Most owners meet audit as an obligation and never discover what it can do. That is a costly misreading. Audit and
assurance services in India span statutory work you must have, internal work you should choose, and specialist reviews
that answer specific questions about risk and control. This guide sets out which audits apply to your entity, what
each one actually tests, and how to select and manage the firm that does the work.
Key Takeaways
-
Which audits apply depends on entity type, turnover and activity, and businesses frequently discover an obligation
late because nobody tracked the trigger. -
Statutory audit is a requirement. Internal audit is a choice, and it is the one that changes how a growing business
is run. - A clean audit trail is built during the year, not assembled in the fortnight before fieldwork starts.
The Audit Landscape in India
Several distinct audits operate in India and they answer different questions. Statutory audit under company law
expresses an opinion on whether the financial statements give a true and fair view. Tax audit under the income tax law
reports prescribed particulars to the tax authorities. Indirect tax reviews reconcile returns to the books.
Alongside those sit audits the business chooses. Internal audit tests whether controls work and whether the business
is doing what it believes it is doing. Information systems audit tests the technology those controls run on. Forensic
audit investigates a specific suspicion. Each is voluntary until something goes wrong, at which point it becomes
urgent.
Cost audit applies to specified industries and reports on cost records rather than financial statements. Secretarial
audit examines compliance with company law and related regulation. Both are narrow and both catch businesses by
surprise when a threshold is crossed.
The important distinction is between an audit that expresses an opinion for third parties and a review that informs
management. The first is governed by standards, carries a defined scope and produces a report with prescribed wording.
The second can be shaped to the question the board actually wants answered. Assurance in the second sense can also be
given by somebody other than the statutory auditor, which matters where independence rules would otherwise prevent the
incumbent firm from doing the work.
Owners often assume the statutory auditor is looking at everything. They are not. The statutory scope is the financial
statements, tested to a materiality threshold, using sampling. A great deal that matters to an owner falls outside it
entirely, which is why internal audit exists as a separate discipline.
What materiality means in practice
An auditor sets a threshold below which misstatements are unlikely to change a reader’s decision, and designs testing
around it. That is a proper professional judgement, and it also means small but persistent problems can pass
unremarked. A recurring petty cash leakage, an informal supplier arrangement or a process that depends entirely on one
person may all be immaterial to the accounts and highly material to the business.
Assurance that is not an audit
Reviews, agreed upon procedures and certifications sit below audit in the assurance hierarchy. A review gives limited
assurance and costs less. Agreed upon procedures test exactly what the client specifies and express no opinion at all.
For many internal purposes these are more useful and more proportionate than a full audit, provided everyone
understands what level of comfort they give.
Six audits, six different questions.
Which Audits Apply to Your Business
Entity type is the first determinant. Companies incorporated under the Companies Act face statutory audit regardless
of size. Limited liability partnerships and other forms face it once prescribed thresholds are crossed.
Proprietorships and partnerships have no company law audit at all, though tax audit may still apply to them.
Turnover and receipts drive the tax audit trigger, and the thresholds are revised periodically, with different limits
applying where a high proportion of transactions are digital. Because the limits move, the applicability test should
be run each year rather than assumed from last year’s position.
Activity matters independently of size. Businesses in specified sectors face cost audit or industry specific assurance
requirements. Entities receiving foreign contributions, operating in regulated financial services or holding
particular licences all carry additional reporting.
The consequences of missing a trigger are disproportionate. Late appointment of an auditor, a statutory audit not
completed in time, or a tax audit report not filed by the due date each carry their own penalty, and they compound
because one late filing usually delays the next.
The practical answer is an applicability review at the start of each financial year rather than at the end. Our note
on
optimising compliance systems in a chartered accountant firm
sets out how to build that into a calendar somebody owns.
Foreign owned subsidiaries carry an additional layer, because the Indian statutory audit sits alongside a group
reporting package prepared under the parent’s framework. Those two timetables rarely align naturally and need to be
planned together.
The triggers businesses miss most often
Crossing the tax audit turnover threshold mid year, so the obligation applies to a year that is already half over.
Starting an activity that brings the entity into a regulated category. Receiving foreign investment for the first
time, which adds reporting alongside the audit. Appointing a first institutional investor, whose shareholder agreement
usually imposes assurance requirements of its own. And converting from a partnership to a company, which brings the
full company law audit requirement immediately rather than at the next threshold.
Why late appointment compounds
An auditor appointed late cannot plan, so fieldwork happens close to the deadline when the firm is busiest and the
client is least prepared. The report is signed under pressure, observations are thinner, and the delay pushes into the
tax audit and the annual filings that depend on it. One late appointment routinely produces three late filings, each
with its own consequence.
What Auditors Actually Test
An audit is a risk driven exercise. The auditor forms a view about where the financial statements are most likely to
be wrong, and concentrates effort there. Revenue recognition, stock valuation, receivables recoverability and related
party transactions attract attention in almost every engagement.
Testing splits between controls and substantive work. Where controls are reliable the auditor tests them and reduces
detailed checking. Where they are not, the auditor tests transactions and balances directly, which takes longer and
costs more. Businesses with weak controls pay for that weakness in audit fees before they pay for it in losses.
Certain procedures are effectively universal. Confirmation of bank balances and borrowings, attendance at a stock
count, direct confirmation from significant customers and suppliers, and review of events after the balance sheet
date. Knowing these are coming allows a business to prepare rather than scramble.
The audit trail is what makes all of this efficient. Every material transaction should be traceable from the source
document through to the ledger and the statements, without anyone needing to remember why something was done. Where
that trail exists the audit is quick. Where it does not, cost and disruption rise sharply.
Judgement areas are where most audit discussion happens. Provisions for doubtful debts, stock obsolescence, useful
lives of assets and any estimate involving the future are matters of judgement, and the auditor will want to
understand the basis rather than simply accept the figure.
Our note on
accounting and financial reporting as the key to transparency
covers the reporting discipline that makes an audit straightforward rather than adversarial.
Related party transactions receive attention out of proportion to their size, and rightly so. They are the mechanism
through which value most easily leaves a company unnoticed, and the disclosure requirements are specific. Maintain a
register of related parties and the transactions with them throughout the year, because reconstructing it at the year
end is both difficult and unconvincing.
What a clean audit trail looks like
Every material transaction traceable from source document to ledger entry to financial statement line, without anyone
needing to explain from memory. Approvals evidenced at the time rather than signed retrospectively. Control accounts
reconciled monthly and the reconciliations reviewed by somebody other than the preparer. Journals supported by a
narrative and approved before posting. Where those four habits exist, an audit is a verification exercise. Where they
do not, it becomes a reconstruction exercise, and the client pays for the difference in both fees and disruption.
Internal Audit as a Growth Control
Statutory audit looks backwards at whether the accounts are right. Internal audit looks at whether the business is
operating the way management believes it is. Those are different questions, and the second one is usually more useful
to an owner.
The case for internal audit strengthens as a business grows past the point where the owner can see every transaction.
That transition is uncomfortable and often unnoticed. The symptoms are familiar: surprises in the monthly numbers,
disputes about who approved something, stock differences nobody can explain.
A first internal audit programme should be narrow and practical. Procure to pay, order to cash, payroll and stock
cover most of the risk in a typical trading or manufacturing business. Testing those four properly is worth more than
a broad review that touches everything lightly.
The output should be a small number of findings with owners and dates, not a long report. Internal audit fails when it
produces volume rather than change, and the measure of success is how many findings are actually closed by the
following review.
Independence matters even in a small business. The person testing a control should not be the person operating it,
which in owner managed firms usually means bringing the work in from outside. Our note on
risk management audit essentials covers what a first
programme should include.
Where growth is the objective, internal audit is a growth control rather than a compliance chore. It is what allows an
owner to delegate authority without losing visibility, which is the constraint that limits most Indian small and mid
market businesses.
The cost objection is usually misplaced. A focused programme covering four cycles across a year costs materially less
than a single significant loss, and considerably less than most owners assume. The comparison that matters is against
the exposure rather than against zero.
There is also a fee interaction worth knowing about. Where the statutory auditor can rely on controls that internal
audit has tested, detailed transaction testing reduces and fieldwork shortens. That does not pay for internal audit on
its own, but it offsets part of the cost and it compresses the year end.
Five practical triggers for a first internal audit.
Technology, Data and Information Systems
Financial controls increasingly live inside software, which means testing the software is part of testing the control.
If the approval workflow exists only in an application, then who can change that workflow matters as much as who
approves a payment.
General controls over technology cover four areas. Who has access and how it is granted and removed. How changes to
systems are authorised and tested. How the environment is operated and monitored. And how data is backed up and
recovered. Weakness in any of these undermines every application control that sits above it.
Access is the most common failure in Indian small and mid market businesses. Accounts for departed staff remain
active, administrator rights are shared, and the same person can create a supplier and pay it. None of this requires
sophistication to fix and all of it requires somebody to own.
Data integrity deserves separate attention where the business runs on spreadsheets alongside its accounting system.
Spreadsheets are flexible and entirely uncontrolled. Where a spreadsheet feeds a reported number, it needs version
control, review and protection just as a system would.
Our note on
streamlining a business with accounting technology services
covers the practical side of getting systems into a state where they can be relied on.
For technology businesses selling to enterprise customers, an information systems audit is often commercially
necessary rather than merely prudent, because customers ask for it during procurement.
Cloud accounting changes the risk profile rather than removing it. Segregation of duties still has to be configured,
audit logs still have to be reviewed, and integrations between systems still have to be reconciled. What the cloud
does remove is the excuse that the data was not available, which makes monitoring cheaper for any business willing to
do it.
Group and Subsidiary Reporting for Foreign Parents
An Indian subsidiary of a foreign parent runs two reporting processes. The local statutory audit produces financial
statements under Indian requirements. The group package reports the same underlying business under the parent’s
accounting policies and on the parent’s timetable.
Those two rarely align. The Indian financial year, the parent’s year end, the group reporting deadline and the local
audit timetable each have their own logic, and the subsidiary finance team is expected to satisfy all of them with the
same underlying ledger.
The reconciliation between local and group figures is the document that matters. It should be maintained continuously
rather than constructed at the year end, and every difference should be attributable to a named policy rather than to
an unexplained adjustment.
Parents also expect assurance over the control environment, not just the numbers. Confirming that delegation of
authority is respected, that local statutory obligations are current and that related party transactions are properly
recorded is usually more valuable to a group controller than the audit opinion itself.
Our note on
virtual CFO services for foreign subsidiaries
covers how that oversight is delivered in practice where the parent has no local finance presence.
The transfer pricing documentation requirement sits alongside all of this and shares much of the same underlying
analysis, so the two exercises are best planned together rather than run separately by different advisers.
Timing is the practical constraint. A group reporting deadline typically falls weeks after the period end, while the
Indian statutory audit runs on a longer cycle. The subsidiary therefore reports twice from the same ledger, first on
estimates for the group and later on audited figures locally, and the difference between those two submissions has to
be explained. Planning the two timetables together at the start of the year is what keeps that explanation short.
Choosing and Managing an Audit Firm
Independence is the first filter and it is not negotiable. A firm that prepares your accounts cannot audit them, and
the boundaries around other services are defined rather than a matter of taste. Ask the question directly at the
proposal stage.
Registration and standing are worth verifying rather than assuming. The
accounting standards and technical material published by the ICAI
set the framework the firm is required to work to, and a practice that cannot discuss how a current standard affects
your sector is telling you something useful about the depth of the engagement you will receive.
Capacity is the second. Audits cluster around the same statutory deadlines, and a firm that has taken on more than it
can staff will deliver late or thinly. Ask who will actually do the fieldwork, how experienced they are and how much
partner time the engagement carries.
Sector fit is the third. An auditor who understands your industry asks better questions and needs less explanation,
which shortens the process. It also means the observations you receive are worth reading rather than generic.
Fee should be the last consideration rather than the first. An audit priced well below the market is priced on an
assumption about how little work will be done, and the cost of that shows up as a qualification, a delay or a missed
issue. Our note on
building a strong compliance framework
covers the wider governance context.
Manage the engagement actively once appointed. Agree the timetable in writing, provide the requested schedules before
fieldwork rather than during it, and hold a planning meeting so both sides know what is expected. Audits go badly when
the client treats them as something done to them.
Finally, read the management letter. It is the part of the process with the most practical value to an owner, and it
is the part most frequently filed unread. The observations in it are usually the cheapest improvement advice a
business receives all year. The professional standards behind all of this are published by the
Institute of Chartered Accountants of India.
Keep your own copy of everything you provide. Schedules, reconciliations, signed reports and the management letter,
filed by year and independently of the firm’s systems. A business that can hand a complete history to an incoming
auditor changes firms in weeks. One that cannot spends a year rebuilding comfort over opening balances and pays a
premium for it.
For foreign owned entities, brief the firm on the parent’s reporting framework at appointment rather than at the year
end. The
Indian corporate tax administration summary
is a reasonable orientation for an overseas controller, but the reconciliation between local statements and group
policy is specific work that has to be scoped into the engagement rather than absorbed into it.
Six steps that turn an audit from disruption into routine.
Conclusion
Audit and assurance services deliver most value when a business treats them as a system rather than a deadline. Know
which audits apply before the year starts, build the trail as you go, choose internal audit deliberately once growth
outpaces direct oversight, and read what your auditor tells you. JPKAD provides statutory, internal, tax and
specialist assurance work for businesses across Kerala and India.
Talk to our audit team about the year ahead.
