Picture a Pune-based manufacturer that has grown from one plant to three, from 60 employees to 400, and from a handful of suppliers to more than 200. The accounting team still closes the books every month, but approvals now happen over WhatsApp, vendor details change without a second check, stock differences are written off at year-end, and nobody is quite sure who can edit the ERP. None of this shows up as a single dramatic problem. It shows up as small leaks.

That is where internal audit for mid-size companies earns its place. Internal audit is a structured, independent review of how well a company’s controls, risk management and processes actually work, followed by practical recommendations to fix what is weak. It is not just a hunt for fraud or a re-check of accounting entries. A good internal audit also looks at governance, operational efficiency and compliance with the requirements that apply to the business.

What Is Internal Audit?

The Institute of Chartered Accountants of India (ICAI) describes internal audit as an independent, objective assurance and advisory function that evaluates the effectiveness of an organisation’s governance, risk management, compliance and internal controls, with the aim of adding value and recommending improvements.

In practice, internal audit helps management and the Board understand whether:

• financial and operational controls are working as intended;
• business risks are identified and managed;
• policies and approval procedures are being followed;
• financial information is reliable enough to base decisions on;
• regulatory and contractual obligations are being monitored; and
• inefficiencies and control weaknesses are being picked up early.

Internal audit can be performed by an in-house team, an external firm, or a combination of both. It is different from bookkeeping (recording transactions), management review (managers checking their own areas) and the statutory audit (an independent opinion on the financial statements).

Why Do Mid-Size Companies Need Internal Audit?

Increasing transaction volumes. More transactions, vendors, employees and locations make it harder for a small finance team to spot problems manually.

Greater financial and operational complexity. Multiple departments, procurement processes, inventory, customer credit and decentralised approvals create more points where controls can break down.

Internal control weaknesses. Unclear responsibilities, excessive system access, weak reconciliations and informal approvals all increase the risk of errors and misuse.

Management visibility. Structured audit reports show leadership where problems recur, so they can fix root causes rather than symptoms.

Governance and accountability. Documented processes, clear ownership and independent review give directors, lenders and investors more confidence in how the business is run.

These are good reasons, but they are not a legal requirement in themselves. Whether internal audit is mandatory depends on the law, as explained next.

Is Internal Audit Mandatory for Mid-Size Companies in India?

It depends on the company’s category and financial figures, not on whether it calls itself “mid-size”. Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014 (as substituted in 2016), requires the following companies to appoint an internal auditor:

Swipe the table sideways to see all columns.

A few points matter in practice:

• The test uses the preceding financial year. Check the thresholds against last year’s audited figures, and track loan balances throughout the year, since the borrowing test applies “at any point of time”.
• Who can be the internal auditor. Section 138 allows a chartered accountant, a cost accountant or another professional decided by the Board. Under Rule 13, the internal auditor may or may not be an employee of the company.
• Scope is set by the Audit Committee or Board. Rule 13(2) requires the Audit Committee or the Board, in consultation with the internal auditor, to formulate the scope, functioning, periodicity and methodology of the internal audit.
• The statutory auditor also looks at it. Where CARO 2020 applies, the statutory auditor reports on whether the company has an internal audit system commensurate with its size and nature of business.

A private limited company with turnover under ₹200 crore and bank borrowings within ₹100 crore is generally not legally required to appoint an internal auditor, but many such companies choose to as a governance and risk measure. Confirm applicability against your current financials and the rules as they stand.

What Is the Scope of an Internal Audit?

Scope should follow the company’s size, industry, risk profile, business model and control environment. For most mid-size companies, it draws on the following areas.

1. Financial Controls and Accounting

General ledger reviews, bank and balance sheet reconciliations, journal-entry approvals, financial reporting processes, accruals and provisions, expense classification, and month-end and year-end close. These checks surface unsupported transactions, inconsistencies and process gaps before they reach the financial statements.

2. Revenue and Receivables

Sales recording, revenue recognition controls, customer credit approvals, invoicing, credit notes and returns, receivables ageing and collection follow-up. The aim is to catch revenue leakage and overdue balances early.

3. Procurement and Vendor Management

Vendor onboarding, purchase approvals and purchase orders, three-way invoice matching, duplicate payments, vendor master changes and conflicts of interest. Strong controls here reduce unauthorised purchases and payment errors.

4. Payroll and Human Resources

Employee master data, payroll changes, attendance and leave records, salary approvals, reimbursements, applicable statutory payroll obligations such as PF, ESI and TDS on salaries, and access to payroll data. Which obligations apply depends on the company’s size, location and workforce.

5. Inventory and Fixed Assets

Physical stock verification, inventory adjustments, slow-moving and obsolete stock, fixed asset registers, asset tagging, disposals, and differences between physical assets and the books. This is especially important for manufacturers and distributors.

6. Tax and Regulatory Processes

Review of the processes behind GST, TDS, income tax records and other applicable obligations: are returns filed on time, reconciled with the books and properly supported? Internal audit does not replace the statutory audit, a tax audit, a legal review or specialised compliance engagements.

7. IT Systems and Access Controls

User access rights, segregation of duties in the accounting system, password and MFA practices, backup and recovery, change management, audit logs, and timely removal of access for former employees. Companies using accounting software must also maintain an audit trail (edit log) under the Companies (Accounts) Rules, so its operation is worth testing.

8. Operational Processes and Fraud Risk

Approval bypasses, unusual transactions, weak documentation, conflicts of interest, repeated control exceptions, process bottlenecks and unusual cash or inventory movements. A control exception is not proof of fraud. Where fraud is suspected, a separately scoped investigation may be needed; see our guide to financial fraud red flags.

How Frequently Should a Mid-Size Company Conduct Internal Audits?

There is no single legally prescribed frequency for every company. Frequency should reflect risk, legal requirements, business complexity and the nature of each process. For companies covered by Rule 13, the periodicity is set by the Audit Committee or Board. The table below is an illustrative planning example only, not a statutory requirement.

Swipe the table sideways to see all columns.

High-risk areas may need more frequent review, and low-risk areas less. Legal and sector-specific requirements always take precedence over a generic schedule.

What Is a Risk-Based Internal Audit?

A risk-based internal audit focuses effort where the likelihood and potential impact of problems are highest, instead of auditing every area equally. Factors that raise an area’s priority include transaction volume, financial materiality, past control failures, system or process changes, fraud exposure, regulatory sensitivity, business expansion, management concerns and previous audit findings.

Swipe the table sideways to see all columns.

These categories are illustrative. Each company should define its own risk criteria.

What Does the Internal Audit Process Look Like?

1. Understand the business: structure, business model, systems, processes and major risks.
2. Define the audit scope: objectives, departments, periods, transactions, locations and deliverables.
3. Prepare the audit plan: priorities, procedures, sample sizes where appropriate, timelines and contacts.
4. Test controls and review evidence: document inspection, transaction testing, reconciliations, interviews, walkthroughs and analytics. Sampling tests a selection of transactions, not every one.
5. Validate findings: confirm facts with process owners and separate genuine control weaknesses from isolated errors.
6. Report and follow up: agree corrective actions, owners and target dates, then track and verify remediation.

What Should an Internal Audit Report Include?

A useful internal audit report is clear, evidence-based and actionable. It typically includes:

• Executive summary
• Audit objectives and scope
• Period and processes covered
• Methodology
• Key findings, with supporting evidence
• Risk or impact assessment
• Root causes, where established
• Recommendations
• Management responses
• Action owners and target dates
• Follow-up status of earlier findings

Sample finding format (hypothetical example):

Reports should focus on evidence, risk, root causes and practical action. Assigning blame without sufficient support undermines trust in the process.

Internal Audit vs. Statutory Audit

Swipe the table sideways to see all columns.

The two serve different purposes, and one does not replace the other. Section 144 of the Companies Act also prevents a company’s statutory auditor from providing internal audit services to it. For year-end preparation, see our statutory audit checklist for FY 2026-27.

Common Internal Audit Mistakes Mid-Size Companies Should Avoid

1. Treating it as a year-end formality. Problems found in March are expensive to fix; spread reviews through the year.
2. Auditing low-risk areas while ignoring material risks. Start from a risk assessment.
3. Unclear scope. Agree objectives, periods and deliverables in writing.
4. Accepting explanations without evidence. Every conclusion should rest on documents or testing.
5. Treating every exception as fraud. Most exceptions are process failures; investigate proportionately.
6. Reports without named action owners. Findings without owners rarely get fixed.
7. Not tracking corrective actions. Follow up and verify closure.
8. Ignoring changes in operations or systems. Update the plan when the business changes.
9. Confusing internal and statutory audit. They answer different questions.
10. Assuming outsourcing shifts responsibility. Management and the Board remain responsible for controls.

When Should a Company Consider Outsourcing Internal Audit?

An external internal audit provider can be useful when the company has no dedicated internal audit team, wants an independent perspective, is expanding to new locations, has more complex financial processes, keeps finding the same control weaknesses, needs specialist technology or industry expertise, or wants help building a risk-based audit plan.

When evaluating a provider, check qualifications, independence (including that it is not your statutory auditor), relevant industry experience, reporting format, confidentiality safeguards and how it follows up on findings. Management and the Board keep their responsibilities even when the audit work is outsourced. Learn more about our internal audit services and how they connect with internal financial controls.

Frequently Asked Questions

Building an Internal Audit Programme That Fits

A well-designed internal audit for mid-size companies helps strengthen controls, catch operational weaknesses early, improve accountability and support better decisions. The right scope and frequency depend on your risks, complexity, applicable law and industry. Internal audit does not guarantee fraud prevention, legal compliance or error-free reporting, but it gives management a clearer, evidence-based view of where to act.

This article is general guidance and not legal or professional advice. Confirm statutory applicability against your company’s current figures and the law in force.

Sources: Companies Act, 2013 (MCA) · Rule 13, Companies (Accounts) Rules, 2014 · ICAI Compendium of Standards on Internal Audit (Feb 2026) · The Institute of Internal Auditors