Volume VII Part 5 June 10, 2014 8 Business Advisor

A new provision relating to internal audit

Dr S. Chandrasekaran

Internal audit

Internal audit is an examination, monitoring and

analysis of activities related to a company's operation,

including its business structure, employee behaviour

and information systems. An internal audit is designed

to review what a company is doing in order to identify

potential threats to the organisation's health and

profitability, and to make suggestions for mitigating the

risk associated with those threats in order to minimise

costs.

The Sarbanes-Oxley Act of 2002 was enacted as a reaction to a number of

major corporate and accounting scandals including those affecting Enron,

Tyco International, Adelphia, Peregrine Systems and WorldCom. These

scandals cost investors billions of dollars when the share prices of affected

companies collapsed, and shook public confidence in the US securities

markets. Enactment of this regulation has increased oversight role of boards

of directors and thus the requirement for performing internal audits. They

are important components of a company's risk management, as they help

companies identify issues before they become substantial problems. They

also help identify risky behaviour by individual employees and threats posed

by outside parties, such as attempts to steal intellectual property.

The Institute of Internal Auditors (IIA) is an international professional

association established in 1941 in the US. The Institute of Internal Auditors,

India, is affiliated to its parent body IIA, Inc., in Florida, USA. Generally, the

members of the said Institute are working in internal auditing, risk

management, governance, internal control, information technology audit,

security etc. The concept of internal audit is so wide that it is not an

exclusive area relating only to financial functions.

The scope of internal auditing within an organisation is broad and may

involve topics such as organisation's governance, risk management and

management controls over efficiency/ effectiveness of operations (including

safeguarding of assets), the reliability of financial and management

reporting, and compliance with laws and regulations. Internal auditing may

also involve conducting proactive fraud audits to identify potentially

fraudulent acts; participating in fraud investigations under the direction of

Volume VII Part 5 June 10, 2014 9 Business Advisor

fraud investigation professionals, and conducting post investigation fraud

audits to identify control breakdowns and establish financial loss (Source:

Wikipedia).

Frequent or on-going audit conducted by an entity‟s own (as opposed to

independent) accountants to (1) monitor operating results, (2) verify

financial records, (3) evaluate internal controls, (4) assist in efforts for

increasing efficiency and effectiveness of operations and, (5) to detect fraud.

Internal audit can identify control problems, and aims at correcting lapses

before they are discovered during an external audit. Although the internal

audit can be done by an entity‟s employees, they normally do not audit

themselves, and the task is usually entrusted to independent auditors.

(Source: Business Dictionary).

Concept of internal audit in MAOCARO & CARO

The internal audit system was introduced in Manufacturing and other

Companies (Auditor's Report) Order, 1988 (MAOCARO), and accordingly, the

statutory auditors have to report whether the company has internal audit

system commensurate with its size and nature of business. This

requirement applied in respect of a company having paid up capital

exceeding Rs 25 lakh at the commencement of the financial year or having

an average turnover exceeding Rs 2 crore for a period of three consecutive

financial years immediately preceding the relevant financial year.

The Companies (Auditor‟s Report) order, 2003 (CARO) came into force on

01.07.2003 in replacement of MAOCARO. The concept of internal audit

system was strengthened in CARO and accordingly, internal audit system is

applicable to:

Every company including a foreign company as defined in section 591 of the

Companies Act, 1956 except the following:

(i) a Banking company as defined in clause (c) of section 5 of the Banking

Regulation Act, 1949 (10 of 1949);

(ii) an insurance company as defined in clause (21) of section 2 of the

Companies Act, 1956;

(iii) a company licensed to operate under section 25 of the Companies Act,

1956; and

(iv) a private limited company with a paid up capital and reserves not more

than fifty lakh rupees and has not accepted any public deposit and does not

Volume VII Part 5 June 10, 2014 10 Business Advisor

have loan outstanding ten lakh rupees or more from any bank or financial

institution and does not have a turnover exceeding five crore rupees.

Introduction of internal audit in Companies Act, 2013

The concept of internal audit is introduced in the Companies Act, 2013 (Act)

with the notification of section 138 and rules made thereunder w.e.f. 1st

April, 2014. It is the responsibility of the Board of directors of a company to

conduct internal audit of the functions and activities of the company. With

the introduction of an exclusive section in the Act it is clear that internal

audit is a wider term and does not restrict only to financial functions of a

company. It is probably the reason that the Act has allowed professionals

other than chartered accountants or cost accountants, as may be decided

by the Board to be appointed and engaged as an internal auditor of the

companies.

Interestingly, in most of the provisions of the Act, the applicability is started

with “every listed company and such class or classes of companies” and in

this section relating to internal audit, it is started as “such class or classes

of companies”. The Companies (Accounts) Rules, 2014 (Rules), on the other

hand clarify the classes of companies which includes every listed company.

The other classes of companies which have to comply with the provisions

relating to internal audit are:

(a) every unlisted public company having-

(i) paid up share capital of fifty crore rupees or more during the preceding

financial year; or

(ii) turnover of two hundred crore rupees or more during the preceding

financial year; or

(iii) outstanding loans or borrowings from banks or public financial

institutions exceeding one hundred crore rupees or more at any point of

time during the preceding financial year; or

(iv) outstanding deposits of twenty five crore rupees or more at any point of

time during the preceding financial year; and

(b) every private company having-

(i) turnover of two hundred crore rupees or more during the preceding

financial year; or

Volume VII Part 5 June 10, 2014 11 Business Advisor

(ii) outstanding loans or borrowings from banks or public financial

institutions exceeding one hundred crore rupees or more at any point of

time during the preceding financial year.

Internal audit system

All these years, the requirement is that the internal audit system applicable

to such companies has to take all necessary steps for proper internal

control in all functions and activities of a company. It is not a function

restricted only relating to finance and accounts. The internal audit system is

wider and runs deep into various functions and activities of a company such

as risk management, governance, internal control

The rules provide that applicable companies shall be required to appoint an

internal auditor or a firm of internal auditors and to the best of knowledge

and information there is no “firm of internal auditors” in our country.

Professionals to carry out internal audit

Companies which are required to have proper internal audit system in

compliance of CARO, have established own team of internal audit

department or engaged the professional services of chartered accountants

firm or a company carrying out internal audit.

The explanation to the Rule provides two situations as under:

(i) The internal auditor may or may not be an employee of the company;

(ii) The term “chartered accountant” shall mean a chartered accountant

whether engaged in practice or not.

Companies which have already established their own team of executive with

an identified department as “internal audit” or otherwise can continue to

engage such team to conduct internal audit and the same would be in

compliance of the rules.

Companies which have engaged the services of a company, say a private

The rules provide that applicable companies shall be required

to appoint an internal auditor or a firm of internal auditors.

Volume VII Part 5 June 10, 2014 12 Business Advisor

limited company have to change such companies since they are not within

the meaning of professionals as provided in the Act and the Rules.

The rules explained the term “Chartered Accountant” as Chartered

Accountant who may or may not be in practice. But, if the understanding is

right, a chartered accountant in terms of the code of conduct of the Institute

of Chartered Accountants of India cannot carry on the function of audit

including internal audit as a professional without obtaining a certificate of

practice from the said Institute.

However, if a chartered accountant is employed in a company and entrusted

the assignment of internal audit, he can do so. The prohibition may be not

to carry on the profession without the certificate of practice from the

Institute and not for an employment in a company and to conduct internal

audit within the organisation.

It is also a matter for consideration that the companies, hitherto providing

the professional services of internal audit, change constitution from private

company to that of limited liability partnership (LLP).

The liability of a professional in carrying out the internal audit cannot be

limited. In the case of statutory auditors, the Act exclusively permits that

the firm of statutory auditors can be of LLP. In such a situation, it is a

matter of interpretation whether a LLP firm of chartered accountants can

render the professional services of “internal audit”.

Role of audit committee

The powers for appointment of internal auditors in the Act, is vested with

the Board of directors. However, pursuant to the Rules, the audit committee

of the company or the Board, shall, in consultation with the internal

auditor, formulate the scope, functioning, periodicity and methodology for

conducting internal audit.

The audit committee in terms of the provisions of the Act, inter alia, evaluate

internal financial controls and risk management and may also discuss any

issues with the internal auditors and the management of the company.

However, the role of audit committee in listed company is wider and to

include the following in addition to the provisions of the Act:

a) Reviewing with the management, performance of internal auditors,

adequacy of the internal control systems;

b) Reviewing the adequacy of internal audit function, if any, including

the structure of the internal audit department, staffing and seniority of the

Volume VII Part 5 June 10, 2014 13 Business Advisor

official heading the department, reporting structure coverage and frequency

of internal audit;

c) Discussion with internal auditors of any significant findings and

follow up there on;

d) Reviewing the findings of any internal investigations by the internal

auditors into matters where there is suspected fraud or irregularity or a

failure of internal control systems of a material nature and reporting the

matter to the Board.

The directors who are on the Board of listed companies as well as unlisted

companies hope to strengthen the role of audit committee of unlisted

companies in order to have better and improved functioning of internal

audit team.

Conclusion

The introduction of the provisions relating to internal audit is a welcome

move and would improve the performance of the company in the overall

interest of all stakeholders. The internal audit function is not restricted only

for the function of finance and accounts. It travels to all functions and

activities of a company depending on the nature of business, size of a

company.

For example, a pharma company or automobile company need professionals

with expertise to conduct internal audit of the functions and activities

relating to manufacturing, selling and distribution of products. There being

no firm of internal auditors, one school of thought is whether the

functioning of internal audit system can be outsourced to any firm of

professionals with diversified team of professionals to conduct internal audit

and to improve the internal audit system over all functions and activities of

a company.

(Dr S. Chandrasekaran is Senior Partner, Chandrasekaran Associates, Delhi)

The introduction of the provisions relating to internal audit is

a welcome move and would improve the performance of the

company in the overall interest of all stakeholders.