Internal Audit Checklist

Introduction

Let's be honest. Most internal audit checklists floating around the internet look like they were written in a rush. They cover the basics, skip the foundations, and leave out the frameworks that actually give your audit structure and credibility.
This guide is different. It is written for practising Chartered Accountants and audit professionals in India who want to do internal audit the right way — from planning through reporting. No shortcuts. No fluff. Everything that belongs in a proper internal audit, in the order it should actually happen.

What Is Internal Audit and Who Needs It?

Before jumping into the checklist, let’s understand what internal audit actually means.
Internal audit is an independent and objective review of a company’s operations, financial controls, risk management, and compliance systems. It is very different from a statutory audit. A statutory audit looks backward and gives an opinion on financial statements. Internal audit is forward-looking — it identifies risks, evaluates whether controls are working, and highlights issues before they become serious problems.
Under Section 138 of the Companies Act, 2013, internal audit is mandatory for:

• Every listed company
• Every unlisted public company with:
• Paid-up share capital ≥ ₹50 crore
• Turnover ≥ ₹200 crore
• Outstanding loans/borrowings ≥ ₹100 crore
• Outstanding deposits ≥ ₹25 crore
• Every private limited company with:
• Turnover ≥ ₹200 crore
• Outstanding loans/borrowings ≥ ₹100 crore

The Frameworks Behind a Good Internal Audit

A serious internal auditor does not just rely on checklists. The work must be structured around globally accepted frameworks. Two are especially important — and highly relevant for Indian CAs.
IPPF — International Professional Practices Framework
Issued by the Institute of Internal Auditors, the 2024 IPPF (effective January 9, 2025) replaced the 2017 version and is now the global benchmark for internal audit practice.
Think of IPPF as the rulebook. It guides how internal audits should be planned, executed, and reported. ICAI’s guidance in India is closely aligned with it.
The 2024 IPPF has three parts:

• Global Internal Audit Standards (mandatory; built on 15 principles across five domains)
• Topical Requirements (mandatory for specific risk areas)
• Global Guidance (recommended implementation support)

Phase 1: KYC and Engagement Understanding Checklist

Before you test a single control, understand who you are auditing and what you are responsible for.
Start with basic legal and structural clarity:

• Obtain Certificate of Incorporation
• Review Memorandum & Articles of Association
• Check whether activities align with the objects clause
• Study organization chart and reporting hierarchy
• Identify key management personnel — who approves purchases, who controls cash, who authorizes payments
• Review latest audited financial statements
• Review previous internal audit reports for repeat findings

Phase 2: Audit Program Preparation

This is where professionalism begins. An Audit Program is not a random checklist — it is your structured roadmap.
Prepare the program as follows:

• List all major processes: procurement, sales, payroll, inventory, fixed assets, treasury, IT, compliance
• Rank areas as High / Medium / Low risk
• Define audit objective for each process
• Document specific test procedures
• Decide sample selection method (random / judgmental / statistical)
• Identify data requirements in advance
• Allocate responsibility within the audit team
• Get partner/CAE sign-off before fieldwork

Professionals who want to strengthen their approach beyond basic checklist testing often benefit from structured methodologies similar to those discussed in Master Blaster of Internal Audit, especially around risk assessment, RCM preparation, and report structuring.

Phase 3: Planning Meeting Preparation

Before fieldwork, hold a formal planning or kick-off meeting. Many skip this — serious auditors don’t.
Before the meeting:

• Prepare an initial process questionnaire
• Share it with the process owner
• Collect policy and procedure documents
• Obtain department-specific org chart
• Identify ERP modules used (SAP, Tally, Oracle, etc.)
• Review key management reports

Phase 4: Risk Assessment Checklist

You cannot audit everything deeply. Prioritize based on risk exposure.
Identify high-risk areas such as:

• Procurement and vendor management
• Sales and revenue recognition
• Payroll processing
  
• Cash and bank operations
  
• Fixed assets
• Statutary compliance (TDS, GST, PF, ESI)
• Related party transactions
• IT system controls

Phase 5: Internal Controls Testing — Area by Area

Now comes detailed testing. Focus on whether controls are properly designed and actually operating.
Procurement Controls

• Is there a formal PR → PO → GRN → Invoice matching system?
• Are multiple quotations obtained above threshold values?
• Is there an approved vendor list?
• Are POs approved as per delegation matrix?
• Are debit/credit notes properly documented?

As companies increasingly move toward Ind AS reporting, internal auditors must also understand areas like revenue recognition, financial instruments, and deferred tax — concepts that require deeper practical clarity similar to those explored in Master Blaster of Ind AS.