What is Internal Audit?
An internal audit is an independent, risk-based review of an organisation's processes, controls and compliance, reporting to the board or its audit committee rather than to shareholders. Section 138 of the Companies Act, 2013 requires specified classes of company to appoint an internal auditor, and the Institute's Standards on Internal Audit govern how the work is carried out.
Who needs it
- Every listed company, which must appoint an internal auditor under Section 138 of the Companies Act, 2013.
- Unlisted public companies that cross any of the thresholds in the Companies (Accounts) Rules for capital, turnover, borrowings or deposits.
- Private companies that cross the turnover or borrowing thresholds in those Rules.
- Companies below the thresholds whose board or lenders want independent assurance on controls even though it is not mandatory.
- Organisations in a growth or transition phase, where processes were built informally and have not been reviewed since.
Benefits
- Compliance with Section 138 where it applies, with the appointment and reporting properly recorded.
- A risk-based view of where the organisation is most exposed, rather than a uniform check of everything.
- Findings reported with their cause and a practical recommendation, not only the exception itself.
- Early identification of control weaknesses that would otherwise surface in the statutory audit or a tax proceeding.
- A follow-up record showing which recommendations were implemented and which remain open.
Key facts
| Item | Position |
|---|---|
| Who must appoint one | Companies covered by Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 |
| Who appoints | The board of directors, on the audit committee's recommendation where one exists |
| Who may be appointed | A chartered accountant, a cost accountant, or another professional the board decides; an employee or an external firm |
| Reports to | The board or the audit committee |
| Professional standards | The Standards on Internal Audit issued by the Institute of Chartered Accountants of India |
| Scope and frequency | Determined by the board or audit committee, not fixed by the Act |
When is internal audit mandatory under Section 138?
Section 138 requires an internal auditor for the classes of company set out in Rule 13 of the Companies (Accounts) Rules, 2014. The thresholds are tested against the preceding financial year, so a company can come within the requirement because of a single year's growth in turnover or borrowings. The commonly stated thresholds are below; confirm them for the year in question, because the Rules have been amended more than once.
| Class of company | When an internal auditor is required |
|---|---|
| Listed company | In every case |
| Unlisted public company | Paid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore; or outstanding deposits of ₹25 crore or more |
| Private company | Turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore |
Any one of the thresholds in a row brings the company within the requirement; they are not cumulative. Borrowings and deposits are tested on the outstanding amount at any point during the preceding financial year, not only at the year end, which is why a company that repaid a large facility mid-year can still be covered.
Who can be appointed, and who cannot
The Rules allow a chartered accountant, a cost accountant, or such other professional as the board decides, and the appointment may be of an individual, a partnership firm or a body corporate. The internal auditor can be an employee of the company or an external professional, which is why larger companies often run an in-house function and smaller ones engage a firm.
The limit that matters in practice is independence. A company's statutory auditor cannot be its internal auditor, and the Institute's ethical requirements prevent an auditor from reviewing work the same firm performed. A firm that keeps a company's books or runs its payroll should not be internally auditing those same processes either, because it would be examining its own output.
How a risk-based internal audit is planned
A risk-based audit directs effort to where the organisation is most exposed, instead of covering every area equally every year. The sequence is usually as follows.
- List the processes and locations in scope, and what could go wrong in each: error, loss, fraud, non-compliance or interruption
- Rank each risk by how likely it is and how much damage it would cause, using the business's own numbers
- Set the coverage: high-risk areas audited deeply and often, low-risk areas on a longer cycle or by analytical review
- Agree the annual plan with the audit committee, including what is deliberately not being covered this year
- Test both the design of the control and whether it actually operated through the period
- Revisit the assessment when the business changes: a new location, a new system or a new line of business shifts the risks
How does internal audit differ from statutory audit?
The two are often confused because both involve an independent firm examining the books. They answer different questions for different readers.
| Internal audit | Statutory audit | |
|---|---|---|
| Required by | Section 138, for the classes of company in Rule 13 | Section 139, for every company |
| Appointed by | The board of directors | The shareholders |
| Reports to | The board or audit committee | The shareholders |
| Question answered | Are the processes and controls working? | Do the financial statements give a true and fair view? |
| Output | Findings and recommendations, with follow-up | An audit opinion |
| Coverage | Operations, compliance and reporting, by risk | The financial statements as a whole |
| Timing | Through the year, on an agreed cycle | After the year end |
What the engagement produces
An internal audit report is only useful if each finding can be acted on, which means stating more than the exception. A finding is normally reported with what was tested, what was found, why it happened, what it could lead to, and a recommendation with an owner and a date. Findings are graded so the audit committee can see what needs attention now and what is a housekeeping matter.
The second deliverable is the follow-up record. At each cycle the auditor re-tests what management said it had implemented and reports which recommendations are closed, which are in progress and which have not moved. Without that record, the same findings tend to reappear in report after report, which is the most common reason an internal audit function stops being taken seriously.
Related reading
- Statutory audit, tax audit and internal audit compared — which audit a business actually needs
- Statutory audit — the annual audit of the financial statements
- Virtual CFO services — building the controls and reporting internal audit tests
Official sources
- Ministry of Corporate Affairs – Companies Act, 2013 — Section 138, internal audit
- Ministry of Corporate Affairs – rules — Rule 13 of the Companies (Accounts) Rules, 2014
- The Institute of Chartered Accountants of India — Standards on Internal Audit
Documents required
- 01Board or audit committee resolution appointing the internal auditor and approving the scope
- 02Organisation chart, delegation of authority and the list of standard operating procedures
- 03Financial statements and trial balance for the period under review
- 04Process documentation for the areas in scope, such as purchases, sales, payroll and inventory
- 05Access to the accounting and operational systems, with the reports and audit trails they generate
- 06Statutory compliance records: GST, TDS, provident fund, ESI and company law filings
- 07Earlier internal audit reports, statutory auditor's observations and the management replies to them
- 08Policies on related-party transactions, approvals and authorisation limits
Due dates and penalties
| Item | Due date | If missed |
|---|---|---|
| Appointment of internal auditor | By the board, for a company to which Section 138 applies | Penalty for contravention of the Companies Act provisions on internal audit |
| Internal audit reporting | At the frequency the audit committee fixes, commonly quarterly | Weak board oversight; adverse comment from the statutory auditor |
| Internal financial controls reporting | At the year end, where the statutory auditor must report on controls | Qualification in the auditor's report on internal financial controls |
The Companies Act fixes who must appoint an internal auditor; it leaves the scope, the periodicity and the reporting format to the board or the audit committee to determine. The thresholds in the Companies (Accounts) Rules are stated below and should be confirmed for the year in question.
Mistakes to avoid
- Assuming internal audit is only for large listed companies, when the Rules also catch private companies above the turnover and borrowing thresholds.
- Appointing an internal auditor on paper without a board-approved scope, periodicity or reporting line.
- Treating internal audit as a second check of the same vouchers the accountant already checked, instead of testing the process.
- Auditing every area equally each year, so the areas carrying real risk get the same attention as low-value routine ones.
- Reporting exceptions without their cause, which leaves management with a list and no fix.
- No follow-up, so the same findings reappear in report after report.
- Giving the internal audit to a person or firm whose independence from the process being reviewed is compromised.
Why PHMG
- Partner-led: a chartered accountant reviews your work, not only a junior team.
- Clear fee and scope in writing before we start.
- Deadlines tracked for you, with reminders well before the due date.
- Your documents and data are handled confidentially.
- Online service across India, with a single point of contact.
Fees depend on your case. Request a quote for a clear scope and fee.