Does a clean internal audit report mean your business is sound, or that the audit looked in the wrong places?
The report alone rarely tells you. The answer usually traces back to one earlier decision: which IA partner you appointed. An IA partner (internal audit partner) is the external firm or consultant that tests your controls and reports the findings to management and the board.
To choose an internal audit partner in India, first confirm independence: the firm cannot be your statutory auditor (Section 144, Companies Act, 2013) and should report to the audit committee or board. Then score proposals on seven criteria and run a limited pilot before signing a multi-year mandate.
Key Takeaways on Choosing an IA Partner
- Independence is a pass or fail test. Your statutory auditor cannot be your IA partner, and a firm should not audit a function it runs.
- The law sets a floor, not a full picture of need. Rule 13 sets mandatory limits, but some businesses need internal audit sooner
- Score proposals on seven criteria. Expertise and methodology carry the most weight.
- Ask for evidence. Request a sanitised sample report and the names of the people doing the work.
- Pilot first. Start with one process area and name a senior owner inside the company.
Why Does Your Choice of IA Partner Matter?
Internal audit tests how your business actually runs, rather than how the policy manual says it runs. Your IA partner decides how well that testing is done.
Area | Weak IA partner | Capable IA partner |
The report | Clean, with few specific findings | Specific findings you can act on |
When problems surface | Late, when a statutory auditor or lender raises them | Early, inside the audit cycle |
Cost of correction | Higher, because the conversation is about explaining what went wrong | Lower, because the conversation is about preventing it |
Appoint an IA partner the way you would appoint a senior finance hire, with reference checks.
Does Your Business Need an Internal Audit Partner in India?
Many growing businesses assume internal audit can wait. For some, the law has already decided. Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, makes it mandatory for the companies below.
Company type | Internal audit is mandatory if, in the preceding financial year, it had |
Listed company | Always mandatory |
Unlisted public company | Paid-up share capital of ₹50 crore or more, turnover of ₹200 crore or more, borrowings above ₹100 crore, or deposits of ₹25 crore or more |
Private company | Turnover of ₹200 crore or more, or loans or borrowings from banks or public financial institutions above ₹100 crore at any point in the year |
The rule’s own wording for the borrowings limit, “exceeding one hundred crore rupees or more,” is loosely drafted, so a company near that figure should take professional advice. Below these limits, internal audit is not mandatory, but the same criteria apply to a voluntary appointment.
Why a threshold is not the same as a need?
A threshold shows when the law forces the decision, not when the business needs the function. A company with several locations and investor reporting duties usually needs independent assurance well before it reaches a statutory line.
Is There a “Best Internal Audit Firm” in India? Why Fit Matters More Than Rankings
Online lists often rank firms as the best internal audit firm in India, but rankings are a poor basis for appointment. A firm built for a listed manufacturer with twenty plants may be wrong for a 300-person services company. Ask instead which internal audit service provider fits your risk profile and stage of growth. Fit can be verified through references and sample work, whereas a ranking cannot.
If you operate in Bangalore, our guide on choosing an audit firm in Bangalore applies the same fit-first logic locally.
How to Check an IA Partner’s Independence First?
Independence is a pass or fail test. Expertise matters little if the partner cannot report freely.
The Section 144 bar on statutory auditors
Section 144 of the Companies Act, 2013 bars a statutory auditor from providing internal audit services to the company, directly or indirectly, and the bar extends to its holding and subsidiary companies. If your statutory auditor offers to double as your IA partner, the law has already answered.
A pending bill proposes extending this restriction for three years after an auditor’s term ends; it is not yet law.
Conflicts and reporting lines
A firm that designs your controls or runs your accounting function should not audit that same function. If the internal auditor reports only to the CFO, it cannot credibly audit finance. Our position is that the IA partner should report to the audit committee or the board, with the CFO as day-to-day contact.
Independence checklist
- Is the firm, or an affiliate, your statutory auditor?
- Does it design your controls or run your accounting function?
- Does it report to the audit committee or the board?
- Can it explain how it separates teams and manages conflicts?
A “yes” to either of the first two fails the test. A “no” to either of the last two calls for hard questions.
What Are the 7 Criteria to Evaluate an IA Partner or Internal Audit Firm?
Once independence is established, these seven criteria separate a useful internal audit service provider from a merely available one.
1. Industry expertise: Has the team worked in your sector?
Generic checklists miss sector risks: revenue leakage in a hospital and inventory valuation in a manufacturer are different problems.
Questions on industry expertise
- Who on the proposed team has worked in your industry?
- Can you see anonymised examples of findings?
Warning sign: textbook definitions instead of specific answers.
2. Audit methodology: is the work risk-based and mapped to a standard?
A credible methodology is risk-based and mapped to a recognised standard: in India, the Standards on Internal Audit issued by ICAI, and often the IIA Global Internal Audit Standards, which took effect on 9 January 2025. A partner that cannot map its work to a standard asks you to trust a process you cannot inspect.
Questions on audit methodology
- Which standard does the firm map its work to?
- How is the annual plan built, and how are working papers reviewed?
Warning sign: a plan that covers every department once a year regardless of risk is a calendar, not a methodology. Our guide on how to determine the scope of an internal audit in India shows how to document scoping.
3. Risk assessment: Is the audit testing the right controls?
Control testing asks whether a control works. Risk assessment asks whether the audit is testing the right controls. A capable partner builds a risk and control matrix before fieldwork starts, linked to a framework such as COSO and, where applicable, to the internal financial controls your statutory auditor reports on under Section 143(3)(i) of the Companies Act, 2013. A thin matrix tends to surface later, in that report.
Questions on risk assessment
- Can you see the format of the risk and control matrix?
- How does the partner assess fraud exposure?
Warning sign: testing that starts in week one is selling hours, not assurance.
4. Technology and data analytics: does the partner test full populations?
Sampling a few dozen invoices from a ledger of tens of thousands is weak when the full population can be analysed.
Questions on technology and data analytics
- Does the partner test entire datasets for duplicate payments, split invoices and vendor master changes?
- Which tools does it use, and how does it protect your data?
Warning sign: a “data analytics” claim with no named tools or sample outputs.
5. Reporting quality: will the report drive a decision?
In audit reporting, the report is the product. Request a sanitised sample report before you sign. Each finding should state the condition, criteria, cause, effect and recommendation, with a risk rating, an owner and a date.
Illustrative example (hypothetical, not a client case)
Weak finding | Strong finding | |
What it says | “Some vendor payments lacked approval.” | Vendor bank details were changed without a second approval |
Cause | Not stated | The ERP did not enforce dual authorisation |
Recommendation | Not stated | Enforce system-level dual approval and review the change log monthly |
Warning sign: a sample report that lists observations with no cause, risk rating or owner.
6. Compliance knowledge: can the partner test the law your business follows?
A compliance audit is only as reliable as the partner’s knowledge of the law it tests. Your IA partner should know the Companies Act, GST, TDS, FEMA and labour laws well enough to test them.
For companies where it applies, Clause (xiv) of CARO 2020 requires the statutory auditor to report on whether an internal audit system exists and whether internal audit reports were considered. Lenders and investors may read that report. Our CARO 2020 internal audit checklist explains what auditors ask for.
Warning sign: compliance answers that cite no section or rule numbers.
7. Scalability and continuity: will the team stay stable as you grow?
A new entity, a new state, an ERP migration or an acquisition will change the audit universe, so continuity matters as much as capacity.
Questions on scalability and continuity
- Can the firm add IT and forensic specialists without replacing the core team?
- Who is the named team, and how many hours will the partner personally spend?
Warning sign: a manager who changes every quarter takes your business knowledge along.
Outsourced Internal Audit, In-House or Co-Sourced: Which Model Fits?
Model | Suits | Main risk |
In-house team | Large, multi-location groups with a steady audit workload | Fixed cost and skill gaps, with some pressure on independence |
Outsourced internal audit | Growing mid-sized businesses that need independence and varied skills | Dependence on the provider’s knowledge and weak internal ownership |
Co-sourced | Companies with an internal audit head who need external specialists | Unclear division of roles |
Outsourcing works only if a senior person inside the company owns the relationship; otherwise even a good internal audit consultant produces reports that sit unanswered.
How to Read an Internal Audit Proposal and Its Fees?
Providers usually quote either a fixed fee per audit cycle or a time-based fee. Compare scope, not totals: hours, seniority mix, site visits and whether follow-up reviews are included. A proposal priced well below the others often covers a narrower scope, and a promise of zero findings is a red flag.
How Should You Compare Internal Audit Proposals With a Scorecard?
Use a weighted scorecard so the decision is documented. Independence is a pass-or-fail gate and carries no weight. The weights below are illustrative and should be adjusted to your risk profile.
Criterion | Weight | What strong looks like |
Industry expertise | 20 | Named sector experience on the proposed team |
Audit methodology | 20 | Risk-based plan mapped to ICAI standards |
Risk assessment | 15 | Risk and control matrix before fieldwork |
Reporting quality | 15 | Rated findings, owners, dates and a one-page summary |
Compliance knowledge | 10 | Working knowledge of Indian statutes |
Technology | 10 | Full-population analysis with data safeguards |
Scalability | 10 | Stable team with access to specialists |
Ask two reviewers, such as an audit committee member and the CFO, to score separately, then compare. Large gaps show where you need more questions. If you have a proposal in hand, a professional review can test it against these criteria. MSNA & Associates is a firm of chartered accountants that provides internal audit services.
Worked example (hypothetical, not a client case):
Two proposals are scored out of 10 on each criterion and weighted using the scorecard above.
Firm A | Firm B | |
Industry expertise (20) | 8 | 6 |
Audit methodology (20) | 7 | 9 |
Risk assessment (15) | 8 | 9 |
Reporting quality (15) | 9 | 7 |
Compliance knowledge (10) | 7 | 8 |
Technology (10) | 6 | 8 |
Scalability (10) | 7 | 6 |
Weighted total (out of 100) | 75.5 | 76.0 |
The totals are almost identical, but the profiles differ. Firm A is stronger on sector knowledge and reporting. Firm B is stronger on method and risk work. Look at the gaps before you look at the total.
How to Appoint Your IA Partner: Readiness, Pilot and First 90 Days ?
Some weak audits are not the partner’s fault: unclear process owners and slow data produce thin work from any firm. Before appointing:
- Name an internal sponsor, usually the CFO or a senior controller.
- Agree turnaround times for data requests and management responses.
- Decide which committee reviews findings and how often.
Start with a limited pilot
Our recommendation is to start with one process area, such as procure-to-pay, before signing a multi-year mandate. A pilot shows how the team handles data requests and how it behaves when findings are unwelcome. Check references from similar-sized clients.
What the first 90 days should look like?
Period | Focus | Output |
Months 1 and 2 | Process walkthroughs and risk assessment | An audit plan approved by the audit committee |
Month 3 | The first fieldwork cycle | A draft report |
If a proposal cannot show this sequence, the plan is probably generic.
Conclusion: Choose the IA Partner Who Will Challenge You
A good IA partner is judged by the quality of its questions, not the length of its client list. Methodology and risk assessment decide whether the work changes how the business runs, and reporting decides whether anyone acts.
A professional review can show how these criteria apply to your situation. MSNA & Associates provides internal audit services for Indian businesses. You can reach the team at contact@msna.co.in or +91 9036727740.
Looking for the Right Internal Audit Partner for Your Business?
Frequently Asked Questions About Choosing an IA Partner
Can my statutory auditor also be my IA partner?
No. Section 144 of the Companies Act, 2013 bars a statutory auditor from providing internal audit services to the company, and the restriction also reaches holding and subsidiary companies. Our guide on first auditor appointment for Indian subsidiaries explains how statutory auditor appointments work.
Is internal audit mandatory for a private limited company?
Only above the Rule 13 limits. A private company needs an internal auditor if its turnover in the preceding financial year was ₹200 crore or more, or its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point in that year. Below these limits, internal audit is a choice.
Who can be appointed as an internal auditor under Section 138?
A chartered accountant, a cost accountant or another professional the board decides. Under Rule 13, the company appoints an internal auditor or a firm of internal auditors, who may or may not be an employee.
What is the difference between an internal audit firm and an internal audit consultant?
A firm usually fields a team under partner oversight with access to specialists. A consultant is often an individual or a small practice. The same standards of independence and methodology apply to both.
Discover more from MSNA & Associates LLP
Subscribe to get the latest posts sent to your email.
