A compliance audit in internal audit checks whether the company follows the laws, regulations, contracts and internal policies that apply to it. The method is simple: list every obligation, decide which ones carry real risk, test evidence of compliance for those, and report each breach with its cause. The hard part is the list, not the testing.
Last reviewed: 17 October 2026. Facts checked. We described the general method and the legal basis of the internal auditor's role from general knowledge, without opening the statute. We did not verify individual due dates, rates or penalties, so none are quoted. Confirm each against the current law before you use it in a report.
What a compliance audit is, and is not
It tests adherence to rules. It is one of the types of internal audit.
It is not the statutory auditor's job. The statutory auditor reports on specified legal matters inside the audit of the financial statements, for example under CARO 2020 for companies it applies to. Internal audit works for management and the board and can look much wider. The split is covered in internal audit vs external vs statutory audit.
Step 1: Build the obligations register
You cannot test what you have not listed. For each obligation, record:
- the law or rule and the specific requirement,
- who in the company owns it,
- the frequency (monthly, quarterly, annual, event-based),
- the evidence that shows compliance.
Typical groups for an Indian company:
| Area | Examples of obligations |
|---|---|
| Indirect tax | GST registration, returns, e-invoicing where applicable, input credit conditions |
| Direct tax | TDS deduction and deposit, returns, advance tax |
| Labour | PF, ESI, professional tax, labour welfare fund |
| Company law | ROC filings, board and AGM requirements, registers |
| Sector | RBI, SEBI or other regulator rules where relevant |
| Contract | Loan covenants, customer and vendor terms |
A ready starting point is the statutory compliance internal audit checklist.
Step 2: Rank by risk
Not every obligation deserves the same effort. Rank by two factors: how likely a breach is, and how bad the consequence would be (money, licence, reputation, personal liability of officers). Spend testing time at the top of the list. Document why low-risk items were only lightly tested.
Step 3: Decide what to test
Compliance has three layers. Test the one that matches the risk.
- Did it happen? Was the return filed, the tax paid, the approval obtained?
- Was it right? Is the amount, period and classification correct?
- Is the process reliable? Does a control make sure it happens every time?
An on-time filing with the wrong amount is still a breach. And a correct filing that depends on one person's memory is a risk.
Step 4: Collect and test evidence
Prefer evidence from outside the company where you can, such as portal acknowledgements and challans. Then compare to the books.
For each sample, ask:
- Is there proof of the date and the amount?
- Does it agree to the ledger?
- Was it approved by the right person?
- Does the same issue repeat across periods?
Where the data allows, test the full population rather than a sample. The audit sampling calculator helps when you do sample.
Worked example: a GST review (illustrative)
Scope: Monthly GST returns for one financial year for one registration.
Tests:
- Compare sales in the return with sales in the ledger.
- Compare input credit claimed with the supplier-reported data on the portal.
- Check filing dates against due dates.
- Check reverse charge entries against a list of relevant expense heads.
Possible results: Some months show sales in the books that differ from the return. Some credit is claimed on items that are blocked by law. Late filing is traced to a vendor invoice cut-off problem.
What you report: The condition, the rule it breaches, the likely cause, the exposure to be quantified and confirmed by the tax team, and the fix. The GST 2B reconciliation checker and blocked credit 17(5) checker support this kind of test.
Step 5: Report breaches properly
A good compliance finding states:
- The requirement (the section or rule),
- The condition (what happened),
- The cause (why),
- The exposure (interest, penalty or other consequence, to be confirmed by a specialist),
- The action (owner and date).
Do not quote a penalty you have not verified. If the exposure is uncertain, say so and recommend advice. The report layout is in internal audit report format.
Keep the register alive
Laws change. Assign someone to update the register, and review it at the start of each audit year. A stale register gives false comfort.
Frequently Asked Questions
What is a compliance audit in internal audit?
A review of whether the company follows applicable laws, regulations, contracts and internal policies, with evidence for each test.
Is compliance audit the same as statutory audit?
No. Statutory audit gives an opinion on the financial statements. Compliance audit is an internal audit engagement that can cover any obligation the board cares about.
How often should compliance be audited?
Base it on risk. High-risk areas such as tax and labour filings may be reviewed more often than low-risk ones. Set the cycle in the annual internal audit plan.
Who owns compliance, management or internal audit?
Management owns compliance. Internal audit gives independent assurance about it. See combined assurance and the three lines model.
Should internal audit report breaches to the audit committee?
Significant breaches should reach the audit committee. Agree the escalation rule in the audit charter.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error