Your audit committee gets five findings reports this quarter, one from each group company, written in five different formats, using five different risk ratings, by four local audit firms and one Big 4 team covering the flagship entity. 

Then the same procurement-to-payment gap surfaces in Maharashtra, Gujarat, and Bengaluru, described differently, used a different risk rating, and proposed a different remediation timeline.

This is the specific problem multi-entity process audit standardisation needs to solve. Learn with us what standardisation actually requires, where groups commonly get it wrong, and how PKC approaches this with a three-phase framework designed for mid-cap groups that need Big 4 quality rigour without their hefty fee structures.

The Multi-Entity Audit Problem

For many multi-entity groups in India, the audit function evolved as the business grew rather than being designed as a group-wide system. A promoter-led manufacturing group may acquire a packaging unit, add a trading subsidiary, and later establish an overseas step-down subsidiary. 

Each entity has its own finance head, its own local auditor, and its own way of documenting controls. The group internal audit team of 3-8 people, is expected to cover all of them.

The problem is not just limited audit capacity. Without a common framework, adding more people or auditors can produce more reports without producing a clearer view of group risk. 

One entity may use a RCM, another a checklist, and a third a methodology designed for a different regulatory environment. Risk ratings, process definitions and control terminology then vary across entities, making group-level reporting difficult.

Three problems follow:

1. Risk ratings are not comparable: A “high” finding at one entity may be treated as “medium” elsewhere because there is no common severity scale.

2. Group-wide control failures remain fragmented: A weak segregation of duties in vendor master management across three subsidiaries may appear as three unrelated findings instead of one recurring group-level risk.

3. Consolidated reporting becomes manual: Management and the audit committee may need to reconcile multiple reports before they can determine where the group’s most significant exposures actually sit.

This becomes more important as regulatory and stakeholder expectations increase.

Section 143(3)(i) of the Companies Act, 2013 requires reporting on the adequacy and operating effectiveness of internal financial controls for applicable companies, while CARO 2020 includes reporting requirements relating to internal audit systems.

For groups, consistent documentation and visibility across entities can therefore become important inputs into statutory audit and governance processes.

The issue also has a direct cost impact. Running several independent audit relationships means repeating risk assessments, process walkthroughs, control documentation and onboarding across entities. If three subsidiaries operate substantially similar procure-to-pay or order-to-cash processes, treating each audit as a completely separate exercise means valuable work is repeatedly recreated rather than reused.

The problem often becomes visible when a board member, lender or investor asks a group-level question: Which entity currently has the highest unresolved process risk? Are similar control failures appearing across subsidiaries? Has a previously closed finding reappeared elsewhere? 

If answering requires manually comparing several audit reports, the group does not have a standardised audit system.

PKC’s Three-Phase Standardisation Framework

PKC’s multi-entity audit standardisation follows a simple principle: the group audit function sets the audit and reporting approach, while entity teams execute it within that framework.

The framework usually takes 12 to 16 weeks, followed by ongoing governance. We don’t impose a single checklist on every subsidiary. Instead, we establish common definitions for the audit universe, risk taxonomy, control expectations, testing and reporting, while allowing procedures to reflect differences in business models, locations and regulatory requirements.

For mid-cap groups, PKC offers a specialist alternative to Big 4 firms. You get partner-level attention, a framework built for 6 to 12 entities, not 60, and fees that reflect mid-market scale, without the layered teams or template-driven approach.

It is done in three phases. The diagnostic phase establishes the baseline, the design phase creates the group-wide methodology, and the execution phase embeds it across entities.

Phase 1: Diagnostic and Baseline Mapping

The diagnostic phase answers: what is actually being audited across the group today, and how consistent is it?

We begin by reviewing existing audit plans, Risk and Control Matrices, previous audit reports, management responses, remediation trackers and process documentation across each entity. The aim is to identify differences, gaps and practices that can be standardised or adopted more widely.

In a mid-cap group with 8 to 12 entities, the diagnostic surfaces three patterns:

Process coverage is uneven:

The parent company may have a detailed RCM covering hundreds of risk-control pairs, while a recently acquired subsidiary may rely on a short checklist prepared by its local auditor. Important processes can therefore remain outside the group’s regular audit universe.

Risk ratings are difficult to compare:

One entity may classify a control failure as high risk while another rates a similar issue as medium because different auditors use different scoring criteria. Existing findings therefore cannot provide a reliable group-wide risk view without being mapped to a common methodology.

Control ownership is unclear:

Documentation may identify a designation rather than a responsible individual, refer to an employee who has left, or fail to distinguish between process ownership and control ownership. This makes remediation difficult to track and accountability harder to establish.

PKC’s diagnostic also maps the regulatory perimeter. This may mean: 

• Mapping GST compliance controls across locations for groups with entities in different states. 
• Identifying where Indian IFC requirements interact with local statutory audit requirements for groups with overseas subsidiaries. 
• Identifying sector-specific controls that must be included in the common audit universe for groups in regulated sectors like pharma, healthcare, infrastructure.

The output of Phase 1 is a baseline report that shows, entity by entity, which processes are covered, which controls are documented, how risks are rated, and where the gaps are. 

We also identify what the group is already doing well. Some entities may have stronger documentation than the parent. Some may have automated controls that the group has not leveraged. 

The diagnostic captures these as candidates for group-wide adoption rather than assuming the parent’s approach is the default.

Phase 2: Common Audit Universe Design

The design phase creates the group’s common audit universe which is a single framework that defines which processes are audited across all entities, which risks are material to the group, and which controls must operate consistently everywhere.

This is also where most standardisation efforts fail because the common instinct is to build a comprehensive RCM that covers every possible risk at every entity. The result is a 500-page document that no one uses. 

PKC’s approach is to design for materiality and comparability, not exhaustiveness.

The common audit universe starts with core processes that apply across most or all entities. For an IT or services group, it may prioritise revenue recognition, resource management, subcontractor payments and information security. For a manufacturing group, these may include procure-to-pay, order-to-cash, inventory, fixed assets, payroll, treasury and financial close. 

Entity-specific processes are then added where the business model requires them. The specific processes differ by industry, but the design principle is consistent: start with what every entity must have, then add what specific entities need.

Controls over cash, bank access, vendor master changes, manual journals and segregation of duties may belong in the core framework across entities. Production planning controls, however, would only apply to manufacturing entities. A trading subsidiary may require different inventory or revenue controls. Overseas entities may also need additional controls to address local regulatory requirements.

We build the framework with defined local extension points. Entities can adapt procedures to their operations, but any deviation from the common framework is documented and approved by the group audit function. This avoids both over-auditing smaller entities and under-scoping entities simply because they are smaller or have lower audit budgets.

Standardising Risk and Control Definitions

The common framework also establishes a shared risk taxonomy, severity scale and scoring methodology. For example, the group may define 3-5 impact categories and 3-4 likelihood categories, with clear criteria for assigning each rating.

This is important because a “high” risk should have the same meaning across the group. A significant vendor control weakness at a ₹200 crore subsidiary should be assessed using the same principles as a similar weakness at an ₹1000 crore parent company.

PKC also creates a shared control library for recurring processes such as procurement, payroll, cash and banking, and fixed assets. Instead of each entity describing the same segregation-of-duties control differently, the library provides a standard reference description covering the control objective, owner, frequency, evidence and associated risk. The entity can then adapt the procedure to its systems and operating model without losing comparability.

Standardising Audit Reporting

The same principle applies to reporting. We help you establish a standard audit report structure covering the entity, process, risk, control tested, test result, root cause, management response, action owner and remediation timeline.

Because entity-level findings use common definitions and fields, they can be consolidated into a group audit dashboard without manually reconciling different report formats. Management and the audit committee can then identify repetitive control failures, compare risk across entities and distinguish isolated issues from group-wide patterns.

You get a framework that gives the group one audit methodology without requiring every entity to operate identically. That balance makes standardisation practical across diverse subsidiaries.

Phase 3: Centralised Execution with Local Adaptation

This is where we test whether the methodology works across different entities, systems and operating environments without losing consistency.

PKC uses a hub-and-spoke model. The group audit function acts as the hub, owning the common audit universe, risk taxonomy, testing methodology, documentation standards and reporting format. Entity-level teams or local auditors act as the spokes, carrying out fieldwork within that framework. The group retains responsibility for quality review and consolidated reporting.

This model addresses a specific pain point for mid-cap groups: the group audit team cannot physically audit 10 entities across six states. But it can define what good looks like, train entity-level teams to execute against that standard, and review their outputs to ensure consistency.

PKC supports the execution phase in three ways. 

1. Provides audit programme templates for each core process, with standardised test procedures that entity-level teams can execute without requiring senior audit judgment on every test. 
2. Runs training sessions for entity-level finance and audit teams, typically two to three days per process cluster, covering the RCM, the test procedures, the evidence requirements, and the documentation standards.
3. Conducts quality reviews of a sample of entity-level audit outputs in the first cycle, identifying where the standard is not being applied correctly and providing corrective guidance.

The technology layer is important here. PKC deploys audit management workflows that allow entity-level teams to log findings, attach evidence, and submit reports through a common platform. 

This eliminates the email-and-spreadsheet coordination and also gives the group audit function real-time visibility into audit progress across entities, rather than waiting for end-of-cycle consolidation.

One of the most common questions from group audit heads is how to handle entities that do not have dedicated audit staff. For smaller subsidiaries or recently acquired entities, PKC’s model allows the group audit function to conduct the audit directly using the standardised programme, with local finance teams providing process walkthroughs and evidence. This keeps the standard consistent without requiring the entity to build audit capacity it does not need.

The first execution cycle usually takes 10 to 12 weeks from kick-off to consolidated reporting. By the second cycle, most groups find that entity-level teams have internalised the standard and can execute with minimal group intervention. 

The group audit function shifts from coordination to analysis: reviewing consolidated findings, identifying cross-entity patterns, and preparing the audit committee report.

Governance and Reporting Structure

Standardisation only works when governance makes the common framework the default. Without clear ownership, entities can gradually return to their previous audit methods, recreating the fragmentation the framework was designed to address.

PKC helps establish a Group Audit Council, usually chaired by the Group Head of Internal Audit or Group CFO, with representation from relevant entity finance leaders and, where appropriate, the statutory auditor. The Council meets quarterly and oversees changes to the common audit universe, reviews consolidated findings, and approves material entity-specific adaptations.

At the centre of the reporting structure is a consolidated findings register. Every entity’s findings are recorded against the common risk scale established in Phase 2, with a named owner, remediation deadline and re-test date. Where the same control weakness appears across multiple entities, it is identified as a group-wide pattern rather than reported as separate local findings.

The group audit function then prepares a consolidated report for the Audit Committee, or for the CFO or promoter-led leadership team where a formal committee does not exist. The report highlights risk distribution, recurring findings, remediation status, control failures affecting multiple entities and significant outliers.

Reporting is generally quarterly, supported by a lighter monthly update covering open high-risk findings, overdue actions and upcoming re-tests. This avoids repeatedly presenting the same information while maintaining visibility between formal reviews.

Escalation rules are defined upfront. High-risk findings can be escalated to the Group Audit Council within a specified timeframe, while issues affecting multiple entities trigger a group-level root cause review. This prevents the same weakness from being identified repeatedly without a coordinated response.

Follow-up is equally important. PKC’s re-testing confirms whether corrective action has actually resolved the control weakness, including at other entities where the same control should exist. This turns audit reporting from a record of past findings into an ongoing group-wide control monitoring system.

For groups subject to consolidated financial reporting and group audit procedures, a consistently documented internal audit trail can also provide more structured information to the statutory auditor when evaluating component-level controls and audit work.

Technology Enablers We Deploy

Technology helps audit standardisation by making a well-designed framework easier to execute, monitor and maintain across multiple entities. At PKC we use three technology capabilities to support this.

Centralised Audit Management

A shared audit management workspace brings the common RCM, process documentation, audit programmes, evidence, findings and remediation status into one environment. Entity-level teams can complete their assigned work while the group audit function maintains visibility across the entire group.

The system also supports consistent documentation and reporting. Findings are recorded using the common risk categories, severity definitions and reporting fields established during Phase 2. The group can therefore see which entities have completed specific audits, where findings are concentrated and which remediation actions remain open without manually combining separate spreadsheets.

RCM Version Control

The common RCM needs to remain current as processes, systems and regulations change. PKC uses version control to document changes, identify affected entities and maintain approval records before an updated control framework is adopted.

This prevents one subsidiary from operating against an updated control while another continues using an outdated version. It also creates a clear audit trail showing when the framework changed and why.

Data Analytics for Control Testing

For high-volume processes such as procure-to-pay, order-to-cash and financial close, data analytics can supplement traditional sample-based testing. Depending on data availability and control objectives, PKC can analyse complete transaction populations to identify exceptions such as duplicate payments, segregation of duties conflicts, unusual journal entries, duplicate vendor records or transactions outside defined approval thresholds.

Where entities use different ERP systems, analytics can work from standardised data extracts rather than requiring every subsidiary to adopt the same technology platform. This allows the group to apply consistent analytical tests even when its underlying systems differ.

The technology layer also supports role-based access. Entity teams can work with their detailed records and the common framework, while the group audit function and audit committee can access consolidated views across entities.

Remember, the technology supports the framework and does not replace it. A dashboard built on inconsistent risk definitions simply makes fragmented auditing faster. The audit universe, risk taxonomy, control standards and reporting rules must come first. Technology then helps preserve that consistency as the group grows, systems change and new entities are added.

Case Example: Mid-Cap Indian Group

Let’s take a look at an example of the kind of engagement PKC commonly encounters.

Problem:

A mid-cap Indian manufacturing group with ₹1000 crore consolidated turnover has eight entities: the parent manufacturing company, three manufacturing subsidiaries in different states, a trading subsidiary, a logistics subsidiary, an overseas trading entity, and a recently acquired packaging unit. 

The group internal audit team has four people. Each entity has its own audit arrangements, mostly through local chartered accountants, and the group has no common audit universe.

The audit committee had flagged a recurring issue: procurement control weaknesses were being reported by multiple entities, but the group could not determine whether these were isolated incidents or a systemic control design failure. The group CFO estimated that the audit function was spending 60% of its time on coordination and reconciliation, and only 40% on actual audit analysis.

PKC’s Process Audit Standardisation Framework

In such a scenario, PKC would run its three-phase framework over the next few weeks. 

The diagnostic phase would map existing audit documentation across all eight entities and identify that the parent company had a 220-line RCM covering 12 processes, while the recently acquired packaging unit had a 35-line checklist covering 4 processes. The three manufacturing subsidiaries had RCMs prepared by their statutory auditors, with no common risk taxonomy.

The design phase produces a common audit universe covering 10 core processes, a standardised five-point risk rating scale, and a standard audit report format. Entity-specific extensions were approved for the overseas entity (local statutory audit requirements) and the trading subsidiary (revenue recognition controls specific to trading operations).

The execution phase trains 16 entity-level finance and audit personnel across three regional clusters. The first audit cycle covered all eight entities against the common framework. The group audit function reviewed 100% of high-risk findings and 25% of medium-risk findings for quality and consistency.

Result:

The outcomes, measured over 18 months, includes a reduction in audit cycle time from 16 weeks to 10 weeks, a 40% reduction in group audit coordination time, and most importantly the identification of a common root cause behind the procurement control weaknesses: the group’s ERP system had different approval workflow configurations across entities, and three entities had no automated three-way match control. This is a group-level control design issue that was never visible when audits were conducted entity by entity.

The group’s statutory auditor also benefited. For the first time, the group could provide a consolidated IFC documentation pack covering all entities, with consistent risk ratings and control descriptions. The statutory auditor reduced the additional procedures previously required to form the group IFC opinion.

How to Get Started

The starting point for multi-entity audit standardisation is a scoping decision: which processes, which entities, and which risks are in scope for the first cycle.

For groups starting this process, we recommend focusing on three to four important processes that are common across most entities and carry a higher risk of financial misstatement. For example, in a pharma group, these could include procurement, sales and revenue, inventory management, and financial reporting and close.

The first audit cycle should cover all entities for these processes. However, the level of testing can be adjusted based on the size, risk profile, and maturity of each entity. Smaller or recently acquired entities may require a lighter approach initially.

The next step is to establish clear governance. The group should decide who will own the common audit framework, who can approve changes for individual entities, and how significant findings will be reported and escalated. This approach should be approved by the Audit Committee, as it sets the overall direction for IFC assurance across the group.

The third step is deciding who will carry out the audits. Groups with a strong internal audit team can manage the execution internally, with PKC supporting the framework design, methodology, and training. Groups with limited internal resources can use PKC’s audit teams for entity-level execution while keeping overall ownership within the group.

The right approach will depend on the group’s internal capabilities, number and location of entities, and the regulatory requirements applicable to the business.

PKC has supported mid-large Indian groups across manufacturing, pharma, logistics, and other sectors in standardising multi-entity audits. A common factor in successful implementations is strong central ownership. The group defines the audit standard centrally and ensures that entity-level teams follow it, rather than allowing each entity to develop its own approach.

If your group is preparing for an Audit Committee review, a statutory audit IFC assessment, or the next phase of SA 600 implementation, and your audit documentation is currently spread across different entities, a diagnostic review is a good place to start.

The diagnostic helps you understand what is already in place, identify gaps, and assess the group’s overall risk exposure. From there, you can build a consistent and practical audit framework across entities.

Talk to a PKC Process Audit Specialist to discuss your group’s audit standardisation requirements.

FAQs

Does standardising process audits across entities require replacing our existing auditors?

No, standardisation is about the internal audit framework: the audit universe, risk taxonomy, testing methodology, and reporting format. Your entity-level statutory auditors continue their work. What changes is that internal audit outputs follow a common standard, which makes them more useful to the group audit function and to the statutory auditor’s IFC assessment.

How long does a multi-entity standardisation implementation take?

An engagement may take 12 to 16 weeks from kick-off to first-cycle completion. The diagnostic phase takes 4 to 5 weeks, the design phase 3 to 4 weeks, and the execution phase 5 to 7 weeks. Groups with more entities or more complex regulatory requirements may need additional time for the design and training phases.

Can we implement this with our existing internal audit team of four people?

Yes, with the right execution model. The group audit team owns the framework and reviews outputs. Entity-level execution can be handled by local finance teams using standardised audit programmes, or by PKC’s audit teams where entity-level capacity is limited. The key is that the group audit function retains ownership of the standard.

What is the cost of a multi-entity standardisation engagement?

The cost depends on the number of entities, the complexity of the regulatory environment, and the execution model. Most mid-cap groups with 6 to 12 entities find that the engagement cost is recovered within the first audit cycle through reduced coordination time, faster audit cycles, and fewer additional procedures required by the statutory auditor for group IFC assessment.

Do we need to deploy new software for this?

Not necessarily in the first cycle. The framework can be implemented with structured templates and a shared reporting format. For groups with more than 10 entities or multiple locations, an audit management platform becomes useful for real-time tracking and consolidation. PKC can advise on the technology layer that fits the group’s scale and existing systems.