Skip to content

Internal and Forensic Audit · Reporting under Internal Audit

Standards and Legal Requirements on Reporting in Internal Audit

Updated 11 October 2026 · Fact-checked

Internal audit reporting is governed by three layers: Section 138 of the Companies Act, 2013 (who must have an internal auditor and to whom the report goes), the ICAI Standards on Internal Audit (SIAs), and IIA standards on communicating results. Answer by naming the source, stating its rule, applying it to the facts, then concluding.

Understand Standards and Legal Requirements on Reporting

An internal audit report is how the internal auditor turns fieldwork into something management and the audit committee can act on. Without a rule, reports would vary in quality, timing and honesty. So law and standards set a floor.

There are three layers. First, law: Section 138 of the Companies Act, 2013 requires certain classes of companies to appoint an internal auditor, who may be a chartered accountant, a cost accountant or another professional the board decides, and who may be an employee. The Rules under it set which companies are covered. The auditor reports to the audit committee or the board, as the board decides. Check the Rules text for the exact thresholds before you quote any figures.

Second, professional standards of ICAI. The Standards on Internal Audit (SIAs) cover planning, evidence, documentation and reporting. SIA 5 is commonly linked with sampling, so do not assume the number matches your search; for reporting, recall the SIA on communication with management and the SIA on internal audit documentation and reporting as named in your study material. Confirm the exact SIA number and title from your ICSI material before writing it in an answer.

Third, IIA standards. The Institute of Internal Auditors' International Standards require communications to be accurate, objective, clear, concise, constructive, complete and timely. They also expect the chief audit executive to report results to the board and to follow up on whether action was taken.

The external auditor also cares about this. Under SA 610 (Revised), the external auditor who wants to use internal audit work must check that the work was properly planned, performed, supervised, reviewed and documented, that evidence supports the conclusions, and that the reports are consistent with the work done. A well-reported internal audit is therefore more usable by the statutory auditor. That standard also stresses that a statutory auditor cannot be the entity's internal auditor, since independence and objectivity would be lost.

Key rules to remember

Law layer
Section 138 Companies Act, 2013 + Rules: who must appoint, who may be appointed, to whom the auditor reports
Report goes to the audit committee or board as the board decides. Quote thresholds only from the Rules text.
Standards layer
ICAI SIAs: planning, evidence, documentation, communication of results
Give the SIA number only if you are sure of it from your study material.
IIA quality of communication
Accurate, objective, clear, concise, constructive, complete, timely
Use this as a checklist when asked what a good report must be.
SA 610 (Revised) para 23 test
Work properly planned, performed, supervised, reviewed, documented + sufficient evidence + conclusions appropriate and reports consistent with work
This is what the external auditor tests before using internal audit reports.
Independence rule
A statutory auditor of an entity cannot be its internal auditor
Quoted in SA 610 (Revised) from the ICAI Code of Ethics, para 290.173, because of self-review threat.

How to solve Standards and Legal Requirements on Reporting questions

Use this order for any question on legal and standards requirements for internal audit reporting.

  1. 1Identify the source being tested: Companies Act, ICAI SIA, IIA standard or SA 610.
  2. 2State the rule in plain words, with exact conditions.
  3. 3List the facts given: type of company, who the auditor is, to whom the report goes, timing.
  4. 4Apply the rule to each fact and note any breach or gap.
  5. 5Link to quality of the report: accuracy, objectivity, clarity, completeness, timeliness.
  6. 6Add practical points: draft the recommendation, assign management response, plan follow-up.
  7. 7Conclude with a clear yes or no and the action required.

Quickest way: Three-layer recall

When to use it: When time is short and the question asks for requirements or a comparison.

  1. Write three headings in your answer: Law, ICAI standards, IIA standards.
  2. Under each, give two or three points in one line each.
  3. Add one line on SA 610 if the external auditor is mentioned.
  4. Close with the facts-based conclusion.

Common mistakes in Standards and Legal Requirements on Reporting

  • Quoting company thresholds for Section 138 from memory

    Numbers are easy to confuse across Rules and amendments.

    Fix: State the principle and say thresholds are prescribed in the Rules unless you are certain of them.

  • Saying the statutory auditor can also act as internal auditor

    Both roles involve checking books, so they look similar.

    Fix: Remember the ICAI Code of Ethics position quoted in SA 610: independence and objectivity cannot be met.

  • Giving a wrong SIA number with confidence

    Students memorise numbers without titles.

    Fix: Learn each SIA by title and number together; if unsure, name the standard by its subject.

  • Treating IIA standards as binding law

    They are used heavily in practice.

    Fix: Describe them as professional standards, not statute.

  • Listing findings without a conclusion

    Students focus on the rule only.

    Fix: Always finish with provision, analysis and conclusion.

Worked examples

Example 1

Sundaram Textiles Ltd's statutory auditor has also been appointed as its internal auditor to save cost. The partner says the internal audit report will be used directly in the statutory audit. Advise.

Show the solution
  1. Rule: SA 610 (Revised) quotes the ICAI Code of Ethics: a statutory auditor of an entity cannot be its internal auditor, as an independent and objective opinion would not be possible.
  2. Reason: using the results creates a self-review threat, because the team may use its own work without proper evaluation or professional scepticism.
  3. Facts: the same firm would do both, and the report is meant to be used directly.
  4. Conclusion: the arrangement is not permissible; a separate internal auditor should be appointed and the statutory auditor should evaluate that work under SA 610.

Answer: The arrangement should not continue. The company must appoint an independent internal auditor, and the statutory auditor may use that work only after evaluating it as SA 610 requires.

Example 2

The external auditor of Kaveri Foods Ltd wants to rely on the internal audit reports on inventory counts. What must the external auditor check before relying on them?

Show the solution
  1. Rule: SA 610 (Revised), para 23, requires sufficient audit procedures on the body of internal audit work as a whole.
  2. Check (a): the work was properly planned, performed, supervised, reviewed and documented.
  3. Check (b): sufficient appropriate evidence was obtained to support reasonable conclusions.
  4. Check (c): conclusions are appropriate and reports are consistent with the work performed.
  5. Also consider objectivity and competence of the function, and a systematic and disciplined approach.
  6. Note that observation of inventory counts is an example of work that can be used, but significant judgments stay with the external auditor.

Answer: The external auditor must test the adequacy of the internal audit work against the three para 23 criteria and remain solely responsible for the audit opinion.

Exam tips

  • Structure answers as provision, analysis, conclusion, and name the source for each point.
  • Do not write section numbers or SIA numbers you are not sure of; describe the rule instead.
  • Use the IIA seven qualities as a ready checklist for good-report questions.
  • Case questions often hide an independence issue; check who the auditor is and to whom they report.
  • Link internal audit reporting to the audit committee and follow-up for extra marks.

Practice questions from Reporting under Internal Audit

Standards and Legal Requirements on Reporting: frequently asked questions

Does Section 138 say how the internal audit report must look?

No. It deals with who must appoint an internal auditor and the basis of reporting to the audit committee or board. The format comes from standards and the engagement terms.

Is SIA 5 the reporting standard?

Do not assume so. Check the title and number in your ICSI study material. Describe the standard by its subject if you are unsure of the number.

Are IIA standards mandatory in India?

They are professional standards, not law. Companies may adopt them, and they are useful to cite for good practice in communicating results.

Can the external auditor rely on internal audit reports?

Yes, in part, after evaluating objectivity, competence and the quality of the work under SA 610 (Revised). The external auditor keeps sole responsibility for the opinion.