The MIS is the mirror of the business. Internal audit should audit the mirror.

Promoters run the business on the monthly MIS, not on the audited accounts. Internal audit still works on last quarter's transactions. Where the two should meet: testing whether the MIS is true, using it to decide what to audit, and putting control health inside it.

1. The pack that actually runs the company.

Ask a promoter which document he reads most closely and it is rarely the audited balance sheet. It is the monthly MIS: sales by product and region, gross margin, debtors and inventory days, cash position, cost per unit, headcount and payroll. Decisions on pricing, credit, hiring and capex are taken on that pack, usually within days of it landing.

The MIS is the mirror of the business. If it is accurate, management sees what is really happening. If it is distorted, every decision taken on it inherits the distortion.

2. Two functions that rarely talk.

In most mid-sized companies the MIS and internal audit sit in separate rooms.

The MIS is prepared by finance, monthly, from the ERP and a set of spreadsheets that have grown over the years. Nobody independent checks it.

Internal audit works to an annual plan, visits a process each quarter, tests a sample of last quarter's transactions and reports two months later. Its report is read by the audit committee. It is rarely read alongside the MIS.

The result is a gap at exactly the point where risk is highest. The numbers management relies on most are the numbers nobody audits, and the audit that is done is not pointed at what those numbers are signalling.

3. The first link: audit the mirror itself.

Before internal audit uses the MIS, it should test whether the MIS can be trusted. Five questions cover most of it.

Does it tie to the books? Revenue, margin, debtors and inventory in the MIS should reconcile to the trial balance for the same month. Differences should be explained, not carried.

Are the definitions fixed? "Gross margin" and "debtor days" should be computed the same way every month and documented. A silent change in definition can turn a bad month into a good one.

Where are the manual adjustments? List every manual entry or override between the ERP extract and the final pack, who made it and why.

Is the source data complete? Unbilled dispatches, unposted purchase invoices and stock in transit are the usual gaps at month-end.

Who controls the file? Version control, access and review of the spreadsheet that becomes the MIS. Many MIS packs are a single workbook on one person's laptop.

This is not a new kind of audit. It is the same discipline internal audit applies to financial controls, pointed at the report that management actually uses.

4. The second link: let the mirror pick the audit.

A risk-based audit plan is usually written once a year. The MIS changes every month. Each movement that management questions is also a signal of where a control may be failing.

Gross margin falls in one product line. Test pricing approvals, discounts and credit notes, scrap and yield, and purchase price variances for that line.

Debtor days rise. Test credit limits and overrides, ageing of disputed invoices, unadjusted credit notes and customer master changes.

Inventory days rise. Test slow and non-moving stock, physical verification differences, goods received but not invoiced, and provisioning.

Payroll cost per head moves without a headcount change. Test new joiners and leavers, overtime and incentive payouts, and bank account changes in the employee master.

Power or fuel cost per unit rises. Test meter readings against bills, consumption norms against production and contractor billing.

When the audit plan reads the MIS each month, internal audit moves from a fixed calendar to a live one. The annual plan still sets the base. The MIS decides where to look harder this quarter.

5. The third link: put control health inside the mirror.

The MIS shows how the business performed. It rarely shows whether the controls behind those numbers held. Internal audit can add a short control section to the same pack, so the promoter reads both together.

A few lines are enough: the number of exceptions found in key controls this month, open audit observations by age, the value of transactions that bypassed an approval, and repeat findings. Exceptions from full-population tests on payments, vendor and customer masters, and inventory fit naturally here.

The effect is simple. A good sales month with a rising count of unapproved discounts reads differently from a good sales month with clean controls.

6. What changes for the internal auditor.

Cadence. Monthly touchpoints with the MIS, even if fieldwork stays quarterly.

Skills. Business understanding first, then data. The auditor has to read a margin bridge as easily as a voucher.

Reporting. One page that sits next to the MIS, not a forty-page report that arrives two months later.

Independence. Internal audit should test and comment on the MIS. It should not prepare it. The moment the auditor owns the numbers, nobody independent is checking them.

This also answers a question the statutory auditor now asks. Clause 3(xiv) of CARO 2020 requires the statutory auditor to report whether the company has an internal audit system commensurate with the size and nature of its business, and whether the auditor considered the internal audit reports for the period. An internal audit that is wired into the MIS is easier to show as commensurate than one that runs on its own calendar.

7. Where to start.

Begin with one month. Reconcile the MIS to the books and list every manual adjustment. Pick the two largest unexplained movements and audit them. Add a five-line control section to the next pack. Review after three months whether the promoter reads it.

The MIS tells management what is happening. Internal audit should tell management whether to believe it.

This article is general in nature and does not constitute professional advice. Readers should seek specific advice before acting on any matter described here.

This website is meant for information purposes only. The contents are made available on a pull basis and are not intended to solicit work or advertise.