Internal audit is a critical function that helps organizations assess their operations, manage risks, and ensure compliance with applicable laws and regulations. In India, the requirements for internal audits are primarily governed by the Companies Act, 2013.
Applicability of Internal Audit
- Mandatory Requirement
Under Section 138 of the Companies Act, 2013, the following companies are required to appoint an internal auditor:
- Listed Companies: All listed companies must have an internal audit function.
- Public Companies:
- Companies with a paid-up capital of ₹50 crore or more.
- Companies having a turnover of ₹200 crore or more.
- Companies with borrowings of ₹100 crore or more.
- Private Companies: Certain private companies may also fall under this requirement based on similar criteria.
- Non-Mandatory Internal Audits
While the above companies must have an internal audit function, other companies can choose to have an internal audit based on their size, complexity, or risk profile.
Compliance Requirements for Companies with Mandatory Internal Audits
Once internal audit becomes mandatory for a company, several compliance requirements must be fulfilled:
- Appointment of Internal Auditor
- Board Responsibility: The internal auditor must be appointed by the Board of Directors.
- Qualifications: The internal auditor should possess the necessary qualifications and experience. Typically, a Chartered Accountant (CA) or a professional with relevant certifications is preferred.
- Internal Audit Charter
- Document Creation: Companies should establish an internal audit charter that outlines the scope, authority, and responsibilities of the internal audit function.
- Approval: The charter should be approved by the Board or the Audit Committee.
- Conducting Internal Audits
- Regular Audits: The internal audit function should conduct regular audits of the company’s operations, financials, and compliance with laws.
- Audit Plan: An annual audit plan should be developed, detailing the areas to be audited and the resources required.
- Reporting and Communication
- Audit Reports: The internal auditor must prepare reports detailing the findings, recommendations, and corrective actions.
- Board Communication: Key findings and reports should be communicated to the Board or the Audit Committee for review and action.
- Follow-Up on Recommendations
- Implementation Tracking: Companies must ensure that the recommendations made by the internal auditor are implemented in a timely manner.
- Follow-Up Audits: Periodic follow-up audits should be conducted to verify the implementation of corrective measures.
- Compliance with Standards
- Internal Audit Standards: The internal audit function should comply with established standards, such as those set by the Institute of Internal Auditors (IIA) or relevant national standards.
- Quality Assurance: Companies may also consider conducting external assessments of their internal audit function to ensure effectiveness and compliance.
- Disclosure in Financial Statements
- Annual Reports: Companies must disclose the appointment of internal auditors and details of the internal audit function in their annual reports as required by the Companies Act.