Internal audit comes in several types, and each answers a different question: are processes working (operational), are rules followed (compliance), are numbers reliable (financial), are systems secure and controlled (IT). Most real engagements mix two or three types, so the useful skill is knowing which question you are being asked. The type decides your scope, your tests and the evidence you collect.
Last reviewed: 17 October 2026. Facts checked. We drew on general internal audit practice and secondary summaries of the Three Lines Model and of Companies Act section 138; we did not open the primary texts. We did not check sector regulator circulars (RBI, SEBI, IRDAI), and ICAI's Standards on Internal Audit are being updated, so we cite no standard numbers here.
Why "types" matter
Internal audit is an independent check, run for the board or management, on how well a business manages risk and controls. Unlike statutory audit, the law does not fix one format. Section 138 of the Companies Act, 2013 requires certain companies to appoint an internal auditor but leaves the scope to the board and audit committee.
So the scope is a choice. Naming the type makes that choice clear. If you want a broader look at all audit kinds, see types of audit in India. This page stays inside internal audit.
The main types
| Type | Question it answers | Typical evidence |
|---|---|---|
| Operational | Does the process run efficiently and as designed? | Walkthroughs, cycle times, exception reports |
| Compliance | Are laws, policies and contracts followed? | Filings, approvals, policy tests |
| Financial | Are records and controls over reporting reliable? | Reconciliations, journal samples |
| IT | Are systems and data controlled and secure? | Access logs, change records, configurations |
| Performance / value for money | Did a programme deliver results at reasonable cost? | Targets, outcomes, cost data |
| Forensic / fraud-focused | Was there misconduct, and how did it happen? | Transaction trails, interviews, data analytics |
| Special reviews | A specific event or concern | Whatever the trigger needs |
Operational audit
An operational audit looks at how a process actually runs: procure-to-pay, order-to-cash, hire-to-retire. It asks whether the process is efficient, whether controls work and whether the process achieves its goal. It is the most common internal audit type. A full guide is in operational audit: scope, approach and worked examples.
Compliance audit
A compliance audit tests whether the company follows external laws and its own policies. In India this often means GST, TDS, PF, ESI and ROC filings. The test is binary: complied or not. Evidence is usually a return, a challan or an approval. Details are in compliance audit in internal audit. For a checklist, use statutory compliance internal audit checklist.
Financial audit (internal)
Internal financial audit is not the same as statutory audit. It tests the controls and processes behind the numbers: bank reconciliations, journal approvals, month-end close. It gives management confidence before the external auditor arrives. It does not produce an opinion on the financial statements. The differences are explained in internal vs external vs statutory audit.
IT audit
IT audit reviews systems, data and the controls around them. It can cover general controls (access, change, operations), application controls or cybersecurity. These are different jobs. See IT audit vs ITGC vs cybersecurity audit and the ITGC audit guide.
Performance and value-for-money audit
This type judges results against goals and cost. It is more common in government and public bodies, and in programmes with clear targets. It overlaps with operational audit but asks a different question. See performance and value-for-money audit.
Forensic and fraud-focused work
Forensic work starts from a suspicion or an event. Ordinary internal audit looks for control weaknesses, while forensic work looks for what happened and who did it. Read what is forensic audit.
How to choose
Ask three questions.
- What decision will the report support? A board worried about fines wants compliance. A CFO worried about cost wants operational.
- What does the risk assessment say? Audit the areas where risk is highest, not the ones that are easiest.
- Who can do the work? IT and forensic work need specific skills. Do not stretch a general team beyond its competence.
Most annual plans blend types. A payroll review, for example, can test compliance (PF and ESI filings), operations (how attendance becomes pay) and financial controls (payroll journal) in one engagement. The internal audit annual plan generator can help lay this out.
Frequently Asked Questions
What are the main types of internal audit?
Operational, compliance, financial, IT, performance (value for money) and forensic. Many engagements combine more than one type.
Is internal audit mandatory in India?
Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 require certain companies to appoint an internal auditor. Use the internal audit applicability checker and confirm against current rules.
Who can perform internal audit?
Section 138 allows a chartered accountant, a cost accountant or another professional the board decides. The internal auditor may or may not be an employee.
How is internal audit different from statutory audit?
Internal audit serves management and the board and its scope is chosen by them. Statutory audit gives an opinion on the financial statements to the members, and its scope is set by law and auditing standards.
Can one engagement cover several types?
Yes. Stating the types in the scope document keeps the work focused and avoids gaps.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error