Modern organizations operate in highly complex environments characterized by a high volume of transactions, multiple locations, and a heavy reliance on technology. With the increasing decentralization of activities and delegation of authority, stakeholders—including the Board of Directors, investors, and lenders—require reliable financial and non-financial information. This is where the internal audit function steps in, acting as a crucial mechanism to identify deficiencies in internal controls and ensure better governance.

The Institute of Chartered Accountants of India (ICAI) defines internal audit as an independent assurance function designed to evaluate the effectiveness of internal controls and risk management processes, ultimately helping an organization achieve its objectives.

Here is a comprehensive guide to understanding the framework, applicability, scope, and execution of internal audits.

1. Applicability: Who Needs an Internal Auditor?

Under Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, the appointment of an internal auditor is mandatory for specific classes of companies. The threshold requirements are as follows:

• Unlisted Public Companies: Mandatory if they meet any of the following criteria in the preceding financial year:
    - Paid-up share capital of ₹50 crore or more.

          - Turnover of ₹200 crore or more.

           - Outstanding loans or borrowings from banks/public financial institutions exceeding ₹100 crore at any point in time.

           - Outstanding deposits of ₹25 crore or more at any point in time.

         • Private Companies: Mandatory if they meet either of the following criteria in the preceding financial year:

           - Turnover of ₹200 crore or more.

           - Outstanding loans or borrowings exceeding ₹100 crore at any point in time.

The internal auditor can be a chartered accountant, a cost accountant, or any other professional decided by the Board. They can be either an employee of the company or an external professional/firm.

2. The Scope and Objectives of Internal Audit

The scope of internal audit extends far beyond mere financial verification; it encompasses an organization's operational activities, legal compliance, and governance frameworks. The Audit Committee or the Board, in consultation with the Internal Auditor, is responsible for formulating the scope, functioning, periodicity, and methodology for conducting the internal audit.

The primary areas of review include:

         • Internal Control System and Procedures: Evaluating the design and operational efficiency of internal controls to minimize residual risk.

        • Custodianship and Safeguarding of Assets: Verifying the existence of tangible and intangible assets and ensuring adequate segregation of duties.

       • Compliance with Policies and Regulations: Ensuring all functional segments comply with internal policies, plans, and relevant external laws.

         • Relevance and Reliability of Information: Evaluating information systems to guarantee the integrity of financial and operational data.

         • Organizational Structure: Reviewing how activities are grouped, ensuring authority matches responsibility.

         • Utilization of Resources: Identifying under-utilized assets and ensuring resources are used economically.

 • Accomplishment of Goals: Assessing whether organizational objectives are clearly stated, quantifiable, and attainable.

3. Core Principles and Qualities of an Internal Auditor

For the internal audit function to add genuine value, the auditor must adhere to fundamental principles of independence, integrity, and objectivity.

     • Objectivity and Integrity: The auditor must be honest, fair, and avoid any conflicts of interest.

To execute these duties, the internal auditor must possess a diverse skill set, including expertise in financial accounting, knowledge of operational and commercial practices, understanding of ERP systems and IT controls, and strong management and communication skills.

4. The 5-Step Internal Audit Engagement Process

Executing an internal audit follows a systematic, disciplined approach categorized into five distinct steps:

1.     Obtain Knowledge of the Business and its Environment: The auditor conducts meetings with key stakeholders to understand operations.

2.      Perform Audit Planning: Following SIA 310, the auditor prepares a detailed audit plan and schedule.

3.     Gather Required Information: The auditor collects necessary data directly from source systems to ensure integrity.

4.    Perform Audit Checks: This involves executing analytical procedures (SIA 6) to identify outliers, utilizing sampling techniques (SIA 5), and gathering sufficient audit evidence (SIA 320).

5.   Reporting of Internal Audit Issues: The auditor drafts a report highlighting control gaps, their business implications, and management action plans.

5. The Internal Audit Report and Follow-up

Reporting generally occurs in two stages: an assignment-specific report at the end of a particular audit, and a comprehensive periodic (e.g., quarterly) report submitted to the Audit Committee.

A standard internal audit report includes:

  • An overview of the audit scope and the period covered.

   • An executive summary of key observations.

   • Detailed findings covering the root cause and business impact.

   • Risk ratings for highlighted issues (e.g., High, Medium, Low).

   • A summary of corrective actions agreed upon by management, complete with targeted timelines.

Crucially, the internal audit process does not end with the report. Under SIA 390, the Chief Internal Auditor must continuously monitor the implementation of management's action plans. This is typically managed through an "Action Taken Report" to track pending resolutions.

6. The Relationship Between Internal and External Auditors

While internal audit evaluates the adequacy of operational controls and is appointed by the Board, external (statutory) audit focuses on the truthfulness and fairness of financial statements and is appointed by shareholders. However, the work of the internal auditor is often highly relevant to the statutory auditor.

Under Standard on Auditing (SA) 610, the external auditor must evaluate the internal audit function's organizational status, level of competence, and systematic approach. If these elements are satisfactory, the external auditor may rely on the internal auditor's work to modify the nature, timing, and extent of their own audit procedures.

7. IT Controls and the Audit Trail

With digital operations dominating modern business, maintaining an "Audit Trail" (or Edit Log) is increasingly critical. An audit trail is a chronological record capturing when data changes were made, who made them, and what specific data was altered.

Internal auditors evaluate specific IT controls to ensure audit trails remain functional. This includes verifying that the audit trail feature hasn't been disabled, ensuring unique User IDs are assigned without sharing, and confirming that periodic backups of the logs are maintained in accordance with statutory requirements.