CARO 2020 Clause 3(xiv): How to Evaluate the Internal Audit System and Internal Audit Reports

CARO 2020 Clause 3(xiv) asks the statutory auditor to report on two related but distinct questions: whether the company has an internal audit system that is commensurate with the size and nature of its business, and whether the internal audit reports for the period under audit were considered by the statutory auditor. The clause is short, but a good conclusion requires more than checking whether an internal auditor has been appointed.

ICAI's Guidance Note on the Companies (Auditor's Report) Order, 2020 (Revised 2022 Edition) gives the practical framework for Clause 3(xiv). For the related auditing-standard perspective, ICAI has also published an Implementation Guide to SA 610 (Revised), Using the Work of Internal Auditors.

What Clause 3(xiv)(a) actually requires

Clause 3(xiv)(a) is an adequacy question. The auditor must assess whether the internal audit system is commensurate with the size and nature of the business. This means that the existence of an appointment letter, an internal audit charter or a few reports does not by itself establish an adequate system.

ICAI's CARO Guidance Note identifies several factors that should be evaluated, including the scale of the internal audit function, the number and competence of personnel, the reporting level of the internal auditor, the scope and periodicity of internal audit, the need for technical assistance, whether the system is actually functioning, and whether reported deficiencies are followed up and corrected.

A useful way to test commensurateness

1. Map the business risk profile: consider turnover, operating locations, business complexity, decentralisation, regulated activities, information systems and the significance of inventory, revenue, procurement, payroll, treasury and other processes.
2. Map internal audit coverage: compare the annual internal audit plan with the important processes and locations. Identify major risks that receive little or no coverage.
3. Evaluate competence and objectivity: understand who performs the work, the team's qualifications and experience, and whether the reporting structure gives the function sufficient independence.
4. Check frequency and depth: a high-risk process reviewed once in several years may not be commensurate merely because it appears somewhere in a rolling plan.
5. Test follow-up: verify whether significant observations are assigned, tracked, escalated and closed with evidence rather than remaining open indefinitely.

Example: appointment exists, but the system may still be weak

Assume a manufacturer operates four plants and has material inventory, procurement and production risks, but its internal audit programme covers only head-office finance and vendor payments twice a year. The company can still say that it has an internal auditor, but the statutory auditor should ask whether the coverage is proportionate to the actual risk footprint. Plant controls, inventory, production systems and decentralised operations may make the existing scope inadequate. The CARO conclusion therefore depends on the system, not merely the designation of a person.

Section 138 applicability is not the same as the CARO question

Section 138 of the Companies Act prescribes internal audit requirements for specified classes of companies. Clause 3(xiv), however, is a CARO reporting clause. ICAI's Guidance Note specifically explains that even where a company is outside the mandatory internal-audit ambit of section 138, the statutory auditor is still well-advised to inquire about the existence of an internal audit system and report the fact under Clause 3(xiv).

This distinction prevents a common mistake: concluding that Clause 3(xiv) can be skipped merely because the company is not required to appoint an internal auditor under section 138. The correct sequence is to determine CARO applicability first, then evaluate Clause 3(xiv) on the company's facts.

What Clause 3(xiv)(b) requires

Clause 3(xiv)(b) asks whether the internal audit reports for the period under audit were considered by the statutory auditor. ICAI's Guidance Note says the statutory auditor should review internal audit reports as part of the regular audit process and should consider the reports before concluding the audit and finalising the auditor's report.

The timing matters. A report that reaches the statutory auditor after fieldwork is complete, or only immediately before signing, may not permit meaningful consideration. The Guidance Note says internal audit reports should be made available sufficiently in advance so that the statutory auditor can assess their impact, discuss significant matters with the internal auditor and evaluate whether the observations affect the financial statements, controls or audit approach.

Consideration is different from blind reliance

Reading an internal audit report does not transfer responsibility for the statutory audit. The statutory auditor remains responsible for obtaining sufficient appropriate audit evidence and forming the audit opinion. Where the statutory auditor decides to use the work of internal auditors for audit purposes, the principles of SA 610 (Revised) become relevant. ICAI's current implementation guide to SA 610 (Revised) is a useful first-party reference for applying that standard.

A practical distinction is therefore: Clause 3(xiv)(b) requires the reports to be considered; SA 610 governs the auditor's use of internal-audit work as audit evidence or as a basis for changing the nature, timing or extent of statutory-audit procedures.

What should the statutory auditor do with internal audit findings?

• Identify observations with a direct or possible financial-statement impact.
• Check whether management has recognised, corrected or appropriately explained those matters.
• Consider control deficiencies when evaluating internal financial controls over financial reporting, where that reporting requirement applies.
• Reassess audit risks and procedures if internal audit findings indicate a higher risk than originally expected.
• Retain evidence in the statutory audit file showing which reports were reviewed, significant findings identified, follow-up performed and conclusions reached.

Example: reports arrive too late

Suppose internal audit completed three quarterly reports during the year, but management provides them to the statutory auditor only one day before the audit report is due to be signed. Two reports contain unresolved revenue-recognition and user-access-control observations. The issue is not cured merely because the PDFs were eventually shared. The statutory auditor needs enough time to evaluate the observations, obtain explanations and evidence, decide whether additional procedures are required, and assess any impact on CARO and internal-control reporting.

Company-side preparation checklist

1. Approve an internal audit plan that is linked to business risks, locations and significant processes.
2. Define reporting lines, escalation routes and access rights for the internal auditor.
3. Track planned versus completed assignments through the year.
4. Maintain a central register of observations, owners, due dates, closure evidence and reopened issues.
5. Share final and relevant draft internal audit reports with the statutory auditor early enough for proper review.
6. Document management responses and Board or Audit Committee oversight of significant findings.

Common mistakes under Clause 3(xiv)

• Treating appointment of an internal auditor as proof that the system is commensurate.
• Ignoring locations or processes that materially change the company's risk profile.
• Using a standard annual plan without linking coverage to current business risks.
• Closing observations on the basis of management comments without verifying remedial action.
• Giving the statutory auditor only summaries or presentations when the underlying reports are needed for evaluation.
• Providing reports so late that meaningful consideration before audit completion becomes difficult.
• Confusing review of internal audit reports with automatic reliance on internal-audit work.

Practical takeaway

CARO 2020 Clause 3(xiv) is best treated as a quality test of the internal audit process, not an appointment checklist. Clause 3(xiv)(a) asks whether the system is proportionate to the company's size, complexity and risks. Clause 3(xiv)(b) asks whether the statutory auditor actually considered the internal audit reports in time to assess their effect. A defensible conclusion should therefore connect the internal audit plan, competence, reporting line, coverage, findings, follow-up and statutory-audit response in one documented chain.