Risk assessment and audit plan
A risk map of your processes and an annual internal audit plan, approved by the board or audit committee, that puts effort where the risk is highest.
Internal Audit Services in Kochi, Kerala
T K Chandy & Associates provides internal audit services in Kochi and across Kerala for companies, MSMEs, hospitals, educational institutions and NGOs. We run risk-based internal audits of your key processes, meet the section 138 Companies Act requirement where it applies, follow the ICAI Standards on Internal Audit, and report findings with clear, practical action points for management.
- Led by a chartered accountant since 1994
- Member of SGA World International
- Kakkanad, Kochi
At a glance
Internal audit at a glance
- Who needs it: Listed companies and larger unlisted public and private companies under section 138; any growing business that wants independent eyes on its controls.
- What it covers: Purchases, sales, inventory, payroll, cash and bank, statutory compliance and IT access, chosen by risk, not by habit.
- What you receive: Periodic internal audit reports with findings rated by risk, root causes, agreed action points and follow-up of earlier issues.
- Our role: An outsourced or co-sourced internal audit team from Kakkanad, reporting to your board, audit committee or owners.
An internal audit is an independent review of how your business actually runs: whether controls work, whether money and stock are safe, whether policies are followed and whether the law is complied with. Unlike the year-end statutory audit, it happens during the year, looks at processes rather than only the final accounts, and reports to management so problems are fixed before they grow.
At T K Chandy & Associates, our chartered accountants act as outsourced internal auditors for companies, MSMEs, hospitals, schools, NGOs and family-run groups in Kochi and across Kerala. We plan each audit around your risks, follow the ICAI Standards on Internal Audit, and write reports that owners and audit committees can act on. Where section 138 of the Companies Act, 2013 applies, we help you meet it properly, with a documented scope approved by your board or audit committee.
Internal audit services
Who Do We Provide Internal Audit For?
Internal audit is useful well before the law requires it. Owners often ask us in when the business has grown beyond what they can personally supervise.
- Companies covered by section 138 of the Companies Act, 2013
- MSMEs and family businesses with several branches or managers
- Manufacturers and traders with significant inventory
- Hospitals, schools and colleges with large cash and fee collections
- NGOs, trusts and societies accountable to donors
- Indian subsidiaries reporting to a foreign parent
What the engagement covers
What Does Our Internal Audit Service Include?
Process audits
Testing of procure-to-pay, order-to-cash, inventory, payroll, fixed assets, cash and bank, and treasury against your policies.
Internal control review
Review of design and operating effectiveness of controls, including support for internal financial control reporting by the statutory auditor.
Fraud-risk checks
Data-led checks for duplicate payments, ghost vendors or employees, unusual discounts, split purchases and cash leakages.
Compliance review
Checks on GST, TDS, PF, ESI, labour and other statutory compliances, with a register of what is due and what was missed.
Management audit
A wider review of how well management decisions, budgets, delegation of authority and MIS support the business objectives.
Section 138 applicability
Is Internal Audit Mandatory for Your Company?
Under section 138 of the Companies Act, 2013 read with rule 13 of the Companies (Accounts) Rules, 2014, these companies must appoint an internal auditor. The tests are applied to the preceding financial year, and meeting any one is enough.
| Class of company | Test (preceding financial year) | Internal auditor required? |
|---|---|---|
| Listed company | Any size | Yes |
| Unlisted public company | Paid-up share capital of ₹50 crore or more | Yes |
| Unlisted public company | Turnover of ₹200 crore or more | Yes |
| Unlisted public company | Outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point | Yes |
| Unlisted public company | Outstanding deposits of ₹25 crore or more at any point | Yes |
| Private company | Turnover of ₹200 crore or more | Yes |
| Private company | Outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point | Yes |
| Private company below these limits | None | No, but often advisable |
The internal auditor can be a chartered accountant or cost accountant, or another professional decided by the board, and may or may not be an employee. The company's statutory auditor cannot act as its internal auditor (section 144). The audit committee or board decides the scope, periodicity and methodology in consultation with the internal auditor.
Our process
How Does Our Risk-Based Internal Audit Work?
Step01
Understand the business and risks
We meet owners and process heads, walk through key processes and rate each area by financial, operational, compliance and fraud risk.
Step02
Agree scope and audit plan
We prepare an annual or quarterly plan with areas, frequency and sample sizes, approved by the board or audit committee.
Step03
Fieldwork and testing
We test transactions and controls, analyse data from your accounting or ERP system and visit sites, stores and branches as needed.
Step04
Discuss findings
Each observation is discussed with the process owner, with root cause, risk rating and an agreed action and timeline.
Step05
Report and follow up
We issue the report to management and the audit committee and track open points at the next visit until they are closed.
Internal vs statutory audit
How Is Internal Audit Different From Statutory Audit?
- Purpose
- Internal audit improves controls and processes; statutory audit gives an opinion on the year-end financial statements
- Timing
- Monthly, quarterly or half-yearly during the year; statutory audit is once a year after year end
- Reports to
- Management, board or audit committee; statutory audit reports to shareholders
- Scope
- Set by the board or audit committee; statutory audit scope is set by law and the Standards on Auditing
- Who can do it
- Employee or outside professional; statutory audit only by an independent chartered accountant
Be audit-ready
What Information Do We Need to Start?
For the first internal audit, these help us understand your business quickly:
- Organisation chart and delegation of authority
- Written policies and SOPs, if any
- Last statutory audit report and management letter
- Previous internal audit reports
- Read-only access to accounting or ERP system
- Vendor and customer masters
- Purchase orders, GRNs and invoices
- Stock records and count reports
- Payroll registers and attendance data
- Bank statements and reconciliations
- Statutory compliance returns and challans
- Board or audit committee minutes
Worked example
Example: Quarterly Internal Audit for a Kochi Distribution Company
A private limited company in Ernakulam distributing FMCG products had turnover of about ₹230 crore, which brought it within section 138. Its board appointed us as internal auditor and approved a risk-based plan focusing on sales, credit control and inventory.
- Data analysis showed credit notes for scheme discounts being issued after month end without approval, at a much higher rate in two territories.
- A stock count at the main warehouse found near-expiry goods that were still valued at cost.
- Vendor master checks found two suppliers sharing one bank account, which turned out to be related concerns not disclosed as related parties.
Management introduced an approval workflow for credit notes, a monthly expiry review and a vendor-master control. At the next quarter's audit the open points were closed, and the statutory auditor relied on the same documentation for its internal financial control testing.
Fees and timing
How Much Does Internal Audit Cost in Kochi?
Internal audit is usually priced as a retainer for the year rather than a one-off fee. The fee depends on the number of processes and locations, frequency (monthly, quarterly or half-yearly), transaction volume, whether data analytics and system access are available, and whether you need section 138 or IFC documentation. We agree the scope with you first and then quote a fixed fee in writing after reviewing your business.
For companies newly crossing the section 138 limits, the board should appoint the internal auditor early in the financial year so the plan covers the full year.
Glossary
Internal Audit Terms Explained
- Risk-based internal audit (RBIA)
An approach that ranks processes by risk and spends most audit time on the high-risk areas, instead of auditing every area equally.
- Standards on Internal Audit (SIA)
Standards issued by ICAI's Internal Audit Standards Board covering basic principles, terms of engagement, planning, reporting and quality of internal audits.
- Internal financial controls (IFC)
Policies and procedures that ensure orderly business conduct, safeguard assets, prevent fraud and keep accounting records accurate and complete.
- Management audit
A review of management performance and decision-making, covering objectives, budgets, MIS and delegation of authority, not only accounting controls.
- Co-sourcing
An arrangement where an outside firm works alongside your in-house internal audit team, adding skills or capacity for specific areas.
Why T K Chandy & Associates
Why Choose Us as Your Internal Auditor in Kochi?
CA-led since 1994
Led by T K Chandy Vaidyan, a chartered accountant since 1994, with experienced chartered accountants on every engagement.
Local and on site
From our Kakkanad office we visit warehouses, branches and sites across Ernakulam and Kerala as the plan requires.
Risk-based, not checklist
Effort goes to the areas where your money, stock and compliance are most at risk, not to routine ticking.
Reports owners can act on
Short, rated findings with root cause and an agreed action, written for owners and audit committees.
Joined up with tax and audit
Findings on GST, TDS and accounting flow straight into your compliance and statutory audit preparation.
Confidential and independent
Strict ICAI ethics, secure handling of data, and no internal audit for companies where we are the statutory auditor.
Related services
Which Other Services Work With Internal Audit?
Statutory audit
Annual audit under the Companies Act, 2013, including IFC and CARO reporting.
IT & systems audit
Access controls, audit trail and ERP reviews that support your internal audit.
Stock & inventory audit
Physical verification and valuation of stock at warehouses and branches.
Due diligence & special audit
Investigations, forensic reviews and due diligence for transactions.
Management consultancy
SOPs, delegation of authority and MIS design after the audit.
Get a quote
Request an internal audit proposal
Tell us your business, turnover, number of locations and whether section 138 applies. We will reply with a suggested scope, frequency and a fixed fee.
Prefer to talk now? Call +91 484 354 1530 or email [email protected].
Who prepared this page
Written and reviewed by chartered accountants at T K Chandy & Associates
This page is prepared by the audit and tax team at our Kakkanad, Kochi office and checked against the Companies Act, the Income-tax Act, GST law and ICAI standards. It is reviewed whenever the rules change.
- Last reviewed 29 October 2026
- Led by T K Chandy Vaidyan, chartered accountant since 1994
- Member of SGA World International
Have a question about your business?
Tell us your entity type, what you need and any deadline. A chartered accountant will reply.
Ask an expertFrequently asked questions
Internal audit in Kochi – frequently asked questions
Short answers to the questions clients in Kochi ask us most. Still unsure?
Talk to our team01.Is internal audit mandatory for private limited companies in India?
Only for larger ones. A private company must appoint an internal auditor under section 138 if its turnover in the preceding financial year was ₹200 crore or more, or if its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point in that year.
02.Which companies need an internal auditor under section 138?
Every listed company; unlisted public companies with paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, bank or institution borrowings above ₹100 crore, or deposits of ₹25 crore or more; and private companies meeting the turnover or borrowing test. The tests use the preceding financial year.
03.Who can be appointed as an internal auditor?
A chartered accountant (whether or not in practice), a cost accountant, or another professional decided by the board. The internal auditor may or may not be an employee of the company.
04.Can the statutory auditor also do the internal audit?
No. Section 144 of the Companies Act, 2013 prohibits a company's statutory auditor from providing internal audit services to that company, its holding company or subsidiaries.
05.Is there a penalty for not appointing an internal auditor?
Section 138 does not set its own penalty, so the general penalty under section 450 of the Companies Act can apply to the company and officers in default. The statutory auditor may also report the non-compliance.
06.What is risk-based internal audit?
It is an approach that first rates each process by risk and then plans audit time accordingly, so high-risk areas like purchases, cash and inventory are covered more often and in more depth than low-risk areas.
07.What are the ICAI Standards on Internal Audit?
They are standards issued by ICAI's Internal Audit Standards Board covering how internal audits are planned, performed, documented and reported. ICAI has been revising the framework, and we follow the standards that apply to each engagement.
08.How often should internal audit be done?
Most businesses in Kochi choose quarterly audits, with monthly reviews for high-risk areas such as cash or inventory. Smaller businesses may start with half-yearly reviews. The board or audit committee should decide the frequency.
09.What is the difference between internal audit and management audit?
Internal audit mainly tests controls, compliance and processes. A management audit looks wider, at how well management sets objectives, budgets and delegates authority, and whether decisions support business goals.
10.Do small businesses and MSMEs need internal audit?
It is not compulsory for them, but it is useful once owners cannot personally supervise purchases, stock and cash at every location. A light, risk-focused internal audit can pay for itself through reduced leakage.
11.What does an internal audit report contain?
Each observation with its risk rating, the facts found, the root cause, the impact, the recommendation and the action and date agreed with management, plus the status of earlier observations.
12.How is internal audit linked to internal financial controls?
Internal audit tests whether internal controls work. For companies whose statutory auditor reports on internal financial controls, well-documented internal audit work supports that reporting.
13.Can internal audit help detect fraud?
It can flag red flags such as duplicate payments, fictitious vendors, unusual discounts and stock shortages, and recommend controls to prevent them. A detailed forensic investigation is a separate engagement.
14.Do you provide internal audit for hospitals and educational institutions?
Yes. We review fee and billing collections, cash handling, pharmacy or store inventory, procurement, payroll and statutory compliance for hospitals, schools and colleges.
15.When should a company appoint its internal auditor?
At the start of the financial year, once the company knows it meets the section 138 limits based on the previous year. Early appointment lets the plan cover the whole year.
References:Companies Act 2013 (India Code) · Ministry of Corporate Affairs – Companies (Accounts) Rules 2014 · ICAI Internal Audit Standards Board · Institute of Chartered Accountants of India — reviewed 29 October 2026