Cycle-specific internal audit programmes for teams that need fieldwork steps, evidence expectations, sample basis, analytics, red flags and downloadable workbook links without starting from a blank audit file.
A P2P internal audit programme converts procure-to-pay risks into fieldwork procedures covering vendor onboarding, purchase approval, GRN or service acceptance, invoice booking, tax checks, payment release, vendor reconciliation and ERP access.
An O2C internal audit programme tests whether customers are approved, credit is controlled, goods or services are dispatched before billing, invoices are accurate, GST reporting is complete and receivables are collected or escalated.
An R2R internal audit programme tests the reliability of month-end close, chart of accounts, manual journals, balance-sheet reconciliations, accruals, provisions, intercompany balances, reporting packs and finance-system access.
An H2R internal audit programme tests the employee lifecycle from manpower approval and recruitment to employee master changes, attendance, payroll, statutory deductions, reimbursements, exits, full-and-final settlement and access removal.
A cash and bank internal audit programme tests bank account governance, mandates, receipts, payments, bank reconciliation, petty cash, deposits, cut-off and bank-portal access controls.
An inventory internal audit programme tests SKU master data, goods receipt, quality control, issues, transfers, physical verification, ageing, NRV, costing, scrap, write-offs and warehouse-system access.
A fixed assets internal audit programme tests capex approval, CWIP ageing, capitalisation, fixed asset register completeness, tagging, physical verification, depreciation, disposal, impairment, insurance and ERP access.
A treasury internal audit programme tests bank governance, borrowings, interest, covenant compliance, investments, deposits, bank guarantees, letters of credit, forex exposure, hedging, cash forecasting and treasury-system access.
A statutory and tax compliance internal audit programme tests whether GST, TDS/TCS, income tax, ROC, payroll statutory, notices, consultant coordination, portal access and DSC controls are complete, timely and evidenced.
An ITGC internal audit programme tests user access, privileged access, segregation of duties, change management, backup and recovery, interfaces, batch jobs, audit logs, report logic and IT operations controls.
These programme pages are practical fieldwork starters. They should be tailored to the company’s approved scope, risk assessment, ERP configuration, delegation matrix, locations, legal position and the ICAI Standards on Internal Audit applicable to the assignment date.
An internal audit programme is the fieldwork plan for a selected audit area. It converts the approved scope into audit objectives, risks, procedures, evidence requests, sample basis, analytics, reviewer checks and reporting outputs. It should be tailored to the entity, ERP, delegation matrix, locations and audit period.
Start with the cycle that creates the highest business risk or committee concern. For many companies that is P2P, O2C, R2R, inventory, payroll/H2R, treasury, statutory compliance or ITGC. Use the audit universe and risk scorer before locking the annual plan.
A checklist is a coverage aid, an RCM records the risk-control-test-evidence matrix, and an audit programme is the execution plan that tells the auditor what to test, which data to request, what sample basis to use and how exceptions should be concluded.
A P2P audit programme should cover vendor master, onboarding, purchase requisitions, RFQ, purchase orders, GRN or service entry, invoice booking, GST/TDS/MSME checks, payment release, vendor reconciliations, advances, debit balances and ERP access conflicts.
An O2C audit programme should cover customer master, credit limits, order approval, dispatch or service proof, pricing, invoicing, GST and e-invoice reporting, collections, credit notes, write-offs, receivables ageing and customer or billing access rights.
An R2R audit programme should cover chart of accounts governance, close calendar, manual journals, balance-sheet reconciliations, accruals, provisions, intercompany, reporting mappings, late postings, reopen-period controls and finance-system access.
An H2R audit programme should cover manpower approval, recruitment, onboarding, employee master changes, attendance, leave, overtime, payroll processing, PF, ESI, professional tax, salary TDS, reimbursements, exits, full-and-final settlement and leaver access removal.
Sample size should follow the control frequency, population size, risk level, control design, prior deviations and expected evidence quality. High-risk or automated exception testing may require full-population analytics, while recurring manual controls usually need a defensible sample basis and replacement rule.
Every repeatable procedure in an audit programme should be assessed for monitoring potential. Duplicate invoices, old advances, leaver access, stale BRS items, pricing overrides, missing POD, old GRNs and unresolved ATRs can become scheduled exception rules with owners and thresholds.
No. They are fieldwork starters. Final conclusions require current scope approval, complete source data, documented testing, exception evaluation, management response, reviewer sign-off and professional judgement under the applicable ICAI Standards on Internal Audit and engagement terms.
