Cost and Management Audit · Operational Audit and Internal Audit under Companies Act, 2013

Internal Audit Function: Scope, Planning and Reporting

Updated 11 October 2026 · Fact-checked

Internal audit is an independent review of a company's functions and activities by an internal auditor appointed under Section 138. You solve questions by stating who is appointed, what the Board decides on scope and method, how the audit is planned on risk, and how findings reach the Audit Committee or Board.

Understand Internal Audit Function: Scope, Planning and Reporting

Internal audit is a review of the functions and activities of a company, done from inside the governance structure. Its purpose is to tell the Board whether controls, risk management and operations work. It is not a check of the financial statements for outsiders.

Under Section 138(1), prescribed classes of companies must appoint an internal auditor. The auditor is a chartered accountant, a cost accountant, or another professional the Board decides. The Act says the audit covers the "functions and activities of the company". That is wider than accounts. It can cover purchasing, production, stores, IT, HR and compliance.

Section 138(2) lets the Central Government prescribe by rules the manner and intervals of the audit and how it is reported to the Board. So the Act sets the frame and the rules fill in the detail. In practice the Board and the Audit Committee decide scope, frequency and methodology, and they should record this in an internal audit charter or engagement terms. Do not quote a rule detail unless the question gives it.

A good internal audit is planned on risk. You list the auditable areas, rank them by risk, set an annual plan, and then prepare a programme for each assignment. You test, collect evidence, and report findings with recommendations and management responses. Follow-up checks whether actions were taken.

Reporting goes to the Board, usually through the Audit Committee. Under Section 177(5), the Audit Committee may discuss related issues with the internal and statutory auditors and management. Under Section 177(4)(vii), it evaluates internal financial controls and risk management systems. Internal audit reports feed that evaluation.

Key rules to remember

Appointment of internal auditor (Section 138(1)): Prescribed class of company → appoint internal auditor (CA, cost accountant or other professional decided by the Board); Applies only to prescribed classes. Do not say every company must appoint one.
Scope of internal audit (Section 138(1)): Scope = functions and activities of the company; Wider than financial statements. Include operations, controls and compliance.
Manner, intervals and reporting (Section 138(2)): Central Government may prescribe by rules: manner + intervals + reporting to the Board; Say 'as prescribed'. Do not invent frequencies.
Audit Committee composition (Section 177(2)): Minimum 3 directors; independent directors form a majority; Most members, including the Chairperson, must be able to read and understand financial statements.
Audit Committee and controls (Section 177(4)(vii)): Terms of reference include evaluation of internal financial controls and risk management systems; Link internal audit findings to this role.
Audit Committee powers (Section 177(5) and (6)): Call for auditors' comments; investigate; obtain external professional advice; full access to records; Shows why internal audit reports to this committee.

How to solve Internal Audit Function: Scope, Planning and Reporting questions

Use this order for any question on scope, planning or reporting of internal audit. It keeps your answer tied to the Act and to the case facts.

1Identify the company type from the facts. State that Section 138 applies to prescribed classes and check whether the case company fits.
2Name the appointee. The internal auditor is a chartered accountant, a cost accountant, or another professional decided by the Board.
3Define scope as the functions and activities of the company. Pick the areas the case mentions, such as purchase, stores or IT.
4Describe planning. Do a risk assessment, prepare an annual plan, set the audit programme, and fix timing and resources. Say the manner and intervals follow the rules and the Board's decision.
5Describe execution. Collect evidence by inspection, observation, enquiry and testing. Document the working papers.
6Describe reporting. Findings, risk rating, recommendations and management response go to the Audit Committee or Board. Cite Section 177(4)(vii) and 177(5) where relevant.
7Close with follow-up and a clear recommendation or conclusion for the case.

Quickest way: Four-line answer frame: Who, What, How, To whom

When to use it: Use it for short MCQs and for 5 to 6 mark theory parts when time is tight.

Who: internal auditor under Section 138, a CA, cost accountant or other professional decided by the Board.
What: functions and activities of the company, not only accounts.
How: risk-based plan, programme, testing, documentation, as per the manner and intervals prescribed and the Board's decision.
To whom: the Board, usually through the Audit Committee, which reviews internal financial controls and risk management.

Common mistakes in Internal Audit Function: Scope, Planning and Reporting

Saying every company must appoint an internal auditor.
Students remember the heading and skip the words 'as may be prescribed'.
Fix: Write 'such class or classes of companies as may be prescribed' and test the case company against it.
Limiting internal audit scope to financial statements.
It is confused with statutory audit.
Fix: State that scope is the functions and activities of the company, including operations and controls.
Saying only a chartered accountant can be internal auditor.
Students recall the common practice only.
Fix: Section 138(1) allows a chartered accountant, a cost accountant, or another professional decided by the Board.
Quoting fixed audit frequencies or a reporting timetable as law.
Students mix in rules or practice from outside the Act.
Fix: Say the manner and intervals are as prescribed by the Central Government under Section 138(2), and the Board sets the plan within that.
Treating the Audit Committee as having the same role as the internal auditor.
Both deal with controls and the roles overlap in the syllabus.
Fix: Internal auditor performs the audit and reports. The Audit Committee oversees, evaluates controls and risk systems, and can seek external advice.
Saying statutory auditors and KMP can vote in Audit Committee meetings.
Students notice they attend and assume they take part fully.
Fix: Under Section 177(7), they have a right to be heard when the auditor's report is considered but no right to vote.

Worked examples

Example 1

Sundaram Engineering Ltd is a company in a class prescribed for internal audit. The Board wants to know who may be appointed as internal auditor, what the audit covers, and how the findings should reach the Board. Advise.

Show the solution

Appointment: Section 138(1) requires prescribed classes to appoint an internal auditor. Sundaram falls in such a class, so it must appoint one.
Eligibility: the auditor may be a chartered accountant, a cost accountant, or another professional the Board decides.
Scope: the audit covers the functions and activities of the company, such as purchasing, production, stores and compliance, not only the accounts.
Manner and intervals: Section 138(2) allows the Central Government to prescribe these by rules, so the plan must follow them. The Board fixes the detailed scope and methodology within that.
Reporting: the internal auditor reports to the Board as prescribed, usually through the Audit Committee, which examines internal financial controls and risk management systems under Section 177(4)(vii).

Answer: Sundaram must appoint an internal auditor, who may be a CA, cost accountant or other professional decided by the Board. The audit covers its functions and activities. Manner, intervals and reporting follow the rules, and findings go to the Board through the Audit Committee.

Example 2

Which of the following is correct about the Audit Committee under Section 177 of the Companies Act, 2013?
(a) It has at least two directors, all independent.
(b) It has at least three directors, with independent directors forming a majority.
(c) Statutory auditors vote on matters concerning their report.
(d) It cannot take professional advice from outside the company.

Show the solution

Option (a): the minimum is three directors and the Act requires independent directors to be a majority, not all. Wrong.
Option (b): Section 177(2) says minimum three directors with independent directors forming a majority. Correct.
Option (c): Section 177(7) gives auditors a right to be heard but not to vote. Wrong.
Option (d): Section 177(6) gives the committee power to obtain professional advice from external sources. Wrong.

Answer: (b) It has at least three directors, with independent directors forming a majority.

Exam tips

Case scenario MCQs often test who may be appointed and what scope covers. Keep the exact wording of Section 138(1) in mind.
In written answers, link each point to a fact in the case. Name the function or risk, then the audit step and the report.
Use 'as may be prescribed' where the Act leaves detail to rules. Do not invent timelines.
For difference questions against statutory audit, compare appointer, purpose, scope and reporting in short lines.
End reporting answers with the Audit Committee's role under Section 177(4)(vii) and 177(5).

Practice questions from Operational Audit and Internal Audit under Companies Act, 2013

Internal Audit Function: Scope, Planning and Reporting in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function: Scope, Planning and Reporting: frequently asked questions

Who can be appointed as internal auditor under Section 138?

Section 138(1) says a chartered accountant, a cost accountant, or such other professional as the Board decides. The company must belong to a prescribed class.

What is the difference between internal audit and statutory audit?

Internal audit reviews the functions and activities of the company and serves the Board and management. Statutory audit gives an opinion on the financial statements. The two also differ in who appoints the auditor and how scope is set, and internal audit scope is decided by the Board.

To whom does the internal auditor report?

Section 138(2) lets the Central Government prescribe how the audit is reported to the Board. In practice reports go to the Audit Committee, which reviews controls and risk systems for the Board.

Who decides the scope and methodology of internal audit?

The Board decides within the Act and the rules. It records the scope, functions and methodology in terms of engagement, often with the Audit Committee guiding the plan.