Internal Audit Services — Practical Overview
Internal audit under Section 138 of the Companies Act 2013 is mandatory for: every listed company; every unlisted public company with paid-up capital ≥ ₹50 crore or turnover ≥ ₹200 crore or outstanding loans/borrowings ≥ ₹100 crore; and every private company with turnover ≥ ₹200 crore or outstanding loans/borrowings ≥ ₹100 crore.
Regulatory and Statutory Framework
Our internal audit methodology aligns with the Standards on Internal Audit (SIAs) issued by ICAI and the IIA's IPPF (International Professional Practices Framework). The annual internal audit plan is risk-based, focusing on revenue assurance, procurement integrity, payroll controls, fixed asset management, IT general controls, and compliance with statutory and contractual obligations.
Process and Documentation Requirements
The end-to-end process typically involves: (a) initial fact-finding and document collection — incorporation documents, financial statements, board resolutions, and any prior filings on the matter; (b) regulatory analysis — identification of applicable provisions, exemptions, and procedural prerequisites; (c) drafting of the substantive deliverable — whether a report, application, certificate, or representation; (d) obtaining necessary internal approvals from the company's board or shareholders; (e) submission to the regulatory authority with supporting evidence; (f) follow-up on queries and rectifications; (g) post-completion compliance maintenance and record-keeping. Each internal audit cycle delivers: risk-rated finding register, root-cause analysis, recommended actions with management responses, post-implementation testing of remediation, and quarterly audit committee presentation packs.
Common Pitfalls and How We Avoid Them
From our litigation and assessment experience, the most frequent issues that escalate into adverse outcomes are: (a) inadequate documentation supporting the technical position taken; (b) inconsistency between disclosures across different statutory filings (income tax, ROC, GST); (c) failure to obtain timely contemporaneous evidence (board minutes, valuer reports, contracts); (d) reliance on form over substance — the Indian regulatory regime increasingly looks through form to economic substance; (e) missed limitation periods for filings, replies, or appeals. Our engagement methodology builds in checks against each of these failure modes from kick-off.
Why CA V. Viswanathan and Virtual Auditor
The combination of FCA, ACS, CFE, and IBBI Registered Valuer credentials under one practice — IBBI/RV/03/2019/12333 — is rare, and is precisely the breadth needed for engagements that span direct tax, indirect tax, corporate law, FEMA, and valuation simultaneously. Our practice has been operating since 2012 with offices in Chennai, Bangalore, and Mumbai, and serves clients across India through secure document-room workflows, named partner ownership, and weekly status updates. Engagements are scoped on fixed-fee terms wherever the work permits, with full transparency on inclusions and exclusions.
Engagement Process and Next Step
Free 30-minute consultation with CA V. Viswanathan to scope your specific requirement, identify the right approach, and provide a written fixed-fee quote within 24 hours. Engagements typically commence within 3-5 working days of acceptance, with kickoff document checklist shared upon engagement letter signing. References from comparable engagements available on request, subject to confidentiality. Call +91 99622 60333 or email support@virtualauditor.in to schedule.
Frequently Asked Questions
Which companies need internal audit under Section 138?
Virtual Auditor provides expert advisory on this through our FCA + ACS + CFE + IBBI Registered Valuer practice. Contact us at +91 99622 60333 or visit virtualauditor.in for detailed guidance specific to your situation.
What is the difference between internal audit and statutory audit?
A statutory audit is a legally required annual audit by an independent chartered accountant that gives an opinion on the financial statements to shareholders. An internal audit is an ongoing function, appointed by the board under section 138 where applicable, that evaluates risk management, internal controls and operational efficiency and reports to management and the audit committee.
Can the statutory auditor also be the internal auditor?
This depends on the specific facts and regulatory framework applicable to your situation. Virtual Auditor provides case-specific advisory after understanding your circumstances. Call +91 99622 60333 for a preliminary assessment.
How often should internal audit be conducted?
Companies covered by section 138 (listed companies, and unlisted public or private companies above the turnover, borrowing or deposit thresholds in rule 13) must have an internal audit function with a plan approved by the audit committee, usually quarterly. Smaller companies typically run a half-yearly or annual cycle.
What is a risk-based internal audit approach?
Planning the audit around the organisation's risk register, so that the processes with the highest financial, compliance and operational risk get the most audit time, rather than auditing every function equally. The audit plan is revised as risks change.
Which audit or review applies, and what will the work actually cover?
Every company needs a statutory audit of its financial statements by a chartered accountant appointed under section 139 of the Companies Act, reporting under section 143 and, where it applies, the CARO 2020 order and on internal financial controls. An LLP needs an audit when its turnover exceeds ₹40 lakh or its contribution exceeds ₹25 lakh. A tax audit is needed when business turnover or professional receipts cross the income-tax limits. An internal audit is required for prescribed classes of companies (section 138). A statutory auditor cannot also provide certain other services to the same company (section 144). We confirm which audits apply, agree the scope and timetable in an engagement letter, and list the records needed.