An internal audit checklist for a new mandate has four parts: a risk assessment that ranks the entity's processes by likelihood and impact of failure, an annual plan that allocates audit days across those processes in proportion to risk rather than equally, a defined reporting cadence to management and the audit committee, and a follow-up mechanism that tracks whether prior findings were actually closed. Skipping the risk ranking and going straight to a rotation schedule is the most common way a new mandate underperforms.
Start with the risk assessment, not the audit calendar
A firm taking on its first internal audit mandate for a client is often handed, or defaults to, a rotation: finance this quarter, procurement the next, inventory the one after. That is a schedule, not a risk-based plan. A genuine risk-based plan starts by ranking the entity's processes and locations by two independent factors — how likely something is to go wrong, and how much it would matter if it did — and then allocates audit days unevenly across that ranking.
- Inherent risk factors: transaction volume, degree of judgement involved, history of error or fraud, regulatory exposure, and the extent of manual intervention in an otherwise systemic process.
- Entity-specific factors: locations added or closed during the year, a new ERP implementation, key personnel turnover in finance, and any area flagged by the statutory auditor in the prior year.
- Impact factors: materiality to the financial statements, cash exposure, and reputational or regulatory consequence of failure, which does not always track the rupee value of the process.
Common practice, not a requirement
Re-rank the risk assessment at least once a year, and revisit it mid-year if something material changes — a new business line, a large fraud discovered elsewhere in the group, a system migration. A plan fixed at the start of the year and never revisited stops being risk-based the moment the risk profile moves.
Coverage: a year-round plan versus a single visit
The choice between continuous coverage and periodic visits is itself a risk decision, not an administrative one.
| Model | Works well when | Risk if used regardless |
|---|---|---|
| Continuous / rolling coverage across the year | High transaction volumes, a listed or soon-to-list entity, prior findings of control breakdown, or a mandate that includes real-time fraud monitoring | Over-engineering a small, stable entity: cost outweighs benefit and the internal audit function becomes a compliance tax rather than a value add |
| Periodic cycle covering each area once or twice a year | A smaller entity with a stable process set and no recent history of control failure | A process that breaks down mid-cycle is not caught until the next scheduled visit, sometimes many months later |
| One-time or special-purpose review | A specific trigger — a fraud tip, a system migration, an M&A integration, a regulator's query | Treated as the whole mandate when the entity actually needs ongoing coverage; a one-off review gives false comfort that the function is covered |
Areas a plan typically has to include
The specific scope always has to be tailored to the entity, but a plan missing several of these without a documented reason for the exclusion should be questioned.
- Procure-to-pay: vendor master integrity, segregation between requisition, approval and payment, and three-way matching.
- Order-to-cash: credit approval, dispatch versus billing, and collections ageing.
- Inventory: physical verification coverage, slow-moving and obsolete stock identification, and valuation basis consistency.
- Fixed assets: capitalisation policy adherence, physical verification, and disposal authorisation.
- Payroll and HR: master data changes, overtime and incentive calculation, and exit settlement processing.
- Treasury and banking: bank reconciliation review, signatory authority, and fund movement approvals.
- IT general controls: access provisioning and de-provisioning, change management, and backup testing — increasingly load-bearing because weaknesses here undermine every automated control downstream.
- Compliance: statutory dues, related-party transaction approval, and board and committee process adherence.
- Fraud risk and whistleblower mechanism: whether complaints received were actually investigated, not just logged.
Reporting cadence to the audit committee
A new mandate should fix the reporting rhythm before the first fieldwork begins, not after the first report is due. Most audit committees expect a standing pattern rather than ad hoc reports that arrive whenever a review happens to finish.
- 01Agree the plan with the audit committee before starting fieldworkThe risk-based plan, the coverage model, and the resourcing should be presented and approved, not just circulated. This is also the point to agree what counts as a significant finding worth escalating outside the normal cycle.
- 02Report each completed review with a consistent structureScope and period covered, findings graded by severity, management's response and committed action date, and a clear statement of what was not covered and why.
- 03Track open findings at every subsequent meeting, not just at year endA findings tracker that shows date raised, target closure date, actual closure date, and ageing of anything still open is usually the single most useful document in the pack, because it is where a committee sees whether management actually acts on what internal audit reports.
- 04Escalate outside the cycle when something warrants itA fraud indicator or a control breakdown with cash exposure should reach the audit committee chair directly, not wait for the next quarterly pack.
- 05Close the year with a coverage summary against the approved planState what was planned, what was actually covered, what was deferred, and why — so the committee can see the plan was followed or can see and approve the deviation.
A findings tracker that only shows findings raised, with no closure column maintained, gives an audit committee a false sense that internal audit is adding value. The value is in the closure rate and the ageing of open items, not in the count of issues identified.
How we think about this
Building the risk ranking, maintaining the findings tracker, and producing the coverage-versus-plan summary are the parts of an internal audit mandate that are mechanical once the underlying data exists — pulling transaction volumes, ageing open items, comparing planned days to actual days spent. None of that should consume senior time. What should is deciding which process actually deserves more days this year than last, and forming the view on a finding that management disputes.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCBuilding a risk control matrix (RCM) for audit testingHow to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
- Internal audit & IFCInternal audit vs statutory audit: what actually differsWhere internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
- Internal audit & IFCReviewing the whistleblower mechanism as part of the auditWhat a whistleblower mechanism review has to check beyond the policy existing on paper, how to test whether complaints were actually investigated and closed, and how it connects to the auditor's fraud-reporting conversation.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.