Corporate Accounting and Auditing · Audit Risk, Internal Control, Internal Check and Internal Audit

Internal Audit: Scope, Functions and Reporting

Updated 10 October 2026 · Fact-checked

Internal audit is an independent review of a company's operations, controls, risk management and governance, carried out for management and the board. Under Section 138 of the Companies Act, 2013, prescribed companies must appoint an internal auditor. To answer questions, state meaning, scope, reporting line and how it differs from statutory audit.

Understand Internal Audit: Scope, Functions and Reporting

Internal audit is an appraisal activity carried out inside an entity, by employees or by an outside firm, to review and improve its operations. It serves management and the board. It is not a legal check for shareholders, as statutory audit is.

The main objectives are to evaluate how well internal controls work, to test whether policies, laws and procedures are followed, to safeguard assets, to check the reliability of records and reports, and to suggest improvements in efficiency. Modern internal audit also looks at risk management and governance.

The scope is decided by the Audit Committee, or the Board where there is no Audit Committee, in consultation with the internal auditor, so it is wide. It covers financial audit, operational (efficiency) audit, compliance audit, management audit, fraud detection and prevention, and review of IT systems. It is not limited to accounts.

Section 138 requires certain classes of companies to appoint an internal auditor, who may be a chartered accountant, a cost accountant or another professional the board decides, and may be an employee. The Companies (Accounts) Rules, 2014 prescribe the classes: all listed companies, and unlisted public companies and private companies that cross specified thresholds of paid-up capital, turnover, outstanding loans or deposits. Check the current thresholds in your study material. Under Rule 13, the Audit Committee, or the Board where there is no Audit Committee, in consultation with the internal auditor, decides the scope, functions, periodicity and methodology, and reviews the internal audit report. The internal auditor reports to it.

The statutory auditor stays independent and fully responsible for the audit opinion. Under SA 610 (Revised), Using the Work of Internal Auditors, the statutory auditor may use internal audit work only after evaluating the function's objectivity, competence and systematic, disciplined approach, and testing the work used.

SA 610 also deals with direct assistance, where internal auditors work under the statutory auditor's direction. It is permitted only if law or regulation does not prohibit it. The auditor must also have evaluated the internal auditors' objectivity and competence, and must direct, supervise and review their work. The statutory auditor remains solely responsible for the opinion.

Key rules to remember

Section 138 rule: Prescribed class of company → must appoint internal auditor (CA, CMA or other professional; may be an employee); Classes and thresholds are in the Companies (Accounts) Rules, 2014. Do not quote figures unless you are sure of them.
Who decides scope and who receives the report: Scope, functions, periodicity, methodology → Audit Committee / Board, in consultation with the internal auditor; report → Audit Committee / Board; Internal auditor reports to those charged with governance, not to shareholders.
Internal vs statutory audit: core contrast: Internal: for management and the board, scope set by Audit Committee/Board, may be an employee | Statutory: for members, scope set by law, independent of management; Use this contrast as the skeleton for any difference question.
SA 610 test before using internal audit work: Objectivity + Competence + Systematic and disciplined approach → then use and test the work; The statutory auditor alone is responsible for the opinion; using the work is not a reference to it in the report.
SA 610 direct assistance: Not prohibited by law or regulation + objectivity and competence evaluated + auditor directs, supervises and reviews → direct assistance permitted; Responsibility for the opinion stays solely with the statutory auditor.

How to solve Internal Audit: Scope, Functions and Reporting questions

Use this order for any question on internal audit, whether it asks for meaning, difference, applicability or relationship.

1Identify what is asked: definition and scope, Section 138 applicability, comparison with statutory audit, reporting, or SA 610.
2Open with a one-line definition: independent appraisal for management and the board.
3List objectives or scope in short points: controls, compliance, operations, assets, fraud, risk.
4For applicability, state that Section 138 and the Companies (Accounts) Rules prescribe the classes, who may be appointed and who decides scope.
5For comparison, use a two-column style with points such as purpose, appointment, reporting, independence, scope, and legal status.
6For relationship, bring in SA 610: evaluate objectivity and competence, test work, and note that direct assistance is allowed only if law does not prohibit it and the auditor directs, supervises and reviews. The auditor retains sole responsibility.
7Close with a limitation or practical note, such as dependence on management or cost.

Quickest way: Four-line internal audit answer

When to use it: For short notes or MCQs where you have under four minutes.

Line 1: Define it as an independent review for management and the board.
Line 2: Give three scope or objective points.
Line 3: Mention Section 138 and who reports to whom.
Line 4: Add the one distinguishing point from statutory audit or the SA 610 safeguard.

Common mistakes in Internal Audit: Scope, Functions and Reporting

Saying internal audit is compulsory for every company.
Students remember Section 138 but not the prescribed classes.
Fix: Write that it applies to prescribed classes of companies only, as per the Companies (Accounts) Rules, 2014.
Writing that the internal auditor reports to shareholders.
Confusion with the statutory auditor's report to members.
Fix: Say the internal auditor reports to the audit committee or board, as agreed in the engagement scope.
Claiming the statutory auditor can rely fully on internal audit and reduce own responsibility.
Misreading SA 610 as permission to delegate.
Fix: State that the statutory auditor evaluates and tests the work and remains solely responsible for the opinion.
Saying an employee can never be internal auditor.
Mixing it up with statutory auditor disqualifications.
Fix: Section 138 allows the internal auditor to be an employee or not, a CA, CMA or other professional the board decides.
Treating internal audit as only a check of accounts.
Students think of audit as only financial.
Fix: Include operational, compliance, management, risk and IT review in scope.
Mixing internal audit with internal check or internal control.
The three terms sound similar and appear in the same chapter.
Fix: Internal control is the system, internal check is division of duties within it, internal audit is an independent review of that system.

Worked examples

Example 1

Distinguish between internal audit and statutory audit on five points.

Show the solution

Pick five standard headings: purpose, appointment, scope, reporting, independence.
Write each side briefly and correctly.
Keep it in parallel so the examiner can compare quickly.

Answer: 1. Purpose: Internal audit improves controls and efficiency for management; statutory audit gives an opinion on true and fair view of financial statements. 2. Appointment: Internal auditor is appointed by the board (may be an employee) under Section 138 for prescribed companies; statutory auditor is appointed by members under the Companies Act, 2013 and must be a qualified, independent chartered accountant or firm. 3. Scope: Internal audit scope is set by the audit committee or board in consultation with the internal auditor and covers operations, compliance and risk; statutory audit scope is set by law and standards. 4. Reporting: Internal auditor reports to the audit committee or board; statutory auditor reports to the members. 5. Independence: Internal auditor is independent of the activities audited but remains answerable to the audit committee or board; statutory auditor is independent of the company and management.

Example 2

Prime Textiles Ltd is a listed company in Coimbatore. Its statutory auditor wants to use the work of the internal audit department on stock counts, including having internal auditors assist directly in the counts. Explain what the auditor must consider under SA 610 and who remains responsible.

Show the solution

Say that the auditor must first decide whether the internal audit function can be used at all.
List the evaluation factors: objectivity, competence, systematic and disciplined approach including quality control.
State that if satisfied, the auditor must test the work used to see if it is adequate for the audit's purpose.
For direct assistance, state that it is allowed only if law or regulation does not prohibit it, and the auditor directs, supervises and reviews the work.
Conclude on responsibility.

Answer: The statutory auditor of Prime Textiles Ltd must evaluate the internal audit function's objectivity (its organisational status and policies safeguarding impartiality), its technical competence, and whether it applies a systematic and disciplined approach, including quality control. Only if satisfied can the work be used. The auditor must then evaluate and test the specific work used, for example by re-performing part of the stock counts, and judge whether it is adequate for the audit. Internal auditors may assist directly in the counts only if law or regulation does not prohibit it, and the auditor has evaluated their objectivity and competence and directs, supervises and reviews their work. The auditor alone remains responsible for the audit opinion and does not refer to the internal auditor's work in the report as a reduction of that responsibility.

Exam tips

Short notes and difference questions are the usual format; practise a ready five-point comparison table in sentence form.
For applicability MCQs, remember that Section 138 covers prescribed classes only, not all companies.
When SA 610 appears, always end with the statutory auditor's sole responsibility for the opinion.
Link internal audit to internal control and the audit committee to show chapter-level understanding.
Mention scope beyond accounts: operations, compliance, risk and IT, since this earns the extra marks.

Practice questions from Audit Risk, Internal Control, Internal Check and Internal Audit

Internal Audit: Scope, Functions and Reporting in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit: Scope, Functions and Reporting: frequently asked questions

What is the scope of internal audit?

The scope is decided by the Audit Committee, or the Board where there is no Audit Committee, in consultation with the internal auditor, and is not fixed by law. It usually covers financial review, operational efficiency, compliance, risk management, fraud prevention and IT systems.

Is internal audit compulsory under Section 138?

It is compulsory for the classes of companies prescribed in the Companies (Accounts) Rules, 2014, including listed companies and certain unlisted public and private companies above set thresholds. Other companies may appoint one voluntarily.

Can the statutory auditor rely on the internal auditor's work?

Yes, in part, under SA 610, after evaluating the function's objectivity, competence and systematic approach and testing the work used. Direct assistance is allowed only if law or regulation does not prohibit it and the auditor directs, supervises and reviews the work. The statutory auditor still bears sole responsibility for the opinion.

Who can be appointed as internal auditor?

A chartered accountant, a cost accountant or any other professional the board decides. The person may be an employee of the company or an outside firm.