A new provision relating to internal audit - Article by Dr S. Chandrasekaran published in Business Advisor dated June 10, 2013 (http://www.magzter.com/IN/Shrinikethan/Business-Advisor/Business/54223)

1. Volume VII Part 5 June 10, 2014 8 Business Advisor
A new provision relating to internal audit
Dr S. Chandrasekaran
Internal audit
Internal audit is an examination, monitoring and
analysis of activities related to a company's operation,
including its business structure, employee behaviour
and information systems. An internal audit is designed
to review what a company is doing in order to identify
potential threats to the organisation's health and
profitability, and to make suggestions for mitigating the
risk associated with those threats in order to minimise
costs.
The Sarbanes-Oxley Act of 2002 was enacted as a reaction to a number of
major corporate and accounting scandals including those affecting Enron,
Tyco International, Adelphia, Peregrine Systems and WorldCom. These
scandals cost investors billions of dollars when the share prices of affected
companies collapsed, and shook public confidence in the US securities
markets. Enactment of this regulation has increased oversight role of boards
of directors and thus the requirement for performing internal audits. They
are important components of a company's risk management, as they help
companies identify issues before they become substantial problems. They
also help identify risky behaviour by individual employees and threats posed
by outside parties, such as attempts to steal intellectual property.
The Institute of Internal Auditors (IIA) is an international professional
association established in 1941 in the US. The Institute of Internal Auditors,
India, is affiliated to its parent body IIA, Inc., in Florida, USA. Generally, the
members of the said Institute are working in internal auditing, risk
management, governance, internal control, information technology audit,
security etc. The concept of internal audit is so wide that it is not an
exclusive area relating only to financial functions.
The scope of internal auditing within an organisation is broad and may
involve topics such as organisation's governance, risk management and
management controls over efficiency/ effectiveness of operations (including
safeguarding of assets), the reliability of financial and management
reporting, and compliance with laws and regulations. Internal auditing may
also involve conducting proactive fraud audits to identify potentially
fraudulent acts; participating in fraud investigations under the direction of

2. Volume VII Part 5 June 10, 2014 9 Business Advisor
fraud investigation professionals, and conducting post investigation fraud
audits to identify control breakdowns and establish financial loss (Source:
Wikipedia).
Frequent or on-going audit conducted by an entity‟s own (as opposed to
independent) accountants to (1) monitor operating results, (2) verify
financial records, (3) evaluate internal controls, (4) assist in efforts for
increasing efficiency and effectiveness of operations and, (5) to detect fraud.
Internal audit can identify control problems, and aims at correcting lapses
before they are discovered during an external audit. Although the internal
audit can be done by an entity‟s employees, they normally do not audit
themselves, and the task is usually entrusted to independent auditors.
(Source: Business Dictionary).
Concept of internal audit in MAOCARO & CARO
The internal audit system was introduced in Manufacturing and other
Companies (Auditor's Report) Order, 1988 (MAOCARO), and accordingly, the
statutory auditors have to report whether the company has internal audit
system commensurate with its size and nature of business. This
requirement applied in respect of a company having paid up capital
exceeding Rs 25 lakh at the commencement of the financial year or having
an average turnover exceeding Rs 2 crore for a period of three consecutive
financial years immediately preceding the relevant financial year.
The Companies (Auditor‟s Report) order, 2003 (CARO) came into force on
01.07.2003 in replacement of MAOCARO. The concept of internal audit
system was strengthened in CARO and accordingly, internal audit system is
applicable to:
Every company including a foreign company as defined in section 591 of the
Companies Act, 1956 except the following:
(i) a Banking company as defined in clause (c) of section 5 of the Banking
Regulation Act, 1949 (10 of 1949);
(ii) an insurance company as defined in clause (21) of section 2 of the
Companies Act, 1956;
(iii) a company licensed to operate under section 25 of the Companies Act,
1956; and
(iv) a private limited company with a paid up capital and reserves not more
than fifty lakh rupees and has not accepted any public deposit and does not

3. Volume VII Part 5 June 10, 2014 10 Business Advisor
have loan outstanding ten lakh rupees or more from any bank or financial
institution and does not have a turnover exceeding five crore rupees.
Introduction of internal audit in Companies Act, 2013
The concept of internal audit is introduced in the Companies Act, 2013 (Act)
with the notification of section 138 and rules made thereunder w.e.f. 1st
April, 2014. It is the responsibility of the Board of directors of a company to
conduct internal audit of the functions and activities of the company. With
the introduction of an exclusive section in the Act it is clear that internal
audit is a wider term and does not restrict only to financial functions of a
company. It is probably the reason that the Act has allowed professionals
other than chartered accountants or cost accountants, as may be decided
by the Board to be appointed and engaged as an internal auditor of the
companies.
Interestingly, in most of the provisions of the Act, the applicability is started
with “every listed company and such class or classes of companies” and in
this section relating to internal audit, it is started as “such class or classes
of companies”. The Companies (Accounts) Rules, 2014 (Rules), on the other
hand clarify the classes of companies which includes every listed company.
The other classes of companies which have to comply with the provisions
relating to internal audit are:
(a) every unlisted public company having-
(i) paid up share capital of fifty crore rupees or more during the preceding
financial year; or
(ii) turnover of two hundred crore rupees or more during the preceding
financial year; or
(iii) outstanding loans or borrowings from banks or public financial
institutions exceeding one hundred crore rupees or more at any point of
time during the preceding financial year; or
(iv) outstanding deposits of twenty five crore rupees or more at any point of
time during the preceding financial year; and
(b) every private company having-
(i) turnover of two hundred crore rupees or more during the preceding
financial year; or

4. Volume VII Part 5 June 10, 2014 11 Business Advisor
(ii) outstanding loans or borrowings from banks or public financial
institutions exceeding one hundred crore rupees or more at any point of
time during the preceding financial year.
Internal audit system
All these years, the requirement is that the internal audit system applicable
to such companies has to take all necessary steps for proper internal
control in all functions and activities of a company. It is not a function
restricted only relating to finance and accounts. The internal audit system is
wider and runs deep into various functions and activities of a company such
as risk management, governance, internal control
The rules provide that applicable companies shall be required to appoint an
internal auditor or a firm of internal auditors and to the best of knowledge
and information there is no “firm of internal auditors” in our country.
Professionals to carry out internal audit
Companies which are required to have proper internal audit system in
compliance of CARO, have established own team of internal audit
department or engaged the professional services of chartered accountants
firm or a company carrying out internal audit.
The explanation to the Rule provides two situations as under:
(i) The internal auditor may or may not be an employee of the company;
(ii) The term “chartered accountant” shall mean a chartered accountant
whether engaged in practice or not.
Companies which have already established their own team of executive with
an identified department as “internal audit” or otherwise can continue to
engage such team to conduct internal audit and the same would be in
compliance of the rules.
Companies which have engaged the services of a company, say a private
The rules provide that applicable companies shall be required
to appoint an internal auditor or a firm of internal auditors.

5. Volume VII Part 5 June 10, 2014 12 Business Advisor
limited company have to change such companies since they are not within
the meaning of professionals as provided in the Act and the Rules.
The rules explained the term “Chartered Accountant” as Chartered
Accountant who may or may not be in practice. But, if the understanding is
right, a chartered accountant in terms of the code of conduct of the Institute
of Chartered Accountants of India cannot carry on the function of audit
including internal audit as a professional without obtaining a certificate of
practice from the said Institute.
However, if a chartered accountant is employed in a company and entrusted
the assignment of internal audit, he can do so. The prohibition may be not
to carry on the profession without the certificate of practice from the
Institute and not for an employment in a company and to conduct internal
audit within the organisation.
It is also a matter for consideration that the companies, hitherto providing
the professional services of internal audit, change constitution from private
company to that of limited liability partnership (LLP).
The liability of a professional in carrying out the internal audit cannot be
limited. In the case of statutory auditors, the Act exclusively permits that
the firm of statutory auditors can be of LLP. In such a situation, it is a
matter of interpretation whether a LLP firm of chartered accountants can
render the professional services of “internal audit”.
Role of audit committee
The powers for appointment of internal auditors in the Act, is vested with
the Board of directors. However, pursuant to the Rules, the audit committee
of the company or the Board, shall, in consultation with the internal
auditor, formulate the scope, functioning, periodicity and methodology for
conducting internal audit.
The audit committee in terms of the provisions of the Act, inter alia, evaluate
internal financial controls and risk management and may also discuss any
issues with the internal auditors and the management of the company.
However, the role of audit committee in listed company is wider and to
include the following in addition to the provisions of the Act:
a) Reviewing with the management, performance of internal auditors,
adequacy of the internal control systems;
b) Reviewing the adequacy of internal audit function, if any, including
the structure of the internal audit department, staffing and seniority of the

6. Volume VII Part 5 June 10, 2014 13 Business Advisor
official heading the department, reporting structure coverage and frequency
of internal audit;
c) Discussion with internal auditors of any significant findings and
follow up there on;
d) Reviewing the findings of any internal investigations by the internal
auditors into matters where there is suspected fraud or irregularity or a
failure of internal control systems of a material nature and reporting the
matter to the Board.
The directors who are on the Board of listed companies as well as unlisted
companies hope to strengthen the role of audit committee of unlisted
companies in order to have better and improved functioning of internal
audit team.
Conclusion
The introduction of the provisions relating to internal audit is a welcome
move and would improve the performance of the company in the overall
interest of all stakeholders. The internal audit function is not restricted only
for the function of finance and accounts. It travels to all functions and
activities of a company depending on the nature of business, size of a
company.
For example, a pharma company or automobile company need professionals
with expertise to conduct internal audit of the functions and activities
relating to manufacturing, selling and distribution of products. There being
no firm of internal auditors, one school of thought is whether the
functioning of internal audit system can be outsourced to any firm of
professionals with diversified team of professionals to conduct internal audit
and to improve the internal audit system over all functions and activities of
a company.
(Dr S. Chandrasekaran is Senior Partner, Chandrasekaran Associates, Delhi)
The introduction of the provisions relating to internal audit is
a welcome move and would improve the performance of the
company in the overall interest of all stakeholders.