Internal Audit Policy
Internal Audit Policy
1. MISSION:
The mission of the Internal Audit department is to provide independent, objective assurance
and consulting services designed to add value and improve the organization’s operations. It
helps the organization accomplish its objectives by bringing a systematic, disciplined
approach to evaluate and improve the effectiveness of risk management, control and
governance processes.
Internal Audit will help Management achieve its business targets including cost reduction,
maximization of turnover and profit and improving efficiency and effectiveness of process /
operations through:
Operation Reviews
Conduct Operations Reviews in partnership with business teams to improve business
processes continuously in terms of quality, reliability, responsiveness and cost.
Leadership Development
Provide a diversified group of high potential individuals, broad exposure and training in
challenging business environments.
2. SCOPE OF WORK:
The scope of work of the Internal Audit department is to determine whether the
organization’s network of risk management, control, and governance processes, as
designed and represented by management, is adequate and functioning in a manner to
ensure:
The Head of Internal Audit and Risk Management, preferably a Finance Professional
with commensurate experience & knowledge.
Sr. Managers, Managers, Deputy / Assistant Managers with requisite exposure in
Audit/Finance/IT or operations.
Guest Auditors – taken from functions and other group companies to complement the
Internal Audit team and to accord an independent evaluation where necessary.
The strength of the Internal Audit department shall be adequate to ensure coverage of
the annual plan and the objectives to be achieved during the year.
The Internal Audit team should have the requisite blend of Finance and Technical
professionals, required to carry out the planned assignments. The team blend would
consider some members on a career basis and others on a 2 -3 year basis who will
rotate across other departments within the organization.
4. ACCOUNTABILITY:
The Head – Internal Audit and Risk Management in the discharge of his duties shall be
accountable to Management and the Audit Committee to :
5. INDEPENDENCE
To provide for the independence of the internal auditing department, its staff report to the
Head – Internal Audit and Risk Management, who reports functionally to the Chairman of the
Audit Committee and administratively to the CFO. Any non-audit related work which may
conflict in role and independence of the Head - Internal Audit and Risk Management and/or
other members of the internal audit team must necessarily be pre-approved by the Audit
Committee Chairman.
6. RESPONSIBILITIES:
2
Evaluate adequacy and effectiveness of the internal control systems on a continuous
basis through a systematic and disciplined approach.
The Internal Audit Department will in consultation with management present an annual
internal audit plan to the Audit Committee for approval. The plan shall set out the
recommended scope of their work in the period.
The annual plan will be developed using appropriate risk-based methodology with
reference to a long term strategic outlook for internal audit work, prepared in conjunction
with management and approved by the Audit Committee, and should have regard to the
business plans and strategic outlook of the department as a whole.
Implement the annual audit plan, as approved, including, and as appropriate, any special
tasks or projects requested by management and the Audit Committee from time to time.
Review information systems including information technology, information security and
application controls, network controls, hardware and software controls
Present to the Audit Committee significant findings relating to internal control / process
weakness along with process owners action plan.
Keep a track and follow up with the process owners for pending action plans and present
the status to the Audit Committee.
Issue periodic reports to the Audit Committee and management summarizing results of
audit activities.
Share annual audit plan with Statutory Auditors.
Conduct special investigations as directed by the Audit Committee / Management or suo-
moto in case of matters of suspected fraud, irregularity or failure of internal control
system after keeping Management informed.
Establish a system of Controls Self-Assessment (CSA) across the enterprise which will
supplement internal audit efforts, improve coverage and importantly help Process
Owners take ownership of controls.
Review effectiveness of the system for monitoring compliance with laws and regulations.
Review compliance with Accounting Standards
Review mechanism for adherence to the Tata Code of Conduct.
Review compliance on policies, plans, procedures, laws and regulations
Assist the Audit Committee in the review of the Company’s financial reporting process
and the disclosures of its financial information to ensure that the financial statement is
correct, sufficient and credible.
Conduct internal audits in subsidiary companies or review the work done by other auditors to assist
the Audit Committee in overseeing the systems of internal control, results of audits and integrity of
financial reporting of subsidiary companies.
To provide the policy framework for proactive identification and management of the
Companies strategic, operational, financial & compliance risks in order to achieve
reasonable assurance on the achievement of its business objectives & compliance to
provisions of clause 49 of the listing agreement.
3
The risk management process will be integrated with the Long Term Strategic Planning
Process and other business processes of the Company and will inter-alia ensure :
Driving of structured risk identification, assessment & mitigation plans across all major
businesses of TCL and its subsidiaries.
Deriving enterprise level risks from individual business exercises and ensuring
ownership for mitigation and action planning
The Head – Internal Audit and Risk Management shall ensure that high standards are
sustained in the auditing process and towards this, he shall :
Ensure that an Independent / Peer Review of the Internal Audit Department is carried out
at intervals not exceeding 4-5 years.
Establish a quality assurance program by which the Head – Internal Audit and Risk
Management assures the operation of internal auditing activities.
Maintain a professional audit staff with sufficient knowledge, skills, experience, and
professional certifications to meet the requirements of this charter.
Keep the Audit Committee informed of emerging trends and successful practices in
internal auditing.
7. REPORTING :
The primary purposes of internal audit reports are to provide management with an opinion
on the adequacy of the internal control system, and to inform management of significant
audit findings, conclusions and recommendations.
Reporting arrangements, including the format and distribution of internal audit reports, shall
be agreed with management. It will be ensured that reports are sent to managers who have
a direct responsibility for the unit/function being audited and who have the authority to take
action on the internal audit recommendations. Internal audit reports are confidential
documents and their distribution should therefore be restricted to those managers who need
to know, the Audit Committee and the External Auditors.
The Internal Audit Department shall produce clear, constructive and concise written reports
based on sufficient, relevant and reliable evidence, which:
state the scope, purpose, extent and conclusions of the internal audit assignment
make recommendations which are appropriate and relevant, and which flow from the
conclusions
acknowledge the actions taken, or proposed, by management
4
The Head of Internal Audit and Risk Management shall also prepare flash reports to alert
management on the need to take control, or when there are reasonable grounds for
suspicion of any major irregularity fraud or theft.
All reports shall be discussed with appropriate levels of management, for confirmation of
factual accuracy and for agreement of action plans on recommendations made.
The unique advantage Corporate Audit staff enjoy is their exposure to multiple businesses
and a variety of business situations. Hence, the audit department shall:
9. LEADERSHIP DEVELOPMENT:
As audit processes are by definition fact-based and analytical, they provide the audit
staff an opportunity to look at different business situations objectively and draw
conclusions without any bias. This provides a diversified group of high potential
individual’s from the Internal Audit department broad exposure and training in a
challenging business environment. It will help these individuals take up important
positions / assignments when they move into line functions.
Induction of line managers into the team on rotational basis would add the necessary
business perspective to operational audits. It would simultaneously provide line
managers an opportunity to look at issues differently, which should stand them in good
stead when they return to the mainstream of business.
10. AUTHORITY
The Head – Internal Audit and Risk Management and staff of the internal auditing
department are authorized to:
The Internal Audit team will however not substitute for, or perform normal operational
functions or initiate / approve transactions (external to the Internal Audit Department) or
direct activities of any organization employee who is not an employee / associate of Internal
Audit to avoid conflict of interest.
5
11. STANDARDS OF AUDIT PRACTICE:
The Internal Audit department will meet or exceed the International Standards for the
Professional Practice of Internal Auditing of The Institute of Internal Auditors.
All members of the Internal Audit Team will adhere to the Code of Ethics of The Institute of
Internal Auditors (attached to this Charter).