Statutory Compliance Internal Audit Checklist: GST, TDS, ROC and Payroll RCM
Statutory compliance internal audit tests whether an Indian company identifies applicable laws, files returns on time, pays dues correctly, reconciles books to returns, preserves challans and tracks notices. The cycle typically covers GST, TDS/TCS, ROC filings, payroll laws, MSME payments, related-party compliance and industry-specific registrations.
This is not the same as tax audit. A statutory compliance internal audit is a recurring control review: does the company have a reliable compliance calendar, responsible owners, maker-checker evidence, reconciliation to books and an escalation process for missed deadlines or notices? The RCM below is illustrative and should be tailored to the entity's registrations, states, industry and internal-audit scope.
Statutory compliance RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Compliance universe | Applicable law missed | Compliance register should map registrations, returns, owners and due dates | Compare entity operations, states and registrations to compliance register |
| Calendar ownership | Return or payment filed late | Compliance calendar should assign owner, reviewer and escalation date | Test due dates, filing dates, challans and delay reasons |
| GST outward | Sales return mismatch | GSTR-1 should reconcile to sales register and e-invoice/e-way bill data | Compare sales register, GSTR-1, e-invoice and credit notes |
| GST inward | ITC claimed incorrectly | GSTR-2B reconciliation and blocked-credit review should run before GSTR-3B | Compare purchase register, 2B, ITC claim and reversals |
| TDS/TCS | Wrong deduction, collection or deposit | Section-wise rate, threshold and challan review should be evidenced | Recompute samples and reconcile books, challans, returns and Form 26AS/AIS |
| ROC filings | Board or annual filing missed | Secretarial calendar should track forms, resolutions and due dates | Test filing receipts, board minutes and annual-return evidence |
| Payroll laws | PF/ESI/PT/LWF default | Payroll compliance register should map state and employee applicability | Match payroll register, challans and returns |
| MSME | 43B(h) exposure missed | MSME classification and payable ageing should be reviewed | Test Udyam evidence and micro/small supplier payment ageing |
| Notices | Department notice not tracked | Notice register should carry owner, due date, reply and closure status | Test open notices, response dates and management escalation |
Statutory compliance audit data fields to request
| Data table | Minimum fields |
|---|---|
| Compliance register | Law, registration number, return/payment, owner, reviewer, frequency, due date |
| GST data | Sales register, purchase register, GSTR-1, GSTR-2B, GSTR-3B, e-invoice/e-way bill references |
| TDS/TCS data | Ledger, section, deductee, amount, rate, deduction date, challan, return filing status |
| ROC tracker | Form, event, board/shareholder approval, due date, filing date, SRN |
| Payroll compliance | PF/ESI/PT/LWF applicability, challan, return, month, state, employee count |
| Notice register | Authority, notice date, section, due date, owner, reply date, demand/refund status |
Fieldwork checklist
- Compliance register not updated for new state, GSTIN, branch or business line
- Return filed on portal but not reconciled to books
- GST ITC claimed before 2B support or without blocked-credit review
- TDS deducted under wrong section or deposited under wrong challan
- TDS/TCS returns not reconciled to books and Form 26AS/AIS
- ROC forms filed late or without supporting board minutes
- Payroll challans paid but employee-wise return not reconciled
- MSME suppliers not tagged or payment ageing not tracked
- Notices received in email/portal but missing from central tracker
Statutory compliance audit programme
| Step | Procedure | Evidence expected |
|---|---|---|
| 1 | Build the compliance universe from registrations, states, branches and business activities | Law-wise register with return/payment frequency and owner |
| 2 | Test filing and payment timeliness | Due date, filing date, challan, acknowledgement and delay reason |
| 3 | Reconcile GST returns to books | Sales/purchase register, GSTR-1, GSTR-2B, GSTR-3B and exception bridge |
| 4 | Reconcile TDS/TCS to books and returns | Section-wise ledger, challan, quarterly return and Form 26AS/AIS bridge |
| 5 | Test ROC filings and event-based forms | Board/shareholder minutes, form, SRN, due date and challan |
| 6 | Test payroll statutory dues | Payroll register, PF/ESI/PT/LWF challans and employee-wise returns |
| 7 | Review notices and assessments | Notice register, reply date, status, demand/refund and escalation evidence |
| 8 | Review MSME payment ageing | Udyam evidence, invoice due date, payment date and 43B(h) tracker |
Sample and population guidance
Use full-population tests for due-date compliance, challan-to-return reconciliation, GST ITC mismatches, TDS/TCS section mapping, notices and MSME payable ageing. Use samples for supporting document quality, board-minute tracing, classification judgement and root-cause review. For multi-state companies, stratify testing by state because PT, LWF and some labour compliance obligations differ by location.
What to report
- Condition: GST ITC of ₹28 lakh was claimed in GSTR-3B before reconciliation to GSTR-2B. ₹4.6 lakh related to invoices not appearing in 2B for the period reviewed.
- Criteria: Tax SOP requires purchase register to be reconciled to GSTR-2B before monthly 3B filing.
- Cause: The reconciliation is performed after return filing, not before claim.
- Effect: Excess or unsupported ITC may trigger notices, interest exposure and working-capital disruption.
- Recommendation: Move 2B reconciliation before 3B filing, block unsupported ITC by default and require tax-head approval for exceptions.
Statutory compliance internal audit FAQ
What is statutory compliance internal audit?
It is a control review over legal and tax compliance: whether applicable returns, payments, reconciliations, notices and filings are identified, owned, reviewed and completed on time.
Is statutory compliance internal audit the same as tax audit?
No. Tax audit is a statutory reporting engagement under the Income-tax Act. Statutory compliance internal audit is an internal control review across GST, TDS/TCS, ROC, payroll laws, MSME and other applicable obligations.
What is the best first test for compliance audit?
Start with the compliance universe. If the entity's registrations, states, branches and business activities are not completely mapped, later return-by-return testing may miss the very law that was never put on the calendar.
Related CORAA resources
- Internal Audit Software for India
- GST Reconciliation Automation Guide
- Payroll Compliance Calendar Generator
- ROC Compliance Calendar Generator
- MSME 43B(h) Disallowance Checker
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- MCA, Companies Act and Rules - ROC filing, board/shareholder approval and company-law compliance references
- CBIC Tax Information Portal, GST Acts and rules - GST registration, invoicing, return, ITC and reverse-charge provisions
- Income Tax Department, Tax Deductor guidance - TDS return, TAN, rate and compliance guidance
- Income Tax Department, Section 192 - salary TDS where payroll compliance is in scope
- Income Tax Department, Section 43B - actual-payment disallowance framework, including employer contributions and MSME 43B(h) reference
- EPFO employer guidance and contribution-rate downloads
- ESIC, Employees' State Insurance Act, 1948
- India Code, MSMED Act, 2006 - delayed-payment provisions including Section 15 and Section 16