Internal Audit Services in India

Internal audit is an activity within an organization where the management appoints an independent and objective auditor to evaluate internal controls and provide assurance to the management about the effectiveness of internal controls. It also involves consulting engagements conducted with an objective to add value and improve an organization’s operations.

Internal Audit helps an organization achieve its objectives since it provides assurance on the effectiveness of risk management, control, and governance practices in the organization. 

The activities conducted under Internal Audit include evaluation of internal controls towards effectiveness of design and implementation, reviewing business processes in terms of efficiency and effectiveness of operations, review accuracy of financial reporting and assess the organization’s compliance with laws, rules, regulations, and internal policies. As a part of the Internal Audit Report, the Internal Auditor also provides recommendations for improving processes, controls and overall governance.

Internal control is part of a business processes or system that is established to mitigate risks and ensure achievement of organization’s objectives. Internal controls have one or more of the following objectives: 

• Effectiveness and efficiency of operations: The organization’s operations are carried out in an effective and efficient manner. 
• Reliability of financial reporting: The financial statements and reporting done by and within an organization are reliable and accurate. 
• Compliance with laws and regulations: The organization complies with applicable laws, rules, regulations, and internal policies. 

Internal control are designed and implemented by the management and requires periodic evaluation by independent and objective auditors towards effectiveness of design and implementation.

There are several benefits of having an Internal Audit function in your organization. Some of the key benefits of internal audit are listed below:

1. Efficient and effective operations: Based on recommendations made by the Internal Auditor an organization can improve the its operations and processes and make them more efficient and effective.
2. Improved risk management: As a part of Internal audit the risk management processes are reviewed and it also involves evaluation of the effectiveness of its controls for managing the risks identified. The recommendations from Internal Audit can help in improving the overall decision making in relation to risk management.
3. Improved compliance: An Internal Auditor reviews the compliances with applicable laws, rule, regulations and internal policies of the company. It helps in timely identification of non-compliances and implementation of corrective and preventive actions to ensure compliances in future.
4. Enhanced credibility: A company that engages an Internal Auditor, demonstrates a commitment towards internal control and risk management. This enhances the company’s credibility among stakeholders, investors, customers, suppliers and regulators.
5. Improved decision-making: Internal audit provides reliable and objective insights to the management which is used by them to make informed decisions about the organization.

This is a very common dilemma that decision makers face when deciding the source of internal audit. While there are equal arguments between having outsourced and inhouse internal audit functions. Here are some benefits listed on how outsourcing internal audit benefits:

1. Expertise and specialization: Outsourcing internal audit gives the organization access to specialized expertise and knowledge which may not be available within the organization. For example, an organization may choose to outsource its internal audit function to a firm that specializes in a particular industry or type of risk.
2. Cost savings: Outsourcing internal audit can potentially lead to cost savings, as the organization does not need to maintain an in-house team of internal auditors. Travel costs can be eliminated by outsourcing audit to location specific internal audit firms.
3. Objectivity: Outsourcing internal audit provides an added level of objectivity, as the internal auditors are not employees of the organization and therefore, they do not do not get influenced by auditees holding senior positions.
4. Flexibility: The number of resources deployed can be adjusted based on changing audit needs of the organization in case of outsourcing, this leads to greater flexibility.
5. Access to best practices: An external provider of internal audit services has access to knowledge base of practices and tools based on diverse experience of its personnel. This helps the organization benchmark their practices with the best players in the market and improve itself.

Businesses of all sizes, structures, and scales can opt for Internal Auditing Services In India.

Internal audits can be conducted in a wide range of business areas or functions within a company. The decision on which departments to audit will depend on the organization’s philosophy on internal controls, its overall strategic objectives and its risk profile and risk appetite. The most common business areas or functions that every company subjects to internal audit are:

1. Financial reporting: Internal audits of financial reporting includes evaluation of internal control over financial reporting that helps in achieving the objective of having reliable financial statements and disclosures that are in compliance with applicable accounting standards and regulations.
2. Operational processes: Internal audits of operational processes such as Procure-to-pay and Order-to-cash, includes reviewing the efficiency and effectiveness of the organization’s operations, as well as the controls in place to ensure that operations are carried out in compliance with policies and procedures set by the governing authorities.
3. Compliance with laws and regulations: Internal audits of compliance with applicable laws, rules and regulations includes reviewing the organization’s overall compliance processes, identification of compliances applicable, compliance monitoring mechanism and reporting of non-compliances to the Board.
4. Information systems and technology: Internal audits of information systems and technology includes reviewing compliance with the organization’s information security policy and the effectiveness of internal controls relating to access control, data privacy, business continuity, network protection, etc.
5. Human resources: Internal audits of human resources includes reviewing compliance with the organization’s policies and procedures related to employee management and evaluating efficiency and effectiveness of processes with respect to hiring, performance evaluation, and training, succession, termination, etc.
6. Environmental, health, and safety: Internal audits of EHS includes reviewing the compliance with relevant laws and regulations relating to environment, health and safety, as well as internal policies and procedures related to environmental protection, occupational health and safety, and emergency preparedness.

The frequency of internal audit depends on the specific needs and risk profile of your Company. Generally, the frequency of internal audit of various function is planned in such a way that it provides necessary assurance to the Board and Audit Committee that the organization’s risk management, control, and governance processes are operating effectively.

At the department or function level, the frequency of internal audit depends on the overall risk level and past results of control evaluation for that department or function, and the contribution of that department or function to the organization’s objectives. Some internal audit activities, such as financial reporting audits, procurement audits, inventory audits, etc. may be conducted on a regular basis, while others may be conducted on a need basis.

It is important for the organization to determine the appropriate frequency of internal audit based on its risk profile and objectives, as well as its resources and capacity to conduct internal audit activities. The internal audit function should be flexible and able to adapt to changing risks and needs.

The internal auditor is not responsible for implementing internal controls. In fact, the role of an internal auditor’s is to evaluate the effectiveness of internal controls of an organization’s and to give feasible recommendations that will help improve business processes and systems. The responsibility to implement the internal controls lies with the management and Board of the organization.

The internal auditor’s role is to provide assurance that the internal controls are operating effectively and that they are sufficient to achieve the organization’s objectives. The internal auditor does this by performing audit procedures such as reviewing documentation, testing controls, and conducting interviews with key personnel. The internal auditor then provides a report to management and the audit committee detailing the findings of the audit and any recommendations for improvement.

The right time to appoint internal auditors will depend on the specific circumstances the organization is in, needs of the organization and its risk profile.

Under the Companies Act, 2013 your company needs to have internal audit if it meets any one of the following criteria:

1. Your company is Listed on a Stock Exchange
2. Your company is a Limited company having any one of the following in previous financial year:
   1. Share capital >= Rs. 50 crore
   2. Turnover >= Rs. 200 crore
   3. Outstanding Loans or Borrowing >= 100 crore
   4. Public Deposits >= 25 crore
3. Your company is a Private Limited company having any one of the following in previous financial year:
   1. Turnover >= Rs. 200 crore
   2. Outstanding Loans or Borrowing >= 100 crore

If your company does not fall under any of the above criteria, the following factors can be considered by your organization to determine the right time to appoint internal auditors:

1. Regulatory requirements: If your organization is regulated by a statutory authority and such authority mandatorily requires you to appoint internal auditors.
2. Size and complexity of the organization: If your organization has large and complex operations, having an internal audit function shall benefit through appropriate management of risks and ensuring effectiveness of internal controls.
3. Risk profile: If your organization is exposed to high level of risks, having an internal audit function benefits as it helps in identification and mitigation of potential risks.
4. Growth and expansion: If your organization is growing and expanding, it may become more complex and face new risks. In such cases, an internal audit function can help the organization manage its risks and ensure the effectiveness of its controls.

In India, there are several regulatory requirements related to internal audit services that may apply to different types of organizations. 

1. Companies Act, 2013: The Companies Act, 2013 requires following categories of companies to have an internal audit function:
   1. Company is Listed on a Stock Exchange
   2. Limited Company having any one of the following in previous financial year:
      1. Share capital >= Rs. 50 crore
      2. Turnover >= Rs. 200 crore
      3. Outstanding Loans or Borrowing >= 100 crore
      4. Public Deposits >= 25 crore
   3. Private Limited Company having any one of the following in previous financial year:
      1. Turnover >= Rs. 200 crore
      2. Outstanding Loans or Borrowing >= 100 crore
2. Banking Regulation Act, 1949: The Banking Regulation Act, 1949 requires all banks in India to have an internal audit function.
3. Insurance Act, 1938: The Insurance Act, 1938 requires all insurance companies in India to have an internal audit function.
4. SEBI Listing Regulations: The Securities and Exchange Board of India (SEBI) Listing Regulations require listed companies in India to have an internal audit function.
5. Reserve Bank of India (RBI) guidelines: The Reserve Bank of India (RBI) has issued guidelines related to the internal audit function in banks. These guidelines specify the responsibilities of the internal auditor and the reporting requirements for the internal audit function.

In addition to these regulatory requirements, there are also professional standards and guidelines that apply to internal audit, such as the International Professional Practices Framework (IPPF) published by the Institute of Internal Auditors (IIA).

Generally, the internal auditor reports to the Audit Committee, which is a sub-committee of the Board of Directors.

The Audit Committee is responsible for overseeing the organization’s internal audit functions among other things. The internal auditor provides the audit committee with regular reports on the status of the internal audit function and the results of internal audit engagements.

In some cases, the internal auditor reports directly to the Board of Directors or those in charge of governance.

It is not necessarily required to appoint an external agency as the internal auditor. Some organizations choose to establish an internal audit function in-house, while others choose to outsource the internal audit function to an external provider.

There are pros as well as cons to both these approaches, and the decision whether to appoint an external agency as the internal auditor or set it up in-house will depend on the specific needs and circumstances of the organization.

Some organizations may choose to outsource the internal audit function to an external provider in order to access specialized expertise or to ensure objectivity, while others may choose to maintain an in-house internal audit function in order to have greater control over the internal audit process.

It is important for the organization to carefully consider the advantages and disadvantages of both in-house and external internal audit functions and to choose the approach that best meets its needs.

There are several steps you can take to evaluate an internal audit firm before making a selection:

1. Review the firm’s qualifications and experience: It is important to ensure that the internal audit firm has members with the necessary professional qualifications and experience to effectively perform the audit. This may include relevant professional degrees, such as Chartered Accountant (CA) or Certified Internal Auditor (CIA), and experience in auditing or a related field.
2. Consider the firm’s industry expertise: It can be helpful for the internal audit firm to have a good understanding of the organization’s industry and the specific risks and challenges that it faces. However, this is not a limitation as auditors without the industry knowledge may ask more fundamental questions and evaluate without familiarity bias.
3. Evaluate the firm’s objectivity: The internal audit firm should be objective and independent in order to provide unbiased assurance and consulting services.
4. Assess the firm’s communication skills: The internal audit firm should be known for prompt and real-time communication of audit findings and recommendations to the management and the audit committee.
5. Review the firm’s analytical skills: The internal audit firm should have members with strong analytical skills in order to evaluate the effectiveness of the organization’s controls and processes and to identify opportunities for improvement.
6. Evaluate the firm’s problem-solving skills: The internal audit firm reflect its ability to solve problems through its consulting engagements.
7. Consider the firm’s reputation: Consider the reputation of the internal audit firm among peers and in the industry. Review its track record and the references of its past and present clients.

It is important to carefully evaluate the qualifications and experience of potential internal audit firms in order to ensure that the organization has the right firm for the job.