Risk-Based Internal Audits

It is an internal audit function where the areas you audit, and how deeply you audit them, are decided by where the organisation's actual risk is highest — not by a fixed rotation that gives every department roughly equal attention regardless of how risky it actually is. A risk assessment identifies which processes, locations, or business lines are most likely to have control gaps or fraud exposure, and the annual audit plan allocates the available hours accordingly.

Yes, for a defined class of companies. Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 mandates internal audit for every listed company, and for unlisted public companies and private companies that cross prescribed thresholds of paid-up share capital, turnover, outstanding loans or borrowings from banks or financial institutions, or outstanding deposits — measured as at the end of the preceding financial year. Companies below these thresholds are not statutorily required to appoint an internal auditor, though many still choose to for governance and lender-confidence reasons.

The internal auditor may be a Chartered Accountant (whether in practice or not), a Cost Accountant, or such other professional as the Board may decide, and may be an individual, a partnership firm, or a body corporate — but the person appointed must not have any conflict of interest that compromises independence, such as being the same firm that also serves as the company's statutory auditor for the relevant year.

The difference is in the starting point. A traditional cyclical plan typically starts from a list of departments or locations and rotates through them on a fixed schedule — procurement this year, payroll next year, and so on — largely irrespective of which area actually carries the most risk right now. A risk-based plan starts from a documented risk assessment, ranks the audit universe by likelihood and impact, and allocates audit hours so higher-risk areas get more frequent and deeper coverage. Many internal audit functions already claim to be risk-based informally, but without a documented risk assessment behind the plan, it is difficult to demonstrate this to the Audit Committee or defend the scope choices made.

The Institute of Chartered Accountants of India has issued a suite of Standards on Internal Audit (SIAs), revised and re-numbered into a 100-series (key concepts) and 200-series (internal audit management) structure. SIA 130 (Risk Management) sets out how internal audit should evaluate the entity's risk management process, and SIA 220 (Conducting Overall Internal Audit Planning) directs that the internal audit plan be developed from a structured, documented risk assessment rather than an arbitrary or purely historical scope. Read together, these standards give the audit plan a professional, defensible basis that stands up to Audit Committee, statutory auditor, and — where relevant — regulator scrutiny.

Both models are available. For companies without an internal audit function, PNPC can serve as the fully outsourced internal auditor — covering risk assessment, plan design, fieldwork, reporting, and follow-up. For companies with an existing internal audit team that needs additional capacity, specialist skills (IT audit, forensic techniques, sector-specific expertise), or an independent risk assessment methodology overlay, PNPC works in a co-sourced model alongside the in-house team.

The risk assessment underlying the annual plan should be formally refreshed at least once a year, ahead of the new financial year's planning cycle, and should also be revisited mid-year if a material event changes the organisation's risk profile — an acquisition, a new business line, a significant control failure elsewhere in the business, or a major regulatory change. A risk assessment done once and never revisited quickly becomes stale and misdirects audit hours toward risks that may no longer be the most material ones.

Independence is a genuine professional requirement, not a formality. Where PNPC provides accounting, payroll, or tax compliance services to a client, we do not also serve as that client's internal auditor over the same functions — doing so would mean auditing our own work, which compromises the value and credibility of the audit. We structure engagements to avoid this conflict, either by having a different PNPC team with appropriate independence safeguards handle internal audit, or by recommending an alternative arrangement where the conflict cannot be adequately managed.

Cost depends on company size, the number of locations and business lines in the audit universe, sector complexity, and whether the engagement is fully outsourced or co-sourced with an existing in-house team. PNPC agrees a fixed, written scope and fee before any engagement begins, typically structured around the annual audit plan's total hours, with the risk assessment and plan design phase priced separately from the ongoing fieldwork and reporting cycle.

This is a common and entirely expected outcome, particularly in the first year of adopting a risk-based approach — it usually means audit hours were previously spread too thin across low-risk areas. The response is not to audit everything superficially, but to present the Audit Committee with an honest picture: the highest-priority risks that will be covered within the current budget, and the residual risk in areas that will not be covered this cycle, so the Committee can make an informed decision — accept the residual risk, increase the audit budget, or extend the timeline for full-universe coverage across multiple years.

RBIA is preventive and diagnostic — it tests whether the controls designed to prevent or detect fraud are actually operating effectively, and a risk-based approach specifically increases scrutiny in areas with higher fraud susceptibility (cash handling, related-party transactions, procurement with limited segregation of duties). It is not, however, a substitute for a targeted forensic investigation once a specific fraud is suspected or detected — at that point, a dedicated forensic engagement with its own investigative methodology and evidentiary standards is the appropriate response.

Where a formal ERM function exists, its risk register is a natural and valuable primary input to the internal audit's own risk assessment and audit universe — the highest-priority enterprise risks should directly inform which areas get the most audit attention. Internal audit's control testing, in turn, provides evidence back to ERM about whether the controls assumed to mitigate specific risks are actually working, refining the residual risk scores in the risk register. The two functions are meant to reinforce each other, not operate as disconnected exercises.

Yes. A full enterprise-wide ERM programme is not a prerequisite for RBIA. Where no formal ERM function exists, we run a scoped risk identification exercise specifically to inform the audit plan — structured interviews with the CEO, CFO, and function heads, review of prior audit findings and the statutory auditor's management letter, and assessment of transaction volume, complexity, and control history across the audit universe. This produces a defensible risk-weighted plan without requiring the organisation to first build a separate, full ERM framework.

A well-structured internal audit report includes: the specific objective and scope of the audit and the risks it was designed to address, rated findings (typically categorised by severity — high, medium, low), root cause analysis rather than just a description of the symptom, management's response and committed remediation timeline for each finding, and status of previously reported findings that remain open. This gives the Committee a complete, actionable picture rather than a narrative report that is difficult to act on.

For a company with reasonable process documentation and management availability for interviews, a first risk-weighted annual audit plan — from risk assessment input gathering through Audit Committee approval — typically takes 4-6 weeks. The methodology itself is embedded from the first planning cycle; the benefits compound over subsequent years as the risk assessment is refined and the historical findings data feeds back into future prioritisation.

Co-sourcing means the company retains its own internal audit team or function, and engages an external firm like PNPC to supplement it — typically for specialist skills the in-house team lacks (IT audit, data analytics, forensic techniques), additional capacity during peak audit periods, or an independent risk assessment methodology overlay. It tends to make sense for mid-sized to large companies with an existing internal audit team that has strong institutional knowledge but gaps in specific technical areas or bandwidth, where a fully outsourced model would discard valuable in-house context, and a purely in-house model would leave real capability gaps unaddressed.

Yes. PNPC operates from Chennai, Bangalore, Hyderabad, and Dubai. For groups with both Indian and UAE entities, we build a coordinated audit universe and risk assessment that captures cross-border risk correlation — intercompany transaction controls, transfer pricing documentation risk, UAE Corporate Tax and VAT compliance risk, and jurisdiction-specific regulatory risk — rather than running two disconnected, entity-level audit plans that miss how a control gap in one jurisdiction can affect the other.

It can, though the case for it is proportionality-driven rather than statutory. Private equity or venture capital investors increasingly expect a documented internal audit or control-review process as part of governance reporting even pre-threshold. Lenders and rating agencies factor internal control maturity into credit assessments. And practically, a scoped risk assessment and a lighter-touch periodic review of the highest-risk processes — even without a full annual audit plan — can catch control gaps before they become losses. For a small, single-location company with no institutional capital and no near-term growth plans, this is often disproportionate, and a periodic financial review may suffice instead.

Inherent risk is the level of risk in a process or area before considering any existing controls — for example, cash handling is inherently high-risk regardless of how well it is controlled. Residual risk is what remains after existing controls are factored in — a process with high inherent risk but strong, well-tested controls may have low residual risk and warrant lighter audit coverage, while a process with moderate inherent risk but weak or unproven controls may have high residual risk and warrant deeper testing. Rating the audit universe purely on inherent risk, without considering existing controls, misdirects audit hours toward areas that may already be well-managed.

A previously unaudited area is not automatically treated as low priority simply because there is no findings history to reference — the risk assessment considers transaction volume and value, process maturity, personnel turnover, and inherent characteristics of the activity (cash-intensive, related-party exposure, regulatory complexity) even where there is no prior audit trail. In practice, a previously unaudited high-transaction-volume area often scores as high-priority precisely because there is no evidence yet that its controls are working.

Where transaction volumes and system access support it, we use data analytics to test full populations rather than relying solely on sample-based testing — for example, analysing the complete general ledger for unusual journal entries, testing 100% of vendor payments against the approved vendor master for duplicate or fictitious vendor red flags, or reviewing the full population of expense claims against policy thresholds rather than a small sample. This increases the reliability of findings, particularly in high-transaction-volume areas identified as high-risk in the audit universe.

They can be relevant. The statutory auditor's assessment of Internal Financial Controls over financial reporting under Section 143(3)(i) considers the overall control environment, and evidence from a well-documented internal audit function — including unresolved findings in financially significant areas — can inform the statutory auditor's own risk assessment and testing approach. A pattern of unresolved, financially material internal audit findings can, in some cases, contribute to a qualified or adverse IFC opinion if the underlying control weakness is not remediated.

For the function to be genuinely independent, the internal auditor should report functionally to the Audit Committee (for approval of the audit plan, findings, and resourcing) and only administratively — for practical matters like office logistics — to management, typically the CEO or another senior executive without a conflict of interest in the areas being audited. An internal audit function that reports solely to the CFO, for instance, faces an inherent independence tension when auditing finance-function controls.

Treating it as a compliance checkbox rather than a genuine management tool — an annual rotational plan produced to satisfy Section 138, findings reported once and rarely followed up to actual closure, and an Audit Committee that receives the report but does not substantively engage with it. The symptoms are consistent: the same low-value findings repeat year after year, high-risk areas go unaudited for years at a stretch simply because they were not next in the rotation, and management treats the audit as an annual event to survive rather than an ongoing source of insight into where the business is exposed.

Every finding is logged with a named owner and a committed remediation date agreed with management at the time the finding is reported — not left open-ended. Subsequent audit cycles specifically re-test previously open high and medium-severity findings to verify actual closure, rather than accepting management's word that an issue has been fixed. Findings that remain open past their committed date, or recur after being marked closed, are explicitly escalated to the Audit Committee with the history of prior commitments made and missed.

IT general controls — access management, change management, backup and recovery, and system interface controls — are included in the audit universe wherever the risk assessment identifies them as material, which is the case for most businesses running a core ERP or financial system today. Where deeper technical IT audit expertise is required (penetration testing, detailed cybersecurity architecture review), we scope this as a specialist add-on or coordinate with a specialist IT audit partner, while keeping the overall risk-based plan and Audit Committee reporting coordinated through a single engagement.

An internal audit finding arises from testing conducted under the company's own risk-based audit plan, covering financial, operational, compliance, and fraud-risk areas as prioritised by the risk assessment, and is reported to the Audit Committee as part of an ongoing, year-round function. A statutory auditor's observation arises from year-end testing conducted specifically to support the audit opinion on the financial statements, is narrower in scope (financial statement assertions and IFC over financial reporting), and is typically communicated once a year through the management letter alongside the audit report.

For NBFCs, the risk assessment specifically incorporates RBI's risk-based supervision expectations, asset classification and provisioning discipline under Ind AS 109, credit concentration risk, and — depending on the NBFC's regulatory layer under RBI's Scale Based Regulation framework — any enhanced internal audit expectations that apply at that layer. For RERA-registered real estate developers, the audit universe specifically covers project-level escrow account compliance under Section 4(2)(l)(D) of the RERA Act, cost certification processes, and project-wise fund utilisation — categories a generic, non-sector-specific audit plan typically misses.

Yes, and it should be. A risk-based plan that is treated as fixed for the entire year defeats much of the purpose of the risk-based approach. PNPC builds a formal mid-year checkpoint into every RBIA engagement to reassess whether a new risk event — an acquisition, a regulatory change, a control failure discovered elsewhere, a significant personnel change in a key role — warrants reprioritising the remaining audit hours in the plan, with any material reallocation presented to the Audit Committee for approval.

PNPC's internal audit engagements are led by practising Chartered Accountants with internal audit and risk advisory experience, supported by a team with relevant sector exposure and, where the engagement scope requires it, IT audit and data analytics capability. As a CA firm operating since 1986, our internal audit practice sits alongside statutory audit, tax, and advisory functions — bringing broader regulatory and financial reporting context to internal audit findings than a standalone internal-audit-only provider typically has available.

There is no fixed statutory size floor — Section 138 applicability is defined by the specific Rule 13 thresholds, not a general notion of company size. Below those thresholds, the decision becomes a proportionality judgement: a mid-sized private company with growing transaction volumes, multiple locations, or institutional investors on the cap table often benefits meaningfully from a scaled-down risk-based review, even without statutory compulsion, while a very small, simple, single-location business typically does not yet need the formality of a full annual risk-based audit plan.