Internal Control and Internal Audit: formula sheet

Key formulas

Five components of internal control (SA 315, A57)

Control environment + Risk assessment process + Information system and communication + Control activities + Monitoring of controls

Learn the order. Control environment is the base and sets the tone for the rest.

Objectives of internal control

Reliable reporting + Effective and efficient operations + Compliance with laws and regulations

Safeguarding of assets supports all three. Say 'reasonable assurance', not 'absolute assurance'.

Control activities (SA 315, A95)

Authorisation, performance reviews, information processing, physical controls, segregation of duties

These are the examples the standard gives. Control activities are the policies and procedures that help ensure management directives are carried out.

Monitoring (SA 315, A105)

Monitoring = ongoing activities + separate evaluations (or a combination)

It assesses the effectiveness of controls over time and includes taking remedial action.

Inherent limitations

Human error + Collusion + Management override + Cost-benefit constraint + Judgement errors

Use these as headings, then give a short example under each.

Control activities listed in SA 315

Authorisation + Performance reviews + Information processing + Physical controls + Segregation of duties

Use these five as headings when you are asked for control techniques.

Segregation of duties

Authorise ≠ Record ≠ Keep custody of assets

Different people should hold these three responsibilities, so no one can both commit and conceal errors or fraud.

Control types by timing

Preventive (before) | Detective (after) | Corrective (fix and prevent recurrence)

Always say when the control acts and give one example from the case.

Information processing controls

Application controls + General IT controls

Application controls work on individual applications (edit checks, sequence checks, exception follow-up). General IT controls cover many applications (program change, access to programs and data).

Physical controls

Physical security + Authorised access to programs and data + Periodic counts compared with records

For example, cash, security and inventory counts compared with the accounting records.

Audit committee role, Companies Act 2013, Section 177(4)(vii)

Terms of reference include evaluation of internal financial controls and risk management systems

Applies to every listed public company and other prescribed classes. Minimum three directors, independent directors in majority (Section 177(2)).

Auditor's IFC reporting duty

Section 143(3)(i): report whether the company has adequate internal financial controls with reference to financial statements in place AND their operating effectiveness

Two tests: adequacy (design) and operating effectiveness (working in practice). Quote both.

Reasons for negative answers

Section 143(4): any matter answered in the negative or with a qualification must be reported with reasons

An adverse or qualified IFC conclusion needs stated reasons.

Auditor's right of access and information

Section 143(1): right of access at all times to books of account and vouchers, and to require information and explanations from officers

This is the basis for testing controls and getting evidence.

Auditing standards

Section 143(9): every auditor shall comply with the auditing standards

IFC audit is done under the standards and guidance applicable to the auditor.

Application to cost auditor

Section 143(14)(a): Section 143 applies mutatis mutandis to a cost accountant conducting cost audit under Section 148

Link to quote when asked how the IFC duty relates to cost audit.

Holding company auditor's access

Proviso to Section 143(1): holding company auditor has right of access to records of subsidiaries and associate companies as it relates to consolidation

Relevant when consolidated financial statements are audited.

Fraud reporting

Section 143(12): auditor with reason to believe an offence involving fraud is being or has been committed against the company by officers or employees must report as prescribed

Control weaknesses may lead to this. Below the specified amount, report to the audit committee or Board.

Who can be internal auditor (Section 138(1))

Chartered accountant OR cost accountant OR other professional decided by the Board

Applies to such class or classes of companies as are prescribed. The Act does not name the classes; the Rules do.

Manner and intervals (Section 138(2))

Central Government prescribes by rules how often internal audit is done and how it is reported to the Board

Reporting goes to the Board, not to the members.

Producer Company (Section 378ZF)

Internal audit of accounts by a chartered accountant, at the interval and in the manner specified in the articles

Here only a chartered accountant (as defined in the Chartered Accountants Act, 1949) qualifies.

Audit Committee link (Section 177(5))

Audit Committee may discuss related issues with internal and statutory auditors and management

Shows internal audit feeds the Audit Committee.

Engagement stages

Understand entity → Risk assessment → Audit plan and programme → Fieldwork and evidence → Reporting → Follow-up

Use this order as the skeleton for any process question.

Finding structure

Condition + Criteria + Cause + Effect + Recommendation + Management response

Each audit observation should cover all six elements.

Risk prioritisation

Risk = Likelihood × Impact

A guide for ranking areas. Rate both factors on the same scale, such as 1 to 5.

Appointment of internal auditor

Section 138: prescribed class of companies must appoint an internal auditor, who may be a chartered accountant, a cost accountant or another professional decided by the Board

The Board decides the scope, functioning and periodicity, with audit committee input where it exists. Class details come from the Rules.

Risk rating

Inherent risk score = Likelihood × Impact

A common scoring method, not a statutory formula. Use the same scale (for example 1 to 5) for both factors.

Residual risk

Residual risk = Inherent risk − Effect of controls

Conceptual, not arithmetic. Strong controls reduce residual risk. Audit priority follows residual risk and control reliance.

Section 138(1): who can be internal auditor

Chartered accountant, cost accountant, or other professional decided by the Board

Applies to such classes of companies as are prescribed. The auditor may be an employee or an outside professional only if the rules allow it.

Section 177(2): audit committee composition

Minimum 3 directors, independent directors in majority

Majority of members, including the Chairperson, must be able to read and understand financial statements.

Section 177(4): terms of reference (selected)

Review auditor independence and audit process; examine financial statements; approve related party transactions; scrutinise inter-corporate loans and investments; evaluate internal financial controls and risk management systems

These are selected items from the audit committee's terms of reference generally. Review of auditor independence and the audit process concerns the statutory auditor. The internal auditor mainly supports the scrutiny of inter-corporate loans and investments and the evaluation of internal financial controls and risk management systems.

Section 177(9)-(10): vigil mechanism

Listed companies and prescribed classes must have a vigil mechanism with safeguards against victimisation and direct access to the Audit Committee chairperson in appropriate or exceptional cases

A key fraud-detection channel.

Section 144(b): statutory auditor

Statutory auditor cannot provide internal audit services to the company, its holding or subsidiary

Protects independence of both functions.

Section 138(1): internal auditor

Prescribed class of companies → appoint internal auditor (CA, cost accountant or other professional decided by the Board)

The class of companies is set by rules. Do not state thresholds unless the question gives them.

Section 148(3): cost auditor

Cost accountant appointed by the Board; must comply with cost auditing standards

A person appointed as statutory auditor under section 139 cannot be appointed for the cost audit of the same company.

Section 148(4) and (5)

Cost audit is in addition to the section 143 audit; report goes to the Board

The company must give the cost auditor all assistance and facilities.

Section 177(4)(vii)

Audit committee terms of reference include evaluation of internal financial controls and risk management systems

This is the link between the audit committee and internal audit.

Section 177(2)

Audit committee: minimum three directors, independent directors in majority

The Chairperson and a majority of members must be able to read and understand financial statements.

Reliance principle (SA 610)

Reliance = evaluate objectivity + competence + systematic and disciplined approach; responsibility for opinion stays with external auditor

Use this as a memory frame. The standard's detailed paragraphs are not reproduced here.

Quick revision

• Internal control protects assets, supports reliable records, aids compliance and promotes efficient operations.
• Segregation of duties means no single person handles authorisation, custody and recording of the same transaction.
• Internal audit is an independent appraisal of controls and risk processes, usually for management and the Audit Committee.
• Section 177 requires every listed public company to constitute an Audit Committee.
• The Audit Committee has a minimum of three directors, with independent directors forming a majority.
• Its terms of reference include evaluation of internal financial controls and risk management systems.
• Auditors and key managerial personnel can be heard at Audit Committee meetings on the auditor's report but cannot vote.
• A vigil mechanism must safeguard against victimisation and allow direct access to the Audit Committee chairperson in appropriate or exceptional cases.
• A cost audit under section 148 is in addition to the audit under section 143.
• The statutory auditor appointed under section 139 cannot be appointed as cost auditor for the same company.
• The cost auditor reports to the Board of Directors and must follow the cost auditing standards.
• Risk-based internal audit directs effort to areas with higher risk of loss or misstatement.

Common mistakes

• Saying internal control gives absolute assurance or eliminates fraud. Fix: Always write 'reasonable assurance' and add one line on collusion and management override.
• Mixing control activities with the control environment. Fix: Environment is tone, ethics, structure and HR practice. Activities are specific procedures such as authorisation, reviews and segregation of duties.
• Treating internal check and internal control as the same thing. Fix: Say internal control is the whole system of policies and procedures. Internal check is one part, where work is divided so one person's work is checked by another.
• Calling a bank reconciliation a preventive control. Fix: A reconciliation finds differences after transactions are recorded, so it is detective. Approval before payment is preventive.
• Saying the auditor reports on all internal controls of the company. Fix: Write the exact scope: internal financial controls with reference to financial statements.
• Mentioning adequacy but forgetting operating effectiveness. Fix: Always write both tests together. Adequacy is design. Operating effectiveness is working in practice.
• Saying internal audit is compulsory for every company. Fix: Write that Section 138 applies to such classes of companies as are prescribed by the Rules.
• Saying only a chartered accountant can be internal auditor. Fix: Under Section 138 it can be a chartered accountant, cost accountant or other professional decided by the Board. Only Producer Companies need a chartered accountant.
• Treating internal audit as a smaller statutory audit. Fix: Say internal audit is for management, covers operations and controls, and its scope is set by the Board, not by the Companies Act audit report.
• Quoting SIA numbers and titles from memory with errors. Fix: Describe the requirement in plain words. Give a number only if you are certain it is correct.

Exam tips

• In Section A, watch for options that say 'absolute', 'eliminates' or 'guarantees'. These are usually wrong.
• For case MCQs, tag each fact to one of the five components before choosing an option.
• In written answers, define first, list components in the SA 315 order, then apply to the case and recommend.
• Learn the SA 315 examples: seven elements of the control environment and five examples of control activities.
• Link to the Companies Act: the audit committee evaluates internal financial controls and risk management systems under section 177(4)(vii).
• In MCQs, decide the timing first: before the event is preventive, after the event is detective, fixing and stopping recurrence is corrective.
• For case questions, structure the answer by cycle stage and give risk, control and type for each point.
• Always name who does what in segregation answers. Marks go to the application to the case.