Internal audit and internal control, and how they differ from internal check

Principles and Practice of Auditing · Unit II · Topic 6 of 15 · 5 min read

Internal audit, its advantages and disadvantages and the companies required to have one under section 138 and Rule 13; internal control, its objectives and components and the internal financial controls regime of the Companies Act 2013; and the table distinguishing internal check from internal audit.

← All Principles and Practice of Auditing topics Past papers

On this page

1. Internal audit
2. Internal control
3. Auditor s evaluation of internal control
4. Internal check and internal audit distinguished
How this is examined

Cases checked to exist. Read the judgment before quoting a holding.

Every case cited here has been checked to exist — the citation resolves and names the right parties. The propositions attributed to each case have not been verified line by line against the judgment. Case names link through to the full judgment: read it before quoting a holding in an examination answer, and never carry a proposition from notes into court on trust.

The examinable core. “Distinguish between internal check and internal audit” has been set in seven of the nine papers, including January 2026 Q.9(a) and June 2025. “Internal audit: advantages and disadvantages” and “internal control and its objectives” are the other two Unit II essays. Learn the comparison table in section 4.

1. Internal audit

Internal audit is an independent review of the operations and records of a business, carried out by its own staff (or by an outside firm engaged for the purpose) as a service to management. It checks the accuracy of the accounts, the working of the internal check, compliance with policies, and the efficiency of operations, and reports to management or the audit committee. Unlike the statutory audit, its scope is fixed by management.

Under the Companies Act 2013. Section 138 requires prescribed classes of companies to appoint an internal auditor, who must be a chartered accountant, a cost accountant or such other professional as the Board decides. Rule 13 of the Companies (Accounts) Rules 2014 prescribes the classes:

every listed company;
every unlisted public company with paid-up share capital of Rs. 50 crore or more, or turnover of Rs. 200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding Rs. 100 crore, or outstanding deposits of Rs. 25 crore or more at any time in the preceding year;
every private company with turnover of Rs. 200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding Rs. 100 crore.

The audit committee or the Board decides the scope, functioning, periodicity and methodology. The statutory auditor of the company may not act as its internal auditor (s.144(b)). ICAI issues Standards on Internal Audit for this work, and the statutory auditor may use the internal auditor’s work after evaluating it (SA 610).

Advantages

errors and frauds are found soon after they occur, because the work is continuous;
the internal check and accounting system are regularly tested and improved;
a moral check on staff;
the statutory auditor can reduce his detailed checking, saving time and fees;
management gets reports on waste, inefficiency and non-compliance, which help decisions;
accounts are kept up to date, so final accounts are ready quickly.

Disadvantages

expensive for a small concern;
the internal auditor is an employee, so his independence is limited and he may hesitate to report against senior officers;
the work can become routine;
staff may become careless, relying on him to find mistakes;
it does not replace the statutory audit.

2. Internal control

Internal control is the whole system of controls, financial and otherwise, set up by management to run the business in an orderly and efficient manner. SA 315 describes it as the process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets and compliance with applicable laws and regulations. Internal check and internal audit are both parts of internal control.

Objectives

transactions are executed with management’s general or specific authorisation;
all transactions are promptly recorded in the correct amount, account and period;
access to assets is permitted only with authorisation;
recorded assets are compared with existing assets at intervals and differences acted on;
errors and frauds are prevented or detected;
policies are followed and operations are efficient;
reliable information is available for management decisions.

Components (as described in SA 315): the control environment (the attitude and integrity of management and the Board); the entity’s risk assessment process; the information system and communication; control activities (authorisation, segregation of duties, physical controls, reconciliations, IT controls); and monitoring of controls.

Usefulness for a company (2022, 2023). The Companies Act 2013 gives internal control legal force. The directors’ responsibility statement of a listed company must state that the directors laid down internal financial controls and that they were adequate and operating effectively (s.134(5)(e)); the audit committee evaluates internal financial controls (s.177(4)(vii)); and the auditor’s report must state whether the company has adequate internal financial controls with reference to financial statements and the operating effectiveness of such controls (s.143(3)(i)). A sound system protects assets, produces reliable accounts, reduces the risk of fraud, supports these statements and lets the auditor rely on test checks.

Limitations: collusion, management override, human error, cost exceeding benefit, and controls designed for routine transactions failing for unusual ones.

3. Auditor’s evaluation of internal control

The auditor reviews the system by a narrative description, an internal control questionnaire or a flow chart; tests whether the controls actually work (tests of control); and decides the extent of substantive checking. Deficiencies found are communicated to management and, if significant, to those charged with governance (SA 265).

4. Internal check and internal audit distinguished

Point	Internal check	Internal audit
Meaning	Arrangement of duties so the work of one is checked by another	Independent review of records and operations by a special staff
Time	Simultaneous: as the transaction is done	After the transaction is recorded
Done by	The regular staff in the normal course of their work	Internal auditors, separate from the accounting staff
Object	Prevention of errors and frauds	Detection of errors and frauds, and review of efficiency
Method	Automatic, built into the routine	Examination, testing and reporting
Scope	Day-to-day transactions	Accounts, operations, compliance and the internal check itself
Report	No report	Reports to management or the audit committee
Law	No statutory requirement as such	Compulsory for prescribed companies (s.138)

Trap. Internal control is the widest term; internal check and internal audit are its parts. Start the “distinguish” answer with one line making that point, then the table.

How this is examined

“Distinguish between internal check and internal audit” (2019, 2022, April 2023, October 2023, August 2024, June 2025, January 2026). “Define internal audit; explain its advantages and disadvantages” (2019, April 2021, November 2021, 2022, October 2023); “internal audit of a company” (April 2023), where section 138 and Rule 13 earn the marks. “What is internal control? Explain its objectives” (April 2021, August 2024); short notes on internal control (2021, 2023, 2024, June 2025, January 2026) and on how internal control is useful for a large company (2022, April 2023).

Now try the real questions: Principles and Practice of Auditing past question papers.