Expert verified Planning an internal audit in India is a crucial process for ensuring your organization remains compliant, efficient, and transparent.
Explore with us all you need to know about creating an internal audit plan – main steps and process, key components, checklist and real example.
What is an Internal Audit Plan & Why It’s Crucial?
An internal audit plan is a comprehensive roadmap (usually annual) that outlines the what, when, how, and by whom an organization’s internal audit activities will be performed over a specific period.
It contains the details of the areas, functions, or processes that will be audited, the timing and frequency of each audit, the objectives and scope, and the resources required.
Why is Internal Audit Planning Crucial?
- Prioritisation of Risks: It ensures that the audit function targets the most significant risks facing the organization, enabling that critical threats to the organization are addressed proactively.
- Alignment with Goals: It aligns the internal audit function with the organization’s main objectives, ensuring they support the broader mission and goals of the business.
- Efficiency Improvement: By scheduling audits appropriately, avoiding duplication of effort, and ensuring the right expertise for each audit, it enables smoother audit workflows, faster completion, and lower overall costs.
- Accountability Boost: It serves as a communication tool between the internal audit team, management, and the board or audit committee. By setting clear expectations it enhances transparency and accountability.
- Compliance & Governance Support: Helps organizations comply with regulatory requirements and internal standards. It demonstrates to regulators and stakeholders that the organization is committed to effective risk management and governance.
- Adaptability & Responsiveness: It includes mechanisms to adjust for emerging risks (e.g., new regulations, market shifts, operational failures) or urgent requests without completely derailing the function.
- Performance Measurement: It serves as a baseline against which the internal audit function’s actual performance, Indicators like – audits completed, resources used, findings reported – can be measured and reported.
Internal Audit Plan Checklist
Here’s a sample of the internal audit plan checklist for your reference. You can also download it for FREE.
Key Components of an Internal Audit Plan
Every good internal audit plan should include the following:
1. Audit Universe
It is essentially a comprehensive list of all entities within the organisation that can be audited.
These include business units, functions (Finance, Operations, HR, IT), processes (Procure-to-Pay, Order-to-Cash), locations (factories, branches, HO), subsidiaries (including listed/unlisted), Joint Ventures, major projects.
2. Risk Assessment
Risk-based auditing is a standard approach recommended by ICAI. Therefore, before auditing and planning, systematically identify and prioritize risks across the audit universe.
In India, the main risk factors include:
- Strict regulatory and compliance focus such as adherence to Companies Act, 2013, SEBI’s LODR, RBI Guidelines GST, Income Tax, Labour Laws, etc.
- Sector-specific risks like Supply chain volatility in manufacturing, cyber threats in BFSI, regulatory approvals in infrastructure.
- Fraud risk including bribery/corruption risks
- Reputational risks that include sensitivity to corporate governance failures, environmental/social issues (increasing ESG focus)
- Strategic risks impacted by government policies
- Group structure complexity arising from multiple subsidiaries, JVs, and diverse locations
- Financial risks because of interest rate changes, liquidity constraints, etc.
3. Audit Scope & Objectives
Defining the scope and objectives prevents the audit from becoming too large and unfocused. It must answer clearly
- What you want to achieve from this audit – Find errors, Improve controls, etc.
- What areas of the business will be audited – Finance department, IT systems, HR policies, etc.
4. Timeline and Schedule
This means setting realistic timelines for each audit, considering:
- Indian Business Cycles: Festival seasons, financial year-end (March 31st), quarter-end reporting pressures, monsoon impacts (for specific sectors).
- Regulatory Deadlines: Aligning IFC testing with statutory audit timelines, SEBI reporting requirements.
- Management Availability: Coordination with key personnel during peak periods.
5. Audit Team and Resources
Next component is assigning appropriate staff with necessary skills and experience.
You can choose between an internal audit team or specialised outsourced auditors like PKC Management Consulting.
You must also do proper budget allocation considering local costs and potential need for specialized external expertise.
Also plan tools, software, and documentation needed.
6. Regulatory Compliance Checklist
List the laws, rules, and standards that apply to your company to ensure nothing gets overlooked. These may include:
- Companies Act, 2013
- SEBI regulations
- GST Act
- ICAI standards
- ISO 19011 audit guidelines
7. Stakeholder Engagement & Communication :
A good audit plan also has a formalized plan for communication with:
- Audit Committee : Mandatory for listed companies and certain other classes.
- Board of Directors: For overall plan approval and significant findings.
- Management: Particularly KMPs (CEO, CFO, CS), functional/departmental heads for coordination and understanding concerns.
- Statutory Auditors: Coordination to avoid duplication, share relevant information (especially on IFC and frauds), and ensure alignment.
8. Flexibility Mechanism:
This is often missed while planning an internal audit engagement. Having a flexibility mechanism involves a formal process for adjusting the audit plan mid-year.
This flexibility is needed to account for changes like:
- Emerging regulations like SEBI/RBI circulars, GST amendments, changes in Companies Act rules.
- Management requests regarding urgent investigations on whistleblower complaints, suspected frauds, or advisory on new projects/initiatives.
- Business changes like mergers & acquisitions, significant restructuring, new product launches, entry into new markets.
- Major incidents like operational failures, cyber-attacks, natural disasters.
9. Reporting Format & Follow Ups
Planning an internal audit in India also involves outlining how the audit results will be shared and in what format.
Also, it needs to be made clear what actions would be taken after the completion of the audit and how deadlines are to be fixed to resolve the issue.
This step makes sure your audit actually leads to real change.
Internal Audit Planning for a Manufacturing Company – Example
This is an overview of how an annual internal audit plan for a company (Example ABC) may look like.
Remember, this is only a sample. It will vary with your industry, risk factors, business size and more.
Reach out to our experts at PKC for Comprehensive Internal Audit Planning Today!
Why Choose PKC for Internal Audit Planning?
✅37 years crafting comprehensive internal audit frameworks
✅Risk-based internal audit planning with business process expertise
✅Customized audit universe mapping for Indian companies
✅Multi-year rolling audit plans aligned with growth
✅Regulatory compliance integrated into audit planning matrix
✅ERP-integrated audit trails and data analytics capabilities
✅Industry-specific audit programs across 15+ sectors
✅Cost-effective resource planning and audit scheduling
✅GST and tax compliance embedded planning approach
✅Real-time dashboard for audit plan monitoring
✅Management action plan tracking and follow-up systems
✅Concurrent audit planning for high-risk processes
✅Digital transformation risks incorporated in planning
✅Three-tier quality review built into planning process
PKC’s Internal Audit Planning Process: Steps Involved
At PKC Management Consulting, our experts follow a structured and iterative workflow internal audit planning process. Here’s a breakdown of the key steps:
Phase 1: Foundation & Preparation
- Review business strategy, objectives, organizational structure, and operating environment.
- Analyze sector-specific regulations (SEBI, RBI, IRDAI), Companies Act 2013 mandates, GST/FEMA compliance landscape, and emerging ESG trends.
- Identify key processes, systems, locations, and subsidiaries
- Create a comprehensive inventory of all auditable entities
Phase 2: Risk Assessment & Prioritization
- Identify risks by gathering inputs from senior management, audit committee, previous audit findings and external factors
- Evaluate each risk based on likelihood and impact
- Use a consistent scoring methodology
- Assign higher weight to statutory compliance risks and fraud risks due to regulatory scrutiny .
- Ensure high-risk areas align with the organization’s strategic goals and key initiatives.
Phase 3: Plan Formulation
- Decide which high-risk areas need auditing in the planning period and how often
- Outline specific boundaries, goals, and deliverables for each planned audit engagement.
- Assign our specialised auditors and assign budget and time for each audit.
- Ensure access to top PKC specialists for complex areas like Ind AS, GST, or FEMA compliance.
- Sequence audits logically like procure-to-pay before financial statement audit.
Phase 4: Review, Approval & Communication
- Discuss the draft plan with senior management plus mandatory consultation and approval by the Audit committee (where applicable) for input on risks and practicality.
- Incorporate feedback and formalize the plan document.
- Share the final plan with management, the Audit Committee, and the Board.
- Maintain formal documentation for regulatory compliance (NFRA expectations).
Phase 5: Execution & Monitoring
- Create detailed work programs for each specific audit in the annual plan.
- Track progress against the plan (e.g., audits completed, findings, resource usage).
- Use a formal mechanism to adjust the plan for – emerging risks, management/Audit Committee requests and significant business changes.
- Document all changes and justifications.
Frequently Asked Questions
- What is an internal audit plan?
An internal audit plan is a document that outlines what areas of a company will be audited, when the audit will happen, and who will perform it. It helps ensure audits are organized, risk-focused, and aligned with regulatory requirements.
- What documents are required for internal audit planning?
A company needs previous audit reports, standard operating procedures (SOPs), organizational charts, policy manuals, risk registers, and compliance checklists related to Indian laws like GST, TDS, and the Companies Act.
- Who are internal audits planned and scheduled by for companies?
Internal audits are usually planned and scheduled by the internal audit department, Chief Audit Executive (CAE), or sometimes the Finance/Compliance team. In some companies, external audit firms like PKC Management Consulting may also be hired to assist with planning and execution.
- How to create an internal audit plan?
To create an internal audit plan, start by identifying the company’s risks, goals, and compliance requirements.Then define the audit scope, set objectives, allocate resources, and develop a timeline to ensure thorough and timely coverage.
- What are the steps in internal audit planning?
The main steps include defining the audit objective, assessing risks, setting the audit scope, choosing the audit team, and scheduling the audit. It also involves preparing audit tools, communicating with departments, and getting approval from senior management.
