2026 NIC rate, NLW, DDRB pay award, holiday pay calculations, MTD mandation, new GP contract income structures every GP practice should carry out an internal audit review of its payroll, NHS income claims, and financial reporting for the first quarter of 2026/27 as a matter of priority. The risk of error in any one of these areas is high enough individually. Together, the compounding risk is substantial.
Internal Audit vs External Audit vs Accountant: Understanding the Difference
One of the most common questions from GP partners and practice managers is how internal audit relates to the other financial oversight they already have in place. The answer is that they serve entirely different purposes and none substitutes for the others.
Your accountant prepares your year-end accounts, manages your tax compliance (including Self Assessment and corporation tax), advises on tax planning, and if they are a specialist like our GP practice accounting team provides ongoing advice on NHS income, financial management, and practice planning. Your accountant works from historical data and produces a retrospective picture of the practice’s financial performance.
External audit ( where applicable most GP practices are not subject to mandatory external audit) is an independent opinion on whether the accounts show a true and fair view. External auditors check that the accounts are correctly prepared from the underlying records. They do not assess whether your internal controls are adequate or whether your operational processes are working correctly.
Internal audit is forward-looking and control-focused. It examines whether the processes and controls that generate your financial information are working correctly, whether risks are being managed, and whether the practice’s systems would prevent or detect fraud and error. It provides assurance to partners and to commissioners — not a historic opinion on what happened, but a current assessment of whether the practice is being run as it should be.
A GP practice with excellent accounting support and clean year-end accounts may still have significant internal control weaknesses that internal audit would identify. The three functions are complementary, not interchangeable.
The Cost of Not Having Internal Audit in Place
For practices that have never had a formal internal audit review, the potential financial consequences of the gaps internal audit would identify fall into three categories.
Direct financial loss from unclaimed NHS income, payroll errors, fraudulent or erroneous expenditure, or incorrect reimbursement claims. In practices we have reviewed for the first time, unclaimed Enhanced Service income, incorrect QOF accruals, and ARRS reimbursement shortfalls frequently total several thousand pounds per year — money the practice was entitled to but did not claim because the administrative process was not working correctly.
Regulatory and compliance cost from HMRC payroll compliance checks, Employment Tribunal claims for holiday pay underpayment, NHSCFA investigations triggered by data anomalies, or ICB contract queries arising from documentation gaps. Any one of these events costs significantly more to resolve than a proactive internal audit programme would cost to run.
Governance and reputational risk from a poor CQC well-led rating, ICB contract performance concerns, or partner disputes arising from financial management disagreements. A functioning internal audit programme provides the documentation and assurance that prevents these situations from arising and defends the practice if they do.
Our internal audit service is specifically designed for GP practices and other healthcare organisations it is not a generic small business audit approach applied to a healthcare context. We understand NHS income structures, ARRS funding, GP contract compliance, CQC governance requirements, and the specific payroll and HR complexities of GP practice employment.
Frequently Asked Questions
Our practice has never had an internal audit. Where should we start?
Start with a baseline review that covers the five highest-risk areas: NHS income reconciliation, payroll controls, bank controls, purchasing controls, and IR35 compliance for any locums engaged through personal service companies. This baseline review gives you a current picture of where your controls are strong and where they need strengthening and it provides documentation that demonstrates to any commissioner, CQC inspector, or HMRC officer that your practice takes financial governance seriously. Our internal audit team can conduct this baseline review and provide a prioritised action plan for addressing any gaps identified. Contact us to arrange an initial consultation.
Does NHS England require GP practices to have internal audit?
There is no universal mandatory requirement for all GP practices to have a formal internal audit programme the obligation applies directly to NHS trusts and foundation trusts rather than GP practices. However, the CQC well-led domain assessment, ICB oversight requirements, and NHS Counter Fraud Authority expectations all implicitly require practices to have appropriate internal controls and governance arrangements. In practice, the absence of any internal audit function is a risk indicator that CQC inspectors and ICB reviewers will note. Practices that participate in certain commissioning arrangements including some PCN-level contracts may also face contractual governance requirements that are best met through a documented internal audit programme.
Can our existing accountant carry out our internal audit?
This depends on the nature of your accountant’s involvement with the practice. Internal audit should be independent meaning it is carried out by someone who is not involved in the day-to-day preparation of the financial records being reviewed. If your accountant also does your bookkeeping, they cannot objectively audit those same records. Where an accountant provides only year-end accounts and tax services without being involved in day-to-day bookkeeping there is more scope for them to carry out certain internal audit functions. At Kudos, we operate our internal audit service separately from our bookkeeping and accounts preparation services to maintain the independence that gives internal audit its value.
What does an internal audit report look like and who sees it?
A GP practice internal audit report typically covers: the scope of the review (which areas were examined and over what period), the audit methodology (what was tested and how), the findings (both strengths and weaknesses identified), the risk rating of each finding (high, medium, or low), and the recommended actions and timescales for addressing weaknesses. The report is presented to the partners and practice manager it is an internal governance document, not a public document. In practices where there is a management committee or a practice board, the report would typically be presented to that body. The report provides the documentation that demonstrates to CQC, ICBs, and other oversight bodies that the practice has a functioning governance framework.
We are a small practice with only two partners. Is internal audit relevant for us?
Yes and in some respects the risk is higher in smaller practices than larger ones, because the controls that rely on segregation of duties are harder to maintain when fewer people are involved in financial processes. A two-partner practice where the practice manager has both bookkeeping and payment authorisation responsibilities has a structural control weakness that a larger practice can avoid through role separation. Internal audit identifies these weaknesses and recommends practical compensating controls that work within the staffing constraints of a smaller practice for example, requiring partners to review bank statements monthly rather than delegating this entirely to the practice manager. Our GP practice accounting team works with practices of all sizes, from single-handed GPs to large multi-site partnerships.
Summary: Internal Audit Is Not a Luxury It Is a Governance Essential in 2026
The combination of new NHS contract income streams, MTD mandation, employer NIC complexity, CQC governance expectations, and ICB oversight intensity makes 2026 the year in which GP practice internal audit moves from a good-to-have to a governance essential. The practices that have functioning internal controls, regular independent review of their processes, and documented assurance over their financial management are better protected against income loss, regulatory risk, employment law liability, and reputational damage than those that do not.
The cost of a well-designed internal audit programme for a GP practice is modest relative to the financial risks it manages. The cost of getting it wrong unclaimed NHS income, HMRC payroll compliance checks, Employment Tribunal claims, ICB contract queries, or a poor CQC well-led rating is substantially higher.
If your practice has never had a formal internal audit review, or if the last review was more than twelve months ago and did not cover the April 2026 changes, now is the right time to commission one. Our specialist internal audit service is designed specifically for GP practices and healthcare organisations combining deep understanding of NHS primary care with independent, objective assessment of your financial controls and governance arrangements.
Contact our team to discuss an internal audit review for your practice. You may also find these related guides useful: GP contract 2026/27 — what the funding changes mean, MTD for income tax for GP partners, employer NIC changes April 2026, IR35 and healthcare workers, and GP practice holiday pay compliance.
Book a free consultation with Kudos Accounting → kudosaccounting.co.uk/contact-us/