Internal Audit (Section 138, Rule 13, SIAs & SA 610)

The Internal Audit Report is the primary tangible output of the internal audit engagement, communicating findings and recommendations to the Audit Committee and Top Management.

Key Characteristics & Structure:

• Objectivity & Tone: Factual, unbiased, and constructive. Identifies control deficiencies while acknowledging positive management initiatives.
• Standard 5Cs Observation Structure: Every observation details: (1) Condition (factual state); (2) Criteria (benchmark/policy); (3) Cause (underlying root reason); (4) Consequence/Effect (financial or operational risk); and (5) Corrective Action Plan (management response, target date, action owner).
• Executive Summary: Summarizes critical high-risk observations, systemic themes, and remediation status for swift Board-level review.
• Follow-up Action: Mandates systematic follow-up tracking to verify whether agreed management actions were implemented.

Under SA 610 (Revised), before using the work of the internal audit function, the external auditor must evaluate three core aspects:

1. Objectivity of the Internal Audit Function: Whether the function reports directly to TCWG (Audit Committee); whether internal auditors are free from conflicting operational duties; whether management places undue scope restrictions.
2. Level of Competence: Professional qualifications (CA, CMA, CIA), hiring policies, continuing professional education (CPE), and technical resources available to the internal audit team.
3. Systematic and Disciplined Approach: Whether internal audit applies documented audit methodologies, standardized risk-based programs, quality control policies, and complies with Standards on Internal Audit (SIAs).

1. Statutory Applicability under Section 138:

• Under Rule 13 of Companies (Accounts) Rules, 2014, every private company having outstanding loans or borrowings from banks or public financial institutions exceeding ₹ 100 Crore at any point of time during the preceding financial year is mandatorily required to appoint an internal auditor.
• Since AB Pvt. Ltd.'s borrowings exceed ₹ 100 Crore, Section 138 is applicable.

2. Who Can Be Appointed:

• A Chartered Accountant (in practice or not); OR a Cost Accountant; OR such other professional as decided by the Board. May or may not be an employee of the company.

3. Work to Be Reviewed (Scope formulated under Rule 13(2)):

• Review of internal controls, loan utilization, debt-servicing capability, safeguarding of assets, compliance with bank covenants, and operational efficiency.

Under SA 610 (Revised), in deciding whether to use internal auditors to provide direct assistance, the external auditor considers:

• Amount of Judgment Involved: Direct assistance cannot be used in planning procedures or testing where significant judgment is required.
• Assessed Risk of Material Misstatement: Higher risk areas require external auditor's direct personal performance.
• Objectivity and Competence: The significance of threats to objectivity and technical skills of the specific internal audit personnel.
• Prior Written Agreements: Must obtain written agreements from the entity (non-intervention) and internal auditors (confidentiality & objectivity).
• Prohibitions: Direct assistance is strictly barred in significant estimates, going concern, risk assessment, and external confirmations.

(a) Evaluating Accounting Estimates & Risk Assessment:

• Under SA 610 (Revised), the external auditor SHALL NOT use internal auditors to provide direct assistance to perform procedures that involve making significant judgments in the audit.
• Assessing the risks of material misstatement and evaluating significant accounting estimates are core areas of professional auditor judgment. Therefore, Mr. A cannot ask Mr. B for direct assistance in these areas.

(b) External Confirmations & Evaluation:

• SA 610 explicitly prohibits using internal auditors to provide direct assistance with respect to decisions on external confirmation requests and evaluating the results of external confirmation procedures!
• Therefore, Mr. A cannot use Mr. B for direct assistance in confirmation procedures. The answer remains that such direct assistance is strictly prohibited.

The HR head should propose a Dual Reporting Framework:

1. Functional Reporting → Audit Committee / Board of Directors:
   • Approval of internal audit charter and annual risk-based audit plan.
   • Approval of Chief Internal Auditor's appointment, appraisal, and remuneration.
   • Direct reporting of all audit findings, internal control deficiencies, and investigation results.
   • Periodic executive sessions between Audit Committee and Chief Internal Auditor without management.
2. Administrative Reporting → Managing Director / CEO:
   • Day-to-day administrative matters, operational budget approvals, and routine communications.
3. Crucial Negative Directive: The Chief Internal Auditor must NEVER report to the CFO or Finance Director, as doing so introduces a severe conflict of interest and compromises independence over financial auditing.

Mr. Shubh should adopt a systematic risk-based analytical methodology:

1. Data Extraction & Stratification: Extract the entire expense general ledger and categorize expenses by head, department, and vendor volume.
2. Budget vs. Actual Variance Analysis: Compare actual expenses with approved budgets to flag significant cost overruns and unexplained variations.
3. Test of 3-Way Matching & Delegation of Financial Powers (DoFP): Verify that purchase orders, delivery challans/GRNs, and invoices match, and that approvals adhered strictly to authorized spending limits.
4. Analysis of Non-Routine & High-Risk Expenses: Scrutinize legal expenses, consultancy fees, travel expenses, promotional spends, and round-sum disbursements.
5. Vendor Concentration & Related Party Testing: Identify unusual vendor concentrations, split purchase orders designed to evade tender limits, and payments to related parties.
6. Root Cause Identification & 5Cs Reporting: Formulate findings identifying root causes (lack of ERP validation, missing review controls) and provide actionable remediation plans.

1. XYX Limited (Listed Company):

• Under Section 138 read with Rule 13, internal audit is MANDATORY for every listed company without any monetary threshold. Hence, XYX Ltd must appoint an internal auditor.

2. MNM Limited (Unlisted Public Company):

• Criteria: Capital ≥ 50 Cr; OR Turnover ≥ 200 Cr; OR Loans > 100 Cr; OR Deposits ≥ 25 Cr.
• MNM Ltd has Paid-up Capital of ₹ 60 Crore, which exceeds the threshold of ₹ 50 Crore!
• Since meeting any ONE criterion triggers applicability, internal audit is MANDATORY for MNM Limited.

3. GFG Limited (Unlisted Private Company):

• Criteria: Turnover ≥ 200 Cr; OR Loans > 100 Cr. (Capital and Deposits thresholds do NOT apply to private companies!).
• GFG Ltd has Turnover of ₹ 180 Cr (below ₹ 200 Cr) and Loans of ₹ 80 Cr (below ₹ 100 Cr). Its Capital of ₹ 70 Cr is irrelevant for private companies.
• Hence, internal audit is NOT APPLICABLE to GFG Limited!

(a) Rishi's Responsibilities as Internal Auditor:

• Reviewing the adequacy of the accounting and financial reporting system to ensure reliability and integrity of financial records.
• Examining internal controls over cash and bank disbursements to identify control breakdowns, unauthorized payments, or potential fraud.
• Evaluating the accounting impact of new or modified business policies and reporting the lack of notification to the Audit Committee.

(b) Direct Assistance on Going Concern (SA 610 Prohibitions):

• Under SA 610 (Revised), the external auditor shall not use internal auditors to provide direct assistance in evaluating the appropriateness of management's use of the Going Concern assumption.
• Going concern assessment involves significant professional judgment and evaluation of management's future plans. Therefore, CA Nitin CANNOT ask Rishi for direct assistance in evaluating going concern.

Under SA 610 (Revised):

• Direct assistance cannot be used for procedures relating to higher assessed risks of material misstatement where the judgment required in performing the relevant procedures is more than limited.
• Because these assertions involve higher assessed risks and were newly targeted in response to identified vulnerabilities, delegating substantive testing on these assertions to internal auditors is inappropriate.
• CA K must perform these procedures directly or through his own statutory engagement team members.

An Audit Trail (Edit Log) is a chronological, step-by-step digital record providing documentary evidence of the sequence of activities that have affected a specific transaction or data element in accounting software.

Statutory Purpose & Importance:

• Tracking Modifications: Records who made the entry, date and exact time of creation, subsequent alterations, and deletion attempts.
• Fraud Deterrence: Prevents unauthorized back-dated journal vouchers, suppression of sales, and manipulation of ledger balances.
• Data Integrity: Ensures financial statements are based on transparent, immutable accounting records.
• Mandatory Preservation: Companies must preserve books of account and edit logs for at least 8 financial years under Section 128(5).

(a) Jeneva Technologies Pvt. Ltd. (Private Company):

• Criteria for private companies: Turnover ≥ ₹ 200 Cr OR Loans > ₹ 100 Cr.
• Jeneva's turnover is ₹ 210 Crore, which is ≥ ₹ 200 Crore.
• Therefore, Jeneva Technologies Pvt. Ltd. IS REQUIRED to appoint an internal auditor.

(b) Cross Buildcon Ltd. (Unlisted Public Company):

• Criteria: Capital ≥ 50 Cr, Turnover ≥ 200 Cr, Loans > 100 Cr, Deposits ≥ 25 Cr.
• Cross Buildcon breaches TWO independent thresholds: Loans of ₹ 110 Cr (> ₹ 100 Cr) AND Deposits of ₹ 30 Cr (≥ ₹ 25 Cr).
• Therefore, Cross Buildcon Ltd. IS REQUIRED to appoint an internal auditor.

(c) Who Can Be Appointed:

• A Chartered Accountant, a Cost Accountant, or such other professional as decided by the Board. May or may not be an employee of the company.

The company must establish the following essential internal controls over its ERP:

1. Unique User Access Control: Discontinue shared logins immediately; enforce unique user credentials for every user with multi-factor authentication.
2. Continuous Audit Trail Configuration: Lock ERP configuration so that audit trail (edit log) is enabled 24x7 at both application and database levels without ability to disable.
3. Independent Log Review: Establish periodic management review of audit trail exception reports to detect unauthorized alterations.
4. Privileged User Restrictions: Segregate duties between system administrators (who maintain IT) and business users (who enter transactions).

CA L IS COMPLETELY WRONG!

Mandatory Documentation under SA 610 (Revised) & SA 230:

• The external auditor has sole responsibility for the audit opinion expressed and cannot dilute that responsibility by using direct assistance.
• SA 610 explicitly requires that the statutory audit documentation SHALL INCLUDE the working papers prepared by the internal auditors providing direct assistance, including signatures indicating who reviewed their work and the date of review!
• Additional Required Documentation: The evaluation of objectivity and competence, the written agreement from the entity, and the written agreement from the internal auditors.

Prior to using Mr. Yug for direct assistance, the statutory auditor must:

1. Evaluate Threats to Objectivity: Assess whether Mr. Yug has personal bias, operational conflicts, or financial interests that could impair objectivity.
2. Evaluate Level of Competence: Confirm Mr. Yug has requisite technical training, proficiency, and experience to execute the specific assigned audit tasks.
3. Obtain Written Entity Agreement: Obtain written confirmation from the company management that Mr. Yug will follow the statutory auditor's instructions and that management will not intervene.
4. Obtain Written Internal Auditor Agreement: Obtain written confirmation from Mr. Yug that he will keep specific matters confidential and inform the statutory auditor of any emerging threat to his objectivity.

CA M should advise management to implement the following controls:

1. Database & Application Level Enabler: Configure software parameters to enable edit logging across all transaction tables permanently.
2. Restricted DBA Rights: Prohibit database administrators from altering logging tables; ensure change-log tables are append-only.
3. Automated Heartbeat & Alert System: Implement automated alerts that trigger immediately if audit trail logging stops or fails.
4. Periodic Independent Log Scrutiny: Have internal audit or an independent IT auditor review log continuity certificates periodically.
5. Secure Archival & Backup: Ensure daily encrypted backups of audit logs are stored securely to comply with the 8-year statutory retention rule under Section 128(5).