Most internal audits fail for a boring reason: nobody agreed upfront what would be checked. The auditor turns up, samples a few vouchers, and the report says "controls need strengthening". Nothing changes.
This is the checklist we start from for private companies in Delhi NCR, mainly manufacturers and traders. Use it to plan your own review, or to judge whether the internal audit you're paying for is covering the right ground.
Not sure whether internal audit is mandatory for you? That depends on last year's turnover and borrowings. See internal audit applicability first.
Before you start: set the scope
- Get the scope approved. The Board, or the Audit Committee where there is one, decides the areas, frequency and method. Put it in writing.
- Rank areas by risk. Where does most money go out, and where has something gone wrong before? Those areas get covered every quarter. The rest can rotate.
- Pick the period and sample. State the months covered and how samples were chosen, so the next auditor can repeat it.
- Pull last year's findings. Every internal audit should open by checking whether earlier issues were actually fixed.
1. Purchases and payments (procure-to-pay)
- Who can create a new vendor, and who can change a vendor's bank account. These should be different people.
- Purchase orders approved before the invoice, within the approver's limit.
- Three-way match: PO, goods receipt note and invoice agree on quantity and rate.
- Duplicate payments: same vendor, same amount, same invoice number, paid twice.
- Advances to vendors that are old and still not adjusted.
- MSME vendors paid within the agreed period, and never beyond 45 days. Late payments can be disallowed as an expense in income tax and must be reported to the ROC in MSME Form I.
2. Sales and receivables (order-to-cash)
- Credit limits set per customer and actually blocked in the software when crossed.
- Discounts, free goods and rate changes approved under a written policy.
- Every dispatch billed: compare gate-out register and e-way bills with sales invoices.
- Receivables ageing, follow-up on dues older than 90 days, and who approves write-offs.
- Credit notes: who raises them, why, and whether GST on them was handled correctly.
3. Inventory and production
- Physical verification of stock against the books, at least once a year for each item, with differences explained.
- Slow-moving, damaged and obsolete stock identified and valued correctly.
- Goods lying with job workers or at third-party godowns reconciled with their confirmations.
- Consumption per unit compared with the standard. This is where a cost-trained auditor earns their fee.
- Scrap: how it is weighed, recorded, priced and sold, and who collects the money.
4. Payroll and HR
- Headcount in payroll matched to attendance records and the PF/ESI challans.
- Joiners and leavers: salary started and stopped on the right dates, full and final settlements approved.
- Overtime, incentives and reimbursements backed by approvals.
- Salary paid to bank accounts, with no two employees sharing one account.
5. Statutory compliance
- GST: returns filed on time, input tax credit matched to GSTR-2B, credit reversed where a supplier was not paid within 180 days, e-invoicing and e-way bills in place where they apply.
- TDS/TCS: deducted at the correct rate, deposited by the 7th of the next month, quarterly returns filed and Form 16/16A issued.
- PF and ESI: deposited by the 15th of the next month, on the correct wage base.
- ROC: annual filings, board and general meeting minutes, statutory registers and charge filings up to date.
- Cash: no cash receipt of ₹2 lakh or more from one person, and cash expenses within income-tax limits.
6. Fixed assets
- Fixed asset register with location and tag number, physically verified on a cycle. The statutory auditor reports on this under CARO.
- Capital and revenue expenses split correctly, and capital work-in-progress that has been sitting for years explained.
- Assets sold or scrapped removed from the books, with the sale approved.
- Insurance cover matched to the asset values.
7. Cash, bank and treasury
- Bank reconciliations done every month and reviewed by someone other than the preparer.
- Surprise cash counts at the office and at each site.
- Net-banking rights: who can make payments, and who approves them.
- Loans and working-capital limits used for the purpose they were taken, and stock statements to the bank matching the books.
8. IT controls and audit trail
- The accounting software's audit trail is switched on and has not been disabled at any point in the year. It has been mandatory since 1 April 2023.
- User rights: nobody can both post and approve their own entries, and ex-employees' logins are disabled.
- Backups taken and actually restorable.
- Entries edited or deleted after the books were closed for a month.
9. Related-party transactions
- A current list of related parties, and every transaction with them traced.
- Board or shareholder approvals under Section 188 where needed, and prices at arm's length.
- Loans to directors and group companies checked against Sections 185 and 186.
Documents to keep ready
- Trial balance, ledgers and the previous internal and statutory audit reports.
- Purchase and sales registers, GSTR-1, GSTR-3B and GSTR-2B for the period.
- Stock registers, physical verification sheets and job-work records.
- Payroll registers, attendance, and PF/ESI challans.
- TDS returns and challans, bank statements and reconciliations.
- Board minutes, the delegation-of-authority matrix and the list of related parties.
What the internal audit report should look like
Short and ranked. Each finding should state what was tested, what was found, the amount at stake, a risk rating (high, medium or low), the management response, an owner and a target date. A one-page summary for the Board goes on top, and a tracker shows which earlier findings are closed and which are still open.
If your current report doesn't do this, the statutory auditor will struggle to rely on it when reporting on internal audit under CARO 2020, clause 3(xiv).
Frequently asked questions
What should an internal audit checklist cover?
Purchases and payments, sales and receivables, inventory, payroll, statutory compliance (GST, TDS, PF/ESI, ROC), fixed assets, cash and bank, IT controls and audit trail, and related-party transactions. The Board decides the final scope based on risk.
How often should internal audit be done?
Most companies run it quarterly or half-yearly. High-risk areas such as purchases, inventory and cash are usually covered every cycle, while lower-risk areas rotate through the year.
Can we do internal audit with our own staff?
Yes. The internal auditor can be an employee or an outside firm. What matters is independence from the people being audited and a direct line to the Board or Audit Committee.
What is the format of an internal audit report?
A one-page summary for the Board, then each finding with the area tested, observation, amount involved, risk rating, management response, owner and target date, plus a tracker of earlier findings.
How Vitt-Marg helps
We turn this checklist into a risk-based plan for your business, agree it with your Board, and run the internal audit quarterly or half-yearly with working papers and a findings tracker. Our CMAs and CAs focus on where money actually leaks. See how we work as your internal auditor in Noida.
General information, current as of October 2026, not advice for a specific case. Company-law and tax rules change often — check with us before acting on it.