Risk-based internal audit
An internal audit that spends its time where the risk is, and an audit committee that can see what was tested and what is still open.
An internal audit plan built on your risk register, delivered in-house, co-sourced or fully outsourced, and reported to the audit committee.
Internal audit is most useful when it follows risk. A plan built on last year's plan tends to re-test what already works. A risk-based plan starts from the risks to the business's objectives, decides which processes, units and locations matter most, and sets the depth of audit accordingly.
We build the audit universe with management, assess each area for inherent risk and the strength of its controls, and propose an annual plan for the audit committee to approve. We can deliver it for you, co-source specialist skills alongside your team, or act as the outsourced internal auditor where the Companies Act requires one.
Every audit ends with agreed actions, owners and dates, and we follow them up until they are closed. The audit committee receives a clear report: what was planned, what was done, what was found and which risks remain.
Your internal audit needs to focus on the risks that matter most, or you need an independent internal auditor under Companies Act s.138.
Signs we see most often
- 01The audit plan has not changed in years while the business has.
- 02You must appoint an internal auditor under Companies Act s.138.
- 03The audit committee wants assurance on the risks it worries about most.
- 04Your internal audit team lacks specialist skills such as IT, forensics or data analytics.
- 05Audit findings are raised but rarely closed.
- 06New plants, businesses or acquisitions sit outside the current plan.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01UnderstandUnderstand the business's objectives, its risk register and previous audit results.
- 02PlanBuild the audit universe, rate each area and agree an annual plan with the audit committee.
- 03AuditAudit the high-risk processes, units and locations, using data analytics where possible.
- 04AgreeAgree findings, root causes, actions, owners and dates with management.
- 05Follow upTrack actions until they are closed and re-test the important ones.
- 06ReportReport to the audit committee on the plan, the findings and the risks that remain.
An audit committee that sees where risk sits, what was tested and which actions are still open.
- An audit universe and risk assessment
- An annual risk-based audit plan for audit committee approval
- Audit reports with root causes and agreed actions
- An action tracker with owners and dates
- Regular reporting to the audit committee
The law and frameworks this work is aligned to
- Companies Act, 2013 s.138 on internal audit and s.177 on the audit committee
- ICAI Standards on Internal Audit and the Framework governing internal audits
- IIA Global Internal Audit Standards (2024)
- SEBI LODR Reg. 18 and Part C of Schedule II on the audit committee's review of internal audit
- CARO 2020 reporting on the internal audit system
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerQuestions clients ask before we start.
Can BDI be our internal auditor?
Yes, as the outsourced internal auditor, or alongside your own team on a co-sourced basis. The appointment, independence and reporting line are agreed with the board and the audit committee.
How is this different from a statutory audit?
A statutory audit gives an opinion on the financial statements. Internal audit gives management and the audit committee assurance over risks and controls across the business, and recommends improvements.
Can the plan change during the year?
Yes. A risk-based plan is reviewed when risks change, with the audit committee's approval.