Chapter 16: Internal Audit (Section 138 & SIAs Framework)
1. Section 138 Applicability Rules (Mnemonic: D-T-L-P)
Section 138 of the Companies Act 2013 mandates the appointment of an internal auditor for prescribed classes of companies.
| Class of Company | Statutory Criteria (During Preceding Financial Year) |
|---|---|
| Every Listed Company | Always Mandatory (no threshold limits apply). |
| Every Unlisted Public Company | Satisfying ANY ONE of the following 4 thresholds in preceding FY: • Deposits outstanding ≥ ₹ 25 Crore at any point of time. • Turnover ≥ ₹ 200 Crore. • Loans / borrowings from banks/FIs > ₹ 100 Crore at any point of time. • Paid-up Share Capital ≥ ₹ 50 Crore. |
| Every Private Company | Satisfying ANY ONE of the following 2 thresholds in preceding FY: • Turnover ≥ ₹ 200 Crore. • Loans / borrowings from banks/FIs > ₹ 100 Crore at any point of time. |
Who Can Be Appointed as Internal Auditor?
A Chartered Accountant (in practice or not), or a Cost Accountant, or such other professional as may be decided by the Board. The internal auditor may or may not be an employee of the company, and internal audit may be conducted by a firm / LLP.
2. Standards on Internal Audit (SIAs) High-Yield Summary
| SIA Series | Standard Title | Core Principle / Objective |
|---|---|---|
| SIA 210 | Managing the Internal Audit Function | Establish internal audit charter, independence, proficiency, and quality assurance review. |
| SIA 220 | Conducting Internal Audit Engagements | Plan, execute, evaluate evidence, document, and report engagement findings systematically. |
| SIA 310 | Planning the Internal Audit Assignment | Align audit plan with business objectives, risks, processes, and available audit resources. |
| SIA 320 | Internal Control Evaluation | Assess design, implementation, and operating effectiveness of entity-level and process-level controls. |
| SIA 330 | Internal Audit Documentation | Working papers must support observations, findings, and recommendations; retained safely. |
| SIA 520 | Internal Audit Sampling | Determine sample design, sample size, and evaluate sample errors to extrapolate to population. |
3. Risk-Based Internal Audit (RBIA) Approach
Evolution of RBIA
Traditional transaction-checking internal audit has transitioned to Risk-Based Internal Audit, where internal audit resources are directed to areas with the highest residual risk.
| Step in RBIA | Activities Performed |
|---|---|
| 1. Understand Risk Appetite | Review Enterprise Risk Management (ERM) framework, board risk tolerance levels, strategic goals. |
| 2. Audit Universe & Risk Scoring | Catalogue all auditable entities / processes. Score each on Inherent Risk × Control Vulnerability = Residual Risk. |
| 3. Priority Audit Plan | Allocate audit hours to high-risk units first (annual/continuous audit) while low-risk units are audited on longer cycles (every 2-3 years). |
| 4. Value-Added Reporting | Report root causes of control failures and actionable business-improvement recommendations to the Audit Committee. |
4. Internal Audit vs Statutory Audit vs Operational Audit
| Feature | Statutory Audit | Internal Audit | Operational Audit |
|---|---|---|---|
| Objective | True & fair view of Financial Statements. | Review internal controls, risk management, and governance. | Appraise operations for economy, efficiency, and effectiveness. |
| Appointed By | Shareholders at AGM. | Board of Directors / Audit Committee. | Management. |
| Reports To | Shareholders / Members. | Audit Committee / Board of Directors. | Operating Management. |
| Statutory Basis | Mandatory under Sec 139. | Mandatory under Sec 138 (if thresholds met). | Voluntary / Management discretion. |