Cost and Management Audit · Internal Control and Internal Audit

Risk-Based Internal Audit and Role of Internal Auditor

Updated 11 October 2026 · Fact-checked

Risk-based internal audit directs audit effort to the areas where risk to the company's objectives is highest. You identify risks, rate them, plan and sequence audits by rating, test controls, and report to the audit committee. The internal auditor stays independent and supports governance, but does not own controls.

Understand Risk-Based Internal Audit and Role of Internal Auditor

Internal audit checks whether a company's controls, risk management and governance processes work. A company has limited audit time. It cannot test everything every year. So you must decide where to look first.

Risk-based internal audit (RBIA) answers this. You start from the company's objectives, not from a fixed checklist. You list the risks that could stop those objectives, rate each by likelihood and impact, and then plan audits so that high-risk areas get more frequent and deeper coverage. Low-risk areas get lighter or less frequent checks.

The usual cycle is: understand the business, identify and rate risks, build a risk-based audit plan (often annual, with a longer-term view), carry out the audit by testing the controls that mitigate each key risk, report findings, and follow up on action taken. The plan is updated when risks change, for example a new plant, a new ERP, or a fraud incident.

The internal auditor's role in governance has three strands. First, assurance: independent opinion on controls and risk management. Second, advice: suggesting improvements without taking over management decisions. Third, fraud: the auditor assesses fraud risk, tests controls that prevent and detect it, and reports red flags. Management, not the internal auditor, is responsible for preventing fraud.

Independence is what makes the work credible. The internal auditor should report functionally to the audit committee (or the Board) and administratively to a senior executive. The auditor should not be given operating duties, such as running the accounts or approving payments, in the areas audited.

The law links these ideas. Under Section 177 of the Companies Act, 2013, the audit committee's terms of reference include evaluation of internal financial controls and risk management systems. Section 138 requires prescribed classes of companies to appoint an internal auditor, who may be a chartered accountant, a cost accountant or another professional decided by the Board.

Key rules to remember

Risk rating: Inherent risk score = Likelihood × Impact; A common scoring method, not a statutory formula. Use the same scale (for example 1 to 5) for both factors.
Residual risk: Residual risk = Inherent risk − Effect of controls; Conceptual, not arithmetic. Strong controls reduce residual risk. Audit priority follows residual risk and control reliance.
Section 138(1): who can be internal auditor: Chartered accountant, cost accountant, or other professional decided by the Board; Applies to such classes of companies as are prescribed. The auditor may be an employee or an outside professional only if the rules allow it.
Section 177(2): audit committee composition: Minimum 3 directors, independent directors in majority; Majority of members, including the Chairperson, must be able to read and understand financial statements.
Section 177(4): terms of reference (selected): Review auditor independence and audit process; examine financial statements; approve related party transactions; scrutinise inter-corporate loans and investments; evaluate internal financial controls and risk management systems; These are selected items from the audit committee's terms of reference generally. Review of auditor independence and the audit process concerns the statutory auditor. The internal auditor mainly supports the scrutiny of inter-corporate loans and investments and the evaluation of internal financial controls and risk management systems.
Section 177(9)-(10): vigil mechanism: Listed companies and prescribed classes must have a vigil mechanism with safeguards against victimisation and direct access to the Audit Committee chairperson in appropriate or exceptional cases; A key fraud-detection channel.
Section 144(b): statutory auditor: Statutory auditor cannot provide internal audit services to the company, its holding or subsidiary; Protects independence of both functions.

How to solve Risk-Based Internal Audit and Role of Internal Auditor questions

Use this order for any question on risk-based internal audit, the auditor's role or the audit committee link.

1Read the question and identify the angle: approach, independence, governance, fraud or audit committee. Note any facts given (industry, size, listed or not).
2State the core idea in one or two lines: audit effort follows risk, and the auditor gives independent assurance.
3Apply the facts: name the key risks in the case and rate them by likelihood and impact.
4Link each high risk to a control and an audit procedure, such as walkthrough, sample testing or data analytics.
5Address independence: reporting line, no operating duties, and the Section 144 bar on the statutory auditor doing internal audit.
6Connect to the audit committee: reporting findings, Section 177(4) items, and the Board report disclosure under Section 177(8) if the Board rejects a recommendation.
7Give a clear conclusion or recommendation tied to the case, not a generic list.

Quickest way: Risk, Control, Report

When to use it: Use for short descriptive answers and for case-based MCQs where you must pick the best audit response.

Ask: what could go wrong, and how bad? That gives the risk.
Ask: which control stops or detects it? That gives the audit test.
Ask: who must hear about it? That gives the reporting line, usually the audit committee.
In MCQs, reject options that make the internal auditor responsible for preventing fraud or designing controls as an owner.

Common mistakes in Risk-Based Internal Audit and Role of Internal Auditor

Saying risk-based audit means ignoring low-risk areas.
Students read 'priority' as 'exclusion'.
Fix: Write that low-risk areas get lighter or less frequent coverage, and are still reviewed over the cycle.
Saying the internal auditor is responsible for preventing and detecting fraud.
Fraud detection is confused with fraud responsibility.
Fix: State that management owns prevention. The internal auditor assesses fraud risk, tests controls and reports red flags.
Letting the internal auditor report only to the finance head.
Day-to-day reporting is mistaken for the independence line.
Fix: Show functional reporting to the audit committee or Board, with only administrative reporting to management.
Mixing up internal audit and statutory audit roles.
Both use similar procedures.
Fix: Note that the statutory auditor expresses an opinion on financial statements, while internal audit covers controls, risk and operations as the Board directs. Section 144(b) bars the statutory auditor from internal audit.
Quoting wrong audit committee composition, such as 'two independent directors'.
Memory blends the Act with other rules.
Fix: Quote Section 177(2): minimum three directors, independent directors in majority.
Stating that Section 138 applies to every company.
Students skip the words 'such class or classes as may be prescribed'.
Fix: Say it applies to prescribed classes only and check the case facts for applicability.

Worked examples

Example 1

Sunrise Auto Components Ltd, an unlisted public company in Pune, has four areas: raw material purchases (high value, many vendors, past duplicate payments), payroll (stable, automated), petty cash (small amounts), and a new export unit (new processes, no history). The internal auditor has 120 audit days. Explain how a risk-based approach would allocate effort.

Show the solution

Rate the risks by likelihood and impact. Purchases: likelihood high (past duplicates), impact high. Export unit: likelihood high (new, untested controls), impact medium to high. Payroll: likelihood low, impact medium. Petty cash: likelihood medium, impact low.
Rank by residual risk: purchases and export unit are top, payroll next, petty cash last.
Allocate more days to purchases and the export unit, for example about half of the time between them, with vendor master review, three-way match testing and duplicate payment analytics for purchases, and a process walkthrough and control design review for the export unit.
Give payroll and petty cash lighter coverage, such as analytical review and a limited sample, and schedule them less often if the cycle allows.
Report results to the audit committee, with the high-risk findings first, and revisit the plan if new risks emerge during the year.

Answer: Concentrate audit days on purchases and the new export unit because they carry the highest residual risk. Give payroll and petty cash lighter, less frequent coverage, report to the audit committee, and update the plan when risks change.

Example 2

The audit committee of Bharat Textiles Ltd, a listed company, asks how its internal auditor should support it and handle fraud risk. The statutory auditor's firm also offers to do the internal audit to save cost. Advise.

Show the solution

Support to the committee: Section 177(4)(ii) covers review and monitoring of the statutory auditor's independence and performance and the effectiveness of the audit process. The internal auditor does not support the committee on that item. The internal auditor supports the committee mainly on Section 177(4)(v), scrutiny of inter-corporate loans and investments, and Section 177(4)(vii), evaluation of internal financial controls and risk management systems. Here the internal auditor provides independent testing and reports to the committee.
Statutory auditor provisions: Section 177(5) lets the committee call for the auditors' comments on internal control systems and the scope of audit, and discuss related issues with the internal and statutory auditors and the management. Section 177(7) gives the auditors and key managerial personnel a right to be heard, without a vote, when the committee considers the auditor's report. Section 177(5) comments and the Section 177(7) right relate to the statutory auditors and their report. They do not give the internal auditor a statutory right to be heard. The internal auditor reaches the committee through the reporting line set by the Board.
Fraud: the internal auditor assesses fraud risk, tests preventive and detective controls, reviews vigil mechanism reports and escalates red flags to the committee. Management stays responsible for preventing fraud. Under Section 177(10), the vigil mechanism must give direct access to the committee chairperson in appropriate or exceptional cases.
Statutory auditor proposal: Section 144(b) bars an auditor from providing internal audit services to the company, its holding company or its subsidiary, directly or indirectly. The firm's offer must be refused.
Recommend an independent internal auditor, such as a cost accountant or chartered accountant firm under Section 138, reporting functionally to the committee.

Answer: The internal auditor gives the committee independent assurance on loans and investments, internal financial controls, risk management and fraud risk, reporting directly to it. Review of auditor independence under Section 177(4)(ii) and the rights under Section 177(5) and (7) concern the statutory auditors. The statutory auditor's firm cannot be appointed as internal auditor because Section 144(b) prohibits it.

Exam tips

In descriptive answers, tie each point to the case facts. Generic lists lose marks in application questions.
Learn Section 177(2) and 177(4) as short lists. They are easy to test in MCQs and case scenarios.
Write 'such class or classes as may be prescribed' when discussing Section 138, so you do not overstate who must appoint an internal auditor.
For fraud questions, always separate management's responsibility for prevention from the internal auditor's role in assessing risk and reporting.
Finish recommendation questions with a clear action, such as reallocating audit days or changing the reporting line.

Practice questions from Internal Control and Internal Audit

Risk-Based Internal Audit and Role of Internal Auditor in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk-Based Internal Audit and Role of Internal Auditor: frequently asked questions

What is risk-based internal audit in simple words?

It is an audit plan built around business risks. You rate each risk by likelihood and impact, then spend more audit time on the high-risk areas and less on the low-risk ones.

How is the audit committee related to internal audit?

The audit committee oversees the internal audit function and receives its reports. Under Section 177(4) its terms of reference include evaluating internal financial controls and risk management systems, which is where internal audit work feeds in.

Is the internal auditor responsible for detecting fraud?

Management is responsible for preventing and detecting fraud through controls. The internal auditor assesses fraud risk, tests those controls and reports red flags. Audit alone cannot guarantee that every fraud is found.

Can the statutory auditor also act as internal auditor?

No. Section 144(b) of the Companies Act, 2013 lists internal audit among services an auditor cannot provide to the company, directly or indirectly, or to its holding or subsidiary company.

Who can be appointed internal auditor under Section 138?

A chartered accountant, a cost accountant, or another professional decided by the Board. The requirement applies to such classes of companies as are prescribed.