SIA 120 gives a common vocabulary for internal controls and explains who is responsible for what: management's responsibilities and the internal auditor's, as set by law and regulation such as the Companies Act and the SEBI listing regulations. It requires the internal auditor to give independent assurance over the control environment.
This page covers SIA 120 as it stands in ICAI’s October 2022 compendium. ICAI’s February 2026 compendium, applicable from 1 April 2026, renumbers the standards, so check the current number and text in that compendium before citing it in a report.
The file checklist and the mistakes above are practice points drawn from the requirements of the standard. They are not text from the standard.
This is a COSO link rather than an IIA one. Work on internal financial controls in India is commonly built on COSO's Internal Control - Integrated Framework (2013), usually described as five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
This standard is described here as it stands in the October 2022 compendium, which is the earlier set. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). That compendium renumbers the standards, so check the current number and text there before citing this standard in a report. ICAI's compendium page does not say whether the standards are mandatory or recommendatory, so we do not describe any standard as mandatory. The effective-date clause in each 2019 standard said it applied to internal audits beginning on or after a date to be notified by the Council of ICAI.
These pages summarise each standard as it stands in ICAI's Compendium of Standards on Internal Audit (as on 1 October 2022), working from an extract of that document. They are summaries and close paraphrases, not the text of the standards. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). For that current set we have only the titles, taken from the Board's 2025-26 annual report; its text is available from ICAI through a registration form on the compendium page and is not summarised here. ICAI's compendium page does not say whether the standards are mandatory or recommendatory, so we do not describe any standard as mandatory. Before you cite a number, a paragraph or a status in a report, check the February 2026 compendium. internalaudit.icai.org
Editable formats and tools from CORAA’s internal audit library that put SIA 120 into practice. Free to use.
SIA 120, Internal Controls, is a Standard on Internal Audit issued by the Internal Audit Standards Board of ICAI. SIA 120 gives a common vocabulary for internal controls and explains who is responsible for what: management's responsibilities and the internal auditor's, as set by law and regulation such as the Companies Act and the SEBI listing regulations. It requires the internal auditor to give independent assurance over the control environment.
ICAI's compendium page does not say whether the Standards on Internal Audit are mandatory or recommendatory, so we do not describe SIA 120 as mandatory. ICAI's Internal Audit Standards Board lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026 (source: the Board's compendium page, checked on 1 October 2026). SIA 120 as described on this page is from the earlier October 2022 compendium. The February 2026 compendium renumbers the standards, so check the current number and text there before citing it in a report.
The controls identified against each risk and the tests carried out on them. A missing control recorded as a design gap, then validated and reported (SIA 310 paras 3.4 and 4.4).
The number is the same but the title is not. In ICAI's February 2026 compendium, which ICAI lists as applicable from 1 April 2026, SIA 120 is titled "Terms of Internal Audit Engagement". This page covers SIA 120 as it stands in the October 2022 compendium, titled "Internal Controls". Only the titles of the February 2026 set are listed here; check its text in that compendium before citing it.
