Internal audit

What this covers

Internal audit examines whether the controls a business relies on actually work — whether approvals happen before payments, whether what was ordered is what arrived, whether the ledger reflects the transaction. It reports to the board or the audit committee rather than to the members, and its purpose is to fix things during the year rather than to form an opinion at the end of it.

Statutory basis

Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014. The audit committee, or the board where there is none, is required to formulate the scope, functioning, periodicity and methodology in consultation with the internal auditor. Where a company is outside section 138, internal audit is voluntary and the scope is whatever the board asks for.

Who it applies to

Rule 13 requires internal audit for every listed company; for an unlisted public company above the thresholds it sets for paid-up share capital, turnover, outstanding borrowings from banks or public financial institutions, or outstanding deposits; and for a private company above its thresholds for turnover or outstanding borrowings. The figures have been amended, so we check them against your last audited balance sheet rather than from memory. Section 138 permits a Chartered Accountant, a Cost Accountant, or such other professional as the board decides, and the internal auditor may be an employee or an outside firm.

What we do

1. 1Agree the scope, reporting line and periodicity with the audit committee or the board in writing, as Rule 13 requires.
2. 2Map the processes that carry real risk — procurement and payments, sales and collections, inventory, payroll, statutory compliance and access to the accounting system.
3. 3Test how each control actually operates on a sample of live transactions, rather than reading the policy and assuming it is followed.
4. 4Check statutory compliance as part of the same pass: GST returns against books, TDS deducted and deposited, and filings actually made.
5. 5Raise findings as they arise so they can be corrected inside the year, with an agreed owner and date for each.
6. 6Report to the audit committee or board each period, and follow up the previous period's findings rather than reopening them from scratch.

What you receive

Scope document

The agreed scope, periodicity and methodology, in the form section 138 expects to see on record.

Periodic reports

Findings with the control that failed, what it exposes, and a specific corrective action with an owner.

Follow-up register

A live record of what was raised, what was fixed and what remains open.

Year-end summary

A note the statutory auditor and the board can both use.

Documents and information required

Delegation of authority and approval matrix · process notes or SOPs where they exist · accounting system access for read-only review · purchase orders, GRNs and vendor invoices for the period · bank statements and payment records · payroll register · GST and TDS returns filed · prior internal and statutory audit reports with management responses.

Key dates

Set by the board rather than by statute — most commonly quarterly, to line up with the audit committee's meetings. Section 138 fixes no due date; what it fixes is that the scope and periodicity must be formally decided, which is the part most often missing when we are first appointed.