Cycle-specific internal audit programmes for teams that need fieldwork steps, evidence expectations, sample basis, analytics, red flags and downloadable workbook links without starting from a blank audit file.
A P2P internal audit programme converts procure-to-pay risks into fieldwork procedures covering vendor onboarding, purchase approval, GRN or service acceptance, invoice booking, tax checks, payment release, vendor reconciliation and ERP access.
An O2C internal audit programme tests whether customers are approved, credit is controlled, goods or services are dispatched before billing, invoices are accurate, GST reporting is complete and receivables are collected or escalated.
An R2R internal audit programme tests the reliability of month-end close, chart of accounts, manual journals, balance-sheet reconciliations, accruals, provisions, intercompany balances, reporting packs and finance-system access.
An H2R internal audit programme tests the employee lifecycle from manpower approval and recruitment to employee master changes, attendance, payroll, statutory deductions, reimbursements, exits, full-and-final settlement and access removal.
A cash and bank internal audit programme tests bank account governance, mandates, receipts, payments, bank reconciliation, petty cash, deposits, cut-off and bank-portal access controls.
An inventory internal audit programme tests SKU master data, goods receipt, quality control, issues, transfers, physical verification, ageing, NRV, costing, scrap, write-offs and warehouse-system access.
A fixed assets internal audit programme tests capex approval, CWIP ageing, capitalisation, fixed asset register completeness, tagging, physical verification, depreciation, disposal, impairment, insurance and ERP access.
A treasury internal audit programme tests bank governance, borrowings, interest, covenant compliance, investments, deposits, bank guarantees, letters of credit, forex exposure, hedging, cash forecasting and treasury-system access.
A statutory and tax compliance internal audit programme tests whether GST, TDS/TCS, income tax, ROC, payroll statutory, notices, consultant coordination, portal access and DSC controls are complete, timely and evidenced.
An ITGC internal audit programme tests user access, privileged access, segregation of duties, change management, backup and recovery, interfaces, batch jobs, audit logs, report logic and IT operations controls.
These programme pages are practical fieldwork starters. They should be tailored to the company’s approved scope, risk assessment, ERP configuration, delegation matrix, locations, legal position and the ICAI Standards on Internal Audit applicable to the assignment date.
