A statutory and tax compliance internal audit programme tests whether GST, TDS/TCS, income tax, ROC, payroll statutory, notices, consultant coordination, portal access and DSC controls are complete, timely and evidenced.
Compliance failures create interest, penalty, blocked credit, notices and management distraction. Internal audit should test the control system around compliance, not only whether one return was filed.
Objective: All registrations, returns and owners are mapped.
Compliance calendar, registration list, return tracker, challans.
All applicable registrations and selected months/quarters.
Objective: GST returns and ITC claims are supported.
GSTR-1/3B/9, 2B recon, ITC register, challans, notices.
Selected periods plus high-value exceptions.
Objective: Withholding, payment and return controls operate.
TDS/TCS workings, challans, returns, Form 26AS/AIS tie-outs, tax schedules.
High-value sections and exception vendors/customers.
Objective: Entity filings and portal authority are controlled.
MCA SRNs, board records, PF/ESI/PT returns, portal user list, DSC register.
All critical filings and active portal users.
ICAI IASB lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026. Use this page as a practical workpaper starter, then verify the latest standard, law, regulation, ERP report and client fact pattern before concluding.
It should cover the compliance universe, GST, TDS/TCS, income tax, ROC filings, payroll statutory compliance, notices, portal access, DSC custody and consultant controls.
No. It is a fieldwork starter. The internal auditor must tailor it to the approved scope, ERP, delegation matrix, locations, volumes, materiality, prior findings and current legal position.
Yes. Use the linked CORAA workbook for the cycle. It contains editable RCM, testing, evidence and monitoring sheets that can be used as a fieldwork base.
