Internal Audit

Internal Audit: complete guide

Introduction

Internal audit is an independent, ongoing review of how a business actually runs: whether its processes work as designed, whether its controls prevent errors and fraud, whether it follows the laws that apply to it, and whether money and assets are being used properly. Unlike the statutory audit, which looks back once a year and gives an opinion on the financial statements, internal audit looks at operations throughout the year and reports to management, the board or the audit committee with practical recommendations.

In India, internal audit is mandatory for certain classes of companies under Section 138 of the Companies Act, 2013 and the Companies (Accounts) Rules, 2014. Listed companies, larger unlisted public companies and larger private companies must appoint an internal auditor, and the audit committee or the board decides the scope, functioning, periodicity and methodology of the internal audit. Many other businesses, including mid-sized private companies, LLPs, family businesses, trusts and institutions, choose internal audit voluntarily because it gives owners independent visibility into areas they cannot personally supervise.

A good internal audit is not a hunt for mistakes. It is a structured look at risk. It asks where the business could lose money, breach a law, mislead its own reports or damage its reputation, and then tests whether the controls in those areas are working. Procurement, sales and collections, inventory, payroll, fixed assets, statutory compliance and information technology are typical focus areas, but the plan should follow your business, not a template.

Professional help matters because internal audit needs independence, skill and a clear method. An employee who reports to the person whose work is being reviewed rarely gets the full picture, and a checklist borrowed from another business misses the risks specific to yours. Our team of chartered accountants and process specialists plans internal audits around your risks, tests controls with evidence, and reports findings in a form the board can act on. This page explains who needs internal audit, the legal requirements, our process, the documents involved, timelines, how pricing works and what happens after each report.

Who Needs It

Companies required by law. Under the Companies (Accounts) Rules, 2014, the following must appoint an internal auditor:

• Every listed company.
• Every unlisted public company that, during the preceding financial year, had paid-up share capital of 50 crore rupees or more, or turnover of 200 crore rupees or more, or outstanding loans or borrowings from banks or public financial institutions exceeding 100 crore rupees at any time, or outstanding deposits of 25 crore rupees or more at any time.
• Every private company that, during the preceding financial year, had turnover of 200 crore rupees or more, or outstanding loans or borrowings from banks or public financial institutions exceeding 100 crore rupees at any time.

Businesses that benefit voluntarily. Internal audit is also valuable for:

• Growing private companies that have outgrown the founders' direct oversight and need independent checks on spending and approvals.
• Multi-location businesses with branches, warehouses, franchisees or plants that are hard to monitor centrally.
• Family-owned businesses where owners want assurance that professional managers are following agreed policies.
• Companies preparing for investment or listing, where investors expect a working control framework.
• Trusts, schools, hospitals and not-for-profits that handle donations, grants and fees and must account for their use.
• Businesses that have faced fraud or losses and want a structured review to close the gaps.
• Regulated entities such as non-banking financial companies and other bodies whose regulators expect an internal audit function.

Key Benefits

• Early warning of problems. Control gaps, leakages and policy breaches are found during the year, not after the annual audit or a loss.
• Fraud prevention and detection. Testing of approvals, vendor creation, payments and inventory movements deters misuse and identifies red flags.
• Stronger compliance. Reviews of GST, TDS, labour law, environmental and sector-specific compliance reduce the risk of penalties.
• Better processes. Recommendations often remove duplicate steps, speed up approvals and cut costs, not just add controls.
• Support for the board and audit committee. Regular reports give directors the information they need to discharge their oversight duties.
• Reliable internal financial controls. Internal audit testing supports the internal financial controls that directors and statutory auditors must report on.
• Shorter statutory audits. When controls are documented and tested, the statutory auditor can place more reliance on them.

Internal audit compared with statutory audit. The statutory audit is required by law for every company, is carried out by an independent external auditor appointed by the members, and results in an opinion on the financial statements. Internal audit is appointed by the board, reports to the board or audit committee, covers operations and compliance as well as finance, and its scope is set by the business. The law bars a company's statutory auditor from also providing internal audit services to that company, so the two roles must be filled by different people or firms.

Risk-based internal audit in practice. Instead of checking every transaction in every area, a risk-based plan ranks processes by how much could go wrong and how likely it is. High-risk areas, such as cash collections or large procurement contracts, are reviewed more often and in greater depth. Lower-risk areas are covered on a rotation. This keeps the internal audit focused and cost-effective, and the plan is updated each year as the business and its risks change.

Eligibility and Legal Requirements

The key legal requirements for internal audit in India are:

• Section 138 of the Companies Act, 2013. Prescribed classes of companies must appoint an internal auditor to conduct internal audit of the functions and activities of the company.
• Who can be appointed. The internal auditor may be a chartered accountant, a cost accountant, or such other professional as decided by the board. The internal auditor may or may not be an employee of the company, and can be an individual or a firm.
• Board resolution. The appointment of the internal auditor is made by the board at a meeting through a board resolution.
• Scope set by the audit committee or board. The audit committee, or the board where there is no audit committee, formulates the scope, functioning, periodicity and methodology of internal audit, in consultation with the internal auditor.
• Independence from the statutory auditor. Under Section 144 of the Companies Act, 2013, the statutory auditor cannot provide internal audit services to the same company.
• Professional standards. Chartered accountants carrying out internal audit follow the Standards on Internal Audit and related guidance issued by their professional body.
• Internal financial controls. Directors of listed companies, and the board's report of other companies in prescribed respects, must address the adequacy of internal financial controls, and the statutory auditor reports on internal financial controls over financial reporting for many companies. Internal audit work supports these reports.
• Sector rules. Listed entities have additional obligations under the securities regulator's listing regulations, and regulated financial entities may have internal audit rules issued by their regulator.

Thresholds and rules are updated from time to time. We check the current requirements for your company before every engagement.

Step-by-Step Guide

1. Understanding the business. We meet management to understand your operations, locations, systems, key people, past audit findings and areas of concern.
2. Applicability and appointment. We confirm whether internal audit is mandatory for your company, check independence from the statutory auditor, and help with the board resolution and engagement terms.
3. Risk assessment. We map your major processes and rate each for risk, considering size of transactions, complexity, past issues, regulatory exposure and fraud potential.
4. Annual internal audit plan. We prepare a plan that sets out the areas to be covered each quarter, the depth of review and the reporting schedule, for approval by the audit committee or board.
5. Process walkthroughs. For each area, we speak with process owners and document how the process actually works, including approvals, systems and handoffs.
6. Control testing. We test samples of transactions against policies and controls, using documents, system reports and data analysis, and verify physical assets or stock where relevant.
7. Discussion of observations. Findings are discussed with process owners to confirm facts and understand reasons before anything is reported.
8. Draft report. We prepare a draft report rating each observation by severity, with the risk, root cause and a practical recommendation.
9. Management responses. Management records its response, the action it will take, the person responsible and a target date. The final report goes to the audit committee or board.
10. Follow-up review. In the next cycle, we check whether agreed actions have been implemented and report the status of open points.

Documents Checklist

Organisation and governance:

• Organisation chart and delegation of authority or approval matrix
• Board and audit committee minutes relevant to internal audit
• Policies and standard operating procedures, such as procurement, travel, credit and inventory policies
• Previous internal audit and statutory audit reports, and management letters

Finance and accounts:

• Trial balance and general ledger for the period under review
• Bank statements and reconciliations
• Vendor and customer master lists
• Fixed asset register

Operations:

• Purchase requisitions, purchase orders, goods receipt records and vendor invoices
• Sales orders, delivery records, invoices and credit notes
• Stock registers, physical verification reports and warehouse records
• Contracts with major vendors, customers and service providers

Human resources and payroll:

• Employee master, attendance and payroll registers
• Records of joiners, leavers and salary changes
• Provident fund, ESI and professional tax filings

Compliance and IT:

• GST, TDS and other statutory returns and challans
• Licences and registrations held by the business, with renewal dates
• User access lists and system change logs for key applications

How Long It Takes

• Initial risk assessment and annual plan: about two to three weeks.
• Each internal audit cycle: usually two to four weeks of fieldwork per quarter for a mid-sized business, depending on the areas covered and the number of locations.
• Reporting: a draft report is generally shared within a week of completing fieldwork, and the final report after management responses are received.
• Special reviews: a focused review of one process or a suspected irregularity can take one to three weeks, depending on the volume of records.

Timelines depend on how quickly data and people are available. Agreeing a calendar with the audit committee at the start keeps each cycle on track.

Pricing

Internal audit fees are quoted after we understand your business and the scope you need, so please contact us for pricing. The quote depends on:

• Size of the business, turnover and number of transactions
• Number of locations, plants, branches and warehouses
• Processes in scope and how often each is reviewed
• Whether the engagement is quarterly, half-yearly, annual or a one-time review
• Need for specialist work such as IT controls, data analytics or forensic review

Our quote sets out the audit plan, frequency of visits, reporting format and team composition. Travel to other locations, where needed, is agreed in advance. Any government fees for related filings are payable at actual.

Common Mistakes to Avoid

• Appointing the statutory auditor as internal auditor. This is not allowed for companies and creates a conflict of interest.
• Using a generic checklist. Internal audit that ignores the specific risks of your business wastes time on low-value areas.
• No board involvement in scope. For companies covered by the law, the scope must be set by the audit committee or board, not left only to management.
• Reporting to the wrong person. If the internal auditor reports only to the head of finance, findings about finance may never reach the board.
• Reports without action. Observations that are not assigned owners and deadlines tend to repeat year after year.
• Treating internal audit as a fault-finding exercise. When staff see the audit as a threat, they hide issues. A collaborative approach produces more useful findings.
• Ignoring IT controls. Most transactions now run through systems, and weak access controls can undo strong manual checks.

What Happens After

After each internal audit report:

• The audit committee or board reviews the report and the management responses, and may ask for further work in specific areas.
• Management implements agreed actions within the target dates, such as changing approval limits, updating policies or recovering excess payments.
• We follow up in the next cycle and report which actions are complete and which remain open.
• The annual plan is updated to reflect new risks, business changes and recurring issues.
• Internal financial controls documentation is updated so that the directors' and statutory auditor's reporting is supported.
• Serious matters are escalated. Where a review uncovers suspected fraud, we report it promptly to the audit committee or board so that it can decide on further investigation and any reporting required by law.

Over time, internal audit helps build a culture where controls are part of daily work rather than a once-a-year event.

FAQs

Is internal audit mandatory for my company?

It is mandatory for listed companies and for unlisted public and private companies that cross the capital, turnover, borrowing or deposit thresholds in the Companies (Accounts) Rules, 2014 during the preceding financial year. Other businesses can adopt it voluntarily.

Who can be appointed as internal auditor?

A chartered accountant, a cost accountant or another professional decided by the board. The internal auditor can be an employee or an outside individual or firm.

Can our statutory auditor do our internal audit?

No. The Companies Act, 2013 bars the statutory auditor from providing internal audit services to the same company.

Who decides what the internal audit will cover?

For companies covered by Section 138, the audit committee, or the board where there is no audit committee, formulates the scope, functioning, periodicity and methodology in consultation with the internal auditor.

How often should internal audit be carried out?

Most businesses choose quarterly or half-yearly cycles, with high-risk areas reviewed more often. The frequency is set in the annual internal audit plan.

Is the internal audit report filed with the government?

No. The report is an internal document for management, the audit committee and the board. It is not filed with the Registrar, but it may be reviewed by the statutory auditor and by regulators in some sectors.

What is the difference between internal audit and internal financial controls?

Internal financial controls are the policies and procedures a business uses to run efficiently, safeguard assets, prevent fraud and keep accurate records. Internal audit is one of the ways those controls are tested and improved.

Can internal audit find fraud?

Internal audit is designed to test controls and flag unusual patterns, which often brings fraud risks to light. It cannot rule out every possibility of fraud. Where there is a specific suspicion, a focused forensic review may be needed.

Do LLPs and partnership firms need internal audit?

There is no general legal requirement for LLPs or firms. However, many larger LLPs and firms use internal audit to monitor branches, spending and compliance.

What does an internal audit report contain?

It typically contains an executive summary, the scope covered, each observation with its risk rating, root cause and recommendation, management's response, action owner and target date, and the status of earlier observations.

Can internal audit cover IT systems?

Yes. IT general controls such as user access, change management, backups and data security can be included, as can review of controls built into accounting and business software.

Does the company have to maintain an in-house internal audit team?

No. Many companies outsource internal audit to an external firm, or use a mix of an in-house team and outside specialists.

Do internal audit rules change?

Yes. Thresholds under the rules, listing regulations and professional standards are revised from time to time. We check the current position at the start of each engagement.

Related Accounting & Finance services

• Virtual Accountant
• Virtual CFO Services
• Accounting Services
• Audit & Assurance