CS Professional · Compliance Management, Audit and Due Diligence

Internal Audit and Performance Audit for CS Professional

Internal audit is an independent, systematic review of an entity's governance, risk management and internal control, done for management and those charged with governance. Performance audit checks economy, efficiency and effectiveness. To solve questions, state the provision, apply it to the facts given, and conclude with a clear recommendation.

What this chapter covers

This chapter sits in the Audit and Due Diligence part of Paper 3, Compliance Management, Audit and Due Diligence. It covers two linked ideas. Internal audit is a function inside or for the entity that evaluates governance, risk management and internal control. Performance audit looks beyond accounts and asks whether activities are economical, efficient and effective.

The chapter starts with meaning, scope and objectives, then moves to the legal requirement under Section 138 of the Companies Act, 2013, which makes internal audit mandatory for prescribed classes of companies. Next come standards and the engagement process, then internal control and risk-based audit, which is the working method. The last two topics deal with performance audit: its concept, approach, process and reporting.

The chapter connects to the rest of the paper in three ways. Internal audit links to compliance management, because reviewing compliance with laws is a typical internal audit assignment. It links to the statutory audit topics, because an external auditor may rely on internal audit work under SA 610 (Revised), Using the Work of Internal Auditors. It also links to due diligence, where control and risk findings feed the conclusions.

The paper is written and case-based, so this chapter rewards students who can apply a rule to facts, not just define terms. Questions often give a company scenario and ask whether internal audit is required, how an engagement should run, or how far an external auditor may rely on the internal audit function. The topics are practical and the same logic repeats across them: objectivity, competence, risk and evidence. Once you learn that logic, you can answer unseen questions in a structured way. The chapter is also useful in practice if you work in compliance or governance roles.

Internal Audit and Performance Audit: topics in the order to study them

1Internal Audit: Meaning, Scope and ObjectivesIt gives the base vocabulary: assurance and consulting work across governance, risk management and internal control.
2Internal Audit under Companies Act 2013 (Section 138)Once you know what internal audit is, learn who must have it and who can be appointed, using the exact legal conditions.
3Internal Audit Standards and Engagement ProcessThis shows how an assignment runs from planning to reporting and where standards such as SA 610 (Revised) apply.
4Internal Control and Risk-Based Internal AuditControl and risk drive audit planning, so this topic explains why the engagement process is built the way it is.
5Performance Audit: Concept and ApproachIt builds on your control and operations knowledge and introduces economy, efficiency and effectiveness.
6Performance Audit Process and ReportingStudy it last because it applies the concept to a full process, ending in a report with findings and recommendations.

How to prepare Internal Audit and Performance Audit

Treat this as an application chapter. Aim to explain each idea in your own words and then use it on a short fact pattern.

Read the chapter once in the study order above without making notes. Your goal is to see how internal audit, control, risk and performance audit connect.
Make a one-page list for Section 138: who must appoint an internal auditor, who may be appointed, and the role of the Audit Committee or Board. Check each condition against the Act's text and the rules before you write it.
Learn the SA 610 (Revised) reliance logic. The external auditor evaluates objectivity, competence and a systematic and disciplined approach, including quality control. If any of the three fails, the work of the function is not used.
Learn the reverse rule too: the more judgment involved and the higher the assessed risk of material misstatement, the less work of the function the external auditor plans to use. Significant judgments always stay with the external auditor.
Practise three or four case questions in the format provision, analysis, conclusion. Write 150 to 250 words for each and keep to the facts given.
Draw a simple flow for the risk-based internal audit and the performance audit process. Practise writing the stages from memory, with a one-line purpose for each.
Revise with a timed attempt on at least one scenario question. Check that your conclusion answers exactly what was asked.

Common mistakes in Internal Audit and Performance Audit

Treating internal audit as the same as statutory audit.
Fix: Remember the purpose and audience. Internal audit serves management and those charged with governance, covers wide operational and control areas, and is designed by the entity's needs. Statutory audit is an independent opinion on the financial statements.
Stating Section 138 conditions loosely, for example saying all companies need internal audit.
Fix: Write the requirement as applying to prescribed classes of companies, then state the conditions the case facts satisfy. Always test the facts against each condition.
Saying the external auditor can rely fully on a good internal audit function.
Fix: State that the external auditor keeps all significant judgments and uses less of the work as judgment and risk increase. Name the receivables ageing example if it fits.
Listing the three SA 610 criteria without applying them to the case.
Fix: Take each criterion in turn and tie it to a fact, such as reporting lines for objectivity, staff qualifications for competence, and documented work programs for a systematic approach. Then conclude.
Confusing internal control with risk-based audit.
Fix: Control is what the entity operates. Risk-based audit is how the auditor plans work by focusing on higher-risk areas. Keep the definitions separate and link them in one sentence.
Writing performance audit answers as financial audit answers.
Fix: Structure the answer around economy, efficiency and effectiveness. Say what is measured, against what criteria, and what recommendation follows.

Last-day revision: Internal Audit and Performance Audit

Internal audit work typically covers governance, risk management and internal control, through assurance and consulting activities.
Internal audit can include review of compliance with laws, regulations and management policies.
Internal audit can also review the economy, efficiency and effectiveness of operating activities, including non-financial ones.
Section 138 of the Companies Act, 2013 requires internal audit for prescribed classes of companies. Check the class thresholds before the exam.
SA 610 (Revised): the external auditor evaluates objectivity, competence and a systematic and disciplined approach, including quality control.
If objectivity, competence or a systematic and disciplined approach is lacking, the external auditor shall not use the function's work.
The external auditor makes all significant judgments and plans to use less internal audit work as judgment and assessed risk rise.
Example of limits: checking the accuracy of receivables ageing can be assigned, but judging the adequacy of the provision cannot.
The external auditor tells those charged with governance how the work of the internal audit function will be used, as part of the audit scope and timing overview.
Discussion with the internal audit function covers timing, nature, extent of coverage, materiality, sample sizes, documentation and reporting.
Performance audit tests economy, efficiency and effectiveness, not only accuracy of accounts.
A performance audit report should give findings, evidence-based conclusions and practical recommendations.

Internal Audit and Performance Audit practice questions

Internal Audit and Performance Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit and Performance Audit: frequently asked questions

Is Internal Audit and Performance Audit an important chapter for CS Professional Paper 3?

It belongs to the Audit and Due Diligence part of Paper 3, which carries 60 marks. Questions are written and case-based, so the chapter is worth solid preparation. Focus on application, not just definitions.

Do I need to know SA 610 (Revised) for this chapter?

Yes, it is useful for questions on how far an external auditor can use internal audit work. Know the three evaluation criteria, when the work cannot be used, and why more judgment or higher risk means less reliance.

How should I answer a Section 138 case question?

State the requirement in plain words, then check each condition against the facts of the company. Conclude whether internal audit is required and who may be appointed. Verify the prescribed thresholds in the current rules before you rely on them.

What is the difference between internal audit and performance audit?

Internal audit evaluates governance, risk management and internal control, and may include compliance and operational reviews. Performance audit focuses on whether activities achieve economy, efficiency and effectiveness. Their areas overlap, but performance audit is judged against value for resources and results.

How long should I give this chapter?

Give it enough time for one full read, one round of notes and several written case answers. Writing practice matters more than extra reading, because the paper tests how you apply the rules.