Internal Audit Services India: Who Needs It and Who Does Not
Whether Internal Audit Services India applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Internal Audit Services India page.
Is Internal Audit mandatory for my company?
It depends on your company type and financial parameters under Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014. Every listed company must appoint an internal auditor. Unlisted public companies must appoint one on crossing prescribed thresholds of paid-up share capital, turnover, outstanding loans/borrowings from banks or financial institutions, or outstanding deposits. Private companies must appoint one on crossing prescribed thresholds of turnover, or outstanding loans/borrowings from banks or financial institutions. The precise threshold figures are set out in Rule 13 and should be checked against your latest audited financials — we do this assessment as the first step of every engagement.
In practice: We frequently find companies that crossed the Rule 13 threshold a year or two ago and never appointed an internal auditor — usually because no one was tracking it against the latest financials. This is flagged by statutory auditors in their report and is worth resolving proactively rather than waiting to be caught.
Who can be appointed as the Internal Auditor under the Companies Act?
Under Section 138, the internal auditor may be a Chartered Accountant (whether engaged in practice or not), a Cost Accountant, or such other professional as the Board may decide. The internal auditor may or may not be an employee of the company. In practice, most companies either appoint an external CA firm (an outsourced or co-sourced model) or build an in-house internal audit team led by a qualified professional, sometimes supplemented by an external firm for specialist areas like IT audit or forensic review.
In practice: The outsourced model with a practising CA firm is common for mid-sized companies because it delivers independence, a breadth of cross-industry experience, and avoids the cost of a full in-house team. We also work in a co-sourced model — supplementing an existing in-house team for specific high-risk areas or peak-period bandwidth.
Why should we engage PNPC for Internal Audit rather than a lower-cost provider?
A genuinely risk-based internal audit function requires practising CAs who understand both the statutory framework and your specific business and sector — not a generic checklist applied uniformly across clients. PNPC has been a practising CA firm since 1986, with teams across Chennai, Bangalore, Hyderabad, and Dubai. We build a documented risk assessment specific to your business before setting the audit plan, present findings directly to your Audit Committee, track every finding to actual closure with re-testing (not a self-certified 'resolved' status), and stay engaged year-round as your business and risk profile evolve — not as a once-a-year filing exercise.
In practice: Clients who come to us after a low-cost internal audit provider almost always bring the same pattern: a generic risk assessment (or none at all), findings copy-pasted from a template with company name substituted, and no evidence of follow-up testing on prior findings. We rebuild the risk assessment from scratch in the first cycle for every such client.
Does a small private company benefit from a voluntary Internal Audit even if not legally required?
Often, yes — particularly where the company has multiple locations the founder cannot personally oversee, has taken on institutional investors who expect governance discipline, has experienced rapid growth that has outpaced its informal controls, or is preparing for a future fundraise or acquisition. A scoped, proportionate internal audit — even a lighter-touch annual review rather than a full quarterly programme — can identify control gaps and process inefficiencies well before they become costly. The right scope and frequency should be proportionate to the company's actual risk profile, not a one-size package.
In practice: We frequently recommend a lighter, targeted first-year engagement — covering the two or three highest-risk processes only — for smaller companies not yet at the statutory threshold, rather than a full-scale programme they do not yet need. This builds the governance habit without disproportionate cost.
What is the role of the Audit Committee in Internal Audit?
Under Section 177 of the Companies Act 2013, the Audit Committee (mandatory for listed companies and certain classes of public companies) is responsible for overseeing the internal audit function — reviewing and approving the annual audit plan, reviewing findings and management responses, monitoring the adequacy of internal controls, and evaluating the internal audit function's effectiveness. Where a company is not statutorily required to have an Audit Committee, the Board typically performs this oversight role directly.
In practice: We always recommend the internal auditor have a direct reporting line and unfettered access to the Audit Committee Chairman — not solely through the CFO or CEO, whose own function may be the subject of a given audit. This is a basic but frequently overlooked independence safeguard.
What is the difference between a 'design deficiency' and an 'operating effectiveness' finding?
A design deficiency means the control, as designed, would not prevent or detect the risk it is meant to address even if performed exactly as intended — for example, an approval workflow that does not require a second signatory for high-value payments. An operating effectiveness finding means the control is properly designed, but was not consistently performed in practice during the period tested — for example, a required approval step exists in policy but was bypassed for certain transactions. The remediation for each is different: a design deficiency requires redesigning the control itself, while an operating effectiveness gap may require training, enforcement, or a system-based control to prevent bypass.
In practice: Conflating these two categories in a report is a common quality shortfall — it leads management to 'fix' the wrong thing. We report them separately in every finding so the remediation action is correctly targeted.
Where this sits in the wider engagement
Internal Audit Services India rarely arrives on its own. The statutory basis and the current requirements are set out on the Internal Audit Services India service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Internal Audit Services India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.