Start with the hierarchy

An organisation needs internal control to manage risks, internal check to distribute duties so that work is cross-checked, and internal audit to assess whether arrangements are designed and operating effectively. These concepts overlap but are not substitutes.

Internal control: the umbrella system

Internal control includes governance, risk assessment, authorisations, segregation of duties, physical safeguards, information systems, reconciliations, oversight and monitoring. An audit learner can organise it using the five familiar COSO components: control environment; risk assessment; control activities; information and communication; and monitoring activities. Internal control aims at reasonable assurance about operations, reporting and compliance—not certainty.

A payroll process could require HR approval for new employees, line-manager attendance verification, finance review of payroll changes, bank-authorised payment and monthly reconciliation. An exception report about duplicate bank accounts is a detective control; restricting who may create a payroll record is a preventive control.

Internal check: built into the workflow

Internal check is the arrangement of accounting and operational duties so that no one person has uncontrolled responsibility for a transaction from initiation to completion. Cashier receives and deposits cash, accountant posts receipts, and another person performs bank reconciliation. Sequential cross-checking makes concealment harder. In very small entities perfect segregation may be impractical; owners may compensate with independent review.

Internal audit: independent assurance and advice

Internal audit evaluates risk management, governance and controls under an approved plan. It may recommend improved cybersecurity, purchasing discipline, inventory reconciliation or fraud-response procedures. It should have sufficient organisational independence even when employees perform the function. In Indian company law, section 138 addresses internal audit for prescribed classes of companies; it does not make internal auditing mandatory for every conceivable business. Internal auditors generally report according to the entity’s governance framework; statutory auditors report under their distinct legal mandate.

Preventive, detective and corrective controls

Preventive controls seek to stop an error (role-based access); detective controls discover it (exception reporting); corrective controls restore and improve processes (reversing bad entries and strengthening authorisation). A control may involve technology or people. Controls can fail due to management override, collusion, error, obsolete configuration or cost constraints.

Worked case: duplicate vendor payment

Suppose invoices totalling ₹7,80,000 are paid twice. An internal check may require the accounts assistant to match invoice numbers before payment. A detective control flags duplicate PAN, amount and invoice dates. Internal audit examines why the match failed and recommends changes. The external auditor separately evaluates financial-statement misstatement risk. The four roles are connected but not the same.

Audit risk and control risk

Audit risk is often discussed through inherent risk, control risk and detection risk. High control risk may lead auditors to emphasise substantive work. Even strong controls do not justify skipping evidence on material balances. An internal audit report can inform external audit risk assessment, but reliance depends on competence, objectivity and work quality.

Exam checkpoints

Q1. Two employees independently authorise and record a receipt. This illustrates (A) internal check (B) adverse opinion (C) reinsurance (D) insurance premium. Answer: A. Duties are deliberately divided.

Q2. An internal auditor reviews weaknesses in purchase approvals. The auditor is primarily (A) preparing every purchase order (B) evaluating controls (C) appointing the CAG (D) valuing insurance risk. Answer: B. Assurance and evaluation are internal audit roles.

Q3. Segregation may still fail when two employees collaborate to circumvent approval. This is (A) inherent elimination of risk (B) collusion (C) compulsory materiality (D) statutory audit. Answer: B. Collusion is a recognised limitation.

FAQs

Is internal check the same as checking done by an internal auditor?

No. It is the allocation and cross-checking of routine work.

Does installing accounting software guarantee strong controls?

No. User access, approvals, audit logs and oversight still matter.

Does section 138 apply to every company?

No. The Companies Act and applicable rules prescribe its coverage.