Internal audit examines whether controls work in practice, whether processes are followed, and where risk is concentrated. It reports to management or the audit committee, not to shareholders.
This describes the subject in general terms and is not advice; what applies depends on the facts, and the law changes.
Understanding the service
Certain classes of company are required by the Companies Act, 2013 to appoint an internal auditor; the classes are prescribed by rules under the Act. Many other organisations commission internal audit because they want the comfort, not because they must.
ICAI issues Standards on Internal Audit, which address planning, evidence, reporting and the internal auditor's independence.
Internal audit is forward-looking in a way statutory audit is not: the point is to improve the control environment, not to express an opinion on last year's accounts.
When it becomes relevant
- A company that falls within the classes required to appoint an internal auditor
- A board or audit committee that wants independent assurance on controls
- A business that has grown faster than its processes
- An organisation with dispersed locations, or recurring reconciliation differences
What the work usually covers
- A risk assessment, and an audit plan built around it
- Review of financial, operational and compliance processes
- Testing of controls in the areas selected
- Observations with practical recommendations and management responses
- Follow-up on earlier observations
Framework and sources
The law and professional standards this work is carried out under. Links open the official site.
How the work runs
- Risk assessmentIdentify where the risk sits and agree the areas to be covered.
- PlanAgree scope, periods and reporting with management or the audit committee.
- FieldworkWalk through processes, test controls and gather evidence.
- ReportIssue observations with recommendations and management's responses.
- Follow upReview whether agreed actions have been taken.
A general sequence. Engagements differ, and the scope of each is agreed in writing.
Common questions
Can the statutory auditor also be the internal auditor?
No. The Companies Act, 2013 restricts a company's statutory auditor from rendering internal audit services to the same company.
Who receives the report?
Management, or the audit committee or board where one exists. It is not a report to shareholders.