Risk-Based Internal Audits: What It Actually Involves
Most internal audit functions fail quietly — not because they lack effort, but because they audit the same processes every year regardless of where the organisation's real exposure has shifted. A Risk-Based Internal Audit reverses that default: instead of a fixed rotation of departments, the annual audit plan is built from a current risk assessment, so audit hours go to the areas most likely to hurt the business — a customer-concentration blind spot, a control gap in a fast-growing business line, a vendor payment process that has outgrown its original design. At PNPC Global, we have delivered internal audit and risk advisory engagements to Indian and UAE businesses since 1986, drawing on the ICAI's Standards on Internal Audit and Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014.
What You're Really Buying
A Risk-Based Internal Audit (RBIA) is an approach to internal auditing in which the scope, depth, and frequency of audit coverage are determined by a structured risk assessment of the organisation, rather than a fixed cyclical rotation through every department or process in a set sequence. Under a traditional, compliance-driven internal audit model, every function gets broadly equal audit attention on a rolling multi-year cycle regardless of its actual risk profile. Under RBIA, high-risk areas — a business line with weak historical controls, a process with recent turnover in key personnel, a function handling a disproportionate share of cash or high-value transactions — receive more frequent and deeper audit coverage, while genuinely low-risk, stable areas receive lighter-touch review.
For the full scope, current process and what PNPC includes, see the dedicated Risk-Based Internal Audits service page.
Is This Relevant to Your Business?
- Company falls within the Section 138 / Rule 13 threshold for mandatory internal audit — every listed company, and unlisted public or private companies crossing the prescribed paid-up capital, turnover, borrowing, or deposit thresholds
- Existing internal audit function follows a fixed departmental rotation that has not changed in years, and findings have become repetitive and low-value to the Audit Committee
- Rapid growth, a new business line, new geography, or a recent acquisition has changed the organisation's risk profile faster than the audit plan has kept pace
- Recent fraud incident, control failure, or near-miss that has prompted the Board or Audit Committee to ask whether audit hours are actually going to the areas of greatest exposure
When It Isn't the Right Fit
- Very small private company well below the Section 138 / Rule 13 thresholds, with simple single-location operations and no near-term fundraising or listing plans — a lighter periodic financial review may be adequate rather than a formal RBIA function
- Organisation has no risk assessment or risk register of any kind and no interest in building one — a compliance-based internal audit covering statutory-mandated areas may be a more realistic starting point before layering on risk-based prioritisation
- The immediate need is a one-time investigation into a specific suspected fraud or irregularity — a targeted forensic investigation is a faster, more precise fit than standing up a full annual risk-based audit plan
Quick Answers
What exactly is a Risk-Based Internal Audit, in plain terms?
It is an internal audit function where the areas you audit, and how deeply you audit them, are decided by where the organisation's actual risk is highest — not by a fixed rotation that gives every department roughly equal attention regardless of how risky it actually is. A risk assessment identifies which processes, locations, or business lines are most likely to have control gaps or fraud exposure, and the annual audit plan allocates the available hours accordingly.
Is internal audit mandatory for my company under Indian law?
Yes, for a defined class of companies. Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 mandates internal audit for every listed company, and for unlisted public companies and private companies that cross prescribed thresholds of paid-up share capital, turnover, outstanding loans or borrowings from banks or financial institutions, or outstanding deposits — measured as at the end of the preceding financial year. Companies below these thresholds are not statutorily required to appoint an internal auditor, though many still choose to for governance and lender-confidence reasons.
Who can be appointed as an internal auditor under Section 138?
The internal auditor may be a Chartered Accountant (whether in practice or not), a Cost Accountant, or such other professional as the Board may decide, and may be an individual, a partnership firm, or a body corporate — but the person appointed must not have any conflict of interest that compromises independence, such as being the same firm that also serves as the company's statutory auditor for the relevant year.
Where PNPC Fits In
An internal audit plan that repeats the same findings every year protects no one. Talk to PNPC Global about building a Risk-Based Internal Audit function your Audit Committee will actually rely on.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Risk Advisory practice for related services, or go straight to the Risk-Based Internal Audits page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.