Internal audit is usually described as a governance requirement, which is why most owner managed businesses ignore it.
The better framing is practical. It is what replaces the owner’s eyes once the business grows past the point where one
person can see every transaction. This guide sets out the point at which a risk management audit starts paying for
itself, and what a first programme should cover.
Key Takeaways
-
The trigger for internal audit is not a turnover figure. It is the moment the owner stops being able to observe
transactions directly. -
A first programme should cover four cycles properly rather than everything lightly: purchases, sales, payroll and
stock. -
Findings only create value if they carry an owner, a date and a follow up review. Reports without those change
nothing.
The Real Trigger Is Loss of Line of Sight
In a business of fifteen people the owner sees most of what happens. Purchases are approved verbally, unusual payments
are noticed, and a supplier nobody recognises would be questioned. Control is informal and it works.
Somewhere between that and a hundred people, direct observation stops being possible. Authority has been delegated
because it had to be, but the record of who may approve what has not kept pace. That gap is where losses and errors
accumulate, and it opens well before anyone notices.
Turnover is a poor proxy for this because a high volume trading business loses line of sight far earlier than a
project business with a handful of large contracts. Better indicators are the number of people who can commit the
company to spending, the number of physical locations, and whether the owner can still name every significant
supplier.
The clearest signal is surprise. When monthly results regularly differ from what management expected, the reporting is
describing the business too late to act on. That is a control problem before it is a reporting problem.
A second signal is disputed authority. If it takes more than a moment to establish who approved a particular purchase,
then the approval process exists in memory rather than in a record, and memory does not survive an argument or a
departure.
The third is reconciliation drift. Stock differences, unallocated receipts and control accounts that never quite agree
are all symptoms of processes that no longer work at the current volume, and they compound quietly until something
forces attention.
None of these signals is dramatic, which is why they are ignored. Each one is individually explicable and collectively
they describe a business that has outgrown informal control. The useful test is whether you could explain, without
asking anyone, why last month’s gross margin moved.
Where first time internal audits typically find issues.
What a First Programme Should Cover
Purchase to pay first, because that is where money leaves the business. Test whether purchase orders are raised before
commitment, whether goods received notes match invoices, whether new suppliers are approved by someone who cannot also
pay them, and whether payments outside the normal run have documented reasons.
Order to cash second. Test credit approval before despatch, pricing against the approved list, credit notes and their
authorisation, and the ageing of receivables against the stated policy. Credit notes are the most commonly abused
document in a small business and the least frequently reviewed.
Payroll third. Test that everyone paid exists and works there, that changes to bank details follow a verification
step, that overtime and allowances are approved, and that leavers are removed promptly. Payroll fraud in small firms
is usually simple and persistent rather than sophisticated.
Stock fourth, in any business that holds it. Test the counting process, the treatment of differences, the
authorisation of write offs, and the movement of goods between locations. Persistent unexplained differences are
almost never a counting problem.
Resist the temptation to add scope. A first programme that covers these four properly produces findings the business
can act on. One that also touches treasury, compliance, procurement strategy and information technology produces a
document nobody finishes reading.
Fixed assets and expenses can wait for the second cycle unless there is a specific concern. Our note on
risk advisory services and managing growth risks
covers how the programme should broaden over time.
Compliance is the one addition worth making early where the business is regulated or has foreign shareholders, because
the consequences of a lapse are external rather than internal. The
Indian corporate tax administration summary
gives a sense of how the surrounding filing regime operates and why an internal check on it pays for itself.
Independence Without a Department
The person testing a control cannot be the person who operates it. In a business with a finance team of four, that
rules out almost every internal option, which is why smaller businesses generally buy internal audit rather than build
it.
An external provider brings a second advantage beyond independence. They have seen how the same process fails in
twenty other businesses, so they know where to look. An internal appointee learns that over years.
Reporting line matters as much as who does the work. Internal audit should report to the owner or the board, not to
the finance head whose processes are being tested. Where that reporting line is blurred, uncomfortable findings get
softened before anyone sees them.
Frequency should match risk rather than convention. Quarterly is right for a fast growing business with several
locations. Half yearly suits a stable one. Annual is barely enough to be useful, because the gap between reviews
exceeds the time it takes for a process to drift.
Keep the cost proportionate. A focused programme covering four cycles across a year costs less than most owners
expect, and considerably less than a single significant loss. The comparison that matters is not against zero, it is
against the exposure.
For businesses with a foreign parent or institutional investor, an independent internal audit function is often
expected rather than optional, and having one already established removes a common friction point during diligence.
Five habits that make internal audit worth the fee.
From Compliance Chore to Growth Control
The best argument for internal audit is not fraud prevention, although it does that. It is that reliable controls are
what allow an owner to delegate without losing visibility, and delegation is the constraint that limits most Indian
small and mid market businesses.
An owner who must personally approve every payment becomes the bottleneck in their own company. One who has a tested
authority matrix, working reconciliations and periodic independent review can delegate confidently, which is the
difference between a business that scales and one that plateaus at the owner’s capacity.
There is a financing benefit too. Lenders and investors read control quality as a proxy for management quality. A
business that can produce an internal audit report with closed findings is a materially easier credit and a materially
easier investment.
It also reduces audit cost over time. Where the statutory auditor can rely on controls rather than testing
transactions directly, fieldwork shortens. That saving does not cover the internal audit fee, but it offsets part of
it and it shortens the year end.
The final benefit is preparedness. Businesses that are eventually sold or that raise institutional money go through
diligence, and diligence tests exactly what internal audit tests. Our note on
building a strong compliance framework
covers how the two connect.
Start narrow, report briefly, close findings, and widen the scope only once the first cycles are clean. That sequence
produces a control environment in about two years and produces goodwill from the operating team throughout, which is
what makes it sustainable.
Conclusion
Internal audit earns its place the moment an owner can no longer see every transaction. Start with purchases, sales,
payroll and stock, keep the reporting line independent, and judge the programme by how many findings actually close.
Done that way a risk management audit stops being a governance formality and becomes the control that lets the
business grow. Speak to JPKAD about a first programme scoped to your size.
