Internal Auditing in India
In India, external auditors were required to report on the quality of the IAF since 1975 until it was dropped in 2015. However, the language was almost always boilerplate—There was hardly any instance of issue or concern expressed by the auditor on this topic. This is in contrast to the United States: For example, a quick search of the Audit Analytics database indicates that there are more than 350 instances of management reports on internal control disclosing inadequate internal auditing as one of the reasons for indicating material weaknesses in internal controls.8 Nevertheless, prior to 2015, there was at least some institutional support for internal auditing thanks to the requirement that external auditors had to evaluate the IAF; removing that requirement appears to be a step backward.
Perhaps the impetus for removing the requirement related to external auditors’ evaluation of the IAF comes from the fact that after the Satyam scandal in 2009, there have been changes in the stock exchange listing regulations and in The Companies Act. As a result, The Companies Act of 2013 now requires the external auditor to report on the adequacy and effectiveness of internal financial controls. The listing regulations have a discretionary requirement that the internal auditor may report directly to the audit committee. The Companies Act of 2013 mandates the appointment of an internal auditor and provides that the findings of the internal auditor may be reported to the board. Clearly, while the IAF reporting to the audit committee is considered a good practice, it is not mandatory to do so.
