Internal Audit

What is an internal audit?

An internal audit is an independent review of a company's processes, controls, and risks, carried out through the year for the board or audit committee. Where a statutory audit asks whether the annual accounts are right, an internal audit asks whether the business is running the way it should — whether purchases are approved, stock is safeguarded, revenue is billed fully, and rules are followed.

Under Section 138 of the Companies Act, 2013, listed companies and larger unlisted companies must appoint an internal auditor. Many smaller companies choose to have one anyway.

The key terms

A few concepts shape an internal audit:

Who must have one

Listed companies; unlisted public companies with paid-up capital of ₹50 crore, turnover of ₹200 crore, borrowings of ₹100 crore, or deposits of ₹25 crore or more; and private companies with turnover of ₹200 crore or borrowings of ₹100 crore or more.

Internal auditor

A Chartered Accountant, cost accountant, or other professional decided by the board. It can be an employee or an outside firm.

Risk-based plan

An annual plan that focuses audit effort on the areas of highest risk, approved by the board or audit committee.

Process audit

A review of a process end to end — procure-to-pay, order-to-cash, payroll — testing whether controls work.

Findings and ratings

Issues found, rated by severity, with management's response and a deadline to fix them.

Follow-up

Checking later that agreed actions were actually taken.

Audit committee

Where a company has one, the internal auditor reports to it, giving independence from management.

Why it matters

Internal audit finds problems while they're still small:

It's mandatory above the thresholds

Companies crossing the limits must appoint an internal auditor, and the board must decide its scope.

Leakage and fraud

Weak controls over purchases, discounts, stock, and payments are where money quietly leaks.

Board oversight

Directors are responsible for internal controls. Internal audit gives them independent evidence.

Statutory audit support

Strong internal audit makes the statutory audit and IFC reporting smoother.

Compliance

Internal audit checks that tax, labour, and regulatory requirements are actually being met.

Scaling safely

As a business grows, processes that worked informally start to break. Internal audit shows where.

Investor confidence

Investors and lenders take comfort from an active internal audit function.

Who is this for?

The internal auditor can't be the company's statutory auditor, since the statutory auditor can't provide internal audit services to the company it audits.

Internal audit vs. statutory audit

The two work together but answer different questions:

What we'll need from you

Business overview

Locations, products, key processes, and organisation structure.

Policies

Existing policies for purchases, sales, approvals, and delegation of authority.

Risk concerns

Areas management or the board is worried about.

System access

Read access to accounting and operational systems.

Previous reports

Earlier internal and statutory audit observations.

A point of contact

Someone to coordinate information requests and responses.

Internal audit fees depend on scope, locations, and how often reviews are done.

How internal audit works

A typical annual cycle runs like this:

1. 1

   Risk assessment

   We understand the business and identify the areas of highest risk.

2. 2

   Annual plan

   A plan of reviews for the year is prepared and approved by the board or audit committee.

3. 3

   Fieldwork

   Each area is reviewed: processes walked through, controls tested, and samples checked.

4. 4

   Findings

   Issues are discussed with management, rated by severity, and agreed actions recorded.

5. 5

   Reporting

   A report goes to the board or audit committee, usually quarterly.

6. 6

   Follow-up

   Agreed actions are checked in later reviews until they're closed.

Getting value from internal audit

An internal audit report only helps if it's acted on:

Own the actions

Assign each finding to a named person with a deadline.

Track to closure

Keep a tracker of open findings and review it at every board or committee meeting.

Update the plan

Revisit the audit plan as risks change during the year.

Share with the statutory auditor

Internal audit reports help the statutory auditor, especially for IFC reporting.

Fix root causes

Change the process, not just the individual transaction.

Document policies

Turn informal practices into written policies and SOPs.

Benefits and responsibilities