Internal Audit Services
Process reviews, control testing and risk assessment — for companies where it is mandatory, and for anyone who wants to know where money and compliance are actually leaking.
Internal audit is mandatory for some companies and optional for everyone else, and the two groups need different things from it. Under Section 138 of the Companies Act, a private company must appoint an internal auditor once turnover reaches ₹200 crore or outstanding borrowings reach ₹100 crore — checked against any point in the preceding financial year, not just year-end. Listed companies require it regardless of size.
Where it is not mandatory, businesses still commission internal audits voluntarily, usually once they have grown past the point where the owner can personally see every transaction. The value is the same either way: independent testing of whether your controls actually work, rather than assuming they do because a process document says they should.
We work with corporate and BFSI clients on process reviews, control testing and risk assessment, reporting findings in terms a board or management team can act on rather than a generic checklist. The output that matters is not the report — it is what changes afterward.
Enquire about Internal Audit
Tell us what you need. This opens as a WhatsApp message to us, ready to send.
Nothing is submitted from this page. Your details go straight into a WhatsApp draft you send yourself.
Prefer to call? +91 82482 03045Is this you?
If any of these describe where you are right now, this is the service you are looking for.
Your private company's turnover has reached ₹200 crore in the preceding financial year — internal audit is now mandatory under Section 138.
Your outstanding borrowings from banks or financial institutions have reached ₹100 crore at any point in the preceding year.
Your company is listed, where internal audit is mandatory regardless of size.
You suspect controls are being bypassed but cannot see where without an independent review.
You have grown to a size where the owner or promoter can no longer personally oversee every transaction.
A bank, investor or board member has asked for an independent control review.
Everything handled, end to end
The full scope of the engagement, so there is nothing to discover halfway through.
Applicability assessment
Whether Section 138 actually requires you to have an internal audit yet, based on your real turnover and borrowing figures — not assumed.
Process and control review
Purchase, sales, payroll, inventory and cash cycles reviewed for where controls exist on paper but not in practice.
Control testing
Sample transactions tested against the stated process, so findings are evidenced rather than asserted.
Risk assessment
Where the business is exposed — fraud risk, process breakdown, or compliance gaps that would surface badly in a statutory audit.
Findings and reporting
A report written for action — what was found, what it exposes you to, and what to fix first — not a document that restates the obvious.
Follow-up review
Checking that agreed corrective actions were actually implemented, not just accepted in a management response.
What you'll need to hand over
Collected once, at the start. We tell you which of these apply to your case before you gather anything.
To scope the engagement
- 01Latest audited financial statements
- 02Organisation chart and key process owners
- 03Existing process documentation or SOPs, if any
- 04Prior internal or statutory audit reports
For fieldwork
- 01Access to the accounting system for the period under review
- 02Sample transaction documentation as requested during testing
- 03Bank statements and reconciliations for the period
- 04Payroll and vendor master records where relevant to scope
Access matters more than paperwork here. The single biggest delay in an internal audit is waiting on system access or a process owner's time — settle both before fieldwork starts, not during it.
5 steps, start to finish
Where the work actually goes, and what we need from you at each stage.
Scoping
We agree which processes and periods are in scope, based on risk and, where applicable, the Section 138 requirement.
Confirm with us
Fieldwork
Process walkthroughs, control testing and sample checks carried out against the agreed scope.
Confirm with us
Findings discussed
Draft findings shared with process owners before the report is finalised, so nothing lands as a surprise.
Before the final report
Report and presentation
Final report issued and presented to management or the audit committee, with findings ranked by what to fix first.
On completion of fieldwork
Follow-up
A later check that agreed actions were actually implemented, not just noted.
Agreed separately
What to expect, and what it costs
Timelines are indicative and depend on departmental processing and how quickly documents come back to us. Message us on WhatsApp for a written quote.
Enquire on WhatsApp- Scoping
- Confirm with us
- Fieldwork
- Confirm with us
- Mandatory audit trigger — turnover
- ₹200 crore
- Mandatory audit trigger — borrowings
- ₹100 crore
Professional fees
On request
Common questions
The questions we are actually asked about Internal Audit. If yours is not here, ask us directly.
For a private company, yes once turnover reaches ₹200 crore or outstanding borrowings reach ₹100 crore, under Section 138 of the Companies Act. Listed companies require it regardless of size. Below those thresholds it is optional, though often still worthwhile.
At any point during the preceding financial year for the borrowing threshold, not only at year-end. A company that briefly crossed ₹100 crore in borrowings mid-year and repaid it before year-end can still trigger the requirement.
A statutory audit expresses an opinion on whether your financial statements are true and fair, for shareholders and regulators. Internal audit examines whether your operational controls and processes actually work, for management's own benefit. They serve different purposes and a good internal audit often makes the statutory audit smoother.
A chartered accountant, cost accountant, or another professional as the board decides, and the internal auditor may be an employee or an external firm. Independence from the processes being reviewed matters more than the specific qualification.
The Companies Act requires the audit committee or board to formulate the scope and periodicity — commonly annual for smaller companies, more frequent for higher-risk areas or larger operations. It is a decision for your board, tailored to your actual risk profile rather than a fixed rule.
They go to the audit committee or board, along with management's response and an action plan. The findings are internal — they do not get filed with the Registrar the way statutory audit reports do — but ignoring them repeatedly is itself a governance failure that a statutory auditor may eventually flag.
You might also need
Services that usually come up in the same conversation as this one.
Simplify compliance.Accelerate growth.
We respond fast.