Practice 02 · Assure after
Assurance designed for the audit committee, not the file room.
Internal audit under section 138, IFC testing, audit committee support and listing readiness. Planned, risk-based, run on full populations, reported on one page.
A planned, risk-based review of processes, controls and compliance, built around the audit committee’s next agenda: what they need to ask, what management needs to fix, what the statutory auditor will see when they return.
- Section 138 applies: listed, or an unlisted company past the Rule 13 thresholds. Our checker on the home page gives the answer in ten seconds.
- The audit committee wants a one-page answer, not a hundred-page file.
- IFC is in scope and the statutory auditor needs an assertion file to rely on.
- A listing is planned, or has just happened, and the related-party and certification trail needs to hold up.
An audit can be technically complete and useless. Observations without root cause get repeated every quarter, the committee stops reading, and the one finding that would have changed a decision is on page 47.
- Week 1Scoping call, data extracts, calendar. Planning is where most of the value is decided.
- Weeks 2 to 3Fieldwork. Walk-throughs first, then analytics on full populations; we rarely sample. Every exception validated with the process owner.
- Week 4Draft, management response, final report, audit committee close-out.
- Next quarterFollow-up review to verify implementation before new work begins.
- One-page executive summary the committee actually reads.
- Structured findings register: observation, root cause, impact in rupees, owner, date.
- IFC assertion file: risk-control matrices, design and operating-effectiveness testing.
- Listing readiness review: disclosures, CEO and CFO certification, audit committee oversight, related-party approvals.
Questions
Asked before the first call.
Does section 138 apply to my company?
Every listed company; an unlisted public company with paid-up capital of ₹50 crore, turnover of ₹200 crore, bank or PFI borrowings above ₹100 crore or deposits of ₹25 crore; a private company with turnover of ₹200 crore or borrowings above ₹100 crore. Figures are for the preceding financial year, under Rule 13 of the Companies (Accounts) Rules, 2014.
How is this different from the statutory audit?
The statutory auditor opines on the financial statements once a year. We test whether the processes and controls behind those statements work, every quarter, and report to the audit committee, not to shareholders.
Do you sample?
Rarely. Where ERP data is available we test the full population, which is why findings carry a rupee value rather than an extrapolation.
Related practices