Internal Audit

A statutory audit looks back at the year's accounts. An internal audit looks at how the business actually runs: whether purchases are approved, stock is safeguarded, revenue is billed in full, payments go to the right people and the controls management relies on really work. It finds leakages and risks while there is still time to fix them. For some companies it is compulsory; for growing businesses it is often the most useful audit they have.

When internal audit is compulsory

Under section 138 of the Companies Act, 2013 and its rules, an internal auditor must be appointed by:

• every listed company;
• unlisted public companies with paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, borrowings of ₹100 crore or more, or deposits of ₹25 crore or more;
• private companies with turnover of ₹200 crore or more, or borrowings of ₹100 crore or more.

The board appoints the internal auditor and decides the scope, frequency and method. The internal auditor may be a chartered accountant, cost accountant or other professional, and must be independent of the statutory auditor.

What an internal audit covers

• Purchase to pay: vendor selection, purchase orders, approvals, goods receipt, invoice matching and payments
• Order to cash: pricing, discounts, billing, credit control and collections
• Inventory: physical verification, valuation, slow-moving stock and wastage
• Payroll: attendance, salary processing, statutory deductions and joiners and leavers
• Fixed assets: capitalisation, tagging and physical verification
• Statutory compliance: GST, TDS, PF, ESI, labour laws and licences
• IT controls: user access, segregation of duties and data backups
• Internal financial controls: documentation and testing to support the directors' and auditors' reporting

How we carry out an internal audit

1. Risk assessment: understanding the business and identifying the processes with the most risk.
2. Audit plan: agreeing scope, frequency (monthly, quarterly or half-yearly) and timing with management or the audit committee.
3. Fieldwork: walkthroughs, sample testing of transactions and controls, and data analysis.
4. Findings: each observation with its risk rating, financial effect, root cause and a practical recommendation.
5. Management response: agreed actions, owners and dates.
6. Follow-up: checking at the next review that actions were implemented.

Benefits

• Leakages in purchasing, billing and inventory found and stopped
• Stronger controls against error and fraud
• Smoother statutory audits, with fewer surprises
• Better information for management and the board
• Confidence for investors and lenders in how the business is run

Common questions

Can our statutory auditor be our internal auditor?

No. The statutory auditor is not permitted to be the company's internal auditor.

Is internal audit useful for a company that isn't required to have one?

Often yes, particularly for businesses with several locations, significant inventory or rapid growth, where owners can no longer see every transaction.

How often should it be done?

Quarterly is common. High-risk areas such as cash and inventory may be reviewed monthly.