Internal Audit: formula sheet

Key formulas

Section 138 basic rule

Prescribed class of company → must appoint an internal auditor

The internal auditor audits the functions and activities of the company. The Board appoints.

Listed company

Every listed company → internal audit applies

No size test. Listing alone is enough.

Unlisted public company (any one test)

Paid-up capital ≥ ₹50 crore OR turnover ≥ ₹200 crore OR loans/borrowings from banks/public financial institutions > ₹100 crore OR outstanding deposits ≥ ₹25 crore

Use the preceding financial year. For borrowings, the test is any point of time during that year, and the amount must exceed ₹100 crore. The same any-point-of-time test applies to deposits.

Private company (any one test)

Turnover ≥ ₹200 crore OR loans/borrowings from banks/public financial institutions > ₹100 crore

Paid-up capital and deposits are not tests for private companies.

Who can be appointed

Chartered accountant OR cost accountant (in practice or not) OR other professional decided by the Board

May or may not be an employee. The statutory auditor cannot be appointed for this service.

Scope and reporting

Audit Committee/Board, in consultation with internal auditor → scope, functioning, periodicity, methodology

The internal auditor reports to the Audit Committee or the Board.

Meaning in one line

Internal audit = independent, objective assurance and consulting activity designed to add value and improve operations

Use this as the opening sentence of any definition answer.

Core objectives

Controls + Compliance + Risk + Safeguarding of assets + Reliability of information + Efficiency

Pick the ones that match the case facts rather than listing everything.

Who decides scope

Scope of internal audit is set by management or those charged with governance, not by statute alone

Contrast with statutory audit, where scope is set by law and Standards on Auditing.

Statutory auditor and internal audit

Statutory auditor may use internal auditor's work but keeps sole responsibility for the audit opinion

Link to SA 610 (Revised) and SA 315.

Independence rule

Internal auditor reports to the audit committee or top management and has no operational duty over the area audited

Objectivity is the key safeguard.

Risk ranking score (common method)

Risk score = Impact × Likelihood

A practical way to rank auditable areas. It is a method, not a number prescribed by the SIAs. Use the same scale for every area.

Two levels of planning

Overall internal audit plan → Assignment plan

The overall plan decides which areas to audit and when. The assignment plan decides how to audit one area.

Sampling logic

Higher risk or lower reliance on controls → larger sample

Sample size moves with risk, the tolerable error and the population. Sampling risk cannot be removed, only controlled.

Documentation test

Working papers should let an experienced reviewer understand the work done, evidence obtained and conclusions reached

Use this test to say whether the documentation is adequate.

Plan contents to remember

Objectives, scope, timing, resources, risk assessment, procedures, sampling approach, reporting

A short checklist for any assignment planning answer.

Typical contents of an internal audit report

Title and addressee + Scope and objectives + Period covered + Methodology + Findings (criteria, condition, cause, effect) + Risk rating + Recommendations + Management response (action, owner, date) + Conclusion

Use this as a checklist. The finding structure criteria-condition-cause-effect is a common framework for writing each observation.

Qualities of a good report

Clear, Accurate, Objective, Concise, Constructive, Complete, Timely

Examiners often ask for these in a list. Add one line of meaning for each.

Reporting lines

Functional line: Audit Committee or Board. Administrative line: senior management.

The functional line protects independence. Name both when asked.

Follow-up cycle

Recommendation, Management response, Action plan with owner and date, Tracking, Verification, Status report to Audit Committee, Escalation if overdue or unaccepted

Follow-up covers verification of implementation, not only collecting management's assurance.

Section 138 position

Prescribed classes of companies must appoint an internal auditor. The Audit Committee or Board decides scope, functions, periodicity and methodology in consultation with the internal auditor.

State the classes only if the question gives them or you are sure of the Rules.

Three evaluation factors

Use of IA work requires: Objectivity + Competence + Systematic and disciplined approach

If any one is not adequate, the auditor should not use the work of the internal audit function.

Factors affecting planned use

Extent of use depends on: judgment involved in the work + assessed risk of material misstatement

These are qualitative considerations, not a calculation. Where judgment and assessed risk are higher, the auditor plans to use less of the internal audit work and does more of the procedures himself. This applies especially to significant risks.

Responsibility rule

Responsibility for the audit opinion = statutory auditor alone

Use of the work does not reduce the auditor's responsibility. In an unmodified opinion, do not refer to the work of the internal audit function or direct assistance in the auditor's report, as it might imply a modified opinion or shared responsibility. If law or regulation requires a reference, the report must state that it does not reduce the auditor's responsibility.

Procedures on work used

Evaluate quality + Test the work used (re-perform or examine similar items)

Also discuss the planned use with the function, and read its reports on the work to be used.

Direct assistance

Internal auditors under auditor's direction, supervision and review

Check applicable law permits it, and get written agreement that they follow the auditor's instructions and keep matters confidential. Evaluate the existence and significance of threats to their objectivity and the level of competence of the individual internal auditors. Do not use them for work involving significant judgments, or for work related to internal audit work already used or involving decisions the internal audit function made.

Quick revision

• Section 138 requires certain prescribed classes of companies to appoint an internal auditor.
• The internal auditor can be a chartered accountant or a cost accountant (whether engaged in practice or not), or any other professional the Board decides, and may be an employee of the company (Rule 13 of the Companies (Accounts) Rules, 2014). The statutory auditor of the company cannot provide internal audit services to it (Section 144 of the Companies Act, 2013).
• The Audit Committee (or the Board where there is no Audit Committee) formulates the scope, functioning, periodicity and methodology of the internal audit in consultation with the internal auditor.
• Internal audit is an independent function whose scope is set by the Audit Committee or the Board, and whose reports go to those bodies. Statutory audit is carried out for the members.
• Internal audit covers risk management, controls and governance, not only financial records.
• Planning comes before fieldwork: understand the entity, assess risk, set objectives and scope, prepare the programme.
• A good internal audit report states observation, risk, recommendation and management response.
• Follow-up checks whether agreed actions were actually carried out.
• The statutory auditor remains solely responsible for the audit opinion even when using internal audit work.
• Reliance on internal audit depends on its objectivity, competence and a systematic, disciplined approach.
• Producer companies have their own special provisions, so do not apply Section 138 conditions to them by default.
• Always apply the rule to the facts and end with a clear conclusion.

Common mistakes

• Applying paid-up capital and deposit limits to a private company. Fix: Remember the private company has only two tests: turnover and borrowings. Write the two lists separately in your notes.
• Testing the current year's figures. Fix: The rule looks at the preceding financial year. Identify that year first and ignore the others.
• Saying internal audit is compulsory for every company. Fix: Say it is compulsory only for prescribed classes of companies, and optional otherwise.
• Writing that the internal auditor gives an opinion on the true and fair view of financial statements. Fix: The true and fair opinion belongs to the statutory auditor. Internal audit reports findings and recommendations to management.
• Treating the overall audit plan and the assignment plan as the same thing. Fix: Say the overall plan decides what to audit and how often. The assignment plan decides how to audit a single area.
• Ranking areas by size of balance instead of by risk. Fix: Rank by impact and likelihood of the risk, including non-financial risks such as compliance, fraud and system failure.
• Treating management as the final recipient of the report. Fix: Say the report goes to the Audit Committee or Board on the functional line. Management gets the draft to respond and acts on it.
• Leaving out the management response. Fix: Always list the response with action, owner and date. Mention the auditor records any disagreement.
• Saying the auditor can rely on internal audit work fully if it is competent. Fix: Always list all three factors and then state that extent of use depends on judgment and risk.
• Writing that the internal auditor shares responsibility for the audit opinion. Fix: State clearly that the statutory auditor has sole responsibility and the report does not refer to internal auditors' work.

Exam tips

• In case MCQs, first label the company type, then apply only its tests. Most wrong options come from using the wrong list.
• Always find the preceding financial year in the facts before you compare any figure.
• Write one line on who can be appointed (CA, cost accountant, other professional decided by the Board, employee or not) in every theory answer. It earns easy marks.
• For reporting questions, name the Audit Committee or Board and list the four items: scope, functioning, periodicity and methodology.
• Link to the statutory auditor bar and to SA 610 in answers on coordination. It shows you see the whole picture.
• Always start definition answers with independence and with the fact that internal audit serves management or those charged with governance.
• For difference questions, use a two-column grid with at least five heads, and include internal vs management audit if the question mentions it.
• In case MCQs, reject options where the internal auditor takes management decisions or issues the statutory opinion.