Compliance Management, Audit and Due Diligence · Internal Audit and Performance Audit

Internal Audit Standards and Engagement Process for CS Professional

Updated 11 October 2026 · Fact-checked

The Standards on Internal Audit (SIAs) are issued by ICAI to set the benchmark for how internal audit is done. An engagement moves through four stages: planning, execution, reporting and follow-up. In the exam, name the stage, apply the facts, and conclude with a practical step.

Understand Internal Audit Standards and Engagement Process

Internal audit is an independent, objective assurance and consulting activity inside or for an entity. It evaluates and improves governance, risk management and internal control. SA 610 (Revised) says the same: the scope typically covers governance, risk management, evaluation of internal control, examination of financial and operating information, review of operating activities and review of compliance with laws and regulations.

The Standards on Internal Audit (SIAs) are issued by the Institute of Chartered Accountants of India. They lay down the principles for planning, performing, documenting and reporting internal audit work. Do not memorise the SIA numbers and titles from this page alone. Learn the list from your study material, grouped by theme: general standards, planning, risk and control, execution and evidence, and reporting.

An engagement runs in four stages. Planning means understanding the entity, assessing risk, setting scope and objectives, and preparing the audit plan and audit programme. Execution means performing the procedures in the programme, collecting evidence and documenting it in working papers. Reporting means communicating findings, risks and recommendations to management and those charged with governance. Follow-up means checking whether management has acted on the recommendations.

The internal auditor's work also matters to the statutory auditor. SA 610 (Revised) lets the external auditor use internal audit work, but the external auditor alone is responsible for the audit opinion. The statutory auditor of an entity cannot be its internal auditor, because independence and objectivity would be lost.

Key rules to remember

Four stages of an engagement: Planning → Execution → Reporting → Follow-up; Use this as the skeleton of every answer on the engagement process.
Plan versus programme: Audit plan = scope, timing, resources; Audit programme = detailed procedures to perform; The plan is the overall approach. The programme is the step-by-step work list.
SA 610 (Revised): limit on using internal audit work: Use less internal audit work when: more judgment is involved; assessed risk of material misstatement is higher; objectivity is weaker; competence is lower; The external auditor makes all significant judgments and should plan to use less of the function's work in these cases.
Significant judgments (SA 610, A19): Risk assessment, sufficiency of tests, going concern, significant estimates, adequacy of disclosures; These stay with the external auditor.
Procedures to evaluate internal audit work (SA 610, A28): Inquiry + Observation + Review of work programme and working papers (plus reperformance); The external auditor uses these to judge the adequacy of internal audit work.

How to solve Internal Audit Standards and Engagement Process questions

Use one structure for any question on the SIAs or the engagement process. It keeps your answer in the provision, analysis, conclusion format.

1Identify what is asked: a standard, a stage of the engagement, a document (plan, programme, report) or the relationship with the statutory auditor.
2State the rule or standard in plain words. Name the SIA or SA 610 only if you are sure of it.
3List the stage-wise activities relevant to the question: planning, execution, reporting or follow-up.
4Apply the facts given: entity size, risk level, competence and objectivity of the internal audit team, and the issue raised.
5Show the practical point: working papers, management response, reporting line to the audit committee, timelines.
6Conclude clearly with the recommended action or the answer to the question asked.

Quickest way: Stage-wise answer frame

When to use it: Use it when time is short or when the question simply says 'explain the internal audit process'.

Write the four stage names as sub-headings.
Under each, give two or three points: planning (risk, scope, plan, programme), execution (testing, evidence, working papers), reporting (findings, recommendations, management response), follow-up (status check, escalation).
Add one line on standards: SIAs guide each stage.
Close with one case-specific line if facts are given.

Common mistakes in Internal Audit Standards and Engagement Process

Treating the audit plan and audit programme as the same document
Both are prepared in the planning stage and the names sound alike.
Fix: Say the plan sets scope, timing and resources, while the programme lists detailed procedures.
Ending the engagement at the report
Students think the report is the final deliverable.
Fix: Always add follow-up: tracking management's action on recommendations and reporting the status.
Saying the statutory auditor can also be the internal auditor
Both roles involve audit, so they seem interchangeable.
Fix: State that a statutory auditor cannot be the internal auditor, since independence and objectivity are lost. This also creates a self-review threat.
Saying the external auditor can rely fully on internal audit work
Students confuse using work with transferring responsibility.
Fix: Under SA 610 (Revised), the external auditor has sole responsibility for the opinion and makes all significant judgments.
Quoting SIA numbers from memory without certainty
Students try to show recall of the list.
Fix: Use the standard's theme or title when sure. A correct description earns more than a wrong number.
Giving a generic answer to a case question
Students recite the process without using the facts.
Fix: Link each stage to the facts: the risk, the entity and the issue raised.

Worked examples

Example 1

Greenfield Foods Ltd., an Indian manufacturing company, has appointed an internal auditor. Briefly explain the stages of the internal audit engagement.

Show the solution

Provision: an internal audit engagement follows the guidance of the Standards on Internal Audit and runs in four stages.
Planning: understand the business, assess risks, define scope and objectives, prepare the audit plan and audit programme.
Execution: carry out the programme, such as testing controls and transactions, gather evidence and record it in working papers.
Reporting: communicate findings, risk ratings and recommendations, with management's response, to management and those charged with governance.
Follow-up: check the status of agreed actions and escalate unresolved items.

Answer: The engagement has four stages: planning, execution, reporting and follow-up. Each is guided by the SIAs. Follow-up completes the cycle by confirming that recommendations are implemented.

Example 2

CA Mehta is the statutory auditor of Sunrise Textiles Ltd. The company also asks him to act as its internal auditor. It also asks him to rely fully on the internal audit work. Advise.

Show the solution

Provision: the ICAI Code of Ethics, as quoted in SA 610 (Revised), says a statutory auditor of an entity cannot be its internal auditor, as an independent and objective opinion would not be possible.
Analysis: if he accepts, a self-review threat arises. He may use results without proper evaluation or without the same professional skepticism.
SA 610 (Revised) says the external auditor has sole responsibility for the audit opinion and must make all significant judgments, such as risk assessment, sufficiency of tests and going concern.
So even where an independent internal audit function exists, he cannot rely on it fully. He should plan to use less of its work where judgment is high, risk is high, or objectivity or competence is weak.
He should evaluate the work through inquiry, observation and review of the work programme and working papers, and communicate to those charged with governance how he plans to use it.

Answer: CA Mehta should decline the internal audit role. He cannot rely fully on internal audit work either, because he alone is responsible for the audit opinion.

Exam tips

Open every process answer with the four stages, then expand. Examiners look for a clear structure.
In case questions, name the facts that decide the answer, such as risk level, objectivity and competence of the team.
Always mention working papers in execution and management response in reporting. These are easy marks.
For SA 610 questions, keep the sole-responsibility rule and the four 'use less' conditions ready.
Add a drafting or compliance point where possible, such as reporting to the audit committee and a follow-up timeline.

Practice questions from Internal Audit and Performance Audit

Internal Audit Standards and Engagement Process in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Standards and Engagement Process: frequently asked questions

What are the Standards on Internal Audit?

They are standards issued by ICAI that set the principles for how internal audit is planned, performed, documented and reported. Study the list and themes from your ICSI study material. Use them to support your answer on the engagement process.

What is the difference between an audit plan and an audit programme?

The plan sets the overall scope, timing and resources. The programme lists the detailed procedures to be performed. Both are prepared in the planning stage.

Can the external auditor use internal audit work?

Yes, but under SA 610 (Revised) the external auditor alone is responsible for the opinion and makes all significant judgments. The extent of use falls as judgment, risk or concerns about objectivity and competence rise.

Why is follow-up needed in internal audit?

A report has value only if recommendations are acted on. Follow-up checks implementation, flags delays and escalates unresolved issues to those charged with governance.