Internal Audit & Risk

Internal audit is separate from the statutory audit and answers to management or the audit committee rather than to shareholders. We plan the work by risk: which processes move cash, which create liabilities, and which depend on a single person. Procure-to-pay, order-to-cash, payroll, inventory movement, and statutory compliance are the usual starting points. Testing is sample-based and documented, so that a finding can be traced back to the transaction that produced it. Each observation records the control gap, its consequence, the process owner, and an agreed remediation date. We follow up in the next cycle rather than reissuing the same list. Some companies fall under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014. There, the appointment and the reporting cadence follow that requirement. For a company preparing for a statutory audit or a funding round, the same work reduces surprises later. Related work includes internal financial control documentation under Section 143(3)(i), risk registers, and standard operating procedures. We also investigate where a specific concern has already been raised.