Internal Audit and Process Review

Overview

An internal audit is an independent review of how a business actually runs: whether transactions are recorded correctly, controls work, laws are followed and risks are managed. Unlike the statutory audit, which gives an opinion on the financial statements once a year, an internal audit is continuous or periodic, covers operations as well as accounts, and reports to management or the audit committee with recommendations.

Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 make it mandatory for certain companies. Others commission it voluntarily to tighten controls, prepare for funding or find leaks.

Who needs it

Mandatory for these companies, based on the previous financial year:

Company	Internal audit required if
Listed company	Always.
Unlisted public company	Turnover of Rs 200 crore or more, or paid-up capital of Rs 50 crore or more, or loans from banks or financial institutions above Rs 100 crore at any point, or deposits above Rs 25 crore at any point.
Private company	Turnover of Rs 200 crore or more, or loans from banks or financial institutions above Rs 100 crore at any point.

Voluntary users include growing businesses with several branches or cash-heavy operations, businesses preparing for investment or a sale, companies after a fraud or loss, and owners who want assurance on purchasing, inventory, payroll or receivables processes.

What Zenith does

Zenith listens first, agrees the scope, areas and frequency and gives a tailored quotation. A relationship manager is assigned. Internal audit is performed only through appropriately authorised and independent professionals, subject to eligibility and applicable rules.

• Agrees an audit plan with management or the audit committee: processes in scope, locations, frequency and reporting lines.
• Maps processes such as procure-to-pay, order-to-cash, inventory, payroll, fixed assets, treasury and statutory compliance.
• Tests the design and operation of controls: approvals, segregation of duties, reconciliations, authorisation limits and system access.
• Reviews compliance with tax, GST, TDS, labour and company-law requirements for the area in scope.
• Looks for leakage, duplicate payments, unreconciled balances and fraud indicators, and reports exceptions.
• Issues a written report with ratings, root causes, practical recommendations and management responses.
• Follows up on open points at the next cycle.

Zenith does not audit the same company's statutory financial statements through the same professional team, and an internal audit does not replace the statutory audit or tax audit.

Eligibility and key rules

• Rule 13 requires the audit committee, or the board where there is no committee, to agree the scope, functioning, periodicity and methodology with the internal auditor.
• The Companies Act does not prescribe qualifications for an internal auditor. An authorised professional, a cost accountant, a certified internal auditor or a qualified employee can be appointed.
• A statutory auditor cannot act as the internal auditor of the same company.
• The Act does not set the frequency; it is decided by the audit committee and auditor based on risk.
• The appointment is by board resolution with the auditor's consent, and Form MGT-14 is filed with the Registrar within 30 days.

Documents required

• Organisation chart, process descriptions and delegation of authority.
• Chart of accounts, trial balance and the latest financial statements.
• Policies and manuals: purchase, sales, expense, HR, IT and inventory.
• Samples and registers for the areas in scope: vouchers, invoices, bank reconciliations, stock records, payroll and fixed asset registers.
• Previous internal and statutory audit reports and management responses.
• Statutory returns for the period in scope.
• For appointment: board resolution, auditor's consent and appointment letter.

Process and timeline

1. Scoping and risk assessment. Processes, locations and frequency agreed.
2. Planning. Audit programme, sample sizes and information request.
3. Fieldwork. Walkthroughs, testing and discussions with process owners.
4. Draft report. Findings shared with management for factual accuracy.
5. Final report. Findings, ratings and agreed actions go to management or the audit committee.
6. Follow-up. Closure of previous findings at the next cycle.

Time depends on the number of processes, locations and sample sizes.

Government fees, penalties and due dates

There is no government fee for the audit itself. If the internal auditor is appointed by a company, Form MGT-14 is filed within 30 days of the board meeting with the prescribed fee. The Act has no dedicated penalty section for missing a mandatory internal audit; Section 450 applies to the company and officers in default, with a penalty of up to Rs 10,000 and a further Rs 1,000 for each day the default continues. The offence can be compounded.

Amounts and dates above reflect public sources read in October 2026 and change with notifications, so Zenith confirms the current figures in your quotation.

Common mistakes

• Assuming a company below the thresholds cannot benefit from an internal audit.
• Appointing the statutory auditor as internal auditor.
• Choosing a scope that is too wide for the budget, rather than starting with the highest-risk processes.
• Treating the report as a formality: no owners or dates for the recommended actions.
• Giving the auditor access to the finance team only, not operations.
• Forgetting to file MGT-14 after appointing the internal auditor.

FAQs