Internal Audit
Find leakages before they find you
Risk-based internal audits covering processes, controls and compliance — with a practical, prioritised action report.
What's included
- Process & control testing
- Revenue-leakage analysis
- Compliance gap report
- Management presentation
Understanding Internal Audit
An internal audit is a systematic, independent review of your organisation's operations, controls and compliance — designed to find revenue leakages, process gaps and fraud exposure before they turn into losses or statutory trouble. Under Section 138 of the Companies Act, 2013, internal audit is legally mandatory for listed companies and for unlisted public and private companies crossing specified thresholds — for private companies, turnover of ₹200 crore or more or outstanding bank borrowings of ₹100 crore or more during the preceding year.
Even where the law does not compel it, internal audit is where mid-sized businesses typically recover multiples of the fee. Unbilled dispatches, duplicate vendor payments, unreconciled ITC, inventory shrinkage, expense policy abuse and idle statutory exposure rarely show up in a year-end statutory audit — they surface when someone walks the process end to end. We follow a risk-based approach: rather than checking everything thinly, we rank your processes by money-at-risk and go deep where it matters.
Our engagements start at ₹9,999 for a focused single-cycle review — typically procurement-to-pay, order-to-cash, inventory or payroll — delivered in 1 to 2 weeks with a practical, prioritised report. Larger scopes and quarterly retainers are quoted after a short scoping call. Every finding comes with a root cause and a fix, not just an observation, so your team knows exactly what to change on Monday morning.
Who needs this?
Companies covered by Section 138
Listed companies always; unlisted public companies above ₹200 crore turnover, ₹50 crore paid-up capital, ₹100 crore borrowings or ₹25 crore deposits; and private companies above ₹200 crore turnover or ₹100 crore borrowings must appoint an internal auditor by law.
Growing businesses where the founder no longer sees everything
Once purchasing, billing and cash move beyond the promoter's direct line of sight, controls need to replace supervision. Internal audit tests whether they actually work.
Businesses suspecting leakage or fraud
Margins shrinking without explanation, vendor bills creeping up, stock never matching books — a targeted internal audit quantifies the leak and traces it to specific transactions and people.
Companies preparing for funding or acquisition
A pre-diligence internal audit fixes control and compliance gaps before an investor's team finds them, protecting valuation and credibility.
Multi-branch and franchise operations
Branch cash handling, local purchases and discount practices drift from head-office policy over time. Periodic branch audits keep the network honest and consistent.
Boards and audit committees needing assurance
Directors carry personal responsibility for internal financial controls; a documented internal audit programme is the practical evidence that they exercised oversight.
Documents you'll need — and why
Process descriptions or SOPs (even informal ones)
We audit against how the process is supposed to work; where no SOP exists, mapping the as-is process becomes the first deliverable.
Accounting data backup and MIS reports
Data analytics on the full ledger — duplicate payments, round-sum entries, weekend postings, one-time vendors — directs fieldwork to the riskiest transactions.
Purchase orders, GRNs and vendor invoices (sample access)
Three-way matching of order, receipt and invoice is where most procurement leakage — short supply, rate variance, duplicate billing — is caught.
Sales orders, dispatch records and e-way bills
Comparing dispatches with invoicing reveals unbilled revenue and cut-off manipulation, a classic and expensive gap.
Bank statements and payment approval records
We test who can release payments, whether limits are enforced, and whether beneficiaries match approved vendor masters.
Payroll register and attendance data
Ghost employees, unapproved overtime and incorrect statutory deductions are payroll's recurring leaks, found by matching payroll to attendance and bank credits.
Stock records and last physical verification results
Book-to-floor variance history tells us how reliable inventory records are and where shrinkage concentrates.
Statutory compliance calendar and recent notices
GST, TDS, PF/ESI and labour law lapses carry interest and penalty; the audit checks whether the compliance machine actually runs on time.
How it works, step by step
- 1
Scoping and risk assessment
Day 1-2A short call plus data review to rank your processes by money-at-risk; we agree the audit scope, sample periods and access needed before fieldwork starts.
- 2
Data analytics
Day 2-4We run exception tests on your full transaction data — duplicates, outliers, policy breaches, unusual vendors — so fieldwork targets real anomalies, not random samples.
- 3
Fieldwork and walkthroughs
Day 4-8On-site or remote testing: document verification, process walkthroughs with staff, surprise counts where relevant, and control testing on the flagged transactions.
- 4
Findings discussion with management
Day 8-10Every draft finding is discussed with process owners first — facts confirmed, explanations recorded — so the final report contains no ambushes and no errors.
- 5
Report and action plan
Day 10-12A prioritised report: each finding with quantified impact, root cause, recommended fix and suggested owner and deadline. Optional follow-up review after 90 days.
Why doing this right pays off
Recovers real money
Duplicate payments, excess vendor rates, unbilled sales and ITC left unclaimed are quantified and recovered — engagements frequently pay for themselves several times over.
Fraud deterrence
The knowledge that transactions are periodically tested independently is itself a control; most occupational fraud thrives on the certainty of never being checked.
Statutory comfort under Section 138
Where internal audit is mandatory, our appointment and reports keep the company compliant and give the board documented evidence of oversight.
Sharper processes, not just findings
Reports come with fixes — approval matrices, reconciliation routines, segregation of duties — that your team can implement immediately.
Diligence and lender readiness
Documented internal controls and clean follow-up trails materially smooth investor due diligence and bank credit reviews.
Common DIY mistakes we see
- Treating internal audit as a policing exercise and announcing it as such — staff cooperation collapses and findings go underground.
- Auditing everything superficially instead of the two or three processes where the real money moves.
- Filing the report and fixing nothing: without owners and deadlines against each finding, the same issues reappear next year.
- Using the statutory auditor's team for internal audit, which weakens both independence and the fresh-eyes value of the review.
- Skipping data analytics and relying on tiny manual samples that miss systematic leakage patterns.
Frequently asked questions
Only if you crossed the Section 138 thresholds in the preceding financial year — for private companies, turnover of ₹200 crore or more, or outstanding bank or financial institution borrowings of ₹100 crore or more. Below that, it is voluntary but often pays for itself in recovered leakage.
Not sure if this is the right service?
Message us on WhatsApp — a real expert replies, usually within minutes.
All-inclusive professional fee. Government fees (if any) extra at actuals.
Grab a coupon below — it applies at checkout.
🎁 Offers on this service
20% off up to ₹1,500
You save ₹1,500 → pay only ₹8,499
on orders above ₹4,999
10% off up to ₹500
You save ₹500 → pay only ₹9,499
Tax audit report due — FY 2025-26
30 September 2026 — book now and beat the last-minute rush.