Internal control and internal audit

In short

Internal control is the whole system of policies, procedures and checks a company's management builds into its operations to safeguard assets, prevent and detect fraud and error, ensure reliable accounting records and secure compliance with law. Internal audit is an independent appraisal *of* that system, carried out from within the organisation (or outsourced) and reporting to the audit committee or the board. Both are examined heavily in B.Com auditing papers, in CA/CS/CMA audit modules, and in interviews for internal audit, risk, compliance and process-audit roles at the Big Four, Grant Thornton, BDO, banks, NBFCs and corporate internal audit teams.

Explained

Internal control: meaning, objectives and components

• Definition (SA 315 sense): the process designed, implemented and maintained by those charged with governance and management to provide *reasonable assurance* about the reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets, and compliance with laws.
• Five components (COSO, adopted in SA 315): (1) control environment — tone at the top, integrity, ethics, organisation structure; (2) risk assessment process; (3) information system and communication; (4) control activities; (5) monitoring of controls.
• Types of control activities: *preventive* (authorisation limits, passwords, segregation of duties), *detective* (bank reconciliation, physical stock count, exception reports), *corrective* (error-correction routines, backup restoration).
• Key control techniques: segregation of duties (authorisation, custody, recording never in one hand), proper authorisation and approval limits, physical custody and access controls, independent verification and reconciliation, documentation and audit trail, job rotation and compulsory leave, IT general controls (access, change management, backups).
• Internal check is one *part* of internal control — the arrangement of work so that one person's work is automatically and independently verified by another in the normal course of duty, with no extra cost.
• Internal financial controls (IFC) is the Companies Act, 2013 term: controls over orderly conduct of business, adherence to policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy of records and timely financial statements (explanation to section 134(5)(e)).

Internal audit: nature, scope and legal position

• Nature: an independent, objective assurance and consulting activity that evaluates and improves risk management, control and governance; it reports functionally to the audit committee, administratively to management — independence comes from reporting line, not from being outside the company.
• Scope: review of internal control and IFC, operational/efficiency audit, compliance audit, risk-based audit plan, special investigations, follow-up on past observations.
• Section 138, Companies Act, 2013 (with Rule 13 of the Companies (Accounts) Rules, 2014): internal audit is mandatory for every listed company; every unlisted public company with paid-up capital ≥ ₹50 crore, or turnover ≥ ₹200 crore, or outstanding bank/PFI borrowings > ₹100 crore, or outstanding deposits ≥ ₹25 crore; every private company with turnover ≥ ₹200 crore, or outstanding bank/PFI borrowings > ₹100 crore (figures of the preceding financial year). The internal auditor may be a CA, a cost accountant or any other professional decided by the board, and may be an employee.
• Other statutory hooks: section 177 — audit committee evaluates internal financial controls and may call for an internal audit; section 143(3)(i) — the *statutory* auditor must report whether the company has adequate IFC with reference to financial statements and their operating effectiveness (exempt for certain small/OPC/private companies by notification); section 134(5)(e) — directors' responsibility statement on IFC for listed companies; CARO 2020 requires comment on whether the internal audit system is commensurate with the size and nature of business. SEBI LODR Regulation 18 governs the audit committee's review of internal audit for listed entities.
• Professional standards: ICAI issues Standards on Internal Audit (SIA) — SIA 110 Nature of Assurance, SIA 310 Planning, SIA 320 Internal Audit Evidence, SIA 350 Reporting, etc.; ICAI has been making them mandatory in phases, so check the current ICAI announcement for the applicable date. Statutory auditors follow SA 315 (understanding and assessing controls), SA 330 (responses), SA 265 (communicating control deficiencies) and SA 610 (using the work of internal auditors).

Evaluation, documentation and limitations

• How controls are evaluated: understand the process → document it (narrative note, flowchart, internal control questionnaire (ICQ) or internal control evaluation questionnaire) → walk-through one transaction end to end → test of controls on a sample → conclude on control risk → decide the extent of substantive testing.
• Deficiency vs significant deficiency vs material weakness: a deficiency is a control that fails to prevent/detect misstatement on a timely basis; a significant deficiency is important enough to report to those charged with governance (SA 265); a material weakness could allow a material misstatement to go undetected.
• Advantages: fewer errors and frauds, reliable MIS, smoother statutory audit (auditor may reduce substantive work), better compliance, process efficiency and cost savings, management accountability.
• Inherent limitations (always asked): cost-benefit constraint, controls aimed at routine and not unusual transactions, human error/carelessness, collusion between two or more employees, management override of controls, abuse of authority, obsolescence as conditions change, and limitations of IT controls. Hence internal control gives *reasonable*, not absolute, assurance — and the statutory auditor cannot rely on it blindly.

Key points

• Internal control - management's system of checks for reliable reporting, asset safeguarding, efficiency and compliance.
• Internal check - built-in cross-verification of one clerk's work by another; a subset of internal control.
• Internal audit - independent in-house appraisal of controls; statutory audit - external opinion on true and fair view.
• Five COSO components - control environment, risk assessment, control activities, information and communication, monitoring.
• Segregation of duties - authorisation, custody and recording kept in separate hands.
• Section 138 + Rule 13 - internal audit compulsory for listed, and for public/private companies crossing the capital, turnover, borrowing or deposit thresholds.
• Section 143(3)(i) - statutory auditor reports on adequacy and operating effectiveness of IFC with reference to financial statements (the statutory wording after the 2017 amendment).
• CARO 2020 - comment on whether the internal audit system suits the size and nature of the business.
• SA 315 / SA 330 / SA 265 - understand controls, respond to assessed risk, report deficiencies.
• SA 610 - the statutory auditor may use internal audit work but remains solely responsible for the opinion.
• Reasonable not absolute assurance - collusion and management override defeat any control system.
• Audit committee - internal audit's functional reporting line; the source of its independence.

Formulas and examples

Example 1 — Is internal audit mandatory? Alpha Metals Pvt Ltd, previous financial year: paid-up capital ₹12 crore, turnover ₹240 crore, bank borrowings outstanding ₹60 crore, deposits nil.

1. It is a *private* company, so only two tests apply: turnover ≥ ₹200 crore, or borrowings > ₹100 crore.
2. Turnover ₹240 crore ≥ ₹200 crore → test satisfied.
3. Borrowings ₹60 crore ≤ ₹100 crore → not satisfied, but only one test needs to be met.
4. Conclusion: internal audit is mandatory under section 138; the board must appoint an internal auditor and the audit committee/board decides scope, periodicity and methodology.

Example 2 — Test of controls and its effect on substantive work. The control: every purchase invoice above ₹50,000 must carry the purchase manager's signature. The auditor tests 60 invoices and finds 3 unsigned; tolerable deviation rate 4%; audit risk accepted 5%; inherent risk assessed 70%.

1. Deviation rate = 3 / 60 × 100 = 5%.
2. 5% > 4% tolerable → the control is not operating effectively; control risk is raised, say to 80% (0.80).
3. DR = AR / (IR × CR) = 0.05 / (0.70 × 0.80) = 0.05 / 0.56 = 0.0893, i.e. about 8.9%.
4. Had the control been effective (CR = 0.40), DR = 0.05 / (0.70 × 0.40) = 0.179, about 17.9%.
5. Meaning: a weaker control forces a lower acceptable detection risk, so the auditor must do roughly twice as much substantive testing; the deficiency is also reported under SA 265.

Where it is used

• Banks and NBFCs: concurrent audit, risk-based internal audit and branch audit under RBI directions; maker-checker controls on every transaction.
• Manufacturing and FMCG: stores and procurement controls, three-way match (purchase order, goods receipt note, invoice), physical stock verification, plant internal audit teams at Tata Steel, ITC, Hindustan Unilever.
• Consulting and assurance firms: internal audit, risk advisory and SOX/IFC testing practices at the Big Four, Grant Thornton and BDO — a major recruiter of B.Com and CA students.
• Listed companies and IT/ITES: IFC documentation under section 143(3)(i), ERP access and change-management controls in SAP/Oracle, audit committee reporting under SEBI LODR.

Interview questions

• Q: What is the difference between internal control and internal audit? A: Internal control is management's system of checks built into operations; internal audit is an independent evaluation of whether that system exists and works.
• Q: Which companies must appoint an internal auditor? A: Under section 138 read with Rule 13, all listed companies, and unlisted public or private companies crossing the prescribed capital, turnover, borrowing or deposit limits of the preceding year.
• Q: What are the five components of internal control? A: Control environment, risk assessment, control activities, information and communication, and monitoring of controls.
• Q: Why does internal control give only reasonable assurance? A: Because of cost-benefit limits, human error, collusion among employees and the ability of management to override controls.
• Q: What is segregation of duties and give an example? A: Splitting authorisation, custody and recording — the person approving a payment should not also handle cash or write the books.
• Q: Can a statutory auditor rely on the internal auditor's work? A: Yes, under SA 610, after assessing the internal auditor's objectivity, competence and systematic approach — but the statutory auditor alone remains responsible for the opinion.
• Q: What does section 143(3)(i) require? A: The statutory auditor must state whether the company has adequate internal financial controls with reference to financial statements and whether they were operating effectively.

Common mistakes

• Treating internal check, internal control and internal audit as the same thing — internal check is the narrowest, internal control the widest.
• Saying a good internal control system *prevents* all fraud; it gives reasonable assurance only, and management override defeats it.
• Quoting the section 138 limits for a private company as though all four tests apply — only turnover and borrowings do.
• Claiming the internal auditor must be an independent outsider or a practising CA; an employee, a cost accountant or another professional chosen by the board also qualifies.
• Confusing IFC under the Companies Act with the statutory auditor's narrower reporting on controls *with reference to financial statements*.

Related topics

Auditing basics · Companies Act basics · Forensic accounting and fraud detection · Corporate governance and audit committee · Risk management.