New functions often over-invest in structure and under-invest in credibility.
Organizations setting up internal audit for the first time often put too much into structure and too little into credibility. Credibility is what decides whether the function has any effect.
Report to the audit committee, not the CFO. Internal audit that reports into the function it oversees will sooner or later be asked to soften a finding. Independence is the whole value, not a formality.
Start with a risk-based plan, not an exhaustive one. Year one should cover the three or four areas with the highest combined likelihood and impact, not every process. A focused plan that gets finished builds more trust than an ambitious one that does not.
Write findings people can act on. "Controls around vendor onboarding are weak" helps less than "a number of new vendors in Q2 were onboarded without a completed due-diligence checklist, which exposes the business to this specific risk." Specifics turn a finding into a fix.
Follow up, in the open. The biggest credibility killer for a new function is findings that quietly disappear. A simple open-items tracker reviewed each quarter does more for its reputation than any single report.
Internal audit earns its place one credible, specific, followed-through finding at a time, not through the sophistication of its method on day one.