Skip to content

CMA Final · Cost and Management Audit

Internal Control and Internal Audit for CMA Final Paper 17

Internal control is the set of policies and procedures management uses to protect assets, keep records reliable and ensure compliance. Internal audit is an independent check on whether those controls and risk processes work. To solve questions, identify the objective, find the control gap, name the risk, and recommend a practical fix.

What this chapter covers

This chapter covers two linked ideas. Internal control is the system a company builds to run safely and accurately. Internal audit is the function that tests that system and reports to management and the Audit Committee. You study concepts and components first, then techniques, then the legal frame under the Companies Act, 2013, then the internal audit function itself.

The chapter connects directly to the rest of Paper 17. Cost audit under section 148 relies on sound cost records, and those records are only as good as the controls behind them. A cost auditor reads the internal control and internal audit environment to decide how much to test. Management audit also draws on the same ideas, because it judges how well management uses controls and resources.

Expect both Section A MCQs and written answers. MCQs test definitions, objectives, legal provisions and who does what. Written questions give you a case, such as weak purchase approval or a stores mismatch, and ask you to identify weaknesses and recommend controls or an audit approach.

This chapter gives you steady marks because its ideas are used across the paper. Concepts and legal provisions suit quick MCQs, while case-style questions reward a structured answer of risk, control gap and recommendation. The same vocabulary helps you in cost audit and management audit answers, so the effort pays back more than once. It is also a chapter where clear thinking beats heavy memorisation.

Internal Control and Internal Audit: topics in the order to study them

  1. 1Internal Control: Concepts, Objectives and ComponentsStart here because every later topic uses these definitions and the idea of control objectives.
  2. 2Internal Control Systems and TechniquesOnce you know the objectives, learn the practical controls such as segregation of duties, authorisation and reconciliations.
  3. 3Internal Financial Controls under Companies Act 2013This adds the legal layer, including the Audit Committee's role in section 177 and its duty to evaluate internal financial controls and risk management systems.
  4. 4Internal Audit: Meaning, Scope and ObjectivesNow move from the control system to the function that tests it, and learn how it differs from statutory audit.
  5. 5Internal Audit Standards and Engagement ProcessWith scope clear, learn how an engagement runs from planning to reporting and follow-up.
  6. 6Risk-Based Internal Audit and Role of Internal AuditorThis builds on the process by showing how audit effort is directed to higher-risk areas.
  7. 7Internal Audit versus Management and Cost Audit LinkagesFinish with comparisons and links, which tie the chapter to the rest of the paper and suit revision.

How to prepare Internal Control and Internal Audit

Treat this as a concept-and-application chapter. Build the vocabulary first, then practise applying it to small cases.

  1. Read the concepts and write the control objectives in your own words: safeguarding assets, reliable records, compliance and operational efficiency.
  2. For each technique, note the risk it addresses. For example, segregation of duties reduces the chance of fraud going unnoticed.
  3. Read section 177 and section 148 from the Act text. Note the Audit Committee's minimum size, the independent director majority and the list of items in its terms of reference.
  4. Make a comparison table on paper for internal audit versus statutory audit versus cost audit, covering who appoints, to whom they report and the purpose.
  5. Practise three or four short case scenarios. For each, write the weakness, the risk, the recommended control and who should review it.
  6. Answer MCQs by topic and review each wrong option to see why it fails.
  7. Revise using a one-page summary of definitions, legal points and comparisons.

Common mistakes in Internal Control and Internal Audit

  • Treating internal control and internal audit as the same thing

    Fix: Remember that management designs and runs internal control, while internal audit independently tests it and reports on it.

  • Listing controls without naming the risk they address

    Fix: In every answer, pair each control with the specific risk or weakness it fixes.

  • Mixing up the cost auditor and the statutory auditor

    Fix: Recall that the section 139 auditor cannot do the cost audit, that cost audit is additional to section 143 audit, and that the cost auditor must be a cost accountant.

  • Misstating Audit Committee composition

    Fix: State both parts: at least three directors, with independent directors forming a majority.

  • Giving generic recommendations in case answers

    Fix: Give a specific fix tied to the facts, such as independent approval of purchase orders or periodic stock reconciliation, and say who should monitor it.

Last-day revision: Internal Control and Internal Audit

  • Internal control protects assets, supports reliable records, aids compliance and promotes efficient operations.
  • Segregation of duties means no single person handles authorisation, custody and recording of the same transaction.
  • Internal audit is an independent appraisal of controls and risk processes, usually for management and the Audit Committee.
  • Section 177 requires every listed public company to constitute an Audit Committee.
  • The Audit Committee has a minimum of three directors, with independent directors forming a majority.
  • Its terms of reference include evaluation of internal financial controls and risk management systems.
  • Auditors and key managerial personnel can be heard at Audit Committee meetings on the auditor's report but cannot vote.
  • A vigil mechanism must safeguard against victimisation and allow direct access to the Audit Committee chairperson in appropriate or exceptional cases.
  • A cost audit under section 148 is in addition to the audit under section 143.
  • The statutory auditor appointed under section 139 cannot be appointed as cost auditor for the same company.
  • The cost auditor reports to the Board of Directors and must follow the cost auditing standards.
  • Risk-based internal audit directs effort to areas with higher risk of loss or misstatement.

Internal Control and Internal Audit practice questions

Internal Control and Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control and Internal Audit: frequently asked questions

Is this chapter more important for MCQs or written answers?

It matters for both. MCQs test definitions, legal provisions and who does what. Written answers usually apply the ideas to a case, so practise both styles.

Do I need to remember section numbers?

Know the key ones well, such as section 177 for the Audit Committee and section 148 for cost audit. Focus on what each section requires in plain words, since that is what answers need.

How does this chapter help with cost audit questions?

A cost auditor judges the reliability of cost records by looking at the control environment. Knowing control objectives and internal audit work helps you explain how the audit is planned and what reliance can be placed on the system.

How should I practise case-based questions?

Read the case, identify the weakness, state the risk, recommend a control and name who should review it. Keep each answer short and structured so you do not lose marks on clarity.