Internal audit explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sales are where the business earns, and also where it can leak: goods dispatched but never billed, discounts nobody approved, credit given beyond what the customer can pay. An internal audit of order to cash follows a sale from the customer's order to the money in the bank. This guide gives an illustrative programme that finance heads and sales managers can use to prepare for such an audit.
There is no standard on internal audit specific to sales. The approach rests on SIA 120 (internal controls), SIA 130 (risk-based audit), SIA 310 (assignment planning) and SIA 320 (evidence), with SIA 6 on analytical procedures, all from the ICAI Compendium of Standards on Internal Audit (as on 1 October 2022). SIA 6 belongs to the older group in that compendium, which its own note describes as recommendatory in the initial period until the Council notifies a date. Under paragraph 5.1 of the Preface the Council decided to make the SIAs mandatory in a phased manner. The checklists below are TaxClue's own and illustrative; none is mandatory unless a cited standard or linked law post says so. Check current versions on internalaudit.icai.org.
Plan from a risk assessment, map the order-to-cash steps, test the design and operation of the key controls and use analytics to find leakage before testing items. The usual control points are customer master, price and discount approval, credit limit, dispatch-to-invoice matching, collection and credit notes.
How the SIAs shape the audit
SIA 130 (paragraph 5.1) and SIA 310 (paragraph 3.4) ask for risk-based planning; SIA 120 (paragraphs 5.2 and 5.3) asks the auditor to test design and operating effectiveness of key controls, linked to risks in a risk control matrix; SIA 320 (paragraph 3.1) asks for sufficient, appropriate evidence. SIA 6, paragraph 2, asks for analytical procedures at planning and at the overall review, which suits a sales audit because revenue relationships are usually predictable. For the statutory audit view of the same cycle, see our article on audit of revenue and trade receivables. If you want monthly sales, discount and receivable reports built so that leakage shows early, our MIS reporting service covers that.
Order to cash: an illustrative control and test map
| Stage | Illustrative risk | Illustrative key control | Illustrative test |
|---|---|---|---|
| Customer creation | Fictitious customer; duplicate accounts | Approval and verification before creation; change log | Review new customers and changes; match addresses and bank details to employees |
| Pricing | Orders at unauthorised prices | Price list maintained by one team; system block on manual price | Compare invoice prices with the price list; review overrides |
| Discount and schemes | Unapproved or excessive discounts | Approval matrix by value and percentage | Match discounts to approvals; group by salesperson and period |
| Credit limit | Sales beyond a customer's capacity to pay | Limit set and reviewed; order blocked beyond limit | Compare outstanding to limit at order date; review overrides |
| Dispatch | Goods leave without a document | Dispatch only against approved order; gate pass | Compare gate entries and delivery notes with invoices |
| Invoicing | Dispatch not billed; wrong rate or quantity | Sequential invoices; dispatch-to-invoice matching | Match dispatches to invoices; check invoice number gaps |
| Credit notes and returns | Credit notes used to hide leakage or reduce receivables | Approval independent of sales; reason codes | Review credit notes after period end and for repeated customers |
| Collections | Cash misapplied or delayed; lapping | Receipts banked daily; allocation by someone other than the collector | Compare receipt dates to bank credit; test allocations |
| Receivables ageing | Doubtful debts not recognised | Regular ageing review and follow-up | Re-compute ageing; compare to subsequent receipts |
Leakage analytics
SIA 6, paragraph 4, lists comparisons with prior periods, budgets and industry data, and paragraph 5 lists relationships such as ratios among financial items and between financial and non-financial data. Illustrative leakage tests of this kind: units dispatched against units invoiced by month; average realised price against price list by product; discount as a percentage of sales by region and salesperson; credit notes as a percentage of sales by month, especially around quarter ends; and days sales outstanding by customer segment. SIA 6, paragraph 19, asks that unusual results be investigated for explanations and corroborating evidence, starting with inquiry of management (paragraph 20). Our article on SIA 5 and SIA 6 covers the analytics and sampling standards.
Red flags
Illustrative: revenue booked in the last days of a quarter and reversed in the next; invoices to a customer with no dispatch record; sales to related or newly created customers; sudden rise in credit notes; customers always paying just after the period end; a single salesperson with discounts well above peers; overdue balances that are rolled forward without follow-up; and order cancellations after dispatch. For possible fraud, see our article on fraud risk and red flags; a related-party customer is covered in our article on treasury and related party transactions.
Receivables and ageing
Tests on receivables include re-computing the ageing from invoice dates, comparing it with the ageing used for provisioning, testing subsequent receipts for old balances, confirming balances with major customers and checking whether disputed amounts are recorded separately. The ageing schedules companies present are described in our post on the four ageing schedules under Schedule III.
Reporting
Report each finding with the observation, criteria, evidence and its extent, the revenue or cash effect where it can be estimated, the recommendation and management's response with owner and date. Share a written draft before the report is final (SIA 370, paragraph 3.3). Follow-up of open items is covered in our article on SIA 360, 370 and 390.
Illustrative example
Illustrative: Veda Paints Ltd, with eight regional sales offices, asks its internal auditor to review dealer sales. Analytics show that units dispatched exceed units invoiced by 1.2 per cent in one region, and that the region's discount percentage is above the others. The auditor matches 50 dispatches from that region to invoices and finds six with no invoice, all released by the same dispatch clerk on a Saturday. A test of credit limits finds nine orders released to dealers over their limit by manual override, and five of those dealers have balances older than 90 days. The report treats the dispatch matching and the override control as design gaps, and recommends a system block, a weekly unbilled-dispatch report and an approval for any override.
Common lapses
- Testing invoices that exist and never testing dispatches that were not invoiced.
- Looking at the ageing but not the credit limit at the date of sale.
- Treating credit notes as routine and never reviewing them in aggregate.
- Quarter-end cut-off ignored until the statutory audit.
Need help finding revenue leakage?
If you want sales, discount and receivable data analysed for leakage or presented in a monthly report your management can act on, our team can help through MIS reporting.
Key takeaways
- Order to cash is audited on the same SIA base as other cycles: risk, control design and operation, and evidence.
- Analytics at planning and review are well suited to sales, because relationships between dispatch, invoice, price and discount are predictable (SIA 6, paragraphs 2 and 5).
- Dispatch-to-invoice matching and credit limit overrides are common weak points; the checklists here are illustrative.
- Credit notes need review in aggregate, not only item by item.
- Share a draft before the final report and follow open items until closed.
Read next
- Internal audit of procurement and inventory
- Audit of revenue and trade receivables
- SIA 5 and SIA 6: sampling and analytical procedures
- Internal audit of treasury and related party transactions
Disclaimer: Based on the Standards on Auditing, the review, assurance and related services standards, the Compendium of Standards on Internal Audit (as on 1 October 2022) and the Compendium of Forensic Accounting and Investigation Standards (as on September 2025) issued by the Institute of Chartered Accountants of India, in the versions named in the article, as consulted on 4 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org and the Companies Act provisions referred to. This article is general information, not legal advice; check the official text before acting.