Internal Audit

Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules 2014 makes internal audit mandatory for: (a) every listed company; (b) every unlisted public company with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or financial institutions of ₹100 crore or more, or outstanding deposits of ₹25 crore or more as at the preceding financial year end; and (c) every private company with turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or financial institutions of ₹100 crore or more. The internal auditor may be a chartered accountant, cost accountant, or any other professional as decided by the board. The audit committee or the board must periodically review the internal audit function and the reports submitted.

No. Rule 13(1) of the Companies (Accounts) Rules 2014 requires the internal auditor to be a person 'other than the statutory auditor.' This prohibition prevents the statutory auditor from auditing their own work, maintaining independence as required under Section 141(3) and ICAI's Code of Ethics based on the International Ethics Standards Board for Accountants (IESBA) framework. The internal auditor may be an individual CA, a CA firm, or even a non-CA professional depending on the board's decision. However, ICAI's Guidance Note on Internal Audit recommends that the internal auditor have independence of reporting — ideally reporting to the audit committee directly rather than to management. Companies that appoint the same firm in both capacities face a qualification risk in the statutory audit report.

A risk-based internal audit for an SME manufacturer should be structured per the ICAI's Standard on Internal Audit (SIA) 3 (Planning the Internal Audit) and SIA 14 (Internal Audit in a Computer-based Environment). Priority risk areas typically include: inventory valuation and existence verification (particularly WIP and raw materials, relevant to Section 128 books of accounts obligations); revenue leakage and dispatch-to-invoice reconciliation; procurement and vendor payment cycle controls; compliance with GST input tax credit eligibility under Section 16 of the CGST Act 2017; payroll and contract labour compliance under the Contract Labour (Regulation and Abolition) Act 1970; and capital expenditure authorisation and asset register accuracy. The audit plan should be risk-ranked each quarter, with higher-risk processes audited more frequently, and findings reported to the audit committee or board with management responses and closure timelines.

Statutory audit is a legal requirement under Section 143 of the Companies Act 2013, mandated for all companies, and results in an opinion on whether the financial statements give a true and fair view under applicable accounting standards. Internal audit under Section 138 is a management assurance function focused on evaluating internal controls, risk management, and operational efficiency — it does not result in a public audit opinion. The two can run in parallel, and in practice many companies schedule internal audit to conclude before year-end so findings can be addressed before the statutory auditor commences work. The statutory auditor is required under SA 610 (Using the Work of Internal Auditors) to evaluate whether the internal audit function's work can be relied upon, and where it can, may reduce the extent of substantive testing — making a strong internal audit function directly beneficial to statutory audit cost and timeline.

If an internal auditor discovers or suspects a fraud during the course of internal audit, the reporting framework has two layers. First, under the company's own governance framework, the internal auditor should report immediately to the audit committee or the board, bypassing management if management is implicated. Second, if the fraud involves an amount exceeding ₹1 crore or involves senior management, Section 143(12) of the Companies Act 2013 creates an obligation on the statutory auditor to report to the Central Government in Form ADT-4, but this obligation falls on the statutory auditor, not the internal auditor. However, the internal auditor has a professional obligation under ICAI's Code of Ethics and SIA 5 (Sampling) to document findings, preserve evidence, and ensure the audit committee is informed. The internal auditor should not tip off the suspected perpetrators and should cooperate with any forensic investigation.