Internal audit services in India give a business an independent, ongoing check on whether its own controls, processes and numbers are actually working — distinct from the statutory audit that signs off the year-end accounts. A statutory audit looks backward and reports to shareholders; an internal audit looks at how the business runs today and reports to the board and management, so problems are caught before they reach the financial statements. For some companies the law now makes this function mandatory; for many others it is a choice — and the first leak it catches usually covers its cost.
What internal audit services in India actually cover
Internal audit reviews the systems behind the numbers rather than the numbers alone. In practice that means testing whether approvals are followed, whether payments match purchase orders and receipts, whether revenue is recorded in the right period, whether statutory dues such as GST, TDS, PF and ESI are computed and deposited on time, and whether the controls the company believes it has are the controls it actually operates. The output is not an opinion on the accounts — it is a list of findings, each with the risk it exposes and a specific corrective action, tracked until it is closed.
A typical engagement runs on a cycle: agree a risk-based plan with the board or audit committee, test each area against that plan, report findings with management responses, then follow up that the agreed fixes were actually made. It is continuous assurance, not a once-a-year event, which is why it sits far closer to how the business runs day to day than the statutory audit does. That is also why many companies scope it as part of a broader audit and assurance programme rather than a standalone exercise.
Which companies are legally required to have an internal audit
Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, makes an internal audit mandatory for defined classes of company, measured against the preceding financial year. The internal auditor may be a chartered accountant, a cost accountant, or such other professional as the board decides, and the law expressly allows that person to be an individual or firm from outside the company rather than an employee.
| Company | When an internal audit is mandatory (preceding financial year) |
|---|---|
| Every listed company | Always — no threshold applies. |
| Unlisted public company | Paid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point; or outstanding deposits of ₹25 crore or more. |
| Private company | Turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point. |
Any single trigger is enough. A private company can cross the borrowing line through one large facility and fall into the requirement without turnover or paid-up capital ever being close. Because the test runs on the preceding year, the obligation can arise before management notices — which is why the thresholds are worth checking at each year-end rather than assumed away.
Why companies below the threshold still run one
Most businesses that commission internal audit in India are not legally required to. They do it because the statutory audit is not built to find what quietly costs money during the year: a vendor paid twice, input tax credit claimed on invoices suppliers never filed, TDS deducted at the wrong rate, reimbursements with no second check, revenue leaking through unbilled work. These are control failures, not accounting errors, and an internal audit surfaces them months before they would ever appear in year-end financials.
For a growing company the function also does something the owner can no longer do alone — give independent eyes on a business that has outgrown the stage where one person saw every transaction. It is the same reason a company brings in virtual CFO support: the organisation has reached a size where informal oversight simply stops being enough.
What to outsource, and what the board keeps
Internal audit is one of the more natural functions to outsource, because independence is the whole point — a reviewer sitting inside the team they review is compromised by design. An external provider brings the testing discipline, the sampling methods and the exposure to how other companies solve the same control problems, without the fixed cost of a standing in-house department that a mid-size business cannot keep busy all year.
What does not move is accountability. The board and audit committee still own the risk, set the scope and decide which findings get acted on; the statutory auditor stays separate; and management still has to implement the fixes. A good outsourced internal audit, run alongside the company’s accounting and bookkeeping and under the board’s direction, gives the organisation the assurance without the headcount — the review done properly, the sign-off kept exactly where the law and good governance put it.
If your company is approaching the Section 138 thresholds, or has simply outgrown the point where informal checks are enough, the practical step is to scope a risk-based internal audit plan now and decide which areas to test first — so the first cycle lands where the money actually leaks.