Your audit committee meeting is next month, but your internal audit plan looks almost identical to last year’s despite adding two subsidiaries, entering a new export market, and migrating your ERP to the cloud.

Many CXOs often find themselves in a similar situation. The audit function kept pace with revenue growth in headcount, not in focus, and the checklist it uses still reads like the one built when the company was a third of this size.

This is a leadership-level scoping issue. At ₹500 crore and above, internal audit needs a mandate aligned with the enterprise’s growing complexity.

This is a practical checklist for CXOs to identify which process risks deserve attention at this scale, followed by a 30-60-90 day plan for the internal audit head.

Why Scale Changes Audit Priorities

A ₹50 crore company audits for existence, a ₹500 crore company audits for resilience.

As companies grow, they tend to add locations, business units, vendors, shared services, technology systems, and regulatory obligations. The audit challenge therefore changes from checking whether basic controls exist to testing whether those controls remain effective across a more complex organisation.

The risks that were important at a smaller scale do not disappear. Approval controls, reconciliations, statutory compliance, and financial reporting remain essential. But at larger companies, a second layer of risk becomes more important. Now you must check whether processes work consistently across locations, systems, subsidiaries, and third parties.

A control failure at one plant can affect consolidated financial reporting. A weakness in a subsidiary’s vendor onboarding process can create group-level compliance or related-party risks. A failure in a shared IT system can disrupt operations across multiple business units. These risks may not be visible when each entity or department is audited independently.

This is why a large-company process audit checklist is not just a longer version of a small-business checklist. It needs to examine the controls that hold the organisation together. That can include cross-location process consistency, consolidated reporting, IT and access controls, third-party risk, regulatory compliance, and group-level risk governance.

The checklist we share below focuses on seven priorities that become increasingly important as organisational scale and complexity increase. Each priority explains what to check and why it is important at this level. 

Priority 1: Statutory and Regulatory Compliance

At ₹500 crore+ your compliance obligations go just beyond filing returns on time. They now include board-level attestations, expanded disclosure requirements, and personal liability for officers in certain cases.

The audit therefore needs to test whether compliance obligations are identified, assigned, monitored, and supported by evidence.

What to Audit

• Internal financial controls: Test whether the controls supporting management and statutory reporting are actually operating as designed. Section 143(3)(i) requires the statutory auditor to report on the adequacy and operating effectiveness of internal financial controls, where applicable.
• CARO 2020 readiness: Review applicable reporting requirements and whether internal audit findings and other control observations are being addressed.
• Related-party transactions (RPTs): For listed entities, test whether the RPT identification, approval, documentation, and disclosure process reflects current SEBI requirements, including the information required for Audit Committee and shareholder review.
• Multi-state compliance: Test GST, TDS, labour law, licences, and other applicable filings across every state and entity, rather than relying on controls at the registered office.
• Corporate compliance: Review applicable requirements covering auditor appointments and rotation, Board reporting, statutory registers, disclosures, and other Companies Act obligations.
• POSH & Maternity Benefit Disclosures: The Companies (Accounts) Second Amendment Rules, 2025, effective July 2025, require companies to include specific disclosures on Prevention of Sexual Harassment (POSH) compliance and maternity benefit compliance in the Board’s report.

Compliance gaps at this size usually arise because business complexity has outgrown the systems tracking those rules. A company that has expanded from three to eleven states may still rely on the same compliance team, spreadsheets, and review process.

The audit should therefore test whether every material requirement has a named owner, defined control, evidence of completion, escalation mechanism, and corresponding audit test. If a requirement exists only on a compliance calendar, without evidence that the underlying control actually works, that is the gap to investigate.

CXO Check: Ask the audit head to map major statutory and regulatory obligations to their owners, controls, evidence, and audit tests. Any requirement without a clear control or testing approach deserves immediate attention.

Priority 2: Process Standardisation Across Locations

For multi-location operations, the same process may vary across sites, creating an audit challenge. For example, a purchase order approval may take 3 days at head office but 11 days at a plant due to differences in systems, approval levels, staffing, or local workarounds.

PKC’s process audits of multi-plant enterprises consistently find that such variations are often unintended, emerging after system rollouts, acquisitions, leadership changes, or rapid growth. Over time, sites may develop different versions of the same process while following local procedures.

The audit priority is to assess whether the group has a common process standard and whether deviations are approved, documented, and risk-assessed.

What to Audit

• Process consistency: Compare how the same process is documented and executed across plants, branches, and business units.
• Common risk and control matrix: Check whether a group-wide RCM exists for key processes, rather than each location maintaining a separate version with different controls or risk ratings.
• System configuration: Compare ERP workflows, approval limits, user roles, and other system settings that may cause the same process to operate differently across locations.
• Local workarounds: Identify spreadsheets, manual approvals, offline registers, or other practices introduced to compensate for system or process gaps.
• Cross-location findings: Where a control failure is identified at one site, check whether the same risk exists at other locations operating the same process.
• Performance differences: Compare cycle times, exception rates, overdue items, manual interventions, and control failures across locations to identify unexplained variations.
• Group reporting: Where subsidiaries or other entities contribute to consolidated reporting, assess whether differences in underlying processes create additional reconciliation, review, or reporting risk. Section 129 requires companies with subsidiaries or associates to prepare consolidated financial statements in the prescribed manner.

With large Indian companies, the real risk is inconsistency. Each site may pass its audit, while the group lacks a consistent control environment.

This extends to group-level financial oversight. NFRA has addressed responsibilities in group audits and the relationship between principal and other auditors, reinforcing the need for effective oversight of component-level audit work.

Internal audit should therefore compare the same processes across locations, covering cycle times, exceptions, manual interventions, control failures, and approval practices. The goal is to distinguish it from uncontrolled deviations that increase risk.

CXO Check: Commission a process standardisation audit that covers one core process across all locations. Use the findings to build a common process definition before extending the audit to other processes.

Priority 3: Internal Financial Controls

Internal financial controls are part of the operating framework that supports reliable financial reporting. At ₹500 crore+ scale, the audit priority is to determine whether the IFC framework remains current, properly configured, and effective in practice.

What to Audit

• Risk and Control Matrix: Check whether the RCM reflects the current business. New revenue streams, ERP modules, subsidiaries, acquisitions, products, or significant process changes should trigger a review of the relevant risks and controls.
• Segregation of duties: Test whether one person can initiate, approve, process, and record the same transaction across cash, procurement, vendor management, and other financially sensitive processes.
• ERP access rights: Compare actual user roles and system privileges with the current approval matrix. Pay particular attention to employees who have changed roles, transferred between locations, or retained access that is no longer required.
• Manual journal entries: Review controls over manual and unusual journal entries, particularly period-end adjustments and entries that bypass normal workflows. SA 240 specifically addresses journal entries and other adjustments in the context of management override risk.
• Master data changes: Test controls over vendor masters, customer masters, pricing, bank details, and other changes that can directly affect financial transactions.
• Financial close controls: Review account reconciliations, intercompany balances, journal approvals, consolidation adjustments, and other controls that operate during the financial close rather than simply checking whether the close was completed on time.
• Change management: Check whether changes to ERP configuration, workflows, interfaces, and financially significant master data are authorised, tested, documented, and independently reviewed where appropriate.

Section 143(3)(i) requires the statutory auditor, where applicable, to report whether the company has adequate internal financial controls and whether they operate effectively.

The risk is that controls may fall behind the business. New subsidiaries, ERP modules, approval structures, or transaction flows can be introduced while the original RCM remains largely unchanged. ERP access creates a similar risk when employees change roles, gain additional privileges, or retain access after moving functions, weakening segregation of duties.

The financial close should also be assessed for control quality, not just speed.does not prove effective controls if key reviews occur retrospectively. The main audit question is: does the live control environment still match the business it is meant to control?

CXO Check: Request an IFC health check that tests the RCM’s currency, the SoD configuration in the ERP, and the financial close controls. Treat the output as a remediation plan, not a compliance certificate.

Priority 4: Vendor and Third-Party Risk

Your vendor base is an extension of your risk surface. At this scale, you likely have hundreds of active vendors, some of whom have access to your systems, your data, or your production schedules. 

The audit priority is to test whether vendor risk is managed by process or by exception.

What to Audit

• Vendor onboarding: Check whether new vendors undergo due diligence proportionate to their risk, including financial stability, ownership, compliance, capability, and business continuity considerations where relevant.
• Approved vendor status: Review whether the Approved Vendor List reflects current qualification and risk status, rather than simply carrying forward vendors approved several years earlier.
• Periodic re-qualification: Test whether critical and high-risk vendors are reassessed at defined intervals and whether changes in financial condition, ownership, performance, compliance, or operating capability trigger additional review.
• Contract compliance: Review major vendor contracts for service levels, responsibilities, confidentiality and data protection provisions where applicable, audit rights, business continuity requirements, termination provisions, and other material obligations. Test whether these terms are actually being monitored.
• Vendor performance: Check whether performance reviews occur at the agreed frequency and use objective measures such as quality, delivery, service levels, incidents, cost, and compliance.
• Concentration risk: Identify critical inputs, services, or processes dependent on a single vendor or a small number of vendors. Test whether documented contingency, dual-sourcing, alternative-supplier, or continuity arrangements actually exist.
• Third-party access: Where vendors have access to company systems, facilities, or sensitive information, review whether access is appropriately authorised, monitored, and removed when no longer required.
• Related-party exposure: Check whether vendor relationships have been screened against the company’s related-party identification and approval processes, including relevant ownership, directorship, and other relationships.

With large companies the issue is often not a lack of initial vendor due diligence, but that the assessment becomes outdated. A supplier approved as financially stable may later change ownership, deteriorate financially, face compliance issues, or become dependent on a single facility or subcontractor.

Concentration risk is also seen. If one vendor supplies 60% of a critical input or runs a process that is difficult to replace, audit should test the failure scenario: Is there a qualified alternative? Are continuity provisions enforceable? How quickly could the business transition?

Audit should therefore distinguish routine vendors from critical third parties. A low-value office supplier does not need the same scrutiny as a sole-source raw-material supplier, strategic logistics provider, CMO, or technology provider with access to sensitive systems.

CXO Check: Ask for a vendor risk audit that covers the top 20 vendors by spend and the top 10 by criticality. The objective is not to find fault with procurement. It is to find the gaps in the control framework that procurement relies on.

Priority 5: IT and Cybersecurity Process Controls

At this scale, IT controls are no longer simply an IT department responsibility. ERP systems, financial applications, cloud platforms, employee access, vendors, and business-critical data are connected across locations. 

The audit priority thus becomes to test whether the controls protecting these systems actually work, not just that the cybersecurity policies exist.

What to Audit

• Incident response: Test whether the organisation can identify reportable incidents, assign responsibility, escalate them, and meet CERT-In’s six-hour reporting requirement where applicable.
• Log retention: Verify that required ICT logs are maintained for the prescribed period and can be retrieved when needed.
• User access: Review privileged and critical-system access on a defined cycle, including whether access is removed promptly when employees change roles or leave.
• Patch and vulnerability management: Test whether critical vulnerabilities are identified, prioritised, remediated within defined timelines, and independently verified.
• Incident testing: Check whether the incident response plan has been tested through simulations or tabletop exercises, rather than simply approved as a document.
• Data protection: Where applicable, assess readiness for the Digital Personal Data Protection framework, including notice, consent, security safeguards, and breach-response processes. The DPDP Rules were notified in November 2025 with phased implementation dates.
• Regulated-entity requirements: For SEBI-regulated entities, test controls against the applicable Cybersecurity and Cyber Resilience Framework requirements, including areas such as asset inventory, VAPT, patch management, and cyber audits.

The problem is rarely a lack of policy, but it’s unclear ownership as systems, locations, vendors, and users multiply.

The six-hour CERT-In reporting requirement illustrates the issue. An organisation may have a documented incident-response procedure but still lose valuable time deciding whether an event is reportable, who owns the response, or who is authorised to notify the regulator.

The audit should therefore test the process from detection to escalation to remediation, using evidence from actual incidents or simulations. The question is whether the organisation can execute the control quickly when a real incident occurs.

CXO Check: Ensure the annual cybersecurity audit includes technical control testing, not just policy review. Ask for evidence of remediation tracking on prior audit findings, with closure verification.

Priority 6: ESG and Sustainability Reporting

ESG reporting is increasingly becoming a data governance and assurance issue, rather than an annual disclosure exercise. 

BRSR is mandatory for the top 1,000 listed entities by market capitalisation, while BRSR Core assurance has been introduced through a phased rollout extending to the top 1,000 by FY 2026-27.

What to Audit

• ESG data sources: Check whether emissions, energy, water, workforce, safety, and other reported metrics come from identifiable and auditable source records.
• Calculation methodology: Verify that Scope 1 and Scope 2 emissions use documented methodologies, consistent emission factors, and reproducible calculations.
• Data reconciliation: Reconcile ESG information to underlying finance, HR, utility, production, procurement, and operational records where applicable.
• Governance and ownership: Identify who owns each BRSR metric and whether that function has authority to obtain reliable data across departments and locations.
• BRSR Core readiness: For entities within the applicable phase, test whether the underlying processes can support independent assurance rather than relying on a year-end manual compilation.
• Value-chain data: Where applicable, assess how ESG information is obtained, reviewed, and documented for relevant value-chain partners.

For large enterprises ESG reporting becomes harder as data is spread across plants, vendors, HR systems, utility records, and multiple reporting teams. A number can appear reasonable in the final report while having no clear trail back to the underlying source.

The audit question is whether the company can trace a reported figure back to source data, reproduce the calculation, and explain who reviewed it.

CXO Check: Add ESG data governance to the internal audit plan for the current year. Start with the BRSR Core indicators and test data traceability from the disclosed number back to the source record.

Priority 7: M&A and Integration Readiness

Acquisitions create audit risk in two directions: the risks a company inherits and the risks created during integration. At ₹500 crore-plus scale, the internal audit function should be prepared to assess both.

What to Audit

• Acquired-entity controls: Assess the target’s RCM, approval structures, segregation of duties, compliance controls, and reporting processes against group standards.
• IT environment: Review system access, cybersecurity controls, interfaces, data migration, and compatibility with the group’s technology standards.
• Related-party and compliance history: Review historical related-party transactions, regulatory issues, open audit findings, and unresolved control weaknesses that may become group-level risks after acquisition.
• Integration plan: Test whether the integration plan has defined control milestones for finance, ERP migration, access management, processes, and reporting.
• IFC integration: Check whether the acquired entity has been brought within the group’s internal financial control framework within a defined timeframe.
• Accounting controls: For business combinations, review the control environment supporting acquisition accounting under Ind AS 103, including purchase price allocation, valuation of identifiable assets and liabilities, intangible assets, and goodwill.
• Previous acquisitions: Check whether earlier acquisitions were formally integrated or whether legacy processes, systems, and access rights continue years after the transaction.

The most common integration problem is an acquisition that closes successfully but never becomes fully integrated from a control perspective.

Two finance teams may operate under one consolidated balance sheet while continuing to use different approval matrices, ERP roles, RCMs, close procedures, and documentation standards. Consolidated financial statements may still be produced correctly, making the underlying control gap difficult to see.

The audit should therefore test whether integration milestones actually changed the acquired entity’s control environment, rather than simply checking whether the integration plan was completed on paper. A faster financial close, for example, is not an improvement if control reviews were removed to meet the group timetable.

CXO action: If an acquisition is in progress or recently completed, commission a post-acquisition control assessment that covers the acquired entity’s RCM, IT environment, and compliance status. Use the findings to prioritise integration effort.

The 30-60-90 Day Audit Priority Plan

A realistic rollout against these seven priorities will not try to fix everything in one quarter. It sequences diagnosis before remediation, and remediation before full audit coverage.

Timeframe	Key Actions	Output
Days 1-30: Diagnostic baseline	Map audit coverage against all 7 priorities.Identify gaps, review RCM currencyConfirm key statutory, regulatory, cybersecurity, ESG, and other deadlines for the next 12 months.	Audit coverage gap analysisRCM status noteRegulatory and compliance gap register
Days 31-60: Highest-risk testing	Commission a process-standardisation audit for one core process across all locations.Test SoD and ERP accessReview the top 20 vendorsTest vendor risk controls for the top 20 vendorsTrace selected BRSR Core metrics to source records.Assess ESG data governance	Priority risk assessment and remediation registerAccess and SoD findingsProcess comparison report Vendor risk assessmentESG data reliability note
Days 61-90: Standardisation and reporting	Update the common RCM framework. Assess acquisition-related control gapsEstablish a quarterly findings register, and present priorities, timelines, and resources to the Audit Committee. Build the 12-month audit roadmap.	Consolidated RCMQuarterly findings registerIntegration risk report, if applicableAudit Committee presentation  and Annual audit plan

Questions CXOs Should Ask Their Audit Team

Here are a few questions you can ask your audit team. These will help assess whether the audit function is operating at the right level for a ₹500 crore plus business. 

• Which of the seven priorities above has not been formally tested in the last twelve months, and why?
• Can you show me the audit test that would catch a control failure at the group level, not just the entity level?
• When was the RCM last updated, and what business changes triggered the update?
• Have the findings from one location or business unit been checked against every other location running the same process, or each location’s audit stands alone?
• Who owns the six-hour clock the moment CERT-In’s reporting window starts? 
• Is our company’s position tracked proactively against SEBI’s BRSR and BRSR Core thresholds?.
• How do you test segregation of duties in the ERP? Is it a policy review or a system configuration test?
• What percentage of audit findings from the last two years have been closed with verified remediation, not just a management response?
• How does the audit plan cover the risks that emerged from the most recent acquisition or system implementation?
• Can you trace an ESG data point from the board disclosure back to the source system? If not, what would it take?
• Does the cybersecurity audit include technical control testing, and are remediation timelines tracked to closure?
• If a regulator, lender, or acquirer asked for evidence against any of these seven priorities tomorrow, with no advance notice, how long would it genuinely take to produce it?

Reviewing next year’s audit plan or need a process audit for a ₹500 crore+ enterprise? Explore how PKC can help prioritise and execute your audit needs.

Get Your Custom Audit Priority List

FAQs

How often should a ₹500 crore plus company commission a full process audit?

A full process audit covering all seven priorities is typically an annual exercise, but the scope should be risk-based. High-risk areas, such as cybersecurity controls and IFC, should be tested at least annually. Lower-risk areas can be covered on a two-year cycle if the control environment is stable. The key is to have a documented rationale for the frequency, not to default to the same schedule every year.

Do all seven priorities need equal audit attention every year?

No. Risk-rank them based on your specific regulatory exposure and operational complexity, a non-listed company can deprioritise BRSR urgency, for instance, while a company approaching a SEBI threshold cannot.

Can the internal audit team handle all seven priorities without external support?

It depends on the team’s skills and capacity. Financial and process audit capabilities are generally available in-house. Cybersecurity audit requires technical testing skills that many internal audit teams do not have. ESG data assurance and M&A control assessment are also specialised. Use external specialists for the technical priorities and use the internal audit team for the process and compliance priorities, with external quality review.

How often should the full checklist be reviewed, not just individual processes?

At minimum annually, tied to budget and audit planning season, with a lighter quarterly check specifically against any regulatory threshold, BRSR Core phase-in, DPDP compliance dates, auditor rotation, that could shift within the year.

How does PKC scope a pilot for a large company?

We usually begin with a 2 -3 week scoping phase covering one core process across 2–3 locations. The 4–6 week pilot establishes benchmarks, identifies control variations, and delivers a cross-location comparison, prioritised control gaps, and rollout plan.