CORAA
Log inRun your first audit free
Topic hub · Internal audit

Internal audit: types, process, templates and tools

Internal audit gives an organisation independent, risk-based assurance and advice on whether its governance, risk management and controls are working. It differs from the statutory audit, which gives an opinion on the financial statements.

This hub brings together CORAA's guides on the types of internal audit, how to plan and run one, how to write observations, and the sector-specific audits, along with templates and free tools such as the Section 138 applicability checker and the annual plan generator.

Each guide states what its facts rest on and what we could not verify. Standards and laws change, so confirm dates and wording against the primary source before relying on them.

Guides

The essential guides: start here.

Internal Audit · 26 Sept 2026
Types of Internal Audit: Operational, Compliance, Financial, IT and More, Explained
The main types of internal audit in plain English: operational, compliance, financial, IT, performance, forensic and more. What each tests and how to choose.
Audit Basics · 28 Sept 2026
Internal Audit vs External Audit vs Statutory Audit: The Differences That Matter
Internal, external and statutory audit are not three equal options. Who appoints, who they report to, what they opine on, and how they use each other work.
Internal Audit · 28 Sept 2026
How to Build an Audit Universe for Internal Audit, Step by Step
An audit universe is the list of everything internal audit could review. How to build one, rate each item for risk, and turn it into an annual plan.
Internal Audit · 29 Sept 2026
Writing Audit Observations: Condition, Criteria, Cause, Effect with Examples
How to write an audit observation using condition, criteria, cause and effect, with three worked examples and a checklist for a clear recommendation.
Internal Audit · 31 Aug 2026
Internal Audit Report Format in India: Word Template, Observations and ATR
A practical internal audit report format for Indian companies: Word template route, Excel/PDF report pack, executive summary, scope, methodology, observation structure, rating matrix, management response, ATR and audit committee reporting.
Internal Audit · 27 Sept 2026
Combined Assurance and the Three Lines Model: Who Assures What
How the IIA Three Lines Model and combined assurance fit together: who owns risk, who oversees it, who assures it independently, and how to map gaps.
Internal Audit · 29 Sept 2026
Internal Audit KPIs and Quality Metrics That Matter
Which internal audit KPIs are worth reporting to the audit committee: plan completion, report timeliness, action closure, stakeholder feedback and more.
All guides on this topic
Free templates and tools

Ready-to-use working papers, no sign-up to look around.

Word template
Internal Audit Charter Template — Section 138 / IIA / SIA
A board-approved Internal Audit Charter establishing the purpose, authority, independence, scope and responsibilities of the internal-audit function. Aligned with IIA Standards and ICAI SIA framework.
Word template
Internal Audit Report Format in Word — Observations, ATR & Management Response
Downloadable internal audit report format for Indian companies — executive summary, scope and methodology, observations by severity, recommendations, management responses, ATR status and audit committee circulation.
Word template
Internal Audit Checklist — General Process Review
A general checklist covering governance, policy, segregation, authorisation, records, reconciliation, access, compliance and follow-up.
Word template
Internal Audit Risk Assessment Matrix — Impact × Likelihood
Score every process in the audit universe on Impact and Likelihood — the risk score is computed automatically — to rank what gets reviewed first and how often.
Word template
Risk Register Template
A risk register with likelihood, impact, scores, existing controls, residual risk, owner and status.
Word template
Root Cause Analysis Template — 5 Whys and Fishbone
Take a finding to its cause with a problem statement, five whys, a fishbone worksheet and an action plan.
Word template
Combined Assurance Map Template
Map each key risk to the assurance given by management, risk and compliance, internal audit and external providers, and find gaps and overlaps.
Word template
Process Audit Checklist Template
Audit one process from start to finish: definition, practice, controls, records, measures and results.
Word template
Audit Working Paper Index and Cross-Reference
One index for the whole audit file with references, preparer, reviewer, evidence location and cross-references.
Word template
Procure-to-Pay (P2P) Risk & Control Matrix Template
A ready risk-and-control matrix for the Procure-to-Pay cycle — vendor onboarding through payment release — mapped to risks, controls and control objectives under ICAI's SIA framework, with space for your own test results.
Word template
Order-to-Cash (O2C) Risk & Control Matrix Template
A ready risk-and-control matrix for the Order-to-Cash / revenue cycle — credit approval through dispatch, invoicing and receivables recovery — with risks, controls and control objectives mapped, and space for your own test results.
Word template
Payroll Process Internal Audit Checklist
A risk-and-control checklist for the payroll (hire-to-retire) cycle — ghost employees, unauthorised master changes, statutory-deduction compliance and exit settlements — with space for your own test results.
Free tool
Section 138 applicability checker
Check whether the company must appoint an internal auditor.
Free tool
Annual plan generator
Turn risk into a quarter-by-quarter plan.
Free tool
RCM builder
Build a risk and control matrix.
Free tool
Observation report generator
Write observations with condition, criteria, cause and effect.
Free tool
Risk assessment matrix
Score risks on a 5x5 heat map.
Free tool
Fishbone diagram generator
Map root causes of a finding.
Frequently asked questions

Internal audit: in plain words.

Internal audit is an independent, objective assurance and advisory activity inside an organisation. It evaluates whether governance, risk management and internal controls are working, and reports to management and the audit committee, with a focus on risk. Read more: Types of internal audit.
Commonly described types are operational, compliance, financial and IT audits, with performance, forensic, environmental and integrated audits also used. Each looks at a different question, and one engagement may combine more than one. Read more: Types of internal audit explained.
Internal audit is done for the organisation, covers operations, risk and controls, and reports to management and the audit committee. An external or statutory audit gives an independent opinion on the financial statements for owners and other users. Read more: Internal vs external vs statutory audit.
Section 138 of the Companies Act, 2013 and the rules under it require certain classes of company to appoint an internal auditor. Whether yours is covered depends on its type, size and borrowings, so use our applicability checker and read the current rules.
Under section 138, a chartered accountant, a cost accountant or another professional the board decides may be appointed, and the internal auditor may or may not be an employee of the company. Independence from the activities audited still matters.
Internal controls are the policies, procedures and checks that help an organisation achieve its objectives, protect its assets, keep reliable records and comply with law. They include approvals, segregation of duties, reconciliations and system access limits.
In outline: plan using risk, perform fieldwork and test, report observations with recommendations, agree management responses, and follow up until actions are closed. The audit universe and annual plan sit above these steps. Read more: Build an audit universe.
It means choosing what to audit, how deeply and how often by the level of risk, instead of rotating through every area equally. The risk assessment drives the annual plan and the scope of each audit.
Usually the scope and objective, a summary of conclusions, each observation with its condition, criteria, cause, effect and recommendation, the management response and a follow-up status. A clear rating of each finding helps the audit committee prioritise. Read more: Writing audit observations.
It depends on risk. Higher-risk areas are audited more often or continuously monitored, and lower-risk areas less often. The annual plan approved by the audit committee records the frequency for each area.