Internal Audit and Performance Audit: formula sheet

Key formulas

Scope of internal audit (SA 610 (Revised), A1)

Governance + Risk management + Internal control (evaluation of controls, financial and operating information, operating activities, compliance)

Use this as a checklist when a question asks for the scope. Both assurance and consulting activities are included.

Ways the external auditor uses internal audit (A4)

(1) Risk assessment information; (2) Use of work in partial substitution for audit evidence; (3) Direct assistance

Uses (2) and (3) apply unless prohibited or restricted by law or regulation. The external auditor keeps full responsibility.

Objectives of the external auditor (para 13)

Decide if and how far to use the work or direct assistance; if work is used, check it is adequate; if direct assistance, direct, supervise and review it

These apply when the auditor expects to modify the nature or timing, or reduce the extent, of procedures, or to use direct assistance.

Statutory auditor and internal audit

A statutory auditor of an entity cannot be its internal auditor

Quoted in A14 from the ICAI Code of Ethics. Reason: independence and objectivity, and the self-review threat.

Section 138(1): who must appoint

Prescribed class of companies → must appoint an internal auditor to conduct internal audit of its functions and activities

The class is set by Rule 13 of the Companies (Accounts) Rules, 2014.

Rule 13: listed companies

Every listed company → internal audit applies

No size test. Listing alone is enough.

Rule 13: unlisted public company (any ONE test)

Paid-up share capital ≥ ₹50 crore, or turnover ≥ ₹200 crore, or loans/borrowings from banks or public financial institutions > ₹100 crore, or outstanding deposits ≥ ₹25 crore

Capital and turnover are tested for the preceding financial year. Borrowings and deposits are tested at any time during the preceding financial year. Meeting one test is enough.

Rule 13: private company (any ONE test)

Turnover ≥ ₹200 crore, or loans/borrowings from banks or public financial institutions > ₹100 crore

Paid-up capital and deposit tests do not apply to private companies.

Who can be internal auditor

Chartered accountant or cost accountant (in practice or not), or other professional decided by the Board

May or may not be an employee of the company.

Role of Board and Audit Committee

Board appoints; Audit Committee (or Board) in consultation with the internal auditor formulates scope, functioning, periodicity and methodology

Reports are made to the Audit Committee or the Board.

Four stages of an engagement

Planning → Execution → Reporting → Follow-up

Use this as the skeleton of every answer on the engagement process.

Plan versus programme

Audit plan = scope, timing, resources; Audit programme = detailed procedures to perform

The plan is the overall approach. The programme is the step-by-step work list.

SA 610 (Revised): limit on using internal audit work

Use less internal audit work when: more judgment is involved; assessed risk of material misstatement is higher; objectivity is weaker; competence is lower

The external auditor makes all significant judgments and should plan to use less of the function's work in these cases.

Significant judgments (SA 610, A19)

Risk assessment, sufficiency of tests, going concern, significant estimates, adequacy of disclosures

These stay with the external auditor.

Procedures to evaluate internal audit work (SA 610, A28)

Inquiry + Observation + Review of work programme and working papers (plus reperformance)

The external auditor uses these to judge the adequacy of internal audit work.

Risk rating (common approach)

Risk score = Likelihood × Impact

A common scoring method, not a statutory formula. Rate each on a set scale, such as 1 to 5, and rank risks by score.

Residual risk

Residual risk = Inherent risk − Effect of controls

Conceptual, not arithmetic in the strict sense. Inherent risk is the risk before controls. Residual risk is what remains after controls.

Internal check vs internal control

Internal check ⊂ Internal control

Internal check is one part of the wider internal control system.

Conditions to rely on internal audit work (SA 610)

Objectivity + Competence + Systematic and disciplined approach (including quality control)

The external auditor evaluates all three. If the function fails any one, the external auditor shall not use its work.

The 3 Es

Performance audit = Economy + Efficiency + Effectiveness

Economy is about cost of inputs, efficiency is about output per unit of input, effectiveness is about achieving objectives.

Efficiency measure

Efficiency = Output ÷ Input

Compare with a target or benchmark. A higher ratio, or a lower input per unit of output, means better efficiency.

Effectiveness measure

Effectiveness = Actual result ÷ Intended result

Shows how far the stated objective was achieved. It is a rule of thumb for answers, not a prescribed standard formula.

Scope of internal audit function (SA 610 Revised)

Review of operating activities = economy, efficiency and effectiveness, including non-financial activities

The standard lists this next to governance, risk management, internal control, financial information and compliance reviews.

The three Es

Economy = minimising cost of resources for the right quality; Efficiency = best output for given input; Effectiveness = extent to which objectives are achieved

Some frameworks add a fourth E, equity or ethics. Say so only if the question asks for it.

Audit cycle

Select topic → Plan → Set objectives, questions and criteria → Gather evidence → Findings → Draft report and auditee comments → Final report → Follow-up

Use this as the skeleton of any process question.

Efficiency measure

Efficiency = Output ÷ Input (compare with a benchmark or past performance)

A ratio only means something against a criterion, such as a standard cost or target.

Finding structure

Finding = Criteria + Condition + Cause + Effect (+ Recommendation)

Each finding in the report should show what should have been, what was, why, and the impact.

Judgment and reliance (SA 610, para 18)

More judgment, higher assessed risk, weaker objectivity or lower competence → use less of the internal audit work and do more directly

Applies when an external auditor relies on internal audit. Significant judgments stay with the external auditor.

Quick revision

• Internal audit work typically covers governance, risk management and internal control, through assurance and consulting activities.
• Internal audit can include review of compliance with laws, regulations and management policies.
• Internal audit can also review the economy, efficiency and effectiveness of operating activities, including non-financial ones.
• Section 138 of the Companies Act, 2013 requires internal audit for prescribed classes of companies. Check the class thresholds before the exam.
• SA 610 (Revised): the external auditor evaluates objectivity, competence and a systematic and disciplined approach, including quality control.
• If objectivity, competence or a systematic and disciplined approach is lacking, the external auditor shall not use the function's work.
• The external auditor makes all significant judgments and plans to use less internal audit work as judgment and assessed risk rise.
• Example of limits: checking the accuracy of receivables ageing can be assigned, but judging the adequacy of the provision cannot.
• The external auditor tells those charged with governance how the work of the internal audit function will be used, as part of the audit scope and timing overview.
• Discussion with the internal audit function covers timing, nature, extent of coverage, materiality, sample sizes, documentation and reporting.
• Performance audit tests economy, efficiency and effectiveness, not only accuracy of accounts.
• A performance audit report should give findings, evidence-based conclusions and practical recommendations.

Common mistakes

• Saying internal audit gives an opinion on the true and fair view of the financial statements. Fix: State that internal audit serves management and those charged with governance and focuses on controls, risk and operations.
• Giving a fixed scope as if it applies to every entity. Fix: Say that objectives and scope vary with the entity's size, structure and management needs.
• Applying the paid-up capital and deposit tests to a private company. Fix: Keep two lists. Unlisted public: capital, turnover, borrowings, deposits. Private: turnover and borrowings only.
• Requiring all the tests to be met together. Fix: The tests are alternatives. Meeting any one makes the company covered.
• Treating the audit plan and audit programme as the same document Fix: Say the plan sets scope, timing and resources, while the programme lists detailed procedures.
• Ending the engagement at the report Fix: Always add follow-up: tracking management's action on recommendations and reporting the status.
• Treating internal check and internal control as the same thing. Fix: Say that internal check is a routine arrangement within accounting where work is cross-checked, and that it is only a part of the wider internal control system.
• Saying internal audit is the same as internal control. Fix: Internal control is operated by management. Internal audit is an independent function that evaluates it and recommends improvements.
• Treating performance audit as another form of financial audit. Fix: State the focus clearly. Financial audit gives an opinion on financial statements. Performance audit judges how well resources are used and results achieved.
• Mixing up economy and efficiency. Fix: Economy is the cost of inputs. Efficiency is the relation between input and output. Use the phrase 'lowest reasonable cost' for economy and 'output per unit of input' for efficiency.

Exam tips

• Always mention both assurance and consulting in your definition.
• For comparison questions, use fixed heads and one line per head to score quickly.
• Add the line that scope varies with size, structure and management needs; it shows you read the standard.
• In case questions, state the rule, apply the facts, then conclude. Do not stop at theory.
• Where the external auditor is involved, say it keeps sole responsibility for the audit opinion.
• Write the company type first. Marks in applicability questions depend on using the correct list of tests.
• Show each test with the company's figure beside the limit, then a one-line conclusion. Examiners reward this structure.
• Watch the wording: 'exceeding ₹100 crore' for borrowings against 'or more' for the other limits. Check the figures given for traps near the limit.