The plan needs the prescribed governance process
Companies (Accounts) Rules, 2014 rule 13(2) requires the Audit Committee of the company or the Board, in consultation with the internal auditor, to formulate internal audit’s scope, functioning, periodicity and methodology. Applicability under section 138 and rule 13(1) is a separate gateway. Once applicable, an appointment letter alone does not demonstrate that the required planning elements and consultation have been addressed.
Read the applicable text: ICSI statutory e-book: Companies (Accounts) Rules, rule 13(2) Official Companies Act: section 138.
Record the responsible body and consultation
Identify the actual company governance structure and the Audit Committee or Board handling the rule. Retain the internal auditor’s input, proposed scope, discussion record and resulting plan. Do not replace consultation with a generic management instruction or label a draft as a decision without supporting minutes or other actual authority. This guide does not invent a voting threshold, statutory number of meetings or universal audit-cycle frequency.
Map scope to functions and activities
List processes, sites, systems and business changes, then explain included areas and material omissions. Separate internal-audit scope from statutory financial-statement audit and from management’s own control operation. A risk-ranking model may help prioritise work, but its weights and cut-offs are internal planning choices rather than limits prescribed by rule 13(2).
Connect periodicity and methods to resources
Explain planned timing and frequency, use of testing, data analysis or other methods, evidence access and reporting routes. Hours and sample sizes must support the intended work. The six examples use fictional approved planning assumptions, not statutory minima or guaranteed assurance levels. A numerical coverage percentage does not by itself establish adequate audit scope or justify excluding a high-risk area.
Control changes and follow-up
When a new location, system migration, incident or resource constraint changes the plan, record the proposed change, consultation and actual decision. Preserve what was originally planned, completed, deferred or replaced. A completed report is not proof that management implemented its recommendations. Link follow-up to evidence and keep unresolved matters visible to the responsible body.
Finish with a plan-to-delivery bridge
Maintain the formulated scope and methodology, resource basis, consultation, reports delivered and approved changes. Review separate independence, eligibility and prohibited-service requirements where relevant rather than assuming rule 13(2) resolves them. This use case concerns planning governance and delivery controls, distinct from the prior-year turnover and borrowing tests for mandatory appointment.
Six worked illustrations
All facts and amounts are fictional. Calculations illustrate the stated assumptions, not a predetermined legal outcome.
Illustrative example 1: Audit-universe selection
Assume the formulated plan identifies 20 process areas and selects 12 for the stated cycle, with the remaining eight explicitly deferred with reasons. Selected count is 60% of the universe. That percentage describes the plan; it does not prove statutory adequacy or justify omission of a critical process.
Illustrative example 2: Resource allocation
Approved fictional work budgets are procurement 120 hours, inventory 100 and IT access 80, total 300 hours. Available resources are 270 hours, leaving a 30-hour gap requiring a documented scope, resource or timing decision, not a silent reduction in testing.
Illustrative example 3: Repeat site work
Assume three selected branches each have two planned reviews of 24 hours. Total planned site effort is 144 hours. Two reviews per branch are the actual planning assumption, not a rule 13(2) mandate.
Illustrative example 4: Report completion
Eight reports are planned, six issued and two still pending. Issued-report count is 75% of the plan. The record must identify the two pending reports and any authorised change rather than describing the whole plan as delivered.
Illustrative example 5: Methodology change
Original testing budget is 200 hours. An actual supported change removes 40 hours of one procedure and adds 55 hours of a different procedure, giving 215 hours. The net increase is 15 hours; preserve the methodological reasons and actual consultation rather than only the revised total.
Illustrative example 6: Follow-up is different from report delivery
An issued report has 15 agreed actions. Evidence confirms ten implemented, three remain in progress and two are disputed. Total remains 15, but confirmed implementation is ten, not fifteen. An issued report does not close all recommendations automatically.
Ten-step verification table
| Step | Action | Evidence |
|---|---|---|
| 1 | Confirm applicability separately | Section 138 and rule 13(1) assessment. |
| 2 | Identify responsible governance body | Actual Audit Committee or Board structure. |
| 3 | Record internal-auditor consultation | Inputs, discussion and resulting decisions. |
| 4 | Define scope | Processes, sites, systems and exclusions. |
| 5 | Define functioning and reporting | Responsibilities and evidence access. |
| 6 | Formulate periodicity | Actual timetable and reasons. |
| 7 | Formulate methodology | Procedures and supported testing approach. |
| 8 | Reconcile resources | Hours, capacity and documented gaps. |
| 9 | Control plan amendments | Consultation and actual authorised changes. |
| 10 | Bridge plan to delivery and follow-up | Reports, deferred work and evidenced action status. |
Sixteen practitioner FAQs
1. Does appointment alone demonstrate rule 13(2) planning?
No. Address its specified planning elements and consultation.
2. Who formulates the plan under the rule?
The Audit Committee or Board, in consultation with the internal auditor.
3. Which four elements are named?
Scope, functioning, periodicity and methodology.
4. Does this guide repeat applicability thresholds?
No. That gateway requires its separate current-law assessment.
5. Is a quarterly cycle prescribed universally here?
No. Do not invent a uniform cycle from the planning rule.
6. Are example hours statutory minima?
No. They are fictional planning assumptions.
7. Does percentage coverage prove adequacy?
No. Consider the actual risks and scope.
8. Can critical exclusions remain unexplained?
Keep exclusions and their reasons visible to the responsible body.
9. Is internal audit identical to statutory audit?
No. Their functions and legal requirements differ.
10. Does a resource gap justify silent testing cuts?
It requires an accountable planning decision rather than concealment.
11. Should methodology changes be retained?
Yes. Preserve the change, reasons and actual consultation.
12. Can a draft plan be described as finally formulated without evidence?
No. Establish the actual governance record.
13. Does an issued report prove implementation?
No. Follow-up needs implementation evidence.
14. Can disputed actions be marked complete automatically?
No. Record their actual status.
15. Does rule 13(2) decide every independence question?
No. Review other applicable requirements separately.
16. What should the final bridge show?
Original plan, supported changes, delivered work, deferrals and follow-up evidence.
Official sources
ICSI statutory e-book: Companies (Accounts) Rules, rule 13(2) Official Companies Act: section 138