Audit
Internal audit that boards can use, not a binder they store
The value of internal audit in banks, NBFCs, and operating companies is whether findings change control. Volume of observations is not a proxy for that.
NETZONE Research
March 4, 2026·16 min read
Indian companies and regulated financial entities are not short of audit activity. Statutory audit, concurrent audit, internal audit, stock audit, and various certifications can fill a calendar. The scarce resource is attention: what should the board or the audit committee actually change this quarter?
An internal audit that lists fifty low-severity observations and three buried high-severity ones has not done its job. The job is to concentrate risk, explain how the control failed, and recommend a fix that operations can implement. NETZONE’s audit work is built around that standard, accounting integrity plus internal and operational reviews that leadership can defend.
Start from the risk, not the checklist
Checklists have a place in testing. They should not define the plan. A useful plan asks: where could a material error, fraud, or regulatory breach hide in this business model? For a lender, that may be file completeness, maker-checker, agency payments, and collections cash. For a manufacturer, inventory, related-party purchases, and cutoff. For a services company, revenue recognition and statutory withholdings.
When the plan is copied from last year, the organisation is auditing its memory, not its current risk.
Findings that name the control owner
A finding without an owner is a comment. Effective reports specify the process, the evidence, the impact, the root cause, and who must fix it by when. They distinguish design gaps from operating effectiveness gaps. They do not use severity labels as a negotiation tool.
Follow-up is part of the audit, not a courtesy. Open items that age past two cycles are a governance signal. Audit committees should see ageing as clearly as they see new issues.
Working papers you can reopen
If a regulator, statutory auditor, or incoming CFO asks “how did you conclude this?”, the file should answer. Sampling method, population, exceptions, and management comments belong in the working papers. Oral comfort does not survive personnel change, and personnel will change.
That is the difference between audit as a recurring ritual and audit as a control that compounds.
3 findings
Better than fifty observations if they name an owner and a date
2 cycles
Open items older than this are a governance signal
Working papers
What a new CFO or RBI sample will ask to reopen
Indian boards already have too much audit theatre
Listed companies, banks, and large NBFCs run statutory audit, concurrent audit, stock audit, and internal audit. The committee pack becomes a catalogue. The useful question is which three issues would change next quarter's operating rhythm if they were true.
Severity inflation is as harmful as severity suppression. If everything is high, nothing is. If nothing is high, the auditor is negotiating.
A one-page finding that Indian audit committees can use
Process, evidence, impact in rupees or customers, root cause, owner, and date. Distinguish design from operating effectiveness. Put ageing of prior issues above new issues. If last quarter's high finding is still open, do not open with a new theme.
This note reflects NETZONE operating experience in risk, audit, and statutory work across India. It is not legal, tax, or regulatory advice. Institutions should take counsel on their specific facts and licences.
