A control repository is the source library behind an internal audit RCM. It records the process risk, expected control, test procedure and evidence requirement before the auditor tailors it to the entity, cycle, ERP and approved SOW.
Keep the repository granular enough to become a workpaper, but not so granular that every entity becomes a copy-paste exercise. These fields allow one library row to become an RCM row, a monitoring rule, an observation and an ATR item.
Use this as the first draft of the repository. The internal auditor should then remove irrelevant controls, split broad rows, add entity-specific control owners and map each test to the actual ERP report or source document.
Vendor master change log, PO approval report, GRN, supplier invoice, payment run and MSME ageing.
Customer master, credit approval, sales order, dispatch proof, invoice register, credit note register and ageing.
Journal listing, approval workflow, close checklist, reconciliation file, provision workings and reviewer notes.
HR master, offer letter, attendance report, payroll register, bank file, PF/ESI challans and exit clearance.
Bank master, bank statements, BRS, payment approvals, cheque/online mandate and cash count sheet.
GRN, stock ledger, issue slips, count sheets, variance approval, ageing report and valuation working.
Capex note, vendor invoice, CWIP register, fixed asset register, physical verification file and depreciation working.
Sanction letters, covenant workings, investment file, bank balances, cash forecast, forex exposure register and board approvals.
Compliance calendar, challans, returns, reconciliations, notice register, legal updates and management sign-off.
User list, role matrix, access review sign-off, change tickets, deployment approval, backup logs and restoration evidence.
Generate an editable Excel/PDF RCM across core cycles.
Prioritise the audit universe before building the control repository.
Convert recurring controls into exception rules and reviewer conclusions.
Turn the approved repository scope into engagement terms and a data request list.
Report observations, ratings, management responses and follow-up requirements.
Track closure evidence, revised dates, owners and repeat observations.
Section 138 creates the internal-audit requirement for prescribed companies. Rule 13(2) requires the Audit Committee or Board, in consultation with the internal auditor, to formulate scope, functioning, periodicity and methodology. The repository should therefore connect every control row back to approved scope and cadence.
ICAI's February 2026 Compendium of Standards on Internal Audit applies from 1 April 2026. The repository should support SIA 220/310 planning, SIA 320 evidence, SIA 330 documentation, SIA 350 review, SIA 370 reporting and SIA 390 follow-up.
An internal audit control repository is the reusable library of process risks, control objectives, control activities, test procedures, evidence requirements and reviewer conclusions used to build engagement-level RCMs.
No. The repository is the reusable source library. The RCM is the engagement-specific extract after the auditor selects cycles, tailors controls, adds entity owners and records testing results.
Most Indian finance-led internal audit plans start with P2P, O2C, R2R, cash and bank, payroll/H2R, inventory, fixed assets, statutory compliance and treasury. ITGC is added wherever ERP controls affect the process evidence.
The repository identifies controls worth testing. Continuous monitoring converts selected controls into recurring rules with population source, rule logic, cadence, exception owner and reviewer conclusion.
