Internal audit of a manufacturing unit that exists only in a conference room will find nothing. The observations are at the gate, the weighbridge, the stores, the shop floor and the cash cupboard. Section 138, where it applies, is the legal reason. The operating reason is that proprietors of growing units in GIDA are often the last to know what the storekeeper knows.
A first-year scope that fits a plant
- Inward: GRN versus invoice versus weighbridge versus quality rejection.
- Stores: BOM versus actual consumption, scrap recording, slow-moving stock.
- Outward: gate pass, e-way bill, invoice, transporter.
- Purchase-to-pay: vendor creation, three-way match, related-party vendors.
- Contractor labour: attendance, wages, PF/ESI where applicable, versus production.
- Cash and banking: petty cash at the plant, unused cheque books, UPI on a personal number.
- IT: shared Tally passwords, disabled audit trail. See audit trail.
The report
Each observation should state the fact, the risk, the cause, and a management response. A fifty-page lecture on COSO that does not mention the open scrap yard is not an internal audit of that unit. The statutory auditor will read the report; CARO will ask whether an internal-audit system exists and whether it is commensurate.