Internal Audit Should Look for Fraud, and Say So

Read the internal audit reports of a typical Indian company and you will find observations on approvals missing, policies outdated and reconciliations delayed. You will rarely find the word fraud. That is not because there is none. It is often because nobody asked internal audit to look.

Under s. 138 of the Companies Act 2013 and the rules under it, prescribed classes of companies must appoint an internal auditor. The law says little about scope, so scope is what the audit committee and management make it. Many functions settle into compliance testing: safe, predictable and unlikely to find anything that embarrasses anyone.

Why compliance testing is not enough

Compliance testing checks that transactions followed the process. Fraud is designed to look as though it did. A fictitious vendor is approved, invoiced and paid exactly as the policy requires. A kickback leaves no trace in the voucher. A manipulated provision is supported by a memo.

The ACFE's Occupational Fraud 2026 report found that a lack of internal controls was the primary weakness in 33% of cases and override of existing controls in another 19%. Both are invisible to an audit that only checks whether the documented steps were followed.

What a fraud mandate looks like

In the charter

The internal audit charter, approved by the audit committee, should state that internal audit:

• considers fraud risk in planning every audit, drawing on the fraud risk assessment;
• tests for specific schemes in high-risk processes, using full-population data where possible;
• reports fraud indicators promptly to the audit committee chair, not only in the periodic report;
• has unrestricted access to records, systems, people and premises, including data held by IT.

In the plan

The annual plan should show which schemes each audit is designed to detect, which analytics tests will be run, and which areas have been left out and why. The audit committee should be able to see the link between the fraud risk assessment and the plan on one page.

In the work

Fraud-aware auditing changes how fieldwork is done:

• testing master data changes, manual journals and exceptions, not just routine transactions;
• confirming that goods and services were actually received, not just that the invoice was approved;
• looking at who benefits from an exception, not only whether it was approved;
• speaking to people below management level, who often know what is going on;
• treating unexplained anomalies as questions to answer, not observations to note.

In the reporting line

The head of internal audit should report functionally to the audit committee, meet the committee privately at every meeting, and be appointed and removed only with the committee's agreement. Where internal audit reports administratively to the CFO, findings about finance need a route that does not pass through the CFO first.

When internal audit finds something

Agree a protocol before it is needed:

1. Stop and preserve. Once an indicator looks like fraud rather than error, the priority shifts to securing evidence. Further auditing can alert the people involved.
2. Escalate. Inform the audit committee chair and, where appropriate, counsel. Decide who will investigate.
3. Decide who investigates. Internal audit may handle straightforward, junior-level matters if it has trained investigators. Senior, complex or digitally heavy matters need independent investigators working under counsel.
4. Consider the auditor. The statutory auditor may have a reporting duty under s. 143(12); decide who will brief them.

Common mistakes

• Avoiding the word. Calling a suspected fraud a "process lapse" delays escalation and can mislead the committee.
• Rotating the same plan. A cyclical plan that visits each unit every three years is easy to predict and to prepare for.
• Auditing documents, not substance. A signed goods receipt note does not prove that goods arrived.
• Investigating without training. Interviews and evidence handling done badly can damage a later disciplinary or legal process.
• Reporting through the subject. Findings about a function should not be filtered by the head of that function.

Where we can help

We help audit committees write internal audit fraud mandates and protocols, design scheme-based tests through our forensic accounting and data analytics team, train internal auditors in investigation basics, and take over matters that need independent investigation. Speak to us in confidence.