Depending on the size of a company, an internal audit function must be installed as a separate staff department or these activities must be outsourced to a qualified institution.

A risk analysis performed by IMMOFINANZ indicated that the creation of a traditional internal audit department would not support the reasonable optimisation of risk management because of the specific characteristics of the group. In accordance with the results of this analysis, internal control and audit functions are carried out as part of group controlling activities. The Executive Board provide regular reports to the Supervisory Board on the results of monitoring and controls.