Companies Act 2013: Internal Audit’s response to the changing governance landscape

2 | Companies Act

Section 138 – renewed focus on Internal Audit (IA)

Call to action

Understand the role Internal Audit can play in supporting boards, audit committees and independent directors in discharging their

increased responsibilities

Redefine IA priorities in consultation with the key stakeholders and stay aligned with the emerging needs of

the Companies Act, 2013

Upgrade skills of IA teams and build talent pool to perform

specialist reviews

Update IA methodology as Leverage data analytics Understand and Define Internal Audit well as processes to focus on and continuous controls coordinate assurance value charter emerging risk areas and to monitoring for expanding activities to minimize

meet requirements according to IA coverage standards with regards to due care

as well as documentation

Background and Context

► IA was not mandatory according to the Companies Act 1956. However, according to Companies Auditors Report Order, the external auditors are required to comment upon the effectiveness of the Internal Audit system for applicable companies

► According to the Companies Act 2013: ► Such class or classes of companies as may be

prescribed will be required to appoint an internal auditor

► Internal auditor should either be a chartered accountant or a cost accountant, or such other professional as may be decided by the board to conduct Internal Audit of functions and activities of the company

► The Central Government may, by rules, prescribe the manner and the intervals in which Internal Audit shall be conducted and reported to the board

Applicability

The Ministry of Corporate Affairs have published rules under the Companies Act 2013 and the following class of companies shall be required to appoint an internal auditor:

► Every listed company; ► Every public company with a paid up share capital of

INR100 million or more

gaps and remove overlaps

► Every other public company, which has any outstanding loans or borrowings from banks or public financial institutions exceeding INR250 million or which has accepted deposits of INR250 million or more at any point of time during the last financial year

Key takeaways

► Board, management, independent directors etc., are expected to seek increased comfort from IA on areas of compliance, fraud, internal financial controls, corporate social responsibility, related party transactions etc., to comply with their fiduciary responsibilities

► Many new companies, including mid-sized listed companies, without structured IA set-up, are now required to comply with Section 138

► Internal auditors are now covered under class action suits

► Potential use of IA documents as evidenced in class action suits

► IA will be required to play an enhanced role in “Assurance Coordination” - an activity to outline who provides assurance on what aspects of the entire assurance universe

Responding to the changing landscape -questions to be considered

Well Requires prepared consideration

Strategy

► Is there a charter for your IA function specifying its role and responsibility? ► Is the importance of your IA fully supported by organization’s structure,

communication and actions? ► Does your IA have clear and objective performance targets? ► Does your IA comply with professional standards such as those issued by the

Institute of Chartered Accountants of India or the Institute of Internal Auditors to deliver consistent quality?

► Does your IA effectively coordinate with other assurance functions to understand assurance overlaps and address gaps? Does your IA participate in strategic projects/initiatives?

► Does your IA effectively align its resources to focus on both compliance and business improvement and is considered as a value adding function?

► Does your IA set its priorities in consultation with stakeholders and stay aligned with the business objectives?

► Does your IA play a part in defining the Assurance Coverage (what role management, auditors, board etc. will play in the overall assurance to avoid overlaps/duplication) for the organization?

► Do you have an Internal Audit charter outlining coverage approach, sampling philosophy, documentation expectation, reporting requirements etc.?

Operations

► Does your IA perform a periodic functional assessment through an independent party to assess its competency gaps and process inefficiencies?

► Is your IA involved in specialist audits around CSR, compliance, related parties, treasury, marketing etc.?

► Are specialized skills and competencies periodically identified/refreshed for your IA to execute its purpose and mandate?

► Are there established protocols for communicating, elevating and resolving significant audit findings?

► Is your IA coverage focused on emerging risks around fraud, compliance and ethics related areas?

► Does your IA periodically assess the ways to e-enable its process of data analytics, continuous controls monitoring etc.?

► Is your IA delivery supported by effective technology interface for follow-up, reporting and monitoring?

Reporting to the Board of Directors/Audit Committee

► Does your IA periodically publish its achievements through IA activity report or similar means and take stakeholders input on its strategy/vision?

► Does your IA get sufficient time and audience from the board, audit committee etc. to present its work and refresh its vision/strategy?

4 | Companies Act

Strategy

Operations

Reporting to the Board of Directors/Audit Committee

Notes

Meeting your Internal Audit Challenge - How can EY help?

Areas of intervention Do I need support?

► IA function set-up — charter, role and responsibility, reporting, risk assessment process, coverage, value focus etc.

► IA functional assessment — identify focus areas around people, technology and IA strategy aspects

► Benchmark against professional/IIA Standards

► Develop and implement an approach for assurance coordination to avoid IA assurance overlaps and gaps

► Assist in reviewing the IA coverage/focus areas in light of business objectives, emerging risks around fraud, compliance, ethics, internal controls etc.

► Implement technology solutions for data analytics and continuous controls monitoring

► Implement EY IA accelerator – a technology interface for IA follow-up, reporting and monitoring

► Train in-house IA teams

► A co-sourcing or out-sourcing arrangement

► Support in specialist audits such as treasury, capital projects, media & entertainment, CSR, compliance, related parties through industry-focused teams etc.

To measure the gap that you need to bridge to comply with the Act and understand more about how we are assisting our clients with Consolidated Financial Reporting, please contact us at internalaudit@in.ey.com

5

6 | Companies Act

Notes

Notes

8 | Companies Act

EY officesAhmedabad 2nd floor, Shivalik Ishaan Near C.N. Vidhyalaya Ambawadi Ahmedabad - 380 015 Tel: + 91 79 6608 3800 Fax: + 91 79 6608 3900

Bengaluru 12th & 13th floor “UB City”, Canberra Block No.24 Vittal Mallya Road Bengaluru - 560 001 Tel: + 91 80 4027 5000

+ 91 80 6727 5000 Fax: + 91 80 2210 6000 (12th floor) Fax: + 91 80 2224 0695 (13th floor)

1st Floor, Prestige Emerald No. 4, Madras Bank Road Lavelle Road Junction Bengaluru - 560 001 Tel: + 91 80 6727 5000 Fax: + 91 80 2222 4112

Chandigarh 1st Floor, SCO: 166-167 Sector 9-C, Madhya Marg Chandigarh - 160 009 Tel: + 91 172 671 7800 Fax: + 91 172 671 7888

Chennai Tidel Park, 6th & 7th Floor A Block (Module 601,701-702) No.4, Rajiv Gandhi Salai, Taramani Chennai - 600113 Tel: + 91 44 6654 8100 Fax: + 91 44 2254 0120

Hyderabad Oval Office, 18, iLabs Centre Hitech City, Madhapur Hyderabad - 500081 Tel: + 91 40 6736 2000 Fax: + 91 40 6736 2200

Kochi 9th Floor, ABAD Nucleus NH-49, Maradu PO Kochi - 682304 Tel: + 91 484 304 4000 Fax: + 91 484 270 5393

Kolkata 22 Camac Street 3rd floor, Block ‘C’ Kolkata - 700 016 Tel: + 91 33 6615 3400 Fax: + 91 33 2281 7750

Mumbai 14th Floor, The Ruby 29 Senapati Bapat Marg Dadar (W), Mumbai - 400028 Tel: + 91 022 6192 0000 Fax: + 91 022 6192 1000

5th Floor, Block B-2 Nirlon Knowledge Park Off. Western Express Highway Goregaon (E) Mumbai - 400 063 Tel: + 91 22 6192 0000 Fax: + 91 22 6192 3000

NCR Golf View Corporate Tower B Near DLF Golf Course Sector 42 Gurgaon - 122002 Tel: + 91 124 464 4000 Fax: + 91 124 464 4050

6th floor, HT House 18-20 Kasturba Gandhi Marg New Delhi - 110 001 Tel: + 91 11 4363 3000 Fax: + 91 11 4363 3200

4th & 5th Floor, Plot No 2B, Tower 2, Sector 126, NOIDA 201 304 Gautam Budh Nagar, U.P. India Tel: + 91 120 671 7000 Fax: + 91 120 671 7171

Pune C-401, 4th floor Panchshil Tech Park Yerwada (Near Don Bosco School) Pune - 411 006 Tel: + 91 20 6603 6000 Fax: + 91 20 6601 5900

Ernst & Young LLP EY | Assurance | Tax | Transactions | Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.

EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.

Ernst & Young LLP is one of the Indian client serving member firms of EYGM Limited. For more information about our organization, please visit www.ey.com/in.

Ernst & Young LLP is a Limited Liability Partnership, registered under the Limited Liability Partnership Act, 2008 in India, having its registered office at 22 Camac Street, 3rd Floor, Block C, Kolkata - 700016

© 2014 Ernst & Young LLP. Published in India. All Rights Reserved.

EYIN1402-011 ED None

This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither Ernst & Young LLP nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor.

For any queries on how EY can assist you:

Please contact,

internalaudit@in.ey.com