Quick answer
What are internal audit services?
Internal audit services are an independent review of a business's own processes and controls, such as purchases, sales, stock, payroll, GST and TDS. The internal auditor tests transactions, finds leaks and compliance gaps, and reports them to the owners or board with fixes. Listed and larger companies must appoint one; smaller businesses use it by choice.
- Tests processes and controls, not only the final accounts
- Compulsory for listed and larger companies under company law
- Your statutory auditor cannot also act as your internal auditor
- Output is a findings report with owners and deadlines
What do internal audit services cover, and who needs them?
Internal audit services cover the day-to-day processes that produce your numbers: how orders are approved, how stock moves, who can pay vendors, how GST credit is claimed and whether TDS is deducted on time. Any business where the owner can no longer see every transaction personally gets value from one.
The work sits between bookkeeping and the statutory audit. Your accountant records entries; the statutory auditor gives an opinion on the year's financial statements; the internal auditor looks inside the process during the year and asks whether the controls actually work. That makes it useful well before a problem shows up in the balance sheet.
The businesses that usually ask for it fall into four groups: family companies where the second generation wants visibility over a branch or factory, owners who have hired a manager to run purchases or a warehouse, companies preparing for a bank loan or investor review, and businesses that have just found one irregularity and want to know if there are more.
Is internal audit mandatory for your business?
Internal audit is compulsory for listed companies and for unlisted companies that cross the turnover, borrowing, capital or deposit limits set under the Companies Act and its accounts rules. Most small private companies, and every LLP, partnership and proprietorship, are outside that requirement, so for them it is a management choice.
Because the limits are set in the rules and can be amended, ask your chartered accountant to confirm in writing whether your company crossed them in the previous financial year. Where the requirement applies, the board appoints the internal auditor and the appointment should be recorded in board minutes.
| Your situation | Position | What to do |
|---|---|---|
| Listed company | Compulsory under company law | Board appoints an internal auditor every year |
| Unlisted company above the size limits in the rules | Compulsory under company law | Check the limits against last year's audited figures with your CA |
| Small private limited company or OPC | Voluntary | Consider it once a manager, branch or warehouse runs without the owner present |
| LLP, partnership firm or proprietorship | Voluntary | Use a focused review of the risky areas instead of a full programme |
| Bank, investor or group parent asks for it | Contractual | Agree the scope and report format with the party that asked |
The thresholds are prescribed by the rules under the Companies Act 2013 and change from time to time; confirm the current limits on the MCA website or with your auditor. Status as of November 2026.
Need help with internal audit services? Talk to a chartered accountant in Delhi today. First call is free.
Internal audit vs statutory audit: what is the difference?
A statutory audit is the yearly audit of your financial statements required by law and signed by a practising chartered accountant; an internal audit is a review of processes and controls that you or your board commission, during the year, for your own use. The two answer different questions and are done by different people.
The statutory audit is work reserved for chartered accountants, which is why our statutory audit page is informational only. An internal audit is not reserved in the same way, and the board chooses who carries it out. Company law also stops your statutory auditor from providing certain other services to you, and internal audit is generally understood to be one of them, so plan for two separate firms.
| Point | Internal audit | Statutory audit |
|---|---|---|
| Purpose | Find control gaps, leaks and compliance misses | Give an opinion on the financial statements |
| Who appoints | Management or the board | Shareholders, with the board appointing the first auditor |
| Who can do it | Chosen by the board; not reserved for one profession | Only a practising chartered accountant |
| Timing | During the year: quarterly, half-yearly or yearly | After the year closes |
| Report goes to | Owners, board or audit committee | Shareholders, and filed with the ROC |
| Scope | Set by you, can target any process | Set by law and auditing standards |
See also tax audit, which is a third, separate report under income tax law.
What does an internal audit check in a Delhi business?
An internal audit checks the processes where money or stock can leak and where a missed filing can cost a penalty: purchases, sales and credit, inventory, payroll, cash and bank, and statutory compliance. The weight given to each depends on how the business earns and spends.
For 2026 the compliance checks have changed. Since the July 2025 tax period, outward liability auto-filled in GSTR-3B can no longer be edited, so corrections must go through GSTR-1A first, and an internal auditor should test whether sales invoices reach GSTR-1 correctly the first time. From the first quarter of tax year 2026-27, TDS returns move to new form numbers under the Income-tax Act 2025, which is worth testing in the first review of the year. Director KYC is now due once every three financial years, by 30 June, which is easy to miss when it no longer comes round annually.
| Business type | Areas the audit usually tests |
|---|---|
| Manufacturer in Wazirpur, Narela or Okhla | Raw material issue against output, scrap sales, job-work stock with outside units, power and freight bills |
| Wholesale or retail trader | Stock counts against books, credit limits and overdue buyers, cash sales and discounts, purchase rates against market |
| E-commerce seller | Marketplace settlements against invoices, returns and refunds, warehouse stock, GST on platform fees |
| Services firm or start-up | Revenue billed against contracts, vendor onboarding, payroll and reimbursements, access to bank logins |
| Every business | GSTR-2B credit against purchase books, TDS deduction and return filing, ROC and director filings, related-party payments |
Sources: GSTR-3B lock coverage (reported GSTN advisory, June 2025), TDS form mapping under the Income-tax Act 2025 and ICAI note on director KYC, checked October 2026. Confirm current rules on the GST and income tax portals.
How internal audit services work: step by step
Internal audit services follow a fixed cycle: agree the scope, understand the processes, test a sample of transactions, discuss the findings with the people responsible, issue the report and then follow up on whether the fixes were made. A first engagement usually starts with a risk review so the testing goes where the exposure is.
- 1
Scope and engagement letter
Owners and auditor agree the areas, locations, period covered, report format and how often reviews will happen, all in writing.
- 2
Walkthrough of each process
The auditor sits with the staff who raise orders, receive goods, make payments and file returns, and maps who approves what.
- 3
Risk ranking
Each process is rated by how much money passes through it and how weak the controls look, which sets the testing plan.
- 4
Sample testing
Selected transactions are traced from source document to books, bank and returns, and stock or cash is counted where relevant.
- 5
Draft findings and discussion
Each gap is written up with the amount involved and discussed with the person responsible before it goes to the owners.
- 6
Final report
The report lists findings by priority, management's response, the person who will fix each one and a target date.
- 7
Follow-up review
At the next visit the auditor checks whether the agreed fixes were made and reports what is still open.
What does an internal audit report look like?
A useful internal audit report is short and specific: each finding states what was tested, what went wrong, the amount at stake, the risk, the fix and who owns it by when. Long narrative reports that nobody acts on are the most common reason owners feel an internal audit was wasted.
The table below is a hypothetical illustration of the format for a small Delhi trading company. The findings and amounts are invented to show the layout; they are not drawn from any client.
| Finding | Amount at stake | Priority | Agreed fix | Owner and date |
|---|---|---|---|---|
| Purchase bills booked with input credit that is missing from GSTR-2B | ₹1.8 lakh of credit | High | Hold credit until the supplier files; follow up weekly | Accounts head, 30 days |
| Two vendors paid on scanned bills without a goods receipt note | ₹3.4 lakh | High | No payment without a signed receipt note | Store manager, immediate |
| Buyers over their credit limit still receiving goods | ₹6.0 lakh overdue | Medium | System block once limit is crossed | Sales head, 15 days |
| Rent paid to landlord without TDS | Interest and late fee exposure | Medium | Deduct going forward and regularise past months | Accounts head, 30 days |
| Bank login shared by three staff | Not quantified | High | Separate maker and checker logins | Owner, 7 days |
Hypothetical example for format only.
How much do internal audit services cost in Delhi?
Internal audit fees in Delhi depend on the number of locations, the processes in scope, transaction volume, how often reviews happen and whether the auditor must visit factories or warehouses, so there is no standard rate. We do not publish our own prices; you get a fixed quote for a written scope before any work starts.
To compare quotes fairly, send every firm the same brief: entities and locations, yearly turnover band, accounting software, number of staff handling purchases and payments, the areas you are worried about, and the review frequency you want. Ask how many days of fieldwork the fee assumes, who will actually do the testing, and whether follow-up reviews are included.
When not to buy one. If your books are months behind, an internal audit will only confirm that, so get the accounting and bookkeeping current first. If you are a small proprietor who still signs every cheque and counts the stock, a monthly review by your accountant may be enough. And if what you really need is forecasting, budgets and monthly reporting rather than testing, a virtual CFO is the better fit.
What mistakes do businesses make with internal audit?
The most common mistake is buying an internal audit without a scope, which produces a generic checklist instead of findings about your real risks. The others are about independence, follow-up and timing.
- Using the statutory auditor. Company law restricts your statutory auditor from also giving you internal audit services, so a second firm is needed.
- Letting the accountant audit their own work. The person who keeps the books cannot give you an independent view of them.
- No follow-up. A report that is filed and forgotten changes nothing; book the next review when you sign the first.
- Auditing only at year end. By then leaks have run for twelve months. Quarterly or half-yearly reviews catch them earlier.
- Ignoring compliance testing. A missed GST, TDS or ROC filing costs fees and interest; see GST return filing and TDS return filing for what should be running every month.
Who handles internal audit services among the listed firms?
Among the firms listed on CA in Delhi, Greenwolf Advisors lists financial process structuring and controls, along with virtual CFO advisory and MIS reporting. It is a corporate and cross-border advisory firm founded in 2016, not a firm of chartered accountants, so your statutory audit stays with your own practising CA.
If you would rather appoint a chartered accountant firm as internal auditor, it must not be the firm that audits your accounts. The chartered accountant firms in Delhi directory explains how to check a CA's membership on ICAI's CA Connect before you appoint anyone. Factory owners can read our Wazirpur page for the compliance mix we see in the industrial area.
The CA in Delhi office is at 411, Best Sky Tower, Netaji Subhash Place, next to the Red and Pink line metro station, open Monday to Saturday, 10 am to 7 pm. Send a short brief through the form below and you get a fixed quote for the scope you choose.
Frequently asked questions
Is internal audit mandatory for a private limited company?
Only if the company crosses the size limits prescribed under the Companies Act and its rules, which are based on figures such as turnover and borrowings. Most small private companies fall below them, so for them internal audit is voluntary. Ask your CA to check last year's audited figures against the current limits.
Who can be appointed as an internal auditor?
The board chooses the internal auditor, and the role is not reserved for one profession the way a statutory audit is. Companies commonly appoint a chartered accountant firm, another professional firm or an in-house team. The person should be independent of the processes they review.
Can my statutory auditor also do my internal audit?
No. Company law restricts a company's statutory auditor from providing certain other services to it, and internal audit is generally treated as one of them. Appoint a different firm so both reports keep their independence.
How often should an internal audit be done?
Most businesses choose quarterly or half-yearly reviews, with a yearly plan agreed at the start. Quarterly suits businesses with heavy stock, several locations or recent irregularities. A smaller business with stable processes may manage with one or two focused reviews a year.
What documents does an internal auditor ask for?
Expect requests for the books in Tally or Zoho Books, bank statements, purchase orders and goods receipt notes, sales invoices, stock records, payroll registers, GST and TDS returns, and board minutes. The auditor will also want to speak to the staff who run each process.
Does an LLP or partnership firm need an internal audit?
There is no general legal requirement for an LLP, partnership or proprietorship to appoint an internal auditor. Many still commission a focused review when partners are not involved day to day, when a manager handles cash or stock, or when a lender asks for one.
What is the difference between internal audit and internal financial controls?
Internal financial controls are the rules and checks your business runs, such as approval limits, maker and checker logins and stock counts. Internal audit is the independent test of whether those controls exist and actually work, followed by a report on the gaps.
Can an internal audit find fraud?
It can surface the warning signs, such as payments without receipts, unusual vendors, round-sum adjustments or stock that does not reconcile. An internal audit is not a forensic investigation, though. If a review points to deliberate fraud, a separate, focused investigation is the next step.
Can the internal audit be done online?
Much of the testing can be done remotely from shared books, bank statements and scanned documents. Stock counts, factory visits and staff walkthroughs usually need someone on site, so most engagements mix remote testing with planned visits.