Practice 02 · Assure after

Assurance designed for the audit committee, not the file room.

Internal audit under section 138, IFC testing, audit committee support and listing readiness. Planned, risk-based, run on full populations, reported on one page.

Governance & Controls AssurancePage reviewed October 2026
Who it is for
Listed companies, mid-to-large promoter-led businesses, manufacturing groups with ₹100 Cr+ turnover.
Cycle
Quarterly cycles of 3 to 4 weeks; annual IFC review of 4 to 6 weeks.
You receive
A one-page executive summary, a findings register with quantified impact, root-cause recommendations, and our presence at the audit committee close-out.
01 · DefinitionWhat it is

A planned, risk-based review of processes, controls and compliance, built around the audit committee’s next agenda: what they need to ask, what management needs to fix, what the statutory auditor will see when they return.

02 · TriggerWhen to consider it
  • Section 138 applies: listed, or an unlisted company past the Rule 13 thresholds. Our checker on the home page gives the answer in ten seconds.
  • The audit committee wants a one-page answer, not a hundred-page file.
  • IFC is in scope and the statutory auditor needs an assertion file to rely on.
  • A listing is planned, or has just happened, and the related-party and certification trail needs to hold up.
03 · RiskWhat goes wrong without it

An audit can be technically complete and useless. Observations without root cause get repeated every quarter, the committee stops reading, and the one finding that would have changed a decision is on page 47.

04 · MethodHow we do it
  1. Week 1Scoping call, data extracts, calendar. Planning is where most of the value is decided.
  2. Weeks 2 to 3Fieldwork. Walk-throughs first, then analytics on full populations; we rarely sample. Every exception validated with the process owner.
  3. Week 4Draft, management response, final report, audit committee close-out.
  4. Next quarterFollow-up review to verify implementation before new work begins.
05 · OutputWhat you receive
  • One-page executive summary the committee actually reads.
  • Structured findings register: observation, root cause, impact in rupees, owner, date.
  • IFC assertion file: risk-control matrices, design and operating-effectiveness testing.
  • Listing readiness review: disclosures, CEO and CFO certification, audit committee oversight, related-party approvals.
Book a conversationStart with a conversation.

Questions

Asked before the first call.

Does section 138 apply to my company?

Every listed company; an unlisted public company with paid-up capital of ₹50 crore, turnover of ₹200 crore, bank or PFI borrowings above ₹100 crore or deposits of ₹25 crore; a private company with turnover of ₹200 crore or borrowings above ₹100 crore. Figures are for the preceding financial year, under Rule 13 of the Companies (Accounts) Rules, 2014.

How is this different from the statutory audit?

The statutory auditor opines on the financial statements once a year. We test whether the processes and controls behind those statements work, every quarter, and report to the audit committee, not to shareholders.

Do you sample?

Rarely. Where ERP data is available we test the full population, which is why findings carry a rupee value rather than an extrapolation.

Related practices