Governance
Internal Audit for Group Companies: A Practical Guide
By ATTPL HOLDCO / ATTPL GROUP Editorial Team · · 3 min read
How a multi-company group can set up internal audit: scope, risk-based planning, audit cycle, reporting to the board and common findings to fix early.
What internal audit is, and what it is not
When a business grows into a group of companies, each entity develops its own way of buying, selling, paying and recording. Without independent review, small gaps in one company can turn into losses, compliance notices or reputational damage for the whole group. Internal audit gives the board and promoters an honest, independent view of how well controls are working. This guide explains how a growing Indian group can set up internal audit in a practical, proportionate way.
Internal audit is an independent review of a company's processes, controls and risk management. It asks whether the right controls exist, whether people follow them, and whether they actually prevent errors and fraud. It is different from statutory audit, which gives an opinion on the financial statements, and from routine accounting checks done by the finance team.
Under the Companies Act, 2013, certain classes of companies are required to appoint an internal auditor, and many others choose to do so voluntarily. For a group, the real value lies in seeing patterns across entities that no single company's team would notice.
Decide the structure: central, outsourced or hybrid
- Central team: a small internal audit function at the holding company that reviews all group entities. It builds deep knowledge of the business.
- Outsourced: an external firm runs audits to an agreed plan. It brings specialist skills and independence.
- Hybrid: a lean internal team owns the plan and follow-up, while external experts cover specialised areas such as IT, GST or plant operations.
Whatever the structure, the internal auditor should report to the audit committee or the board, not to the managers whose work is being audited.
Plan audits around risk
A group rarely has the budget to audit everything every year. Start with a simple risk map of every entity and process, rating each on likelihood and impact. High-risk areas usually include procurement and vendor payments, cash and bank, sales and receivables, payroll, inventory, statutory compliance and related-party transactions. Our earlier article on the shared services model for group companies explains how shared services can reduce some of these risks.
Build a rolling annual plan that covers high-risk areas every year and lower-risk areas every two or three years, and leave some capacity for special reviews requested by the board.
Run each audit in clear stages
- Planning: agree scope, period, data needed and timelines with the business head.
- Fieldwork: walk through the process, test samples of transactions, review approvals and system access.
- Discussion: share draft observations with the process owner and agree facts.
- Reporting: rate each finding by risk, explain the root cause and agree a corrective action, owner and date.
- Follow-up: check that agreed actions are closed, and report overdue items to the audit committee.
Common findings in growing groups
Some issues appear again and again in fast-growing companies: purchases made before a purchase order is approved, vendors added without verification, one person able to create and approve payments, unreconciled bank and GST ledgers, stock records that do not match physical counts, and contracts that are signed but not stored centrally. None of these needs a complex fix, but each one can become costly if left alone.
Use technology to audit smarter
Data analytics lets auditors test full populations instead of small samples: duplicate invoice numbers, payments on holidays, vendors sharing bank accounts with employees and unusual credit notes can all be flagged automatically. ATTPL IT builds dashboards and business software that make this kind of continuous monitoring possible, and ATTPL HRMS keeps payroll and employee data in one controlled system.
Reporting that the board will read
Keep audit reports short and decision-focused. Start with an overall rating and the three or four issues that matter most, followed by detailed findings in an annexure. Track all open actions in a single dashboard across entities so that the board can see trends over time rather than isolated reports.
Getting expert help
Setting up internal audit for the first time is easier with experienced advisers. ATTPL Consultancy supports businesses with compliance and process improvement, and ATTPL Legal can review contracts and policies that audits often bring to light. To learn how ATTPL HOLDCO supports its group companies, see our services or contact us.
Frequently asked questions
Is internal audit mandatory for private companies in India?
Certain classes of companies must appoint an internal auditor under the Companies Act, 2013, based on turnover, borrowings and other thresholds. Check the current rules with your company secretary or chartered accountant.
How often should internal audit cover each group company?
High-risk areas are usually reviewed every year, and lower-risk areas every two or three years, based on a documented risk assessment.
Who should the internal auditor report to?
To the audit committee or board of directors, so that the review stays independent from the managers being audited.
