Internal Audit

Internal audit is an independent, ongoing evaluation of a company's internal controls, risk management and governance processes, carried out to assure the board that operations run efficiently and comply with law. In India it is mandated by Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, and is separate from the statutory (external) audit under Section 143.

Who must appoint an internal auditor

• Every listed company.
• Every unlisted public company with paid-up share capital of Rs 50 crore or more, turnover of Rs 200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding Rs 100 crore, or outstanding deposits of Rs 25 crore or more (any one of these, at the relevant time in the preceding financial year).
• Every private company with turnover of Rs 200 crore or more, or outstanding bank/PFI borrowings exceeding Rs 100 crore, during the preceding financial year.

Who can conduct it

The internal auditor may be a chartered accountant or a cost accountant, or any other professional the board decides. They may be an individual, a firm, or an in-house employee, and need not be in practice, but the function must stay independent of the areas it reviews. The board, usually through its audit committee under Section 177, fixes the scope, periodicity and reporting lines.

Focus and standards

Typical reviews cover operational efficiency, safeguarding of assets, statutory compliance (GST, TDS, labour and similar), and fraud prevention. ICAI's Standards on Internal Audit (SIAs) offer recommendatory guidance; internal audit is not governed by the Standards on Auditing that apply to statutory audit.