Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics

Internal Audit for CA Final Advanced Auditing

Internal audit is an independent review of an entity's risk management, controls and governance, done by an internal auditor whose scope is set by the Audit Committee or the Board. To solve questions, identify who must appoint one, what the scope is, how the engagement is planned and reported, and how it links with the statutory auditor. Answer in provision, facts, conclusion form.

What this chapter covers

This chapter covers how internal audit works as a function inside an entity. It starts with the legal requirement under the Companies Act, 2013, then moves to scope, objectives and nature, the Internal Audit Standards issued by ICAI, planning of an engagement, reporting and follow-up. It ends with co-ordination with the statutory auditor and the special provision for producer companies.

The chapter is short and mostly conceptual. You will not do heavy computation. Marks come from stating the right requirement, applying it to the facts of a case, and writing a clear conclusion.

It connects to other parts of Paper 3. Internal control, risk assessment and reliance on the work of others (for example, using the work of an internal auditor under the Standards on Auditing) all draw on this chapter. It also supports Paper 6, where case studies often involve an entity's governance and control environment.

Internal Audit is a compact chapter with a clear syllabus, so you can prepare it well in little time. Questions are usually direct: who must have an internal auditor, what the internal auditor can be asked to cover, how a report should be structured, and how the statutory auditor uses that work. These suit both case-scenario MCQs and short written answers. Because the content links to reliance on others' work and control evaluation, understanding it also helps you answer questions elsewhere in the paper.

Internal Audit: topics in the order to study them

  1. 1Internal Audit under Section 138 of Companies ActStart with the legal base: which companies need an internal auditor, who can be appointed, and how the scope is set by the Audit Committee (or the Board where there is no Audit Committee).
  2. 2Scope, Objectives and Nature of Internal AuditOnce you know the requirement, learn what internal audit actually covers and why it exists.
  3. 3Internal Audit Standards and Engagement PlanningStandards and planning turn the scope into a working method, so they follow the concept of scope.
  4. 4Internal Audit Reporting and Follow-upReporting is the output of the engagement, so study it after planning and execution.
  5. 5Internal Audit Co-ordination with Statutory AuditorThis ties the internal audit work to the external audit and builds on what you already know about reliance.
  6. 6Internal Audit Provisions for Producer CompaniesStudy this special case last, as you compare it with the general rule in Section 138. Learn it as it is given in the ICAI study material, and quote a section number only if the material gives one.

How to prepare Internal Audit

Aim for a clear picture of the function first, then fix the provisions and lists that examiners test. Keep your notes short and revise them often.

  1. Read the Section 138 provisions and note the classes of companies covered, who may be appointed, and who sets the scope and reports. Write these as a one-page summary.
  2. Study scope, objectives and nature, and group the content into a few headings you can reproduce quickly in an answer.
  3. Read the Internal Audit Standards and the planning process, and learn the sequence of steps in an engagement so you can apply it to a scenario.
  4. Practise drafting an internal audit report outline and a follow-up process: observation, risk, recommendation, management response, tracking.
  5. Compare internal audit with statutory audit on appointment, objective, reporting and independence, and note how the statutory auditor may use internal audit work.
  6. Study the producer company provision and list how it differs from Section 138.
  7. Solve past exam and ICAI practice questions, and write each answer in provision, facts, conclusion form.

Common mistakes in Internal Audit

  • Confusing the objectives of internal audit with those of statutory audit.

    Fix: Keep a two-column comparison of appointment, objective, reporting line and independence, and revise it before every test.

  • Stating Section 138 applicability loosely, without the class of company.

    Fix: Learn the classes of companies from the Act and rules, and check the facts in the case against each one before concluding.

  • Writing generic answers on the internal audit report.

    Fix: Structure the answer around observation, risk, recommendation, management response and follow-up, and relate each to the facts.

  • Saying the statutory auditor can rely fully on internal audit work.

    Fix: State that the statutory auditor evaluates the work, may use it, and keeps full responsibility for the opinion.

  • Skipping the producer company provision as minor.

    Fix: Study it with a comparison against Section 138 so you can answer a direct or case-based question in a few lines.

  • Answering in theory without applying to the case scenario.

    Fix: State the provision, pick the relevant facts from the case, and end with a one-line conclusion.

Last-day revision: Internal Audit

  • Section 138 requires certain prescribed classes of companies to appoint an internal auditor.
  • The internal auditor can be a chartered accountant or a cost accountant (whether engaged in practice or not), or any other professional the Board decides, and may be an employee of the company (Rule 13 of the Companies (Accounts) Rules, 2014). The statutory auditor of the company cannot provide internal audit services to it (Section 144 of the Companies Act, 2013).
  • The Audit Committee (or the Board where there is no Audit Committee) formulates the scope, functioning, periodicity and methodology of the internal audit in consultation with the internal auditor.
  • Internal audit is an independent function whose scope is set by the Audit Committee or the Board, and whose reports go to those bodies. Statutory audit is carried out for the members.
  • Internal audit covers risk management, controls and governance, not only financial records.
  • Planning comes before fieldwork: understand the entity, assess risk, set objectives and scope, prepare the programme.
  • A good internal audit report states observation, risk, recommendation and management response.
  • Follow-up checks whether agreed actions were actually carried out.
  • The statutory auditor remains solely responsible for the audit opinion even when using internal audit work.
  • Reliance on internal audit depends on its objectivity, competence and a systematic, disciplined approach.
  • Producer companies have their own special provisions, so do not apply Section 138 conditions to them by default.
  • Always apply the rule to the facts and end with a clear conclusion.

Internal Audit practice questions

Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit: frequently asked questions

Is Internal Audit a scoring chapter in CA Final Audit?

It is a short and fairly predictable chapter, so it is good value for the time spent. Questions are mostly direct or based on a simple case. Prepare it well and revise it close to the exam.

Do I need to memorise section numbers for this chapter?

Know Section 138 and what it requires, along with Rule 13 of the Companies (Accounts) Rules, 2014 and Section 144 on the statutory auditor. For producer companies, learn the provision as it appears in the ICAI study material. Focus more on the conditions and application than on numbering.

How do I write an internal audit answer in the exam?

Use provision, facts, conclusion form. State the requirement or standard, link it to the facts in the question, and give a clear conclusion. Keep points short and numbered.

How is this chapter linked to the statutory audit?

The statutory auditor may consider internal audit work when assessing risk and controls. Even then, the statutory auditor alone is responsible for the audit opinion. Learn this link well, as it is a common area of questions.