CA, CS, CMA, Advocates are available for Free Consultation!!!

   +91 85400-99000   A98, Nanhey Park, Uttam Nagar, New Delhi, India

Internal Audit

In today’s fast-paced business environment, organizations are always looking for ways to improve their operations, stay compliant with regulations, minimize risks, and maximize profits. One crucial tool at their disposal is the Internal Audit function, which helps companies achieve these goals by providing an unbiased and impartial evaluation of their internal controls and procedures. In India, the Institute of Chartered Accountants has set standards that define the role and scope of Internal Audit, and the Securities and Exchange Board has mandated its use for listed entities. In this blog post, we’ll explore the importance of Internal Audit in India, its key features, functions, and benefits. Let’s get started.

1. Introduction to Internal Audit in India

Internal is an independent assurance and consulting activity designed to add value and improve an organization’s operations in India. It brings a systematic and disciplined approach to evaluate and improve the effectiveness of risk management control and governance processes. The internal audit activity provides assurance that internal controls are adequate to mitigate the risks, governance processes are effective and efficient and organizational goals and objectives are met. An internal auditor possesses an in-depth understanding of business culture, systems, and processes leading to a broad perspective on the organization. This makes internal auditors a valuable resource to executive management and boards of directors in accomplishing overall goals and objectives while strengthening internal controls and organizational governance.

Internal audit plays a significant role in the day-to-day operations of Indian companies as they assess internal controls and provide independent assurance regarding the effectiveness of internal controls and risk management systems, thereby allowing the organization to meet its goals. Under the Companies Act 2013, every unlisted public company and private company must appoint an internal auditor if they satisfy specific financial and borrowing conditions. The CARO 2020 mandates every company’s external auditor to consider whether the company has an internal audit system commensurate with the size and nature of its business.

Internal auditing is a crucial factor for businesses in India, and it is vital to understand the functions, features, and types of internal audit services. Internal auditing contributes to strong corporate governance, provides assurance, insight, and objectivity to audit committees and boards of directors, and is significant in implementing best practices and high standards. Furthermore, internal audit empowers startups to assess and mitigate risks, contributing to their growth and long-term success. 

2. Importance of Internal Audit for Businesses

Internal audit is an essential component for businesses, and its importance cannot be overstated. It helps businesses to identify areas where they can save time and money by examining the day-to-day tasks of workers and pointing out areas for improvement. In fact, audits also help identify areas of waste in the business and fraudulent spending or improper transactions by employees. According to the Hearst Newspapers, small businesses lose millions every year to employee theft, including skimming payments from customers, check tampering, cash theft, misuse of company credit cards, and improper payroll transactions. Hence, performing internal audits can keep employees from misusing company resources by announcing a policy of detecting fraudulent activities.

Moreover, internal audit doesn’t only help a business detect fraud. It also examines policies and procedures on a regular basis to ensure the business minimizes its exposure to fraud and other losses. According to IIA, internal auditors must ensure compliance with laws and regulations and report their findings and recommendations to the organization’s management and board of directors. Auditing credit lines extended to customers and designing a credit policy with the intention of reducing bad debt helps businesses sustain their financial position in the long run. Ineffective operations add to overhead without increasing profit. An operational audit may reveal these inefficiencies or point to time lost on unnecessary paperwork. In conclusion, internal audit empowers businesses in identifying key risks and providing strategic insights resulting in better decision making, system improvements, and more robust operations with fewer errors and fewer fraudulent activities. 

3. Functions and Features of Internal Audit

Internal audit serves several important functions in an organization. First and foremost, it helps to identify any loopholes in the system and provides recommendations for improvement. As per the Institute of Internal Auditors (IIA), the “definition of internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

Internal audit is also responsible for ensuring compliance with regulations and laws and maintaining ethical standards within a company. In addition, it provides an unbiased assessment of the risk management processes and helps companies to determine whether their policies are effective in mitigating risks.

“Internal audit is not just about checking the financial statements. It’s also about understanding the business processes and the controls embedded in them, and assessing the risks and controls to ensure that they are in line with the objectives of the organization”, says Anil Kumar, Co-founder of EZYBIZ India.

Internal audit also has several features that make it a vital part of any organization. For instance, it is conducted independently of other departments and personnel, ensuring its objectivity. Additionally, it provides an internal perspective on the company’s operations, which can help managers to make better business decisions. Internal audit also enables companies to identify potential problems before they become major issues, saving them both time and money in the long run.

As businesses continue to navigate an increasingly complex regulatory environment, an effective internal audit function is more important than ever. By conducting regular internal audits, companies can ensure that their operations are both efficient and effective, and that they are complying with all relevant laws and regulations. 

4. When is Internal Audit Required?

An Audit is required by certain companies as per the Companies Act 2013. The internal auditor evaluates the functions and activities of the company by reviewing its internal controls, processes, and methods. So, when is internal audit required? If your company falls under any of the following categories, you’re required to appoint an internal auditor:

– Paid-up share capital of Rs.50 crore or above during the preceding financial year

– Annual turnover of income of Rs.200 crores or above during the preceding financial year

– Outstanding loans or borrowings from either banks or public financial institutions that are exceeding Rs.100 crores or above during the preceding financial year

– Outstanding deposits of Rs.25 crores or above during the preceding financial year

If your company meets any of these criteria, you need to appoint an internal auditor. Failing to comply with the provisions of the Companies Act 2013 may lead to a fine ranging from Rs. 5,000 to Rs. 25,000 for every day the default continues. So, it’s essential to appoint an internal auditor if your company falls under the prescribed limit.

To appoint an internal auditor, the Board of Directors must pass a resolution and endorse the terms and conditions of the appointment. The appointed internal auditor should report to the audit committee, and both parties should formulate the function scope, periodicity, and methodology of conducting the internal audit. It’s a statutory requirement that shouldn’t be ignored! 

5. Internal Audit vs. External or Statutory Audit

Internal and statutory (external) audit are two different types of audits that every company goes through to ensure their financial statements are accurate and free from any fraudulent activities. While statutory audit is a legal requirement, internal audit is not. Let’s take a closer look at the key differences between Internal Audit vs. External or Statutory Audit:

– Statutory audit is conducted by an external auditor or audit firm, while internal audit is mainly conducted by the company’s employees.
– Statutory audit mainly focuses on the financial statements, while internal audit covers both financial and non-financial aspects of the organization.
– Statutory audit is a legal requirement, while internal audit is a voluntary process.
– “Internal audit plays a key role in comparing objectives and actual performance standards. Apart from this, it is very helpful in enhancing operational efficiency, analyzing risks, safeguarding business assets, and gaining compliance with the law and industry parameters” as stated in (1).
– Internal audit is more about examining the internal controls and the efficiency of internal processes, while statutory audit is about ensuring that financial statements are compliant with the law.

In conclusion, both internal and statutory audits are important for a company’s growth and success. While internal audit helps in enhancing operational efficiency and analyzing risks, statutory audit ensures that the financial statements of the company are correct and compliant with the law. 

6. Understanding Clause 49 of the Listing Agreement

Clause 49 of the Listing Agreement is a crucial aspect of corporate governance for companies listed on Indian stock exchanges. It was first introduced in 2000 with the aim of improving corporate governance practices and disclosures in Indian companies. Subsequent revisions were made in 2004 and 2008 to further strengthen the clause and bring it more in line with global best practices, particularly the Sarbanes-Oxley Act in the United States. Some of the key highlights of Clause 49 include the requirement for a minimum number of independent directors on the board, the institution of an audit committee, and the disclosure of fees paid to non-executive directors. It also mandates the inclusion of a comprehensive management discussion and analysis section in companies’ annual reports, formal codes of conduct for boards, and disclosures on risk management. One of the most significant changes implemented in the 2004 revisions was the strengthening of responsibilities for audit committees, which are tasked with reviewing company disclosures and evaluating related party transactions. Overall, Clause 49 is a vital component of corporate governance in India, and its continued evolution and enhancement are crucial for ensuring transparency and accountability in listed companies. 

7. Legal Requirements for Internal Audit in Companies Act 2013

Under Section 138 of the Companies Act 2013, certain companies in India are required to appoint internal auditors. As per Rule 13 of Companies (Accounts) Rules 2014, companies with a turnover of INR 50 crores or more during the preceding financial year, or those with borrowings from banks or public financial institutions exceeding INR 100 crores or more at any point during the preceding financial year are required to appoint an internal auditor. Additionally, companies with a turnover of INR 200 crores or more during the preceding financial year, or those with outstanding loans or borrowings from banks or public financial institutions exceeding INR 100 crores or more at any point during the preceding financial year need to appoint an internal auditor.

“An internal auditor may or may not be an employee of the company,” states the Rule. The Audit Committee of the company or the Board will formulate the scope functioning periodicity and methodology for conducting the internal audit in consultation with the Internal Auditor. Furthermore, an internal auditor “may be a CA/CWA or any other professional,” and “anyone who has the knowledge can become an Internal Auditor because the rules did not define the word any other professional.” As per Section 138 of the Companies Act 2013, an internal auditor should either be a chartered accountant, cost accountant, or any other professional as decided by the board. Therefore, internal auditors play an integral role in the financial health of companies, providing independent assurance on the effectiveness of internal controls and risk management systems. 

8. Types of Internal Audit Services and Benefits

Internal have become a critical aspect of a company’s operations and corporate governance. These audits offer risk management and evaluate the effectiveness of many different aspects of a company. Types of internal audit services include financial, operational, compliance, environmental, IT, or for a very specific purpose. Each type provides unique benefits for a company.

Financial audits help a company maintain accurate and timely financial reporting, comply with laws and regulations, and safeguard against potential fraud, waste, or abuse. Operational audits identify problems and correct lapses before they are discovered in an external audit, enhancing the efficiency of operations and motivating employees to adhere to company policy. Compliance audits ensure a company adheres to local laws, compliance needs, external policies, or other restrictions. Environmental audits, as companies become continually more environmentally conscious, result in reviewing the business impact on the planet, such as reducing energy consumption. IT audits evaluate the controls, hardware, software, security, documentation, and backup/recovery of systems.

“Internal audits provide companies with numerous benefits,” says Enterslice, “from financial strategy to exploration of specific areas of its operations. They provide management and the board of directors with a value-added service where flaws in a process may be caught and corrected. This results in better risk management, increased efficiency, better corporate governance, and reduced exposure to fraud.” 

9. Empowering Startups: How Internal Audit Can Help

Internal audit can be of great help to startups in India. As India has the 3rd largest startup ecosystem in the world which is continuously growing, these young entrepreneurs require support in ensuring that their companies are compliant with applicable regulations. Internal audit can empower startups in many ways and some of the benefits are enlisted below, based on factual data:

– Internal audits can help startups identify potential risks that their business faces and deal with them beforehand.

– Internal auditors review the existing policies and controls to determine whether they adequately address the risks.

– Internal audits also help startups in creating simple flow charts and processes for each function of the company, which mitigates the above risks.

– Training employees to understand these processes and their use engage them to develop culture of record-keeping.

– Internal auditors go a long way in making the startup thrive besides ensuring compliance with regulations.

– By conducting regular internal audits, startups can identify areas where their businesses could be more efficient and make changes that will help maximize their profits.

– One of the great benefits of internal audits is that they can help startups identify areas where they can save money.

Startups need to understand the significance of internal controls and hire internal auditors who can act as partners for their growth. Internal controls can help startups achieve their business objectives by providing insights into potential systems and controls to be implemented for attaining the same. 

10. Documents required for Internal Audit in India

When it comes to conducting an internal audit in India, there are certain documents that are required. These documents serve as evidence for the auditor to review and evaluate the company’s financial standing and operations. The following is a checklist of the required documents for internal audit in India:

– Filing of annual return with shareholder and debentures list.

– Filing of resolution and agreement to ROC.

– Submission of the cost audit records to the board.

– Filing cost audit report wherever applicable.

– Filing income tax return of the company.


It’s important to note that these documents must be filed with the relevant authorities and must be up to date. If a company fails to provide these documents, it can result in penalties or legal action. Additionally, it is essential to keep copies of these documents for future reference.

According to Chartered Accountant Act 1949, minimum qualifications required for an auditor is that he/she must have qualified chartered accounts. The auditor must be appointed within 30 working days of incorporation of the company. Also, the audit must be performed by the assigned auditor, who may hold the position of one AGM for the next appointment.

In summary, ensuring the availability and accuracy of these documents can make the internal audit process easier and faster. As the saying goes: “Proper preparation prevents poor performance.” 

11. Process of Internal Audit in India

Internal audit is a crucial process that helps organizations in India to evaluate their risks and identify areas of improvements. In India, the process of internal audit involves several steps that ensure a thorough and effective examination of the financial systems and data of a company. Here are some of the key steps involved in the process of internal audit in India:

– Preparation: The internal auditor in India must gather information about the organization’s financial systems and practices. This includes understanding the objectives, risks, and controls that are in place.

– Risk assessment: The internal auditor then identifies and assesses the risks associated with the organization’s financial systems. This includes evaluating the effectiveness of controls and identifying potential risks that may result in fraud, theft, or other financial irregularities.

– Testing controls: The internal auditor tests the controls to ensure their effectiveness and identify any gaps that need to be addressed. This includes reviewing processes, documentation, and procedures to ensure that they are in compliance with the organization’s policies and regulatory requirements.

– Reporting: Based on the findings, the internal auditor prepares a report that outlines the strengths and weaknesses of the financial systems and provides recommendations for improvement. The report is submitted to management and the audit committee for review and action.

Overall, the process of internal audit in India is rigorous and involves a comprehensive examination of an organization’s financial systems. As Nidhi Bothra, Partner at Deloitte, notes: “The focus on internal audit is increasing with more Indian companies focusing on corporate governance. The risk-based approach to internal audit is becoming more critical as it provides a structured way to identify and prioritize risks.”

12. Frequently Asked Questions about Internal Audit in India

Internal Audit in India: FAQs

1. What is an internal audit?

An internal audit is conducted to examine the financial and non-financial activities of a company in India. It highlights the compliance status and potential risks, helping the company to take corrective measures and improve efficiency.

2. Who must conduct an internal audit in India?

An internal audit must be conducted by a chartered accountant or a cost accountant. Companies that must undergo an internal audit include listed companies, some unlisted public companies, and private companies that meet specific criteria.

3. Is there a penalty for not conducting an internal audit in India?

There are no specific penal provisions for non-compliance with an internal audit under the Companies Act 2013. Non-compliance can result in prosecution under Section 450, with fines up to INR 10,000 imposed on the company and the auditor.

4. Are there guidelines for conducting an internal audit in India?

The mandatory and recommendatory corporate governance provisions outlined in Clause 49 of the Listing Agreement govern internal audits in India. Audit committees must review the effectiveness of the internal audit department, internal audit reports, internal investigations, and disclose any deficiencies in the operation of internal controls.

5. What is the relevance of an internal audit for foreign companies in India?

Internal auditors can help foreign companies navigate local compliance rules and regulations, providing objective evaluations of a company’s financial and business practices.

6. What are common internal auditor interview questions in India?

Examples of interview questions include why you applied for the job, explaining the steps to prepare for and perform an internal audit, describing substantive tests, and discussing the differences between regulatory and performance audits.

7. What are the qualifications required to become an internal auditor in India?

Internal auditors should have an accounting, finance, or related business degree, extensive knowledge of the business and industry, and strong critical thinking and organizational skills. Senior positions may require certification as a Certified Internal Auditor or a Certification in Risk Management Assurance.