Internal Audit That Tells You Something You Did Not Know

Many audits confirm what management already knew, in a format nobody reads, at a cost everyone resents. That is a failure of design, not of auditing. A well designed internal audit examines how controls actually operate, not how the manual says they should, and ranks what it finds by what it would cost the business.

Paper controls and real controls

Every company has a control framework on paper. Approvals, reconciliations, segregation of duties, access reviews. The interesting question is whether these operate in practice. Does the approval happen before the payment or after? Is the reconciliation performed or simply ticked? Who actually has administrator access to the finance system?

The gap between paper and practice is where losses, errors and fraud live. Testing that gap is the point of internal audit.

Rank findings by impact

A finding that a policy document is out of date and a finding that vendor bank details can be changed without a second approval are not equal, yet many audit reports present them in the same list with the same formatting. Findings should be ranked by financial and regulatory impact, with the top three stated in plain language on the first page. A board should be able to read one page and know what to worry about.

Audit for international parents

Overseas parents overseeing an Indian entity face a particular challenge: distance. They rely on reports they cannot easily verify. A periodic internal audit by a party independent of local management, reported directly to the parent in the format the group already uses, is the most effective way to close that gap. Much of the work can be done remotely with read only access, with site visits reserved for physical verification.

Preparing for statutory audit

Statutory audits are executed by independent chartered accountants and are a legal requirement. They go smoothly when the books are reconciled monthly, supporting documents are organised as the year progresses, related party transactions are documented and prior year findings have been closed. They go badly when all of that happens in the last two weeks before the deadline. Preparation is a year long habit, not a seasonal panic.

Connecting audit to risk and compliance

Internal audit is most valuable when it tests the controls that address the risks the board actually cares about, and when its findings feed the compliance calendar. Running risk, compliance and audit as one joined up programme avoids duplicated work and produces a coherent story.

The business impact

Audit that finds real gaps prevents real losses. It also produces cleaner statutory audits with fewer adjustments, stronger positions in due diligence and a board that can say, with evidence, that it knows how the business is controlled. That is worth considerably more than a report confirming that the policy manual exists.