Special Points relating to Internal Audit in various Entities: formula sheet

Key formulas

Risk-based audit logic

Audit priority = Inherent risk × Control weakness

This is a way to remember the idea, not a prescribed formula. Higher risk with weaker controls means more frequent and deeper audit.

NPA classification (general rule)

Loan is NPA when interest or principal stays overdue for more than 90 days

This is the general RBI rule for term loans. Special norms apply to some facilities, such as agricultural advances and out-of-order cash credit or overdraft accounts. Check the current RBI norms when answering.

Asset categories

Standard → Sub-standard → Doubtful → Loss

Asset classification moves down based on how long the asset stays non-performing and on its recoverability. Provisioning rates rise with each category.

Three lines of defence

Business unit (1st) → Risk and compliance (2nd) → Internal audit (3rd)

Internal audit is the independent third line and must not take business decisions.

Net premium retained

Net premium = Gross premium − Premium ceded to reinsurers

Use it to check that cessions under reinsurance treaties are correctly booked.

Claims ratio (incurred)

Incurred claims ratio = Net claims incurred ÷ Net earned premium × 100

A sudden change is an analytical red flag that points to reserving or claims-processing problems.

Reporting line

Internal audit → Audit Committee of the Board

Independence from operations is the key principle. Administrative line to the CEO is acceptable; functional line is to the Audit Committee.

Audit cycle for any area

Risk → Control → Test → Evidence → Finding → Recommendation

Use this chain to structure every written answer.

Audit flow for any NBFC question

Risk → Control → Test → Finding → Recommendation → Report to Audit Committee

Use this chain to structure every written answer.

Credit cycle to audit

Sourcing → KYC → Appraisal → Sanction → Documentation → Disbursement → Monitoring → Recovery

Each stage has its own control points and tests.

Gross NPA ratio

Gross NPA ratio = Gross NPAs ÷ Gross advances × 100

Useful to show asset quality trend to the Audit Committee.

Provision coverage

Provision coverage ratio = Provisions held ÷ Gross NPAs × 100

Shows how much of the bad loans is covered by provisions. Required provision rates come from RBI norms; do not guess them.

Independence rule

Internal audit reports to Audit Committee or board, not to the business head

Independence is the first thing an examiner looks for.

Audit cycle for any area

Understand process → Identify risk → Evaluate control → Test → Report

Use this structure for every area of a manufacturing or trading entity.

Purchase document trail

Requisition → Purchase order → Goods received note → Supplier invoice → Payment

Invoice should match order and GRN (three-way match) before payment is released.

Sales document trail

Customer order → Dispatch note → Invoice → Receipt

Every dispatch should be invoiced, and every invoice should have proof of dispatch.

Stock movement

Opening stock + Purchases (or production) − Issues or sales = Closing stock

Use it to reconcile book stock with physical stock and to explain differences.

Inventory turnover

Cost of goods sold ÷ Average inventory

A low ratio can signal slow-moving or obsolete stock. Compare with past periods and the industry.

Revenue leakage check

Services delivered (records) = Services billed = Revenue booked

Reconcile the operational record to the invoice and then to the ledger. A gap shows unbilled or unrecorded revenue.

Occupancy or utilisation ratio

Utilisation % = (Capacity used ÷ Capacity available) × 100

Use rooms sold, beds occupied, billable hours or seats filled. Compare with revenue to spot leakage.

Average revenue per unit

Average rate = Room (or bed) revenue ÷ Units sold

A fall below the approved tariff suggests unauthorised discounts.

Billable utilisation (IT)

Billable utilisation % = (Billable hours ÷ Available hours) × 100

Low utilisation signals idle resources or unbilled work.

Core audit focus

Authority + Compliance + Purpose + Value for money

Use as a checklist for any government or non-profit audit question.

The 3 Es

Economy, Efficiency, Effectiveness

Economy is low cost for given quality. Efficiency is output per unit of input. Effectiveness is achieving the intended objective.

Propriety test for expenditure

Budget provision + Competent sanction + Rule compliance + Proper record

If any one is missing, the expenditure is irregular even if the work was done.

NGO fund application test

Fund used only for objects in governing document and within donor restrictions

Check restricted and unrestricted funds separately.

Source of scope

Scope = Partnership deed / LLP agreement + owner's risk concerns + applicable laws

Always start with the governing document. It decides authority limits, capital and profit sharing.

Applicability of Section 138

Section 138 applies to specified classes of companies, not to partnership firms or LLPs as such

For firms and LLPs, internal audit is by choice, agreement or lender or client requirement.

Proportionality rule

Audit effort ∝ risk and size of the entity

Small entities need focused, low-cost checks on key risk areas, not a large programme.

Compensating control

Weak segregation of duties → owner review + independent reconciliation + surprise checks

Use this to recommend practical fixes where staff is limited.

Partner account check

Closing balance = Opening + Capital introduced + Interest and remuneration due + Share of profit − Drawings − Share of loss

Test partner current accounts against the deed. Adjust for any other items the deed allows.

Quick revision

• Internal audit method is the same everywhere; risks, regulator and records change with the entity.
• Banks: focus on credit appraisal, asset classification, provisioning, treasury, KYC and IT controls.
• NBFCs: focus on lending practices, asset classification, funding sources, capital and compliance with regulator directions.
• Insurers: focus on premium collection, underwriting, claims, reserves, investments and intermediaries.
• Manufacturing: follow purchases, stores, production, costing, inventory counts and sales.
• Trading: stress stock control, pricing, supplier and customer credit, and returns.
• Services: revenue depends on contracts, time records, billing and people costs, not inventory.
• Government and non-profit: check use of funds against purpose, grant conditions, procurement and value for money.
• Small entities and firms: expect weak segregation of duties, so test owner-related transactions and cash closely.
• Partnerships and LLPs: read the deed or agreement first; it sets profit sharing, capital and authority.
• Always end an answer with a finding, its risk and a recommendation.

Common mistakes

• Treating bank internal audit like a company's internal audit, with equal coverage everywhere. Fix: Stress the risk-based approach: assess risk first, then decide frequency and depth of audit.
• Confusing concurrent audit with statutory audit. Fix: Concurrent audit is a management control tool done close to the transaction. Statutory audit gives an opinion on the annual financial statements.
• Treating internal audit as the statutory audit of the insurer's accounts. Fix: Say that internal audit is a continuous, risk-based review for management and the Audit Committee, covering controls and compliance, not an opinion on financial statements.
• Discussing only premium and claims and leaving out reinsurance and investments. Fix: Cover all four named areas whenever the question asks for scope, even if briefly.
• Treating NBFC internal audit as identical to bank audit. Fix: State the difference: an NBFC has no deposit and clearing operations as a bank does, so the focus is credit, funding, asset quality and returns.
• Writing only generic internal audit theory. Fix: Tie every point to NBFC facts such as loan files, overdue ageing, KYC and RBI returns.
• Writing statutory audit procedures such as verifying true and fair view Fix: Focus on operations, controls, efficiency and recommendations to management.
• Covering only inventory and ignoring production, costing and sales Fix: Walk through the whole cycle and give each area at least a few points.
• Applying manufacturing-style stock verification as the main focus. Fix: Lead with revenue completeness and people cost. Treat stores, such as pharmacy or kitchen stock, as a secondary area.
• Writing generic points without sector detail. Fix: Use sector terms: patient billing, room tariff, fee concessions, timesheets, usage records.

Exam tips

• Open every answer with the bank context: public money, high risk, Audit Committee reporting.
• For scope questions, use short bullets by area: advances, treasury, KYC, NPAs, deposits, IT.
• For case questions, follow provision, analysis, conclusion, and add one drafting or compliance point.
• Say that risk drives frequency and depth under RBIA. Examiners look for this idea.
• Check the latest RBI norms before relying on any rule or limit, and use cautious wording where norms vary.
• Structure answers by the four areas: premium, claims, reinsurance, investments, and add IT and compliance if marks allow.
• Always mention independence and reporting to the Audit Committee.
• In case questions, name the exact control that failed, such as delegation limits or reconciliation, before giving recommendations.