Internal Audit Services in India

Q: Which companies are required to appoint an internal auditor under the Companies Act?

Listed companies; unlisted public companies with paid-up capital ₹50 crore+, turnover ₹200 crore+, or borrowings ₹100 crore+; and private companies with turnover ₹200 crore+ or outstanding loans ₹100 crore+ under Section 138.

Q: What is the difference between internal audit and statutory audit?

Statutory audit is an external, legally mandated opinion on financial statements for shareholders and regulators. Internal audit is an ongoing management-focused function assessing risks, controls, and operational improvements for management and the audit committee.

Q: What is the difference between outsourced and co-sourced internal audit?

Outsourced internal audit means the entire function is provided externally. Co-sourced means an external firm supplements an in-house team — providing specialist skills, capacity, or coverage for specific high-risk areas.

Q: What is a risk-based internal audit approach?

A risk-based approach prioritises audit coverage based on relative risk of each business process. High-risk areas receive more frequent and detailed coverage, directing effort where it adds the most value and assurance.

Q: How does internal audit add value beyond compliance?

Internal audit adds value by identifying process inefficiencies, preventing fraud, improving management information quality, strengthening governance, and providing the board with independent assurance on risk management and controls.

Independent, risk-focused internal audit services that go beyond compliance — identifying control weaknesses, improving operational efficiency, and strengthening governance for businesses across industries.

Risk-Based Audit Planning

Development of an annual internal audit plan based on a risk assessment of business processes, identifying high-risk areas for priority coverage and allocating audit resources accordingly.

Process & Control Reviews

In-depth review of key business processes — procure-to-pay, order-to-cash, payroll, inventory, treasury — assessing control design and operating effectiveness and recommending improvements.

Compliance Audit

Assessment of compliance with applicable laws, regulations, internal policies, and contractual obligations — identifying gaps and recommending corrective actions before regulatory exposure materialises.

Audit Committee Reporting

Preparation of structured, action-oriented internal audit reports for the audit committee — with clear findings, risk ratings, root cause analysis, and management action plan tracking.

What is Internal Audit?

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes.

Under Section 138 of the Companies Act, 2013, certain classes of companies — including listed companies, unlisted public companies above prescribed thresholds, and private companies meeting specified criteria — are required to appoint an internal auditor. For many other businesses, internal audit is adopted voluntarily as a tool for operational improvement and governance strengthening.

Who Needs Internal Audit Services?

Listed companies and unlisted public companies required under Section 138 of the Companies Act
Private companies with turnover above ₹200 crore or outstanding loans above ₹100 crore
Banks, NBFCs, and financial institutions with regulatory internal audit requirements
Manufacturing and trading businesses seeking to strengthen operational controls
Organisations preparing for statutory audit, IPO, or management buyout

Why Choose Our Internal Audit Services?

Our internal audit practice delivers practical, business-focused findings — not just compliance checklists. We use a risk-based approach to focus audit effort on the areas that matter most, work collaboratively with management to understand root causes, and track remediation to ensure audit findings translate into real improvements.

Whether you need a co-sourced internal audit partner to supplement your in-house team or a fully outsourced internal audit function, we provide the flexibility, expertise, and independence that your audit committee expects.

Frequently Asked Questions

Which companies are required to appoint an internal auditor under the Companies Act? +

Under Section 138 of the Companies Act, 2013 and the Companies (Accounts) Rules, the following are required to appoint an internal auditor: listed companies; unlisted public companies with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or PFIs exceeding ₹100 crore, or outstanding deposits of ₹25 crore or more; and private companies with turnover of ₹200 crore or more or outstanding loans exceeding ₹100 crore.

What is the difference between internal audit and statutory audit? +

A statutory audit is an external, legally mandated audit of financial statements providing an opinion for shareholders and regulators. Internal audit is an ongoing, management-focused function that assesses risks, evaluates controls, and identifies operational improvements — primarily serving management and the audit committee. The two serve different purposes and both are important for a well-governed organisation.

What is the difference between outsourced and co-sourced internal audit? +

In an outsourced internal audit arrangement, the entire internal audit function is provided by an external firm — covering planning, execution, and reporting. In a co-sourced arrangement, an external firm supplements an existing in-house internal audit team — typically providing specialist skills, additional capacity, or coverage for specific high-risk areas. Both models can provide independence and expertise while being tailored to the organisation's needs.

What is a risk-based internal audit approach? +

A risk-based internal audit approach prioritises audit coverage based on an assessment of the relative risk of each business process and function. Rather than auditing all areas with equal frequency, high-risk areas receive more frequent and detailed coverage while lower-risk areas are reviewed less frequently. This ensures that audit effort is directed where it can add the most value and provide the greatest assurance to management and the audit committee.

How does internal audit add value beyond compliance? +

Beyond compliance, internal audit adds value by identifying process inefficiencies and cost-saving opportunities, preventing fraud and errors before they cause financial loss, improving the quality of management information, strengthening governance and accountability, and providing the board and audit committee with independent assurance on the effectiveness of risk management and internal controls.

Strengthen Your Controls. Improve Your Business.

Risk-focused internal audit services that deliver real value — not just compliance.

Get Started

F.A.Q.

What is anti-bribery and corruption risk assessment?

It is the process of identifying and managing risks related to bribery, corruption, and unethical practices in a business.

Why is anti-bribery compliance important?

It helps prevent legal penalties, protects reputation, and ensures ethical business operations.

Which laws govern anti-bribery in India?

The Prevention of Corruption Act, 1988 and other regulatory frameworks govern anti-bribery compliance.

What are common corruption risks in businesses?

Unethical payments, vendor kickbacks, fraud, and lack of internal controls.

How can companies reduce bribery risks?

By implementing strong policies, conducting due diligence, and monitoring transactions.

What is third-party due diligence?

It involves evaluating vendors and partners to identify potential compliance and corruption risks.