Concurrent, Operational & Process Audit: The Process, Start to Finish
The mechanics of Concurrent, Operational & Process Audit are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Concurrent, Operational & Process Audit page.
What is the difference between a concurrent audit, an operational audit, and a process audit?
A concurrent audit is a near-real-time review of transactions as they occur — typically daily, weekly, or fortnightly — most commonly mandated by RBI for bank branches, currency chests, and certain NBFC business lines. An operational audit is a periodic review of how efficiently and effectively an entire function or department operates — procurement, inventory, dispatch, HR — measured against process standards and organisational objectives. A process audit is the narrowest of the three: it checks whether one specific, documented Standard Operating Procedure is actually being followed, step by step, on the ground. All three are internal-facing assurance tools, distinct from the year-end statutory audit.
In practice: Clients often ask for 'an audit' without specifying which of the three they actually need. We always start the engagement with a scoping conversation — the right engagement depends on whether this is a regulatory mandate, a growth-stage control check, or a targeted investigation into one process.
Is concurrent audit legally mandatory, and for whom?
Concurrent audit is mandatory for scheduled commercial banks and, in a defined form, for certain classes of NBFCs and currency chests, under the Reserve Bank of India's Master Direction on concurrent audit. The Master Direction prescribes a minimum percentage of business — advances, deposits, non-fund exposures — that must be brought under concurrent audit coverage. It is not a general legal mandate for all companies; for a manufacturing or trading business, an operational/process audit is a voluntary, management-commissioned engagement rather than a statutory requirement, unless the entity separately falls within the internal audit mandate under Section 138 of the Companies Act.
In practice: We always confirm current RBI coverage-percentage norms with the client at engagement start rather than relying on a remembered figure — RBI has revised these norms over time, and using an outdated percentage risks under-coverage.
Does every company need an operational audit, or only larger ones?
There is no universal legal requirement for every company to have an operational audit. Internal audit becomes mandatory under Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 only for companies meeting prescribed thresholds of turnover, outstanding loans/borrowings, outstanding deposits, or paid-up share capital — thresholds that differ for listed companies, unlisted public companies, and private companies. Below those thresholds, an operational or process audit is entirely a management or promoter choice — commonly adopted by growing businesses that want independent assurance beyond what the annual statutory audit provides.
In practice: We recommend clients check current Section 138 thresholds against their latest turnover, borrowing, deposit, and paid-up capital figures each year — a company can cross into mandatory internal audit territory without necessarily noticing, particularly after a funding round that increases paid-up capital or a working capital facility that increases borrowings.
How is a concurrent/operational/process audit different from the statutory audit we already have?
The statutory audit under the Companies Act examines whether your financial statements, taken as a whole, present a true and fair view — it is retrospective, covers a full financial year, and reports to shareholders via the AGM and to the RoC via AOC-4. A concurrent, operational, or process audit examines how well a specific process or transaction stream is being controlled, in near-real-time or periodically through the year, and reports internally to management, the Audit Committee, or the Board. The statutory audit is about the destination — the numbers at year end. These audits are about the journey — the process discipline that produces those numbers.
In practice: A well-run operational audit programme through the year materially reduces surprises at statutory audit time — issues get caught and corrected mid-year rather than discovered as a qualification in March.
How often should an operational audit be conducted?
There is no single fixed statutory frequency for operational or process audits outside of the RBI concurrent-audit mandate. The right cadence depends on transaction volume, risk, and the pace of change in the business — high-risk, high-volume functions (inventory, cash, procurement) are commonly reviewed quarterly; lower-risk, more stable functions may be reviewed annually. Where Section 138 internal audit applies, the Audit Committee or Board typically approves an annual internal audit plan specifying the frequency for each area based on a documented risk assessment.
In practice: We build the frequency into the audit plan explicitly during scoping — not as an afterthought — and revisit it every year, tightening the cycle for areas with recurring findings and loosening it for areas that have stabilised.
What kind of findings does a typical operational audit uncover?
Common findings include: approval limits in the Delegation of Authority matrix not being enforced in practice (purchases approved above authorised limits by a single signatory), stock discrepancies between physical count and system records, vendor payments processed without three-way matching of purchase order, goods received note, and invoice, segregation-of-duties gaps in system access (the same person able to raise and approve a payment), stale or unfollowed SOPs, and control overrides during peak business periods that become the de facto process rather than the documented exception.
In practice: The most valuable findings are rarely the dramatic ones. A recurring, low-value control override — repeated fifty times over a quarter — usually represents a larger cumulative risk than a single large anomaly, and points to a systemic process gap rather than an isolated lapse.
How does PNPC size the sample for transaction testing in an operational audit?
We do not apply a fixed percentage (such as 'test 10% of transactions') uniformly across every client and every process. Sample size is calibrated to the volume, value, and inherent risk of the specific process being tested — a high-value, low-volume process such as capital expenditure approvals may warrant near-100% testing, while a high-volume, low-value process such as petty cash disbursements is tested on a risk-based statistical or judgemental sample. This follows the risk-based approach set out in the ICAI's Standards on Internal Audit.
In practice: Clients sometimes ask for a specific sample percentage upfront, expecting a standardised answer. We explain that a rigid percentage applied without regard to risk either wastes audit effort on low-risk areas or under-tests high-risk ones — neither serves the client well.
What happens if an operational audit uncovers evidence of fraud?
If, during an operational or process audit, evidence emerges suggesting fraud rather than a routine process weakness, PNPC escalates the matter immediately to the Audit Committee, Board, or designated promoter contact — rather than folding it quietly into the routine quarterly report. Depending on the materiality and nature of the finding, we recommend the engagement of a dedicated forensic audit, which follows a different methodology (evidence preservation, chain of custody, interview protocols) suited to matters that may proceed to disciplinary action, recovery proceedings, or reporting to authorities.
In practice: An operational audit is not designed or resourced as a forensic investigation, and we are careful not to let a routine audit mandate substitute for a proper forensic engagement once fraud indicators appear — doing so can compromise evidence and weaken any subsequent legal or disciplinary action.
Do process audits apply only to manufacturing companies, or also to services businesses?
Process audits apply to any business with a documented or documentable process — manufacturing (procurement, production, quality, dispatch), trading (inventory, sales, logistics), and services businesses alike (client onboarding, billing accuracy, service delivery SLAs, timesheet-to-invoice reconciliation for professional services firms). The methodology is the same regardless of sector: identify the SOP, verify actual practice against it, document deviations, and recommend corrective action.
In practice: We have run process audits for IT services firms on their client billing and timesheet reconciliation processes just as often as for manufacturers on their shop-floor procedures. The discipline of checking documented policy against actual practice is sector-agnostic.
Where this sits in the wider engagement
Concurrent, Operational & Process Audit rarely arrives on its own. The statutory basis and the current requirements are set out on the Concurrent, Operational & Process Audit service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Concurrent, Operational & Process Audit we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.