Types of Internal Audit: 7 Types and When to Use Each

By SCORE Editorial Team · Prepared by SCORE’s audit, tax and advisory practice · Law stated as on 14 September 2026

Quick answer: The main types of internal audit are financial, compliance, operational, IT and investigation audits. Many companies now add risk management and ESG audits. Each answers a different question, from “are the numbers right?” to “what went wrong?”. A good annual plan mixes these types according to risk, not habit.

What is internal audit, and why does the type matter?

Internal audit is an independent review of a company’s risks, controls and processes. It reports to the Audit Committee or the Board.

Under Section 138 of the Companies Act, 2013, larger companies must appoint an internal auditor. Rule 13(2) of the Companies (Accounts) Rules, 2014 then leaves the design to the company. The Audit Committee or Board, with the internal auditor, sets the scope, functioning, periodicity and methodology.

That freedom is why the type matters. The law does not tell you what to audit. Your risk profile does.

What are the main types of internal audit?

Type	Question it answers	Typical areas	Related ICAI standard
Financial	Are transactions recorded accurately and completely?	Revenue, payables, inventory valuation, month-end close	SIA 120 (Internal Controls)
Compliance	Are we following laws, regulations and policies?	GST, TDS, labour laws, Companies Act, FEMA, CSR	SIA 150 (Compliance with Laws and Regulations)
Operational	Are processes efficient and effective?	Procurement, production yield, logistics, working capital	SIA 310 (Planning the Assignment)
IT	Are systems secure and data reliable?	Access rights, change management, backups, audit trail	SIA 520 (Internal Auditing in an IT Environment)
Investigation	What happened, and who was involved?	Fraud allegations, whistle-blower complaints, unexplained losses	SIA 11 (Consideration of Fraud)
Risk management	Are risks identified and managed?	Risk register, risk appetite, mitigation owners	SIA 130 (Risk Management)
ESG and third-party	Are non-financial and outsourced activities controlled?	CSR spend, sustainability data, outsourced service providers	SIA 530 (Third Party Service Provider)

The ICAI standards listed are the closest match, not a one-to-one mapping. ICAI’s Internal Audit Standards Board publishes the full set.

Financial audit

A financial internal audit tests whether transactions are recorded correctly and on time. It focuses on the controls behind the numbers, not on giving an opinion.

Typical tests include three-way match in purchases, revenue cut-off, inventory counts and reconciliations. It reduces surprises in the statutory audit.

Compliance audit

A compliance audit checks adherence to laws, regulations, contracts and internal policies. In India, the list is long: GST, TDS, PF and ESI, the Companies Act, FEMA, CSR and sector rules.

Good compliance audits test the process, not only the filing. For example, they check who tracks due dates and how changes in law reach the team.

Operational audit

An operational audit asks whether a process works well and at a sensible cost. It looks at efficiency, waste and delays.

No law makes it mandatory. Yet it often delivers the most value, because it finds money. Examples include freight leakage, slow-moving stock and excess scrap.

IT audit

An IT audit tests the systems that run the business. It covers user access, segregation of duties in the ERP, change management, backups and data integrity.

It matters more now that the accounting software audit trail is a Companies Act requirement.

Investigation audit

An investigation audit examines a specific suspicion: a whistle-blower complaint, a stock loss or a suspicious vendor. It is reactive and evidence-driven.

Under SEBI’s listing rules, the Audit Committee of a listed company reviews findings of internal investigations into suspected fraud or material control failures.

Risk management audit

A risk management audit tests whether the company’s risk process works. It checks whether the risk register is current, owners are named and mitigation actually happens.

ESG and third-party audits

These are newer. ESG audits review sustainability data and CSR spend controls. Third-party audits review outsourced activities such as payroll, logistics or IT services.

Which type of internal audit is mandatory?

None of the types is mandatory on its own. Section 138 requires an internal audit for covered companies. It does not say which type.

For listed companies, SEBI’s listing rules add oversight. The Audit Committee reviews the adequacy of the internal audit function, including its structure, staffing, coverage and frequency. It also reviews internal audit reports on control weaknesses.

How do you combine types in a risk-based annual plan?

Most companies need several types every year. A risk-based plan decides the mix.

1. Map the audit universe: list processes, locations, systems and entities.
2. Score each area on impact and likelihood.
3. Assign audit types to high-risk areas. For example, procurement may need financial, operational and IT testing.
4. Set frequency: high-risk areas every year or continuously; low-risk areas on rotation.
5. Reserve capacity for investigations and management requests.
6. Get approval from the Audit Committee or Board, and review the plan mid-year.

What does a sample allocation look like?

Here is an illustrative plan for a mid-sized manufacturer. Adjust it to your own risk assessment.

Area	Audit type	Frequency
Procure-to-pay	Financial, operational and IT	Annual, with continuous analytics
Inventory and scrap	Operational	Half-yearly
Statutory compliance	Compliance	Quarterly checklist
ERP access and changes	IT	Annual
Branch and store cash	Financial	Surprise visits
CSR projects	Compliance and ESG	Annual
Whistle-blower cases	Investigation	As needed

Frequently asked questions

What are the four main types of internal audit?

The four most cited are financial, compliance, operational and IT audits. Many lists add investigation audits as a fifth. Risk management and ESG audits are growing additions.

Is an operational audit mandatory?

No. The law requires covered companies to have an internal audit, not a particular type. Operational audits are optional, but they often find the most savings.

What does an IT audit cover in internal audit?

It covers user access, segregation of duties, change management, backups and data integrity. It also checks that the accounting software audit trail is enabled and preserved.

Who decides the scope and type of internal audit?

The Audit Committee or the Board, in consultation with the internal auditor, under Rule 13(2). In listed companies, the Audit Committee also reviews the function’s coverage and frequency.

What is the difference between an internal audit and an investigation audit?

A routine internal audit tests controls across a planned area. An investigation audit looks into a specific suspicion and gathers evidence on what happened and who was involved.

How often should each type of internal audit be done?

Risk decides. High-risk areas are audited every year or monitored continuously. Lower-risk areas can be covered on a two- or three-year rotation.

How SCORE helps

SCORE builds risk-based internal audit plans and delivers each type of audit with the right specialists. In one engagement, we helped cut inventory shrinkage from 3.5% to 0.9%.

Planning next year’s audit cycle? Request an internal audit proposal from SCORE and ask for our Risk-Based Audit Plan Template.

Sources

• Standards on Internal Audit: publications (ICAI Internal Audit Standards Board)
• Companies Act, 2013 and rules (India Code)

This article is general information, not professional advice.