Internal control is the whole system management puts in place to run the business properly and report reliably. Internal check is one part of it: arranging duties so that one person's work is automatically checked by another's, as part of the normal routine. Internal audit is a separate review, by people outside the routine, of whether the controls, including internal checks, actually work. In short, internal check is built into the work, internal control is the whole framework, and internal audit tests the framework.
The three side by side
| Internal check | Internal control | Internal audit | |
|---|---|---|---|
| What it is | An arrangement of duties in which one person's work checks another's | The full set of policies, procedures and activities management uses to run the entity and report reliably | An independent review of operations, risk management and controls |
| Scope | Narrow: mostly clerical and accounting routines | Wide: control environment, risk assessment, information, control activities, monitoring | Wide, as set by the audit committee or board |
| When | Continuously, as transactions happen | Continuously | Periodically, under an audit plan |
| Who | The staff doing the work | Management and everyone in the organisation | An internal audit team or an outside firm |
| Purpose | Prevent errors and fraud at the source | Reliable reporting, efficient operations, compliance | Assure management and the audit committee that controls work, and recommend improvements |
| Legal basis in India | None by name: it is a practice | Directors' responsibility for internal financial controls, Section 134(5)(e), for listed companies; auditor reports on it under Section 143(3)(i) | Compulsory for prescribed companies, Section 138 and Rule 13 |
| Relationship | A part of control activities | Contains internal check | Evaluates internal control |
Internal check
Internal check is an old textbook term, and still a useful one. The idea is that no single person handles a transaction from start to finish. Each step is done by a different person, and each one naturally checks the one before.
Examples in an Indian company:
- Purchases: stores raises the requisition, purchase raises the PO, the gate and stores record the GRN, and accounts books the invoice only when PO, GRN and invoice agree.
- Cash: the cashier receives cash and issues a receipt from a numbered book. A different person writes the cashbook. Cash is banked daily, and someone other than the cashier reconciles the bank account.
- Payroll: HR maintains the employee master and attendance, accounts computes salary, and a third person approves the bank upload.
- Payments: two signatories for cheques or bank transfers above a limit.
- Stores: physical custody stays with stores. The stock records are kept by someone else.
Principles of a good internal check:
- Duties are divided so that no one person controls custody, recording and authorisation of the same asset.
- Staff rotate, and take compulsory leave, so that no one hides a fraud by never being away.
- Records are made at the time of the transaction, on prenumbered documents.
- Physical access to cash, stock and systems is limited to those who need it.
Internal control
Internal control is the wider framework. SA 315 asks the statutory auditor to understand internal control relevant to the audit (para 12). It describes internal control in five components:
- The control environment: management's attitude, governance, ethics and the oversight of those charged with governance.
- The entity's risk assessment process: how management identifies and responds to business risks.
- The information system and communication: how transactions are recorded, processed and reported.
- Control activities: approvals, reconciliations, segregation of duties, physical controls and IT controls. Internal check sits here.
- Monitoring of controls: how management checks that controls keep working, which includes internal audit (SA 315, para 22).
COSO 2013 uses the same five components. See the COSO 2013 guide.
In Indian law:
- For listed companies, the directors' responsibility statement must say they laid down internal financial controls and that these were adequate and operating effectively (Section 134(5)(e), Companies Act 2013).
- The statutory auditor reports on the adequacy and operating effectiveness of internal financial controls with reference to financial statements (Section 143(3)(i)), subject to the exemptions notified for some companies. The IFC audit guide covers what the auditor tests.
Internal audit
Internal audit is an independent function that reviews whether the controls work and whether the business is run well. It reports to the audit committee or the board.
- Under Section 138 of the Companies Act and Rule 13 of the Companies (Accounts) Rules 2014, listed companies and companies above prescribed thresholds must appoint an internal auditor. The internal audit applicability checker tests the thresholds. The appointment guide covers who can be appointed.
- ICAI's Standards on Internal Audit (SIAs) set out how internal audit work is planned, performed and reported. See the SIA library.
- Internal audit is part of monitoring in SA 315's framework. It is not a substitute for internal check: an internal auditor visiting quarterly cannot stop a cashier who also writes the cashbook.
What the statutory auditor does with each
| What the auditor does | Standard | |
|---|---|---|
| Internal check | Walks through the process to see that duties are actually divided, not just on paper. Tests the control if planning to rely on it. | SA 315 para 20 (understanding control activities); SA 330 (tests of controls) |
| Internal control | Obtains an understanding relevant to the audit and assesses the risks. Communicates significant deficiencies in writing to those charged with governance. | SA 315 para 12; SA 265 |
| Internal audit | Reads the internal audit reports for risks and deficiencies. May use the internal auditors' work after evaluating their objectivity and competence. | SA 315 para 6 (inquiries of internal audit); SA 610 |
Weak internal check is one of the most common sources of findings. Examples are one person who raises vendors, books invoices and releases payments, or a cashier who reconciles the bank. These should be raised with management and, if significant, reported under SA 265. The deficiency classification guide helps grade them.
Common confusions
- "Internal check and internal audit are the same." They're not. Internal check is done by the people doing the work, as they work. Internal audit is a later review by people outside the process.
- "A company with internal audit doesn't need internal check." Internal audit finds problems after the event. Internal check prevents them.
- "Internal control means accounting controls." It's wider: it includes the control environment, risk assessment and monitoring.
- "Small companies can't have internal check." With three or four staff, full division isn't possible. But owner review of the bank statement, two signatures on large payments and monthly reconciliations by someone else go a long way.
Frequently asked questions
What is internal check in simple words?
A way of dividing work so that each person's work is automatically checked by the next person in the routine. Errors and fraud are caught as they happen.
What is the main difference between internal control and internal check?
Internal control is the whole system. Internal check is one part of it: the division of duties within routine work.
Is internal audit part of internal control?
Yes. It is part of the monitoring component. It checks that the other controls, including internal checks, work.
Is internal audit compulsory in India?
For listed companies and companies above the thresholds in Rule 13 of the Companies (Accounts) Rules 2014, yes, under Section 138 of the Companies Act 2013.
Does the statutory auditor rely on internal check?
Only after understanding it and, where reliance is planned, testing that it works (SA 315 and SA 330). An untested internal check gives no audit evidence.
Source and applicability
- ICAI, Checklist on Standards on Auditing, Auditing and Assurance Standards Board, June 2023 edition: SA 315 paras 6, 12, 20 and 22. Paragraph numbers are as in that edition. The checklist is illustrative and does not replace the Standards themselves.
- SA 315 applies to audits of financial statements for periods beginning on or after 1 April 2008. SA 265 applies from 1 April 2010.
- Companies Act 2013: Sections 134(5)(e), 138 and 143(3)(i); Companies (Accounts) Rules 2014, Rule 13.
- "Internal check" is not defined in the Standards on Auditing or the Companies Act. The description here follows standard auditing texts.
- Last checked 23 October 2026.
See also SA 315, SA 265 and vouching in auditing.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error