CORAA University · Free tool

Internal audit SOW generator

Draft a practical internal audit scope of work for Section 138 engagements: cycles, cadence, reporting line, deliverables, exclusions and the first data request list. Use it as a starting draft for Board or Audit Committee approval, not as a substitute for professional judgement.

Internal audit resources

Engagement inputs

Entity name

Audit period

Locations / units

Fieldwork cadence

Primary reporting line

Exclusions / limitations

Cycle coverage

How CORAA uses this

Public template to working engagement file

The public SOW, RCM and checklist resources are the same structure the Internal Audit module turns into live work: engagement scope, cycle library, testing evidence, observations, management responses and follow-up status.

Need to test whether Section 138 applies first? Run the applicability checker or open the Internal Audit module.

How to scope an internal audit SOW

An internal audit SOW should translate the appointment or engagement mandate into work that can actually be performed: which cycles are in scope, what period is covered, what locations are covered, how often fieldwork or monitoring will run, who receives the report, what data is needed and what is expressly outside scope.

For companies covered by Section 138, Rule 13(2) of the Companies (Accounts) Rules, 2014 requires the Audit Committee or Board to formulate the scope, functioning, periodicity and methodology of internal audit in consultation with the internal auditor. That is why the SOW should be approved before fieldwork begins and should be linked to the risk assessment and RCM.

This tool produces a practical draft only. It does not decide whether internal audit is mandatory, does not appoint the internal auditor, and does not replace the internal auditor's professional judgement. Use it to save drafting time, then tailor the scope to the entity, ERP environment, delegation matrix and risk assessment.

Worked example — manufacturing company quarterly SOW

A private manufacturing company covered by Rule 13 because peak bank borrowings exceeded Rs 100 crore wants a quarterly internal audit over nine locations.

Inputs

PeriodFY 2026-27

CyclesP2P, Inventory, Fixed Assets, Cash and Bank, Statutory Compliance

CadenceQuarterly fieldwork

Reporting lineAudit Committee

Output

Core deliverablesRCM, testing sheet, internal audit report, management response and ATR tracker

Initial data listVendor master, PO/GRN/invoice data, inventory movement, FAR, BRS and statutory returns

Key limitationNo statutory audit opinion or management decision-making

The SOW converts the Rule 13 scope requirement into an executable internal audit plan. It still needs risk assessment, management discussion and formal approval.

Common mistakes

Writing the SOW as a generic checklist

A useful SOW names cycles, locations, data sources, cadence, reporting line, deliverables and exclusions. A generic “review internal controls” sentence is hard to execute and hard to defend.

Skipping the data request list

Most internal audit delays start with unclear data requests. Put the first PBC list in the SOW so ERP exports, masters, approvals and reconciliations are known before fieldwork.

Calling monitoring “real time” when it is not

If data refreshes monthly or weekly, say so. Internal audit evidence depends on source, population, logic, reviewer conclusion and cadence, not marketing language.

Confusing internal audit with statutory audit

The SOW should exclude statutory audit opinions, tax representation and management decisions unless separately agreed. Internal audit reports observations and recommendations; management owns decisions and remediation.

Frequently asked questions

What should an internal audit SOW include?+

An internal audit SOW should include entity and period, locations, cycles in scope, methodology, fieldwork or monitoring cadence, reporting line, deliverables, data request list, exclusions and management responsibilities.

Is this SOW generator enough for Section 138 compliance?+

No. It is a drafting aid. Where Section 138 applies, the company must appoint an eligible internal auditor and the Audit Committee or Board must formulate the scope, functioning, periodicity and methodology in consultation with the internal auditor under Rule 13(2).

How does the SOW connect to an RCM?+

The SOW decides which cycles and locations are in scope. The RCM then expands those cycles into sub-processes, risks, controls, tests, evidence and results. The SOW is the engagement boundary; the RCM is the working file.

Can the SOW cover continuous monitoring?+

Yes, but it should state the actual cadence and evidence model: data source, population, rule logic, refresh frequency, exception owner, reviewer conclusion and follow-up process.

Authoritative sources

MCA

Companies Act, 2013 — Section 138 — Requires prescribed classes of companies to appoint an internal auditor.

MCA

Companies (Accounts) Rules, 2014 — Rule 13 — Rule 13(2) requires the Audit Committee or Board to formulate scope, functioning, periodicity and methodology in consultation with the internal auditor.

ICAI

ICAI IASB — Compendium of Standards on Internal Audit — ICAI lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026.

Always confirm against the latest version of the source. Regulations evolve and amendments are common.

Related calculators

Internal audit resources hub →Internal audit applicability checker →P2P RCM template →Continuous monitoring procedures →

Share this tool

Last reviewed: 2026-08-27 · For informational purposes only — not professional advice.