Expert verified
Your last three process audits flagged the same reconciliation delays, yet nothing changed. One plant continues to report unexplained inventory variances, while another struggles with a reconciliation that takes longer every quarter. On paper, the controls appear adequate, but the financial impact keeps growing.
This is how process audit failures often begin in small operational gaps that go unresolved until they affect working capital, margins, compliance, or financial reporting. For mid-to-large Indian companies, identifying these weaknesses early is critical to effective internal financial controls and regulatory compliance under the Companies Act, 2013.
Delve with us into 12 common process audit failures CFOs and business leaders should identify before they become create major financial problems.
What Is a Process Audit Failure
A process audit failure is a breakdown in how a business process is designed, executed, monitored, or corrected as intended.
It is different from a one off error and reflects structural weakness. A wrong invoice for instance is an isolated mistake but a purchase approval process operating without a clearly designated approver for months is a process audit failure.
It will keep producing errors until someone fixes the process itself, not just the last transaction.
These gaps align with the five components of the COSO Internal Control Framework:
- Control environment
- Risk assessment
- Control activities
- Information and communication
- Monitoring.
When a process audit identifies a gap, you can almost always trace it back to a weakness in one of these five areas.
For mid-to-large Indian companies, Section 143(3)(i) of the Companies Act, 2013 requires the statutory auditor to express an opinion on whether the company has adequate internal financial controls and whether those controls operated effectively during the year.
The ICAI’s guidance also recognises the COSO 2013 Internal Control, Integrated Framework as a reference for evaluating these controls.
Unlike a broad internal audit, a process audit examines a specific workflow. This is usually done using end to end through walkthroughs, transaction testing, and control evaluation. For multi-plant businesses, a process audit also compares execution across locations to identify inconsistencies that routine testing may overlook.
The 12 Critical Failures
The failures below are the ones we see most often at PKC when working with Indian mid-to-large companies.
On their own, they may look insignificant like a missing signature or an undocumented practice. But when you look across a full year, or across plants and branches, the impact can be consequential.
You do not need new software, more people, or an external review to find these failures. Your business already has the information needed. What you need is the right question to uncover the problem. That is what the detection method under each failure is designed to do.
Start by checking these failures against your highest-risk processes:
Failure 1: Undefined Process Ownership
This is the situation where no single person is accountable for the end-to-end performance of a core process. Responsibility is fragmented across departments, so each function owns its tasks but no one owns the outcome.
This develops mostly when companies expand across plants, branches, or business units without formally assigning end-to-end process responsibility.
Example:
During a process audit at a multi-plant manufacturing company, each plant manager identified a different person as responsible for final purchase approval. One pointed to the corporate procurement head, another to the plant finance executive, while the third said approvals were handled based on urgency.
None could clearly explain who was accountable for ensuring that every purchase followed the required approval process.
Business impact:
Unclear ownership delays decisions, weakens coordination, and allows recurring process errors to remain unresolved. In procurement, it can reduce negotiating power, increase purchase costs, and create opportunities for duplicate or unauthorised payments.
Repeated audit observations are another warning sign, particularly when corrective actions address individual incidents without fixing the underlying process.
How to detect it:
During a process walkthrough, ask three people involved in the same workflow who owns its end-to-end performance. Compare their answers rather than relying only on the organisation chart. Then ask who would be accountable if the process failed for an entire week.
If the answers differ, cover only individual tasks, or point to a committee without a designated accountable person, process ownership is likely undefined.
Assigning a named owner with responsibility for performance, exceptions, control compliance, and corrective action is the first step towards closing the gap.
Failure 2: Missing Documentation
Missing documentation occurs when your core processes depend on individual knowledge rather than a clear, documented, current record of procedures, decision rights, exceptions, and control requirements.
The process may work well while experienced employees are in place, but break down when they leave or responsibilities change.
Example:
A healthcare services group with six hospitals across Maharashtra had a revenue cycle process that was only mastered by heads of billing supervisors. Patient billing, insurance claim submission, TDS deduction, and reconciliation sequencing were handled through informal knowledge passed between supervisors over years.
When one hospital’s billing head resigned, the replacement took 4 four months to reconstruct the sequencing rules.
During that period, insurance claim rejection rates rose because the new team did not know the specific order in which claims needed to be submitted for different insurance providers, nor which documentation each provider required.
Business impact:
Undocumented processes create key-person dependency. This increases training and transition costs, and makes consistent control execution difficult to demonstrate.
They can also lead to repeated errors, longer audit cycles, and compliance exposure because there is no reliable baseline against which actual practice can be tested.
How to detect it:
Ask for the current SOP, process map, approval matrix, and documented exception rules. If none exists, or the version shown does not match what staff actually describe doing during a walkthrough, the gap is confirmed.
Interview the person who most recently took over a role and ask what they wish had been written down during their own handover.
Documentation should not become paperwork for its own sake. Capture the critical steps, control points, decision rights, and exceptions clearly enough that another competent employee can execute the process without relying on informal knowledge.
Failure 3: Manual Approvals Without Trail
Manual approval becomes a process audit failure when a transaction is approved verbally, by phone, email, or informal messaging without reliable evidence linking the decision to an authorised person, date, transaction, and approval limit.
The decision may be valid, but the control cannot be independently verified later.
Example:
A Bengaluru-based SaaS company with ₹500 crore in revenue discovered during a pre-IPO ICFR review that vendor payments above ₹10 lakh required CFO approval. In practice, the CFO was approving these over phone calls and WhatsApp messages.
When auditors tested a sample of 40 high-value payments, only 14 had any written approval evidence. The remaining 26 had no trace of authorisation.
The company had to rebuild its approval workflows on its ERP before its IPO filing could proceed. The statutory auditor’s report under Section 143(3)(i) would have flagged this as a deficiency in the operating effectiveness of controls.
Business impact:
Without an approval trail, management cannot reliably establish who authorised a transaction, whether the approval was within delegated authority, or what information supported the decision.
This weakens internal financial controls, increases fraud and compliance risk, and makes audit testing more difficult.
This is what happened during the PNB scam. Two employees issued ₹14,357 crore in LoUs through SWIFT without reconciling them with core banking records. Since the systems operated separately, unauthorized LoUs went undetected until 2018, when a newly appointed official found mismatches during routine reconciliation.
How to detect it:
Select a sample of high-value transactions and trace each one against the delegation of authority matrix. Verify the approver, approval date, transaction value, and supporting evidence.
If approval exists only as a verbal confirmation, an informal message, or an email chain that cannot be reliably linked to the transaction, the control is not operating with sufficient evidence.
Make sure that every material approval leaves a clear, retrievable, and accountable audit trail.
Failure 4: No Standard Operating Procedures
This process audit failure occurs when there is no agreed SOP that defines how a recurring process should be performed, including its sequence, controls, responsibilities, and exception handling.
This is different from the missing documentation issue because here the problem is not that an established process was never written down. The problem is there is no common standard to begin with.
Example:
A manufacturer with three plants handles short-supply deliveries differently at each location. One rejected the entire shipment, another accepted the partial delivery with a handwritten note, and the third escalated every case to procurement.
None was following a group-wide procedure because no SOP defined the required response.
This creates a problem beyond operational inconsistency. If plants record, approve, and resolve the same exception differently, management cannot reliably compare performance, vendor quality, inventory losses, or processing efficiency across locations. New employees also learn from individual supervisors rather than from a consistent operating standard.
Business impact:
Inconsistent SOPs make performance comparison across locations meaningless. You cannot tell whether a low-performing store is badly managed or operating under a structurally inferior process.
Standardising processes usually reduces both stockouts and excess inventory. PKC’s process audit work with multi-plant enterprises consistently finds that one or two locations are clearly more disciplined than others, and that location becomes the template for standardising the group.
How to detect it:
Select a routine exception such as a short delivery, price discrepancy, rejected invoice, or inventory variance. Ask teams at three locations how they handle it.
Then check whether a common SOP defines the required steps, approval limits, documentation, and escalation route.
If the answers differ and there is no documented standard, the process lacks basic operating discipline. The strongest-performing location often provides a practical starting point for developing a group-wide SOP, provided its approach is tested and appropriate for the wider business.
Failure 5: Inconsistent Process Execution Across Locations
This failure occurs when the same documented process is executed differently across plants, branches, stores, or subsidiaries.
The SOP may be identical, but local management practices, system configurations, training, or supervision create different outcomes.
Example:
A ₹2,000-crore infrastructure company operating in seven states found that its material receipt process at project sites ranged from fully digital (GRN entered in ERP within 24 hours) to entirely manual (GRN written in a register, entered into ERP at month-end).
At sites with manual entry, inventory mismatches discovered at month-end averaged 6% of material value. At digital sites, the mismatch was under 1%.
The company was carrying an estimated ₹18 crore in unreconciled inventory across manual sites at any given time.
Business impact:
Inconsistent execution makes location-level performance difficult to compare. Metrics such as return rates, inventory shrinkage, rejection rates, or exception volumes may look different because teams are following different practices, not because the underlying business conditions differ.
Weak execution at one location can also create concentrated fraud, compliance, and financial risk.
How to detect it:
Choose one documented process and test it at all relevant locations using the same criteria.
Compare KPIs, transaction samples, approval records, exceptions, and control compliance. Investigate any major differences to see if they are caused by system setup, training, staffing, or supervision.
Distinguish genuine operational differences from control inconsistency. A plant with higher rejection rates may have a legitimate reason, such as a different product mix. But if the same process step is being skipped at that location, the issue is execution, not performance.
Cross-location benchmarking makes this visible by showing not just which location is underperforming, but where the process actually breaks down and why.
Failure 6: Weak Segregation of Duties
Weak segregation of duties occurs when the same person can initiate, approve, process, and record a transaction without an independent review.
The risk is especially high when ERP access allows one user to perform multiple conflicting activities. Trust in an employee is not a substitute for independent control.
Example:
A mid-sized NBFC in Delhi had a branch-level operations executive responsible for loan disbursement approval, payment processing, and bank reconciliation.
Over 18 months, this person created fictitious loan accounts and disbursed funds to accounts he controlled. The fraud was detected only when the branch’s reconciliation was moved to a central team during a process audit. By then, the accumulated exposure exceeded ₹2 crore.
Business impact:
Poor segregation increases the risk of fraud, unauthorised transactions, concealed errors, and prolonged financial leakage.
It can also create significant internal control deficiencies that become difficult and expensive to remediate once identified.
How to detect it:
Review actual ERP access rather than relying on job descriptions or management representations. For each high-risk process, map who can create, approve, process, modify, and reconcile transactions. Flag combinations that allow one person to control multiple conflicting stages without an independent review.
Where workforce size makes segregation impractical, use compensating controls such as independent review, exception reporting, periodic access reviews, or owner oversight. Ensure no individual can complete and conceal a high-risk transaction without detection.
Failure 7: Lack of KPIs
This happens when a core process has no defined performance measures or targets.
The business may collect plenty of operational data, but without agreed KPIs, management cannot tell whether the process is improving, deteriorating, or performing within an acceptable range.
Example:
A warehouse tracked dispatch times in its ERP system but had no defined target for on-time dispatch.
As customer complaints increased over several months, management could not determine when performance started to decline or how far it had fallen below an acceptable level. The data was available, but there was no KPI to turn it into a clear management signal.
Business impact:
Without process KPIs, management relies on anecdotal feedback rather than early warning indicators.
Process degradation is invisible until it hits the P&L. Cycle-time delays, error rates, and exception volumes are some indicators.
How to detect it:
For each core process, define one cycle-time metric, one quality metric, and one cost metric.
Depending on the process, this could include purchase order cycle time, invoice error rate, collection days, inventory accuracy, exception volume, or cost per transaction. Identify deterioration while there is still time to correct it, rather than waiting for the P&L to reveal the problem.
If you cannot report these monthly, you are not monitoring the process.
Failure 8: Inadequate Risk Assessment
This failure occurs when process-level risks are not formally identified, assessed, and linked to specific controls.
A company may have an enterprise risk register, but it may not necessarily show what could go wrong within procurement, revenue, inventory, treasury, or other critical processes and which controls address those risks.
Example:
A pre-IPO SaaS company in Bengaluru had a documented risk register at the enterprise level but no process-level risk assessment. When its auditors tested revenue recognition controls, they found that the risk of incorrect revenue timing had never been mapped to a specific control.
The company had no control designed to address it. This surfaced as a significant deficiency during due diligence.
Business impact:
Without a clear risk-to-control linkage, audit resources may focus on routine, low-risk activities while material exposures receive insufficient attention.
Management also struggles to demonstrate why particular controls exist, whether they address the right risks, and where additional controls are needed.
How to detect it:
Select the three highest-risk processes and request the risk-control matrix (RCM). For each material risk, verify that there is a specific control, an identified control owner, defined frequency, and a method for testing whether the control works.
Then ask when the risk assessment was last updated and whether recent business changes, such as new plants, products, systems, regulations, or acquisitions, were considered.
If the risk register exists but does not influence audit priorities or connect risks to specific controls, the assessment is incomplete.
Failure 9: No Continuous Monitoring
Continuous monitoring is missing when key controls are tested only during the annual audit, with no regular review to confirm that they continue to operate throughout the year.
A control can be well designed and effective at year-end but fail months earlier because of staff changes, system updates, or process changes.
Example:
A ₹1,200-crore textile manufacturer had strong procurement controls at the time of its annual audit. By the time the next audit came around, three approvers had left, two had been given additional system access, and the three-way match control had been disabled during an ERP upgrade and never re-enabled.
None of this was detected for eleven months. The company’s statutory auditor was required to report on IFC operating effectiveness under Section 143(3)(i), but the testing happened only during the year-end audit window.
Business impact:
Annual testing means control failures persist for months. In fast-growing companies, process changes happen continuously.
The longer a control operates without review, the greater the potential impact when something goes wrong.
How to detect it:
For each key control, compare the monitoring frequency with the transaction volume and risk of the process.
Annual testing may be reasonable for some low-risk activities, but high-risk, high-volume controls such as vendor master changes, bank reconciliations, access rights, and payment approvals generally warrant more frequent monitoring.
Establish monthly or quarterly monitoring for critical controls, with clear ownership within the process and documented escalation of exceptions. Internal audit should provide independent assurance, but it should not be the only function checking whether important controls continue to work.
Failure 10: Vendor Process Blind Spots
Vendor process blind spots occur when you apply strong controls to your internal processes but give limited scrutiny to critical third parties.
Vendor onboarding, compliance checks, performance monitoring, and exit planning may be treated as procurement activities rather than as part of the company’s broader risk and control environment.
Example:
A manufacturer relied on a single supplier for a critical component and selected the vendor primarily on price and sample quality. It did not assess the supplier’s financial resilience or maintain a qualified backup.
When the vendor experienced financial difficulties and stopped supplying, production was disrupted while the company searched for, assessed, and approved an alternative supplier.
Business impact:
Weak vendor controls can lead to supply disruption, quality failures, fraud, data or compliance exposure, unexpected costs, and weak contractual protection.
The risk is particularly high where a business depends on single-source suppliers or vendors handling critical data, payments, or regulated activities.
How to detect it:
Select the top five vendors by spend or business criticality. Check whether each has undergone documented onboarding, compliance and financial due diligence, performance review, contract review, and risk reassessment within the appropriate period. For critical single-source suppliers, also ask whether a viable alternative has been identified and periodically validated.
A vendor contract is not the end of the control process. For critical third parties, ongoing monitoring is as important as initial due diligence.
Failure 11: Compliance Documentation Gaps
This exists when statutory obligations may be completed correctly, but the company cannot quickly produce complete, consistent evidence showing what was filed or paid, when it was completed, who reviewed it, and who was responsible.
Records scattered across emails, spreadsheets, local offices, and individual employees create a control weakness that can be avoided.
Example:
A logistics company operating across states was managing GST filings, TDS deductions, and PF/ESI compliance through email reminders to a shared inbox. During a process audit, it was found that TDS returns for two quarters had been filed late in three states.
The late filing penalties amounted to ₹6.4 lakh, but the bigger issue was that the company had no evidence trail showing who was responsible for which filing. When the audit committee reviewed compliance under its SEBI LODR mandate, it could not demonstrate that the company’s systems for ensuring compliance with applicable laws were adequate and operating effectively, as required under Section 134(5)(f).
Business impact:
Missing documentation can delay due diligence, increase audit effort, weaken lender and investor confidence, and create penalties or regulatory exposure where evidence itself is a requirement.
It also makes management oversight difficult because there is no reliable view of compliance across locations.
How to detect it:
Select one compliance category, such as PF, GST, or TDS, and request twelve months of records across all relevant locations. Measure how quickly the business can produce a complete, consolidated evidence pack.
Check that each item identifies the obligation, due date, completion date, responsible owner, reviewer, and supporting evidence.
If routine compliance evidence takes several days to assemble or depends on individual employees searching through emails and local files, the documentation process has a control gap. A central compliance calendar, named owners, escalation triggers, and a structured evidence repository can close it.
Failure 12: Ineffective Remediation
This is a failure when audit findings are acknowledged but the underlying problem is not actually fixed.
Corrective actions may be discussed or recorded, yet no one is clearly accountable for implementation, deadlines are missed, or completed actions are never independently re-tested.
Example:
A diversified manufacturing group had received the same audit observation about cycle counting gaps for three consecutive years. Each year, the internal audit report noted the issue. Each year, the operations team acknowledged it.
No one was assigned ownership of the fix, no deadline was set. By the fourth year, the accumulated inventory write-offs from undetected shrinkage had crossed ₹3 crore.
The NFRA’s 2024-25 report found the same pattern at listed-company level: auditors identified issues, but the control breakdowns persisted across multiple years because no one fixed them.
Business impact:
Recurring findings can result in inventory losses, control failures, regulatory exposure, and unnecessary audit costs. They also weaken the confidence of the audit committee and board in management’s ability to resolve identified weaknesses.
More importantly, a pattern of repeat findings suggests that the organisation is treating symptoms rather than addressing the root cause.
How to detect it:
Compare the current audit report with the previous two cycles and identify repeated findings. For every open observation, check for a named owner, specific corrective action, target completion date, evidence of implementation, and scheduled re-test.
A management comment such as “process will be strengthened” is not remediation. A finding is closed only when the corrective action has been implemented and there is evidence that the control now works as intended.
How to Build a Process Audit Program
A process audit program that actually identifies failures needs four things in place before starting fieldwork:
1. A risk-based scope
Instead of auditing every process equally each year, rank processes based on what could go wrong and the potential impact.
Use factors such as actual risk indicators, transaction volumes, previous findings, and regulatory exposure rather than convenience or past practice. This directly addresses Failure 8 and is the biggest lever for making a limited audit budget focus on what matters most.
2. Clear standards to audit against
An audit can only determine whether a process is working as intended when that intended process is documented clearly enough to test.
If an SOP does not exist, creating one should be the first audit output rather than something the audit waits for.
3. A named owner and a re-test date for every finding
A corrective action alone is not enough. Every finding should have someone responsible for fixing it and a specific date for checking whether the fix worked and remained effective.
Without this, unresolved issues can become the source of Failure 12. The audit committee or the leadership team where no formal committee exists, should maintain these items as a live action tracker rather than simply filing a report after each audit cycle.
4. An audit frequency based on risk
High-volume, high-risk processes such as cash disbursements, vendor master changes, manual journal entries, and warrant checks should be reviewed between formal audit cycles. This directly addresses Failure 9. Lower-risk and stable processes can reasonably be reviewed less frequently.
Starting by identifying the three processes most likely to contain one of the twelve failures.
These are usually processes with repeated findings, locations that operate differently from others, or processes that have never been formally reviewed. Test these first instead of trying to achieve full coverage in a single audit cycle.
PKC’s Approach
Now the question really is: Your internal audit team already tests controls every year. What would an external process audit find that they have not?
Your internal audit team is incompetent, but they do have a structural constraint: independence.
If your internal audit function reports to the CFO, and the CFO owns the processes being audited, the audit can test whether controls exist. It cannot challenge whether the process itself is designed correctly. The person who designed the process is not the best person to audit it. That is the gap a process audit fills.
PKC’s process audit methodology for mid-to-large enterprises follows a defined nine-step methodology:
- Setting clear review objectives
- Collecting internal data before fieldwork begins
- Interviewing the people who actually perform each process rather than only their managers, mapping the process as it runs in practice
- Measuring it against defined KPIs
- Classifying each gap by severity and root cause
- Building a specific remediation plan against each finding
- Presenting the report in a form the audit committee or leadership team can act on directly
- Following up to confirm each fix actually held.
PKC scopes a pilot across two processes and two locations over four to six weeks. The parallel-run cycle, where the new control design runs alongside the old process before full rollout, typically lasts one reporting quarter.
This gives the finance team time to validate that the redesigned controls produce reliable data before they become the standard. PKC’s IFC audit practice has designed and tested over 300 key controls across financial-reporting cycles for a listed mid-cap, documented complete RCMs enabling clean Section 134(5)(e) assertions, and identified 40+ control gaps with prioritised remediation roadmaps for pre-IPO companies.
If audit findings at your company have started to look familiar from one cycle to the next, or you suspect process execution varies more across locations than anyone at head office can confirm, Schedule a Process Audit Consultation with PKC to discuss what a process audit built around your specific operations would look like.
FAQs
How long does a process audit take for a mid-to-large company in India?
A focused process audit covering two to three core processes across multiple locations typically takes 6-10 weeks from scoping to final report. The timeline depends on the number of locations, the complexity of the ERP environment, and how quickly internal teams can provide transaction samples. A single-process diagnostic can be completed in three to four weeks.
Is internal audit legally mandatory for my company?
Under Rule 13 of the Companies (Accounts) Rules, 2014, it is mandatory for every listed company, for unlisted public companies meeting specific paid-up capital, turnover, or borrowing thresholds, and for private companies with turnover of ₹200 crore or more, or outstanding bank borrowings above ₹100 crore.
Can a process audit failure trigger a qualified audit report under the Companies Act?
Yes. If a process failure creates a material weakness in internal financial controls, the statutory auditor must report it under Section 143(3)(i). The board must also address the objection in its report under Section 134(5)(e) for listed companies. Failure to do so has resulted in penalties on companies and officers under Section 134(8), with fines ranging from ₹50,000 to ₹25 lakh and imprisonment up to three years.
How often should a company run process audits?
At minimum, once a year for each core process. Companies in fast-growth phases or those preparing for IPO should run them half-yearly, because processes change more frequently. After a major ERP migration or a significant acquisition, a process audit should be run within the first six months.
What is the most common process audit failure in Indian mid-to-large companies?
Weak segregation of duties. In multi-location companies, the pressure to keep headcount lean at each site often leads to one person holding multiple incompatible roles. This is also the failure most likely to result in fraud and the hardest to remediate without system-level role redesign.
