Advanced Auditing, Assurance and Professional Ethics · Internal Audit

Scope, Objectives and Nature of Internal Audit (CA Final Audit)

Updated 5 October 2026 · Fact-checked

Internal audit is an independent, objective assurance and consulting activity, set up by management, to evaluate and improve risk management, control and governance. To solve questions, state the meaning, link the objective or scope to the facts, then contrast it with statutory audit on appointment, purpose, reporting and independence.

Understand Scope, Objectives and Nature of Internal Audit

Internal audit is a review of an entity's operations, systems and records carried out for the entity itself. It is usually done by an internal team or an outside professional appointed by management or those charged with governance. It is not a statutory requirement for every entity. Where the law requires it, for example under section 138 of the Companies Act, 2013 for prescribed classes of companies, the entity must have it.

Think of it as the entity's own check on whether its house is in order. It looks at whether controls work, whether risks are managed, whether laws and policies are followed, and whether resources are used well. The scope is decided by management or the audit committee, so it can be as wide as the entity wants.

The objectives go beyond finding errors. They include assessing the adequacy and effectiveness of internal controls, checking compliance with laws, policies and procedures, safeguarding assets, judging the reliability of information used for decisions, spotting fraud risk, and suggesting improvements in efficiency and economy.

The nature of internal audit is that it is a function within management's control framework, continuous or periodic, and forward looking. It advises, it does not take management decisions. To protect objectivity, the internal auditor reports to the audit committee or top management and must not take operating responsibility for what is audited.

The contrast with other audits is a favourite exam point. Statutory audit is required by law, is done by an independent auditor appointed by members, and gives an opinion on financial statements for the owners and other stakeholders. Management audit evaluates the quality of management itself, its policies, structure and decisions, to improve overall performance. Internal audit sits in between: it serves management, covers financial and non-financial areas, and its report goes to management, not to shareholders as an opinion.

Key rules to remember

Meaning in one line: Internal audit = independent, objective assurance and consulting activity designed to add value and improve operations; Use this as the opening sentence of any definition answer.
Core objectives: Controls + Compliance + Risk + Safeguarding of assets + Reliability of information + Efficiency; Pick the ones that match the case facts rather than listing everything.
Who decides scope: Scope of internal audit is set by management or those charged with governance, not by statute alone; Contrast with statutory audit, where scope is set by law and Standards on Auditing.
Statutory auditor and internal audit: Statutory auditor may use internal auditor's work but keeps sole responsibility for the audit opinion; Link to SA 610 (Revised) and SA 315.
Independence rule: Internal auditor reports to the audit committee or top management and has no operational duty over the area audited; Objectivity is the key safeguard.

How to solve Scope, Objectives and Nature of Internal Audit questions

Use this method for definition, scope, objective and difference questions, and for short case scenarios on internal audit.

1Read the question and mark what is asked: meaning, objectives, scope, functions or a comparison.
2Open with a one-line definition of internal audit, stressing independence and that it is an activity for management.
3Pick the objectives or functions that match the facts in the case, such as control weakness, compliance gap or fraud risk.
4State the scope in terms of what the entity wants reviewed: financial, operational, compliance, risk and governance areas.
5If a comparison is asked, use clear heads: appointment, purpose, scope, reporting, independence, and responsibility.
6Apply to the facts: say what the internal auditor should do and what the statutory auditor can or cannot rely on.
7Close with a one-line conclusion tied to the question.

Quickest way: Head-wise comparison grid

When to use it: When the question says distinguish, differentiate or compare, or when time is short.

Write 4 to 6 heads in the margin: basis of appointment, objective, scope, reporting, independence, legal requirement.
Fill one short line for each audit side by side in the same order.
Add a one-line closing point that internal audit may support the statutory auditor but never replaces the statutory audit.
For case MCQs, eliminate options that give internal audit a statutory opinion role or give the internal auditor management decisions.

Common mistakes in Scope, Objectives and Nature of Internal Audit

Saying internal audit is compulsory for every company.
Students mix the general idea with section 138 of the Companies Act, 2013.
Fix: Say it is compulsory only for prescribed classes of companies, and optional otherwise.
Writing that the internal auditor gives an opinion on the true and fair view of financial statements.
Students blur internal and statutory audit.
Fix: The true and fair opinion belongs to the statutory auditor. Internal audit reports findings and recommendations to management.
Treating internal audit as only a check of accounting errors.
Old textbook view of audit as vouching.
Fix: Include operational, compliance, risk, governance and efficiency review in scope.
Saying the statutory auditor can fully rely on internal audit and reduce responsibility.
Confusion about using the work of internal auditors.
Fix: The statutory auditor may use the work but remains solely responsible for the opinion.
Confusing internal audit with management audit.
Both serve management and look beyond accounts.
Fix: Management audit evaluates management's own effectiveness and decisions. Internal audit tests controls, compliance and operations, and works under management.
Giving a long list of points without linking to the case.
Memorised answers are written as is.
Fix: Choose only the points that fit the facts and state a conclusion.

Worked examples

Example 1

Case: Sundar Textiles Ltd has a growing network of plants. The board finds repeated delays in purchase approvals and some stock shortages. The audit committee asks the internal auditor to review the process. A director says, 'This is the job of the statutory auditor.' Advise whether the director is right and state the objectives the internal auditor will pursue.

Show the solution

Meaning: internal audit is an independent activity serving management to evaluate controls, risk and governance.
Director's view: statutory audit is aimed at forming an opinion on financial statements for members. It does not cover reviewing approval efficiency or operational delays in detail.
Objectives here: assess the adequacy of purchase controls, check compliance with approval policy, test safeguarding of stock, and recommend process improvements.
Scope: the internal auditor can review operations as well as records, since scope is fixed by the audit committee.
Relationship: the statutory auditor may consider the findings for risk assessment but holds sole responsibility for the audit opinion.

Answer: The director is not right. The review of purchase controls, delays and stock shortages falls within internal audit. Its objectives are to evaluate controls, check compliance, safeguard stock and improve efficiency. The statutory auditor has a different purpose, which is an opinion on the financial statements.

Example 2

Case: Meera & Co, chartered accountants, are statutory auditors of Zenith Foods Ltd. Zenith's CFO says internal audit and statutory audit are the same, so the internal audit team should sign the audit report instead. Distinguish the two to respond.

Show the solution

Appointment: statutory auditor is appointed by members as required by law. Internal auditor is appointed by management or the board and may be an employee or an outside professional.
Objective: statutory audit expresses an opinion on whether the financial statements give a true and fair view. Internal audit evaluates controls, risk management, compliance and efficiency and suggests improvements.
Scope: statutory audit scope is set by law and the Standards on Auditing. Internal audit scope is set by management or the audit committee.
Reporting: statutory auditor reports to members. Internal auditor reports to management or the audit committee.
Independence: statutory auditor is independent of the entity and its management. Internal auditor is independent of the activities reviewed but remains part of or engaged by the entity.
Conclusion: the internal auditor cannot sign the statutory audit report. The statutory auditor may use internal audit work under SA 610 (Revised) but stays solely responsible.

Answer: The two are different. Statutory audit is a legal requirement giving an opinion to members. Internal audit is a management tool with a wider, flexible scope. The internal audit team cannot sign the statutory audit report.

Exam tips

Always start definition answers with independence and with the fact that internal audit serves management or those charged with governance.
For difference questions, use a two-column grid with at least five heads, and include internal vs management audit if the question mentions it.
In case MCQs, reject options where the internal auditor takes management decisions or issues the statutory opinion.
Mention section 138 of the Companies Act, 2013 only for the point that it applies to prescribed classes of companies.
Link to SA 610 (Revised) in one line when the question touches reliance by the statutory auditor.

Practice questions from Internal Audit

Scope, Objectives and Nature of Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Scope, Objectives and Nature of Internal Audit: frequently asked questions

What is the main difference between internal audit and statutory audit?

Statutory audit is required by law and gives an independent opinion on financial statements to members. Internal audit is carried out for management, with a scope set by management or the audit committee. It focuses on controls, risk, compliance and efficiency.

Is internal audit the same as management audit?

No. Management audit reviews how well management itself performs, including policies, structure and decisions. Internal audit tests controls, compliance and operations within the framework management has set.

Who can be an internal auditor?

It can be an employee, a team within the entity or an outside professional such as a chartered accountant firm. For companies covered by section 138 of the Companies Act, 2013, the internal auditor may be a chartered accountant or a cost accountant (whether engaged in practice or not), or such other professional as the Board decides. Under section 138, the internal auditor may also be an employee of the company.

Can the statutory auditor rely on internal audit work?

Yes, the statutory auditor may use the work of internal auditors after evaluating it, as dealt with in SA 610 (Revised). The statutory auditor still holds sole responsibility for the audit opinion and cannot refer to the internal auditor's work to reduce that responsibility.