A group does not need to audit every subsidiary the same way. The useful approach is to treat the group as one risk universe, decide which entities and processes are in scope by risk, and report to the parent audit committee in a form that lets it compare entities. Intercompany dealings, shared controls and the tone set by the parent need specific attention.
Last reviewed: 17 October 2026. Facts checked. This post is about method. We did not open the text of ICAI's Standards on Internal Audit, the IIA standards, section 138 of the Companies Act 2013 or its rules, so we do not state which subsidiaries must have an internal auditor or which thresholds apply. Check applicability for each entity in the official texts. We reviewed our own existing posts on audit universe and group audit to avoid duplication.
Start with the group view
Subsidiaries differ in size, activity, geography and maturity. A group that runs one fixed audit programme on all of them wastes effort on the small and quiet ones and under-covers the large or risky ones.
Begin with an audit universe built at group level:
- List every entity: subsidiaries, joint ventures, associates where the parent has influence, and branches.
- List the main processes in each.
- Add the group-wide processes: treasury, shared services, IT, intercompany billing, group reporting.
- Score each entity-process pair for risk, using a consistent scale. See risk assessment matrices.
The result is a map showing where the group's risk actually sits. It is often not in the entities that are largest by revenue.
Choosing what to audit where
A sensible split has three layers.
| Layer | What it covers | How it is done |
|---|---|---|
| Group-level processes | Treasury, group reporting, consolidation, intercompany, group IT, policies | Audited once, centrally, covering all entities |
| Entity-level reviews | Governance, delegation of authority, local compliance, key local processes | Rotating plan; higher-risk entities more often |
| Thematic reviews | One topic across several entities, such as payroll or procurement | One programme, run in a sample of entities |
Thematic reviews are efficient and give the audit committee a comparison. A review of procurement across five subsidiaries shows which one is the outlier. That is more useful than five separate reports with different formats.
Risks specific to groups
Intercompany transactions
Intercompany sales, loans, cost allocations and guarantees carry specific risks: mismatch of balances, pricing that does not stand up to scrutiny, and eliminations that hide errors. Tests worth including:
- Do balances agree between the two entities at period end, and are differences explained?
- Are intercompany agreements in place, current and consistent with practice?
- Are loans and guarantees approved at the right level and disclosed?
- Is pricing documented and consistent with the group's transfer pricing approach?
Our template for intercompany reconciliation across group companies shows the reconciliation structure.
Governance and delegation
Does each subsidiary board meet, take decisions in the right forum, and respect the group's delegation of authority? Spot gaps between what the group policy says and what the subsidiary does.
Policy adoption
Group policies are only useful if the subsidiaries apply them. Test whether policies were received, adapted where local law differs, and followed. Where a subsidiary has deviated, find out whether the deviation was approved.
Local compliance
Each entity has its own statutory calendar. A group audit should check that filings, registers and approvals are in place. For Indian entities, see the statutory compliance checklist. Foreign subsidiaries need local advice on the requirements.
Key-person and concentration risk
Small subsidiaries often depend on one finance person. Test whether segregation of duties exists, and what happens when that person is absent.
Who does the work
Options include a group internal audit team, an outsourced firm for all entities, or a mix with local auditors in foreign subsidiaries. Whatever the choice:
- Use one methodology, one rating scale and one report template.
- Keep the head of internal audit reporting to the parent audit committee, not to subsidiary management.
- Where local teams or firms audit foreign entities, set clear instructions and review their work. Principles similar to using the work of another auditor apply, adapted for internal audit.
Reporting
A useful group report has:
- A one-page summary for the parent audit committee, with ratings by entity and theme.
- Entity reports in the standard format, shared with the subsidiary's management and board.
- A group-level tracker of open observations, owners and due dates, with overdue items flagged.
- Repeat findings across entities, since a finding appearing in four subsidiaries signals a group process or policy issue, not four local ones.
See the internal audit report format for observation structure.
Common weaknesses
- Treating each subsidiary report as a separate exercise, so patterns go unseen.
- Auditing only the Indian entities because they are easier to reach.
- Leaving intercompany to the statutory audit.
- Subsidiary management editing findings before they reach the parent.
- No follow-up of observations after the report.
A starting plan
For a group beginning this work: build the group universe, pick three group-level processes and one thematic review, audit the three highest-risk entities in depth, and set up the group tracker. Expand in the second year.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error