Auditing · Beginner-friendly studyhub
Vouching, Verification and Internal Control in Auditing for UPSC EPFO APFC:
SA 500, SA 315, Sec 143 with 10 MCQs
Follow the evidence, understand controls, and separate the ideas exam questions often mix up.
📤 Share this with your APFC study group
Why vouching, verification and internal control pay in APFC
Auditing questions in UPSC EPFO APFC are rarely about long procedures. They test whether you can tell three or four similar-sounding ideas apart. Is checking a purchase invoice vouching or verification? Is segregation of duties internal check or internal audit? Who must report on internal financial controls, the directors or the statutory auditor? Get the boundaries right and this chapter becomes some of the safest marks in the Accountancy and Auditing section.
The same ideas matter beyond the exam. As an APFC you will inspect establishments, check wage registers against contribution returns and spot missing members. That is vouching and verification in practice. For a full sweep of the subject, use CrackTarget’s 100-MCQ Accountancy, Auditing and Insurance practice test after this note.
Vouching: the transaction test
Start simply: Checking a machine purchase invoice is vouching. Checking that the machine exists, belongs to the business and has an appropriate year-end value is verification. Requiring different people to approve, pay and record the purchase is internal check.
Vouching means examining documentary evidence, called vouchers, to confirm that a transaction recorded in the books actually happened, was authorised, relates to the business and is recorded at the right amount, date and account. The classic textbook line, associated with Lawrence Dicksee, is that “vouching is the essence of auditing”, because every later step rests on the transactions being genuine.
What a vouching auditor checks
- Occurrence: the transaction took place (invoice, receipt, contract, minutes).
- Authorisation: a competent person approved it.
- Accuracy and cut-off: right amount and right accounting period.
- Classification: capital or revenue, correct ledger head.
- Business purpose: not a personal expense booked to the company.
Vouching is different from routine checking, which only tests the arithmetic of books: casts, carry-forwards, postings and balancing. Routine checking can find clerical errors but cannot catch a fictitious voucher that has been neatly posted. That is why vouching goes behind the entry to the evidence.
Verification and valuation: the Balance Sheet test
Verification confirms the assets and liabilities shown in the Balance Sheet on its date. Where vouching looks at the flow of transactions during the year, verification looks at the position at the year-end. The table covers four key checks. Also test completeness: are any assets, liabilities or required disclosures missing?
| Assertion | Question asked | Typical evidence |
|---|---|---|
| Existence | Does the asset exist on the Balance Sheet date? | Physical inspection, inventory count attendance (SA 501) |
| Rights and ownership | Does the entity own or control it? | Title deeds, registration, share certificates |
| Valuation | Is it stated at the correct amount? | Accounting policy, AS 2 / AS 10, depreciation workings |
| Presentation and disclosure | Is it shown and disclosed correctly? | Schedule III format, notes to accounts |
Valuation is part of verification, but the auditor is not a professional valuer. The auditor checks that a proper basis was applied consistently and may rely on experts. The leading case is Kingston Cotton Mill Co. (1896), where the court said the auditor is “a watchdog, but not a bloodhound”: on the facts of that 1896 case, the auditor was held entitled to rely on a responsible official’s stock certificate absent suspicious circumstances; once suspicion arises, he must dig deeper. Treat this as historical case law, not modern authority: today SA 500 and SA 501 require sufficient appropriate evidence for inventory, including attendance at the physical count where inventory is material unless impracticable, with alternative procedures where appropriate; therefore a management certificate alone is not a substitute.
Verification also covers liabilities. Here the main risk is understatement, so the auditor looks for unrecorded liabilities through post-balance-sheet payments, supplier statements and external confirmations under SA 505.
Internal check vs internal audit vs internal control
These three terms are the most frequently confused set in APFC auditing. Think of internal control as the umbrella, with internal check and internal audit as two parts under it.
| Feature | Internal check | Internal audit | Internal control |
|---|---|---|---|
| Nature | Arrangement of staff duties so one person’s work is automatically checked by another | Independent review of operations and controls by a separate function | The whole system designed by management to achieve reliable reporting, efficient operations and compliance |
| Timing | Simultaneous, built into the routine | Periodic or continuous, risk-based review | Ongoing |
| Key idea | Segregation of duties, rotation, joint custody | Appraisal and reporting to management or audit committee | Five components under SA 315 |
| Example | Cashier does not post the debtors’ ledger | Internal auditor tests payroll monthly | Approval limits, reconciliations, IT access controls |
Five components of internal control (SA 315)
- Control environment (tone at the top, integrity, governance)
- The entity’s risk assessment process
- The entity’s process to monitor the system of internal control
- The information system and communication
- Control activities (authorisation, reconciliations, physical controls, segregation)
Internal control gives reasonable, not absolute, assurance. It can fail through human error, collusion between employees, or management override. The statutory auditor communicates significant deficiencies in writing to those charged with governance under SA 265, and may use the internal auditor’s work under SA 610, but the sole responsibility for the audit opinion stays with the statutory auditor.
Audit evidence under SA 500
SA 500 requires evidence that is sufficient (a measure of quantity) and appropriate (a measure of quality, meaning relevance and reliability). More evidence cannot make up for poor-quality evidence.
Reliability ladder (general tendencies, not absolute rules): evidence from independent external sources is more reliable than internal evidence; evidence obtained directly by the auditor (such as recalculation or observation) beats evidence obtained indirectly; documentary evidence beats oral representation; and original documents are generally more reliable than copies. Reliability depends on the circumstances and controls over preparation and storage, including electronic records.
Procedures to obtain evidence: inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. Inquiry alone is never enough to test operating effectiveness of controls.
Companies Act anchors: Sec 138 and Sec 143(3)(i)
Sec 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 makes internal audit mandatory for every listed company (no size test); for unlisted public companies with paid-up share capital of ₹50 crore or more during the preceding financial year, turnover of ₹200 crore or more during the preceding financial year, outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the preceding financial year, or outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year; and for private companies with turnover of ₹200 crore or more during the preceding financial year or bank/PFI loans or borrowings exceeding ₹100 crore at any point of time during the preceding financial year. Any one test is enough; private companies are not tested on paid-up capital or deposits. The internal auditor may be a chartered accountant, a cost accountant or another professional decided by the Board, and may be an employee.
Sec 143(3)(i) requires the statutory auditor’s report to state whether the company has adequate internal financial controls with reference to financial statements and whether they operate effectively. Separately, Sec 134(5)(e) puts the responsibility statement on internal financial controls on the directors of listed companies. Directors design and maintain controls; the auditor reports on them. Caveat: Apply the notified company-class exemptions when deciding whether Sec 143(3)(i) reporting is required in a particular case.
High-yield traps
- Vouching tests transactions; verification tests Balance Sheet items on a date.
- Routine checking finds clerical errors but cannot detect a fictitious voucher.
- Internal check is built into routine work; internal audit is an independent review that may be periodic or continuous and risk-based, not only retrospective checking.
- “Watchdog, not bloodhound” is Kingston Cotton Mill (1896) (historical; modern inventory evidence follows SA 500/501).
- Sufficiency is quantity; appropriateness is quality.
- Using the internal auditor’s work (SA 610) does not reduce the statutory auditor’s responsibility.
- Collusion and management override are inherent limitations of internal control.
Revision memory card
V-V-V: Vouching = Vouchers for transactions; Verification = existence, ownership, valuation, presentation on the Balance Sheet date; Valuation is inside verification.
SA map: 500 evidence · 501 inventory count and litigation · 505 confirmations · 315 risk and internal control · 265 deficiencies · 610 internal auditors · 530 sampling · 230 documentation.
Law map: Sec 138 internal audit · Sec 143(3)(i) auditor on IFC · Sec 134(5)(e) directors on IFC (listed).
When you have revised this card, move to timed practice on the EPFO mock tests page.
10 practice MCQs with score analysis
Attempt all ten, then press Submit. You will see correct, wrong and unattempted counts, your percentage and explanations.
📤 Found this useful? Share it with a friend preparing for APFC
FAQ
Is valuation separate from verification?
No. Valuation is one of the assertions tested during verification, alongside existence, ownership and presentation. The auditor checks the basis of valuation but is not a professional valuer.
Is internal check the same as internal audit?
No. Internal check is built into the routine and works at the same time as the transaction, through segregation of duties. Internal audit is an independent review, usually of transactions and controls already operated, though it may be carried out on a continuous, risk-based basis during the year.
Can the statutory auditor rely fully on the internal auditor?
The statutory auditor may use the internal auditor’s work under SA 610 after evaluating it, but the responsibility for the audit opinion remains entirely with the statutory auditor.
Who is responsible for internal financial controls?
Management and the Board design and maintain them; directors of listed companies state this in the responsibility statement under Sec 134(5)(e). The statutory auditor reports on their adequacy and operating effectiveness under Sec 143(3)(i).