Internal audit is an independent review function inside an organisation, or engaged by it, that examines whether processes, controls, compliance and risk management are working as intended. It is not limited to checking accounting entries. In practice, a good internal audit reviews how work actually happens, where failure points exist, and whether management information can be relied on for decisions.
A payment can be recorded correctly in the ledger and still be unauthorised or duplicated. Internal audit follows the process behind that entry: who created the vendor, who approved the purchase, what was received, and who released the money. It can be useful when growth, multiple locations or system changes make informal supervision unreliable.
Why internal audit matters
- It tests whether controls work in real conditions. A policy on paper is not the same thing as an operating control.
- It identifies root causes, not only errors. Repeated revenue leakages, stock differences or delayed collections usually point to process design issues.
- It improves governance. Internal audit gives the board, audit committee and management a more disciplined view of risk and control gaps.
- It supports growth. As a business scales, founders and finance heads can no longer rely on informal supervision.
- It strengthens accountability. Findings can be assigned, tracked and re-tested instead of remaining as informal observations.
What internal audit usually covers
The scope depends on the entity’s risk profile. In a mature function, the coverage is drawn from the audit universe rather than from finance alone.
- Financial controls: payments, receipts, journal controls, reconciliations, close process and delegations.
- Operational processes: procurement, inventory, production, logistics, sales returns, credit approval and collections.
- Compliance areas: entity-specific legal and regulatory obligations, internal policies, contract conditions and reporting responsibilities.
- Technology controls: user access, maker-checker logic, change management, interfaces, backups and exception reports.
- Fraud-risk areas: override points, related-party exposure, cash handling, vendor onboarding and unusual manual adjustments.
How internal audit works in practice
ICAI's compendium page identifies the February 2026 edition for application from 1 April 2026. In that edition, SIA 220 covers planning, SIA 230 evidence, SIA 250 documentation and SIA 310 presentation and communication of reports. Their effective-date paragraphs retain recommendatory status until the Council notifies mandatory application; publication alone should not be described as making every provision compulsory. Check the edition and effective-date provisions relevant to the engagement.
The following workflow shows how a finance team can turn a broad audit objective into specific tests and documented action.
1. Understand the business and the risk landscape
The auditor first understands the process, objectives, people involved, systems used, approvals required and known pain points. This stage should identify where errors or non-compliance would matter most.
2. Define the audit objective and scope
The objective must be specific. “Audit purchases” is too broad. “Review whether procurement controls prevent duplicate vendors, unauthorized purchases and unsupported payments” is workable.
3. Map key risks to expected controls
This is where internal audit becomes useful. The team asks: what can go wrong, what control should prevent or detect it, who owns that control, and what evidence shows it operated?
4. Test design and operating effectiveness
A control may be well designed but poorly performed, or performed consistently but designed badly. Internal audit should test both.
5. Evaluate evidence and exceptions
Not every exception matters equally. Some are isolated errors; others reveal a systemic weakness. Good internal audit distinguishes between the two.
6. Report findings with action points
A useful report links each finding to the underlying risk, the control gap, the practical impact and a realistic remediation step with ownership.
7. Follow up on closure
Agree who will implement each action, when it is due and what evidence will support closure. Management owns the controls; the auditor evaluates the response and records unresolved matters. The 2026 compendium addresses management responsibility in SIA 140 and reports with action plans and follow-up status in SIA 310.
Internal audit is not the same as statutory audit
| Point | Internal audit | Statutory audit |
|---|---|---|
| Primary purpose | Improve controls, processes, compliance and risk management | Express an opinion on financial statements under the applicable legal framework |
| Scope | Flexible and risk-driven | Focused on financial statement audit requirements |
| Timing | Can be continuous, periodic or theme-based during the year | Centered on the statutory reporting cycle |
| Reporting line | Usually management, board or audit committee | Members and those charged with governance under the legal framework |
| Output | Observations, risk ratings, recommendations and follow-up | Audit report on the financial statements |
| Orientation | Forward-looking and corrective | Opinion-focused and reporting-oriented |
Section 144 of the Companies Act, 2013 prohibits an auditor appointed under the Act from providing internal audit, directly or indirectly, to that company or its holding or subsidiary company. Board approval does not override that prohibition. Section 144 also explains the indirect relationships covered.
India-specific legal context
Section 138 requires prescribed classes of companies to appoint an internal auditor: a chartered accountant, cost accountant or another professional decided by the Board. It also enables rules on the manner and intervals of internal audit and reporting to the Board.
Whether an individual company is legally covered requires a separate applicability assessment under the prescribed rules and any relevant exemptions. This guide explains the function and its execution; it does not determine a particular company's statutory applicability. Businesses can also commission internal audit voluntarily to address their own risks.
What makes an internal audit effective
- Risk-based coverage. Time should go first to areas where failure would have the highest business impact.
- Operational understanding. Process knowledge matters as much as accounting knowledge.
- Evidence discipline. Findings should be supported by documents, data, walkthroughs or system logs.
- Clear reporting. Management needs action-oriented observations, not generic criticism.
- Independence in reporting. If the auditor cannot escalate uncomfortable findings, the exercise becomes ceremonial.
- Follow-through. Repeat findings usually indicate weak closure discipline rather than weak audit technique alone.
A procurement finding, from testing to closure
Illustration: A trading company with three warehouses commissions a procurement review. This is a fictional engagement, not a conclusion that its turnover triggers mandatory internal audit. The agreed period is April–June. The team reconciles an ERP population of 240 invoices, totalling ₹1.20 crore, to the purchase register before choosing items to test. All amounts below exclude tax.
For the duplicate-payment test, the team compares vendor identity, normalised invoice number, invoice date and amount across the full population. That comparison produces six candidate pairs. A match is a lead to investigate, not evidence that every pair is a duplicate.
| Finding | Evidence and conclusion | Immediate action |
|---|---|---|
| Four pairs are legitimate | Different deliveries and supporting records explain the matching amounts. No duplicate is established for these pairs. | Record why each flag was cleared; retain the matching rule used. |
| ₹80,000 invoice posted twice; both entries paid | The invoice and goods-receipt record identify one supply. Two bank debits and the vendor's acknowledgement establish the second payment. | Finance seeks recovery and assesses the correct ledger treatment. Record ₹80,000 as the identified overpayment, not the sum of all flagged invoices. |
| ₹45,000 invoice posted twice; second entry unpaid | One supply supports two ledger entries. The payment register and bank records show only the first was paid. | Block the unpaid duplicate and correct the entry through the approved process. It is not a ₹45,000 cash loss. |
The identified duplicate postings total ₹80,000 + ₹45,000 = ₹1,25,000. Of that, ₹80,000 was paid twice and ₹45,000 remained unpaid. Keep these figures separate in the report: the posting error, cash exposure and prevented payment describe different consequences. The checks establish these cases; they do not establish that every other invoice is free from error or fraud.
Next, the auditor traces why the duplicates passed. In this example, punctuation differences in invoice numbers avoided the duplicate check, and users could override the warning without a second approval. The report distinguishes the weak matching rule from the uncontrolled override. Screenshots alone are insufficient if they show today's configuration rather than the configuration during the audited period; retain the relevant change logs and transaction history.
Assume the finance head accepts responsibility for recovery and entry correction, and the ERP owner agrees to introduce a normalised-number check with independently approved exceptions within 30 days. Those owners and the deadline are illustrative agreed actions, not statutory requirements. Each action gets its own closure evidence.
At follow-up, finance supplies the bank credit proving recovery of ₹80,000 and the approved correction for ₹45,000. The auditor then checks the deployed configuration and all 18 invoices and two authorised exceptions processed during an agreed two-week follow-up window. If the exception-approval log is still missing, the cash-recovery action may be closed while the override-control finding remains open. Report that distinction, the limited follow-up period and the next due date; do not label the whole issue resolved because the refund arrived.
Where readers often get confused
Internal audit is not only for large listed entities
Many private businesses benefit from internal audit before any legal trigger becomes relevant, especially when they have fast growth, branch operations, inventory exposure, multiple payment approvers or founder-dependent controls.
Internal audit is not the same as internal financial control review
Internal financial controls are one important part of the picture, but internal audit can go wider into operations, compliance, governance and technology.
Internal audit is not a guarantee against fraud
It reduces risk and improves detection chances, but no audit function can guarantee that fraud or error will never occur.
When internal audit adds the most value
- Rapid growth has outpaced old approval habits.
- Processes differ across branches or business units.
- Margins are under pressure and leakages matter.
- ERP data exists but reconciliations and exception reviews are weak.
- Management receives reports, but does not fully trust them.
- Prior statutory, tax or lender reviews have identified recurring control issues.
What management should receive
The final record should let the reader move from the risk to the test, the evidence, the finding and the agreed response. A concise list of open actions with owners and evidence requirements is more useful than repeatedly issuing the same observation without a decision. Preserve the scope and limitations alongside the result so a targeted procurement review is not mistaken for assurance over the entire organisation.
