Internal audits and reporting structures

Introduction

Internal audits and reporting structures are essential components of corporate governance, regulatory compliance and institutional accountability. Internal auditing refers to the independent and systematic examination of an organisation's financial records, operational activities, risk management systems and internal controls. Reporting structures establish the channels through which audit findings, compliance failures and organisational risks are communicated to management, audit committees and regulatory authorities.

In biotechnology and pharmaceutical organisations, internal audits are particularly important because operations involve clinical research, biological materials, laboratory safety, intellectual property, financial investments and regulatory obligations. Effective audit systems help identify irregularities, prevent misconduct and ensure compliance with applicable laws.

Legal framework governing internal audits in India

1. Companies Act, 2013

The Companies Act establishes important requirements concerning internal audits and corporate reporting.

Section 138: Requires prescribed classes of companies to appoint an internal auditor. The internal auditor may be a chartered accountant, cost accountant or another professional as prescribed.

Section 177: Provides for the establishment of an Audit Committee by specified companies. It oversees financial reporting, audit processes and related internal controls.

Section 134: Requires the Board's report to include specified disclosures concerning financial statements and internal financial controls.

Section 166: Establishes directors' duties, including the obligation to act in good faith and exercise reasonable care, skill and diligence.

2. Companies (Accounts) Rules, 2014

Rule 13 specifies the classes of companies required to appoint an internal auditor and provides the relevant framework for internal audit compliance.

3. SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015

Regulation 18 governs the Audit Committee of listed entities, while Regulation 21 addresses the Risk Management Committee for specified listed entities. These provisions strengthen oversight and reporting responsibilities.

4. Prevention of Corruption Act, 1988

This legislation becomes relevant where bribery, corruption or improper payments involving public servants or public-sector transactions are identified during internal audits.

Objectives and functions of internal audits

Internal audits help organisations evaluate whether their activities comply with legal requirements, internal policies and established operational standards.

Their principal functions include:

1. Financial examination: Reviewing accounting records, expenditure, revenue, procurement and financial statements to identify irregularities.

2. Regulatory compliance: Checking whether the organisation follows applicable corporate, environmental, labour, pharmaceutical and biotechnology regulations.

3. Risk management: Identifying financial, operational, technological and legal risks before they become serious organisational problems.

4. Internal control assessment: Evaluating approval procedures, access restrictions, documentation systems and segregation of responsibilities.

5. Fraud prevention: Detecting suspicious transactions, conflicts of interest, unauthorised payments and manipulation of records.

6. Operational efficiency: Examining whether resources are being used effectively and organisational procedures are functioning properly.

Reporting structures and institutional accountability

An effective reporting structure ensures that audit findings reach the appropriate decision-making authorities without unnecessary interference.

In Indian corporate governance, internal auditors generally report functionally to the Audit Committee or Board and administratively to the appropriate management authority, according to the organisation's governance arrangements.

The Audit Committee plays an important role in examining audit observations, reviewing corrective actions and monitoring financial reporting.

A typical reporting structure may operate as follows:

Internal audit team: Conducts inspections, evaluates records and prepares audit reports.

Departmental management: Responds to audit observations and implements corrective measures.

Chief financial officer and senior management: Review financial and operational irregularities.

Audit Committee: Examines significant findings and monitors corrective action.

Board of Directors: Provides overall governance oversight and ensures accountability.

External auditors and regulators: Receive information where required by applicable law or reporting obligations.

Internal auditors should have sufficient independence and direct access to the Audit Committee for reporting significant concerns.

Internal audits in biotechnology and pharmaceutical organisations

Biotechnology organisations require specialised internal audit procedures because their activities involve scientific research, clinical trials, biological samples and sensitive information.

Important audit areas include:

Clinical trial expenditure and research documentation.

Laboratory safety and biosafety compliance.

Intellectual property ownership and licensing.

Procurement and storage of biological materials.

Data protection and cybersecurity controls.

Environmental and waste-management compliance.

Conflicts of interest in sponsored research.

Auditors should also examine whether research activities follow approved protocols and whether relevant regulatory permissions have been obtained.

Important judicial decisions

1. Official Liquidator v. P.A. Tendolkar (1973) 1 SCC 602

The Supreme Court examined the responsibilities and liabilities of company directors in the context of corporate misconduct. The judgment emphasised that directors cannot necessarily escape responsibility where they have failed to exercise appropriate supervision. It is relevant to internal audit governance because effective oversight requires directors to take organisational accountability seriously.

2. N. Narayanan v. Adjudicating Officer, SEBI (2013) 12 SCC 152

The Supreme Court examined corporate disclosure obligations and the responsibilities of company directors in relation to financial irregularities. The decision highlights the importance of truthful financial reporting, accurate records and responsible corporate governance.

3. Satyam Computer Services Ltd. Securities Litigation

The Satyam corporate fraud exposed serious weaknesses in financial reporting, auditing and corporate oversight. The proceedings demonstrated the consequences of ineffective internal controls and inadequate supervision. The matter is an important illustration of why independent audits and reliable reporting structures are necessary.

4. Dale and Carrington Investment (P) Ltd. v. P.K. Prathapan (2005) 1 SCC 212

The Supreme Court examined directors' fiduciary responsibilities and the misuse of corporate powers. The judgment reinforces the importance of accountability, transparency and proper supervision in corporate decision-making.

Challenges in implementing internal audits

Organisations may experience difficulties because of inadequate auditor independence, insufficient technical expertise, incomplete documentation and management interference.

In biotechnology companies, additional challenges arise from complex research procedures, rapidly changing technologies, confidential scientific information and specialised regulatory requirements.

Internal audit findings may also remain ineffective when management fails to implement corrective actions or reporting channels are unclear.

Recommendations for effective audit governance

Organisations should establish independent internal audit functions with clearly defined responsibilities and direct reporting access to the Audit Committee. Audit plans should be based on organisational risks and reviewed periodically.

They should also maintain documented audit procedures, confidential reporting mechanisms, employee training programmes and time-bound corrective action plans. Serious irregularities should be escalated promptly to the appropriate governing authority.

Conclusion

Internal audits and reporting structures are fundamental to transparency, regulatory compliance and responsible corporate governance. The Companies Act, 2013 and SEBI regulations provide important requirements for audit oversight in India. Judicial decisions concerning directors' duties and corporate accountability further demonstrate the importance of effective supervision and accurate reporting. In biotechnology and pharmaceutical organisations, strong internal audit systems are particularly necessary to protect financial resources, research integrity, intellectual property and public interests.