Internal Audit

It is an independent review — conducted by a Chartered Accountant or a qualified professional — of how well your company's processes, controls, and risk management actually work in practice, not just on paper. Where a statutory audit checks whether your financial statements are accurate, internal audit checks whether the processes that produce those numbers, and the controls that protect your assets and compliance position, are sound. It reports to your Audit Committee or Board, not to external shareholders, and its purpose is improvement as much as assurance.

It depends on your company type and financial parameters under Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014. Every listed company must appoint an internal auditor. Unlisted public companies must appoint one on crossing prescribed thresholds of paid-up share capital, turnover, outstanding loans/borrowings from banks or financial institutions, or outstanding deposits. Private companies must appoint one on crossing prescribed thresholds of turnover, or outstanding loans/borrowings from banks or financial institutions. The precise threshold figures are set out in Rule 13 and should be checked against your latest audited financials — we do this assessment as the first step of every engagement.

Under Section 138, the internal auditor may be a Chartered Accountant (whether engaged in practice or not), a Cost Accountant, or such other professional as the Board may decide. The internal auditor may or may not be an employee of the company. In practice, most companies either appoint an external CA firm (an outsourced or co-sourced model) or build an in-house internal audit team led by a qualified professional, sometimes supplemented by an external firm for specialist areas like IT audit or forensic review.

No. Section 144 of the Companies Act 2013 explicitly prohibits an auditor appointed under Section 139 (statutory auditor) from rendering internal audit services to the company, directly or indirectly, whether the service is provided by the auditor themselves or through a related entity. This is one of the specified non-audit services barred to preserve auditor independence.

Statutory audit is a legally mandated annual examination of financial statements, resulting in an opinion addressed to shareholders on whether the statements present a true and fair view, governed by the Standards on Auditing and reported under Section 143. Internal audit is a continuous, risk-based assurance and consulting function reporting to the Audit Committee/Board, governed by the Standards on Internal Audit issued by ICAI, and its scope covers process design, control effectiveness, compliance, fraud risk, and operational efficiency — well beyond financial statement assertions alone. The two functions are complementary: a well-run internal audit programme materially reduces the surprises a statutory auditor finds at year end.

Internal Financial Controls (IFC), as referenced in Section 134(5)(e) and tested by the statutory auditor under Section 143(3)(i) for applicable companies, focuses specifically on controls over financial reporting — ensuring the accuracy and reliability of financial statements and safeguarding of assets from that lens. Internal Audit has a broader mandate covering operational efficiency, compliance, fraud risk, IT controls, and strategic risk, in addition to financial controls. In practice, the two overlap significantly, and a well-designed internal audit programme often generates the evidence base that supports the company's own IFC assertion and the statutory auditor's IFC opinion.

We start with a structured risk assessment across financial, operational, compliance, fraud, IT, and strategic risk categories specific to your business and sector — not a generic template. Each identified risk is rated by likelihood and impact, and the annual audit plan allocates audit hours to the highest-residual-risk areas first. The plan is presented to and approved by your Audit Committee before fieldwork begins, and it is refreshed annually as your business, systems, and risk profile evolve.

Most companies run internal audit in quarterly cycles aligned to their Audit Committee meeting calendar — each cycle covering a defined set of locations, processes, or entities from the annual plan, with findings reported to the Committee each quarter. Higher-risk areas or higher-risk entities within a group may be audited more than once a year; lower-risk, stable areas may be covered once annually or even once every two years, depending on the risk assessment. A purely annual, once-a-year internal audit is common for smaller companies but generally provides less timely assurance than a quarterly cycle.

A well-structured internal audit report includes: an executive summary for the Audit Committee, the scope and period covered, a risk-rated list of findings (typically Critical/High/Medium/Low), the root cause of each finding, a specific and implementable recommendation, management's response (agree/partially agree/disagree, with reasons), a committed remediation owner and timeline for each accepted finding, and a status update on findings carried forward from prior cycles. The report should be specific to your processes and systems — not generic boilerplate language that could apply to any company.

Open findings are carried forward into the next audit cycle and re-tested to verify actual closure, not just a management assertion. Persistently unresolved high-risk findings are specifically flagged for escalation to the Audit Committee and, where warranted, to the Board. Unremediated control weaknesses can also surface independently — as a statutory audit qualification, a material weakness noted in the Section 143(3)(i) internal financial controls opinion, an actual loss event, or a regulatory finding — at which point the cost of the original gap is usually far higher than the cost of timely remediation would have been.

Internal audit is not primarily a fraud investigation function, but a well-designed risk-based programme — particularly one incorporating fraud risk assessment, segregation-of-duties testing, and data analytics across full transaction populations — meaningfully increases the likelihood that fraud indicators are identified early, before losses compound. Where internal audit identifies a red flag suggesting fraud, the appropriate response is to escalate and, if warranted, commission a focused or forensic review with an appropriately elevated evidentiary standard — internal audit procedures alone are not typically designed or documented to the standard required for legal or disciplinary proceedings.

The Standards on Internal Audit (SIA) are issued by the Institute of Chartered Accountants of India (ICAI) through its Internal Audit Standards Board, providing a structured framework covering planning, risk assessment, evidence, documentation, reporting, and quality control for internal audit engagements conducted by Chartered Accountants in India. PNPC's internal audit methodology is built around this framework, adapted to each client's size, sector, and risk profile.

Both models are legally valid and common in practice. A fully outsourced model — where an external CA firm like PNPC serves as the entire internal audit function — is common for mid-sized companies without the scale to justify a dedicated in-house team, and it also brings independence and cross-industry benchmarking. A co-sourced model — an in-house internal audit head supplemented by an external firm for specialist areas (IT audit, forensic reviews, specific high-risk locations) or for peak-period capacity — suits larger organisations. A fully in-house model is more common for large listed companies with the scale to justify a dedicated internal audit department led by a Chief Internal Auditor.

PNPC prices internal audit engagements based on the scope agreed in the annual audit plan — the number of locations/entities, the audit areas covered, the frequency of cycles, and the complexity of your systems and operations. We provide a written scope and fee proposal before any engagement begins, typically structured as an annual retainer covering the agreed number of audit cycles. We do not price on a generic 'per company' basis because the actual work required varies enormously between a single-location services business and a multi-location manufacturing group.

A genuinely risk-based internal audit function requires practising CAs who understand both the statutory framework and your specific business and sector — not a generic checklist applied uniformly across clients. PNPC has been a practising CA firm since 1986, with teams across Chennai, Bangalore, Hyderabad, and Dubai. We build a documented risk assessment specific to your business before setting the audit plan, present findings directly to your Audit Committee, track every finding to actual closure with re-testing (not a self-certified 'resolved' status), and stay engaged year-round as your business and risk profile evolve — not as a once-a-year filing exercise.

Often, yes — particularly where the company has multiple locations the founder cannot personally oversee, has taken on institutional investors who expect governance discipline, has experienced rapid growth that has outpaced its informal controls, or is preparing for a future fundraise or acquisition. A scoped, proportionate internal audit — even a lighter-touch annual review rather than a full quarterly programme — can identify control gaps and process inefficiencies well before they become costly. The right scope and frequency should be proportionate to the company's actual risk profile, not a one-size package.

Under Section 177 of the Companies Act 2013, the Audit Committee (mandatory for listed companies and certain classes of public companies) is responsible for overseeing the internal audit function — reviewing and approving the annual audit plan, reviewing findings and management responses, monitoring the adequacy of internal controls, and evaluating the internal audit function's effectiveness. Where a company is not statutorily required to have an Audit Committee, the Board typically performs this oversight role directly.

IT general controls — user access management, change management, data backup, and system security configuration — are a standard component of a modern risk-based internal audit plan, because financial and operational controls increasingly depend on the integrity of the underlying systems. Where the risk assessment identifies elevated cybersecurity or IT risk, the audit plan may include a dedicated IT audit or cybersecurity review, potentially involving specialist technical resources in addition to the core internal audit team.

A risk-based approach allocates audit time and depth in proportion to the actual risk each area poses to the organisation, determined through a structured, documented risk assessment — rather than auditing every department equally, or repeating the same fixed checklist every year regardless of what has changed in the business. It ensures that scarce audit hours are spent where a control failure would cause the most damage, and that the audit plan evolves as new risks emerge (a new product line, a new location, a new system) rather than staying static.

Because it is usually impractical to test every single transaction in a process, internal audit relies on sampling — testing a representative subset of transactions to draw a defensible conclusion about the population as a whole. Sample sizes are set based on the population size, the risk rating of the process, and the desired confidence level — not an arbitrary fixed number like 'we test 5 invoices.' Where the volume and system access allow, we supplement sampling with full-population data analytics to identify specific outliers and exceptions that a sample alone might miss.

Related-party transactions are a standard high-risk area in any internal audit plan, given the requirements of Section 188 of the Companies Act and the potential for related-party dealings to be used to move value out of the company on non-arm's-length terms. Internal audit typically tests whether related-party transactions have the required Board/Audit Committee/shareholder approvals, whether pricing is on an arm's-length or otherwise justified basis, and whether the disclosures in the financial statements and related-party register are complete and accurate.

Yes, and for groups with multiple entities this is often essential — control weaknesses at a subsidiary can create financial or reputational exposure for the entire group, and consolidated financial statements depend on the integrity of each entity's underlying records. The annual audit plan should explicitly map which entities and locations are in scope for each cycle, based on their individual risk profile, rather than defaulting to parent-company-only coverage.

Rating criteria vary by firm but generally consider the potential financial impact, the likelihood of recurrence, whether the gap indicates a control that is completely absent (design failure) versus one that exists but was not followed on a given occasion (operating failure), and whether the issue has implications for regulatory compliance, fraud exposure, or the integrity of financial reporting. A missing approval on a single low-value transaction is typically rated differently from a systemic absence of segregation of duties in the payment process.

A design deficiency means the control, as designed, would not prevent or detect the risk it is meant to address even if performed exactly as intended — for example, an approval workflow that does not require a second signatory for high-value payments. An operating effectiveness finding means the control is properly designed, but was not consistently performed in practice during the period tested — for example, a required approval step exists in policy but was bypassed for certain transactions. The remediation for each is different: a design deficiency requires redesigning the control itself, while an operating effectiveness gap may require training, enforcement, or a system-based control to prevent bypass.

Investors and IPO due diligence teams place significant weight on the maturity of a company's internal controls and governance track record. A well-documented internal audit history — showing a genuine risk-based methodology, findings tracked to closure, and Audit Committee engagement over multiple cycles — is direct evidence of governance maturity that can materially smooth due diligence, reduce the scope of pre-deal control remediation demanded by the counterparty, and support the Internal Financial Controls disclosures required in an IPO prospectus.

In some engagements, in addition to the main risk-rated findings report presented to the Audit Committee, the internal auditor may issue a management letter to specific process owners — covering lower-severity observations, process improvement suggestions, or matters better addressed operationally rather than through Audit Committee escalation. Practice varies by firm; PNPC agrees the reporting structure — whether a single consolidated report or a main report plus a supplementary management letter — with each client's Audit Committee at the start of the engagement.

Where the client's systems and data access permit, we apply data analytics across full transaction populations — for example, testing every journal entry in a period for unusual characteristics, every vendor payment for duplicate or split-invoice patterns, and every user access log for dormant or excessive privileges — rather than relying solely on a manual sample. This extends coverage well beyond what manual sampling alone can achieve, particularly for high-volume processes like accounts payable and payroll.

The first cycle typically includes more foundational work — entity and process mapping, a full risk assessment from scratch (rather than a refresh of an existing one), documenting the Delegation of Authority matrix if one does not already exist in usable form, and agreeing the audit charter and reporting protocol with the Audit Committee. Findings in the first cycle also tend to be higher in volume, simply because many companies are being reviewed with this level of rigour for the first time. Subsequent cycles build on this foundation, focus more narrowly on the highest-risk areas identified, and specifically re-test prior findings for closure.

Yes, and it is generally good practice for them to be shared, with the Audit Committee's knowledge. Statutory auditors frequently request internal audit reports as part of their own risk assessment and reliance considerations under the Standards on Auditing — a well-run internal audit function can, in some circumstances, allow the statutory auditor to place a degree of reliance on internal audit work for specific areas, which can reduce duplication of effort (though it never eliminates the statutory auditor's own independent responsibility and testing).

Yes — NBFCs are subject to specific RBI directions on internal audit, including, for larger and systemically important NBFCs, a requirement for a Risk-Based Internal Audit (RBIA) framework aligned to RBI's guidelines, in addition to the Companies Act requirements applicable to them as companies. Internal audit scope for an NBFC typically includes lending operations, credit appraisal and sanctioning controls, asset classification and provisioning (NPA recognition), KYC/AML compliance, and treasury operations, alongside the standard corporate process areas.

For a manufacturing company, the risk assessment typically weights inventory management, shop-floor production controls, quality control documentation, fixed asset and capital expenditure controls, and factory-level statutory compliance (labour law, pollution control, factory licences) more heavily. For a services company, the emphasis usually shifts toward revenue recognition and unbilled revenue, employee cost and utilisation, client contract compliance, and data/IT controls given the more people- and systems-intensive nature of the business. The core methodology is the same — a documented, risk-based approach — but the specific audit areas and testing procedures are tailored to the sector.

Co-sourcing is a hybrid model where a company retains its own in-house internal audit team or head, and engages an external firm like PNPC to supplement specific areas — such as specialist IT audit, a forensic-leaning review, coverage of a specific high-risk location, or additional bandwidth during peak reporting periods. It suits organisations large enough to justify an in-house function but that still want independent specialist input or capacity flexibility, without building every specialism in-house.

Yes. PNPC operates from Chennai, Bangalore, and Hyderabad in India, and from Dubai in the UAE. For groups with operations or entities in both jurisdictions, we run a coordinated internal audit programme rather than splitting the engagement between two disconnected firms — the risk assessment, reporting cadence, and Audit Committee presentation are unified across the group, even where entity-specific regulatory context (Companies Act in India, UAE Commercial Companies Law and free zone regulations in the UAE) differs.

A typical PNPC internal audit engagement includes: applicability and readiness assessment against Section 138/Rule 13; entity and process risk mapping specific to your business; a documented, Audit Committee-approved annual risk assessment and audit plan; a formal audit charter defining scope, authority, and reporting lines; process walkthroughs and control documentation; risk-based sample and/or full-population testing per cycle; a risk-rated findings report with root-cause analysis and specific recommendations; direct presentation to your Audit Committee each cycle; a live action tracker with follow-up re-testing of prior findings; and an annual refresh of the risk assessment and plan. The exact scope, number of cycles, and locations covered are agreed and priced in writing before the engagement begins.