In India, the internal audit function has come a long way since its inception and has undergone significant development in recent years.
In the past, internal audit in India was mostly confined to compliance-based activities and was often viewed as a cost center. With the increasing complexity of business operations and the emergence of new risks, however, the role of internal audit in India has evolved to become more strategic in nature. Today, internal auditors in India are expected to provide valuable insights and recommendations to management on how to improve the organization’s performance and achieve its goals.
One of the major developments in the internal audit function in India has been the increased emphasis on risk management. With the growing complexity of business operations, organizations in India are now more focused on identifying, assessing, and managing risks. Internal auditors play a vital role in this process by providing assurance on the effectiveness of the organization’s risk management framework and suggesting improvements where necessary.
Another important development has been the increased focus on governance. With the growing importance of corporate governance in India, internal auditors are now expected to provide assurance on the effectiveness of the organization’s governance processes and to make recommendations for improvement. This includes assessing the effectiveness of the board of directors, senior management, and internal controls.
The increased focus on technology has also played a significant role in the development of internal audit in India. With the growing use of technology in business operations, internal auditors are now expected to have a good understanding of the technology used by the organization and to provide assurance on the effectiveness of controls over technology. This includes assessing the security and integrity of the organization’s systems and data, as well as the effectiveness of controls over the organization’s technology infrastructure.
The increased focus on sustainability and responsible business practices is yet another development that has had an important impact on the internal audit function in India. Internal auditors are now expected to provide assurance on the organization’s sustainability practices and to make recommendations for improvement. This includes assessing the organization’s environmental and social impact, as well as its compliance with relevant environmental laws and regulations.
The internal audit profession in India has also undergone significant professionalization in recent years. The Institute of Chartered Accountants of India (ICAI) has played a leading role in this process by developing a comprehensive framework for the internal audit function and by providing training and education to internal auditors. The ICAI has also established a certification program for internal auditors, which is recognized by the government and industry.
Guiding Principles
As the business environment continues to evolve, internal auditors in India will continue to play a critical role in helping organizations achieve their objectives and operate effectively. Internal audit in India is governed by the Institute of Chartered Accountants of India (ICAI), as well as the Institute of Internal Auditors (IIA). These organization provide some important pillars that are now more likely to be at the center of the principles guiding internal audit departments in India, including:
- Independence: Internal auditors must be independent from the activities they are auditing.
- Objectivity: Internal auditors must be objective and impartial in their assessments.
- Professionalism: Internal auditors must possess the necessary knowledge, skills, and experience to perform their duties effectively.
- Standards: Internal auditors must adhere to the internal auditing standards established by the ICAI and IIA.
- Reporting: Internal auditors must report their findings and recommendations to the organization’s management and board of directors.
- Follow-up: Internal auditors must follow-up on the implementation of their recommendations to ensure they have been effectively implemented.
- Compliance: Internal Auditors must ensure compliance with laws and regulations.
- Continuous improvement: Internal audit process should be continuously improved to maintain its effectiveness.
Increased Focus on Risk Management
I mentioned earlier that internal audit departments in India are increasingly driven by risk management and looking to evolve into risk-based audit functions.
In internal audit, risk refers to the possibility of an event or circumstance that could negatively impact an organization’s ability to achieve its objectives. (I will note here, that risks may also include positive outcomes, in terms of “risks worth taking.” For the purposes of this article, we will be focusing mostly on the downside of risk, while acknowledging that risk is a two-sided coin.) There are several different types of risk that internal auditors may assess, including:
- Financial risk: The possibility of financial loss or damage to the organization’s financial position.
- Operational risk: The risk of loss or damage resulting from inadequate or failed internal processes, systems, or human factors.
- Compliance risk: The risk of non-compliance with laws, regulations, and other requirements.
- Reputational risk: The risk of damage to the organization’s reputation or image.
- Strategic risk: The risk of failure to achieve the organization’s strategic objectives.
- Information technology risk: The risk of loss or damage resulting from inadequate or failed IT systems and processes.
- Fraud risk: The risk of loss or damage resulting from fraud or other illegal activities.
- Cybersecurity risk: The risk of loss or damage resulting from cyber threats
It’s important to note that the types of risks an organization faces will depend on its industry and specific operations, and internal audit will assess those risks that are material to the organization.
Risk Mitigation Efforts
There are various mitigation plans that organizations can implement to reduce or manage the downside of risks identified by internal audit. Internal audit departments in India have made substantial progress in better evaluating these risk mitigation efforts. Some examples include:
- Financial risk: Implementing financial controls and procedures, such as budgeting, forecasting, and regular financial reporting, to help manage financial risk.
- Operational risk: Implementing quality management systems, process improvements, and regular training programs to help reduce operational risk.
- Compliance risk: Establishing a compliance management system, including regular training, monitoring and testing to ensure compliance with laws, regulations and other requirements.
- Reputational risk: Implementing crisis management plans, developing a strong corporate reputation, and building positive relationships with stakeholders to help mitigate reputational risk.
- Strategic risk: Developing a strategic plan, regularly reviewing and updating it, and monitoring progress to help ensure that the organization is on track to meet its strategic objectives.
- Information technology risk: Implementing IT security measures, such as firewalls, encryption, and regular security updates, to protect against cyber threats.
- Fraud risk: Implementing fraud prevention measures, such as internal controls, regular fraud audits, and a whistleblower hotline, to help detect and prevent fraud.
- Cybersecurity risk: Implementing a comprehensive cybersecurity program, including regular risk assessments, incident response plans, employee training, and vendor management.
It’s important to note that mitigations plan will vary depending on the organization’s specific risk profile and the nature of the risks it faces. An internal auditor can help an organization mitigate risks by:
- Identifying Risks: Internal auditors can help an organization identify risks that it may be facing through regular risk assessments and internal audits.
- Evaluating Controls: Internal auditors can evaluate the effectiveness of existing controls and procedures in place to mitigate risks and make recommendations for improvement.
- Developing Mitigation Strategies: Internal auditors can work with management to develop and implement strategies to mitigate risks identified through their audits.
- Monitoring Progress: Internal auditors can monitor the implementation of mitigation strategies and assess their effectiveness in reducing or managing risks.
- Communicating Risks: Internal auditors can communicate the risks identified and their recommendations for addressing them to management and the board of directors.
- Reviewing Policies: Internal auditors can review policies, procedures and practices to ensure that they are aligned with the organization’s risk management objectives
- Testing Compliance: Internal auditors can test compliance with laws, regulations and other requirements and ensure that the organization is meeting its compliance obligations
- Continuously Improving: Internal auditors can continuously improve the internal audit process to ensure its effectiveness in identifying, evaluating and mitigating risks.
Overall, internal auditors play an important role in helping organizations identify and manage risks, and in ensuring that their mitigation strategies are effective.
The Limitations of Internal Audit
While internal audit has indeed come a long way in India, there will always be restraints to that progress, based on the inherent limitations of the profession itself. Internal audit, like any other process, has some limitations that organizations should be aware of:
- Limited scope: Internal auditors typically focus on specific areas of the organization, such as financial controls or operational processes. As a result, they may not have a comprehensive view of all risks facing the organization.
- Reliance on management: Internal auditors rely on management to provide accurate and complete information. If management is not forthcoming or if there is a lack of transparency, internal auditors may not have a complete understanding of the risks facing the organization.
- Limited Resources: Internal audit departments may have limited resources, including staff, budget, and technology, which can affect their ability to conduct thorough audits and identify all risks facing the organization.
- Limited independence: Internal auditors are employees of the organization they are auditing and may be subject to pressure from management, which can affect their independence and objectivity.
- Limited to Past: Internal audit focuses on past events and records, it may not be able to identify emerging risks
- Limited to Compliance: Internal audit is focused on compliance with laws and regulations, it may not be able to identify all types of risks the organization is facing.
- Limited to internal control: Internal audit is focused on internal controls, it may not be able to identify all types of risks the organization is facing.
It’s important for organizations to be aware of these limitations and to use internal audit in conjunction with other risk management techniques, such as external audit, risk management, and compliance, to have a complete view of the risks facing the organization.
Still Improving
The internal audit function in India has undergone significant development in recent years. With the increased emphasis on risk management, governance, technology, and sustainability, internal auditors in India are now expected to provide valuable insights and recommendations to management on how to improve the organization’s performance and achieve its goals. The internal audit profession has also undergone significant professionalization, with the ICAI playing a leading role in this process.
It’s important for organizations to be aware, however, of the limitations of internal audit and to use it in conjunction with other risk management techniques such as external audit, risk management, and compliance, to have a complete view of the risks facing the organization.
Overall, internal audit can provide significant value to an organization by helping to identify and mitigate risks, improving efficiency and effectiveness of operations, and ensuring compliance with laws and regulations. It can also provide assurance to management, board of directors, shareholders, and other stakeholders that the organization is being well-governed and that its objectives are being met. Expect internal audit departments in India to continue to strive to meet these expectations. 
Pratik Patawari is a managing partner at ALP & Associates, a management consulting firm based in India. He has more than eight years of experience in internal auditor and risk management and has advised several companies on improving compliance and strengthening their control environments.