Audit

SBC :Audit
CategoriesAudit
bySanjeeb Dey

Risk Advisory Services in India

Risk Advisory Services in India: GRC, Internal Audit and Enterprise Risk Management for Business Resilience

Beyond compliance: using governance, risk and controls to support better business decisions.

Risk advisory services in India help organisations understand what could go wrong, decide how much risk they are willing to carry, and put controls in place before a problem reaches the financial statements, a regulator or the board. Cybersecurity incidents, regulatory change, fraud, supplier failures and operational disruption now arrive together, and a policy folder alone does not manage them.

For CEOs, CFOs, boards and audit committees, the useful question is not whether policies exist. It is whether risks have named owners, whether controls work in practice, and whether new exposures reach decision-makers in time. A well-run Governance, Risk and Compliance (GRC) programme answers those questions with evidence.

This guide explains how GRC, enterprise risk management (ERM) and risk-based internal audit fit together, what Indian law and regulators expect, how to build and measure a framework, and how to choose an adviser. It is written for finance heads, boards and audit committees, and it separates what the law requires from what is good practice.

Quick Answer: What Are Risk Advisory Services in India?

Short answer: Risk advisory services help organisations identify and assess business risks, evaluate internal controls, strengthen governance and improve compliance. Depending on the engagement, they cover enterprise risk management, internal audit, internal financial controls testing, process documentation, fraud and cyber risk reviews, and improvement of business processes.

In practice, a risk advisory engagement usually involves some combination of the following:

  • Enterprise risk assessment and risk registers for key processes.
  • Internal audit, delivered in-house, outsourced or co-sourced.
  • Design and testing of internal financial controls (IFC).
  • Standard operating procedures (SOPs), policies and authority matrices.
  • Process and operational audits, and diagnostic reviews to find root causes.
  • Fraud, forensic and cyber security reviews.

What Does GRC Mean? Governance, Risk and Compliance Explained

GRC brings three activities that are often run separately into one connected system. Each answers a different question for management.

Governance: who is accountable, and who oversees?

Governance covers the structures, roles and decision rights that direct and oversee the business. It includes board and committee oversight, delegation of authority, ethical standards and how management reports to the board. Good governance makes it clear who decides, who is answerable and how deviations are escalated. Board records and statutory filings belong here too, which is where secretarial support connects to risk work.

Risk management: what could stop us achieving our objectives?

Risk management is the organised process of identifying, assessing, prioritising and responding to risks that affect strategy, operations, finance, technology and compliance. Enterprise risk management applies this across the organisation, so that management sees the full picture instead of isolated risks.

Compliance: are we meeting our obligations?

Compliance covers legal, regulatory, contractual and internal policy requirements. Effective compliance means knowing the obligations, assigning owners, keeping evidence and handling exceptions. A shared compliance calendar is a practical starting point for tracking statutory deadlines.

When these three work together, fragmented oversight reduces, risk visibility improves and governance is built into daily processes.

Why Risk Advisory Matters for Indian Businesses

Several pressures make structured risk management more than a good-to-have. The following are the ones I see most often in boardroom discussions.

  1. Rising regulatory expectations. Company law and listing regulations place specific duties on boards and audit committees, as the next section explains.
  2. Cyber and data risk. Incident reporting timelines and the new data protection regime make slow detection and response expensive.
  3. Fraud and control override. Weak segregation of duties, unchecked master data changes and manual overrides remain common sources of loss.
  4. Third-party dependence. Vendors, contract manufacturers and service providers extend your risk footprint beyond your own walls.
  5. Growth and complexity. New entities, geographies and systems create control gaps faster than policies are updated.
  6. Scrutiny from lenders and investors. Funders increasingly ask how risk is governed before they commit capital.
  7. Pressure on the finance function. Reliable reporting depends on controls over reconciliations, journals and the financial close.

What Indian Law and Regulators Expect

The requirements below are the main anchors for Indian companies. Applicability depends on the type, size and listing status of the company, so confirm the position for your entity with a qualified professional.

Requirement Source What it means in practice
Board’s report must include a statement on the development and implementation of a risk management policy, including elements of risk that may threaten the company’s existence Section 134(3)(n), Companies Act, 2013 The board must be able to describe how risk is identified and managed
Audit committee terms of reference include evaluation of internal financial controls and risk management systems Section 177(4)(vii), Companies Act, 2013 The audit committee needs reliable information, not only management assertions
Internal audit for prescribed companies Section 138 with Rule 13, Companies (Accounts) Rules, 2014 Listed companies, and unlisted public and private companies above prescribed thresholds, must appoint an internal auditor
Statutory auditor reports on internal financial controls over financial reporting Section 143(3)(i), Companies Act, 2013 Control design and testing should be ready for external scrutiny
Statutory auditor cannot provide internal audit services to the same company Section 144, Companies Act, 2013 Independence must be checked when appointing providers
Risk Management Committee for the top 1,000 listed entities by market capitalisation, meeting at least twice a year, with cyber security in its remit Regulation 21, SEBI LODR Regulations, 2015 Listed entities need a formal committee and a documented risk policy
Reporting of specified cyber incidents to CERT-In within six hours of noticing them CERT-In Directions, April 2022 Incident response must be rehearsed, not improvised
Personal data protection duties, including breach reporting Digital Personal Data Protection Act, 2023 and Rules, 2025 Obligations are phased in; plan for breach intimation and a detailed report within 72 hours

The primary sources are the Ministry of Corporate Affairs for company law, SEBI for listing regulations, CERT-In for incident reporting, and the Ministry of Electronics and Information Technology for data protection. Banks, NBFCs and other regulated entities should also follow the directions of their sector regulator, such as the Reserve Bank of India. Professional standards for chartered accountants, including guidance on internal audit and internal financial controls, are published by the Institute of Chartered Accountants of India, the Institute of Company Secretaries of India publishes governance-related standards, and the Institute of Cost Accountants of India is relevant because section 138 allows a cost accountant to act as internal auditor.

The Four Pillars of an Effective GRC Framework

A sustainable GRC framework needs more than policies or a software platform. Its strength depends on four elements working together.

1. People: building a risk-aware culture

Even well-designed controls fail when responsibilities are unclear or management does not act on weaknesses. Organisations should name an owner for each significant risk across operations, finance, technology, human resources and procurement.

The priorities are straightforward:

  1. Assign ownership for each major risk and its controls.
  2. Train staff on the risks and procedures relevant to their roles.
  3. Provide a safe channel for reporting misconduct and control concerns.
  4. Define clear escalation routes and timelines.
  5. Have senior management model the standards it expects.

2. Process: embedding risk management into operations

Processes turn governance policy into daily controls. Risk assessments and control activities should sit inside core workflows, not only in periodic reviews. The processes that most often need attention are:

  1. Procure-to-pay: vendor onboarding, approvals, conflicts of interest and payment verification.
  2. Order-to-cash: credit control, billing accuracy and collections.
  3. Hire-to-retire: onboarding, payroll changes and exits.
  4. Record-to-report: reconciliations, journal entries and the financial close.
  5. Fixed assets and capital expenditure approvals.
  6. Treasury and financial management.
  7. Third-party and vendor risk.
  8. Information technology and cyber security.

SOPs, authority matrices, documented control ownership and regular exception reviews help keep these consistent across business units.

3. Technology: enabling data-driven risk intelligence

Technology improves how risk information is collected, how controls are monitored and how exceptions are investigated. Spreadsheets, manual evidence collection and periodic reporting make it hard to spot emerging issues. Integrated GRC platforms, analytics and automation can connect risk registers, controls, audit findings, compliance tasks and remediation tracking.

Data-driven monitoring can flag, for example:

  • Duplicate vendor payments.
  • Transactions above approval limits.
  • Unauthorised changes to master data.
  • Unusual journal entries and repeated control overrides.
  • Delays in account reconciliations.

Artificial intelligence can help identify patterns across large datasets, but it needs reliable data, cybersecurity safeguards, model governance and human oversight. Technology should improve the quality and timeliness of information, not replace professional judgement or management accountability.

4. Assurance: validating that controls work

Management and the board need evidence that controls are designed properly and operate as intended. Internal audit, external auditors and other independent providers each contribute within their own scope, and the National Financial Reporting Authority oversees audit quality for specified classes of companies. Coordinated assurance planning reduces gaps and duplication and directs resources to significant risks.

Lines of Defence: From the Three Lines Model to a Five-Line View

The reference point most boards use is the Institute of Internal Auditors’ Three Lines Model, updated in July 2020 from the earlier Three Lines of Defense. It describes the governing body’s oversight, management’s roles (first and second line) and internal audit as the independent third line. It stresses that internal audit’s independence from management responsibilities is essential to its objectivity. The model is voluntary guidance and should be adapted to the organisation.

Some organisations extend this into a five-line view to show external assurance providers and regulators as well. This is a practitioner variant and not a prescribed standard, so use it only if it helps your governance conversation.

Line Who Role
First Business management and operations Own risks, run controls, follow procedures and fix weaknesses
Second Risk, compliance, information security and other specialist functions Set methods, advise, monitor exposures and challenge business practices
Third Internal audit Provide independent and objective assurance and report to the audit committee
Fourth (extended view) External assurance providers, such as statutory auditors and independent assessors Provide assurance within the scope of their engagements; they do not replace management’s responsibility
Fifth (extended view) Regulators and external stakeholders Set and enforce requirements and shape expectations through oversight

Enterprise Risk Management: A Practical Process

ERM is an organisation-wide way of identifying, assessing and responding to risks that affect objectives. Widely used references include the COSO Enterprise Risk Management framework and ISO 31000. A practical ERM cycle follows these steps.

  1. Set the context: objectives, risk appetite and the scope of the exercise.
  2. Identify risks across strategy, operations, finance, technology, compliance and third parties.
  3. Assess each risk for likelihood and impact, with a consistent scale.
  4. Prioritise risks so attention goes to the few that matter most.
  5. Decide the response: avoid, reduce, transfer or accept.
  6. Assign an owner and agree the controls and actions.
  7. Monitor through indicators and report to management, the risk committee and the board.
  8. Review the framework periodically and after significant changes.

An illustrative risk register extract

Risk area Example risk Typical control Monitoring indicator
Procurement Payment to a fictitious or conflicted vendor Vendor onboarding checks and independent approval Exceptions in vendor master changes
Financial reporting Misstatement through unsupported journal entries Journal review and monthly reconciliations Reconciliation ageing
Technology Unauthorised access to critical systems Access reviews and privileged-user monitoring Open access exceptions
Third party Supplier failure disrupts delivery Supplier assessment and contingency sourcing Share of spend with single-source vendors
Compliance Missed statutory filing Compliance calendar with named owners Late or missed filings

The Role of Internal Audit in a GRC Programme

Management owns risks and controls. Internal audit provides independent and objective assurance on whether governance, risk management and controls are effective. The points below are where it adds the most value.

Risk-based planning

The audit plan should reflect the organisation’s risk profile, strategic priorities, operational changes and emerging threats. Periodic risk assessments direct audit effort to areas where independent assurance matters most.

Control testing and internal financial controls

Internal audit evaluates the design and operating effectiveness of controls and compliance with policies. For internal financial controls, this usually means documenting risk and control matrices and testing controls for both design and effectiveness, which prepares the company for the statutory auditor’s reporting under the Companies Act.

Root-cause analysis

A good audit report explains why a control failed, not only that it failed. Unclear ownership, poor supervision, weak process design and system configuration problems are common root causes, and fixing them prevents repeat findings.

Data analytics and continuous auditing

Where the data allows, analytics can widen coverage and surface unusual transactions and repeat exceptions. Internal audit can review the reliability of monitoring arrangements while staying separate from management’s operating responsibilities.

Independence and the conflict rule

Internal audit must stay objective and should not own or operate the controls it audits. Under section 144 of the Companies Act, 2013, a company’s statutory auditor cannot also provide internal audit services to that company, so the appointment of internal auditors should be reviewed for independence.

In-house, outsourced and co-sourced models

Model Strength Consider when
In-house Deep knowledge of the business and quick access You have scale and the skills to staff a full function
Outsourced Independence, breadth of expertise and flexible capacity You lack a dedicated team or need specialist skills
Co-sourced Combines internal knowledge with external specialists You want specialist support on specific areas such as IT or analytics

Businesses that want to share capacity with an external team can explore outsourcing support alongside advisory work.

Cyber and Data Protection Risk

Cyber and data risks now sit at the centre of enterprise risk. The CERT-In directions require specified cyber incidents to be reported within six hours of noticing them, and the Digital Personal Data Protection Rules, 2025 require a data fiduciary to intimate a personal data breach to the Data Protection Board without delay and follow with a detailed report within 72 hours. The Rules commence in phases, so check the current timeline on the MeitY website.

The control implications are practical. Maintain an incident response plan, test it, know who decides on external reporting, keep logs, and review third-party processors who hold personal data. For listed entities, the SEBI Regulation 21 mandate covers cyber security within the risk management committee’s remit.

From Compliance to Continuous Risk Intelligence

Most organisations do not leap to advanced analytics in one step. A realistic path moves through four stages, and not every organisation needs to reach the last one.

Stage Characteristics
1. Traditional compliance Focus on obligations, documented policies, periodic audits and manual control checks
2. Integrated risk management Risk assessments, compliance activities, controls and assurance plans are aligned across functions
3. Data-driven GRC Integrated systems, analytics and automated reporting give timely visibility of risk and control performance
4. Continuous and predictive intelligence Where data quality and governance allow, advanced analytics support early warning and forward-looking assessment

Illustrative Scenarios

These examples are simplified and do not describe any particular client.

Scenario 1: A fast-growing manufacturer with weak procurement controls

A company adds plants and vendors quickly. Purchase approvals vary by site and vendor master data is edited by several people. A process risk assessment and procure-to-pay review would document the actual flow, define approval limits, restrict master data changes and set monitoring for duplicate payments.

Scenario 2: A newly listed company building its risk committee

The company must constitute a risk management committee and a documented policy. It needs a risk register, defined risk appetite, reporting to the committee twice a year at minimum, and a clear approach to cyber security risk. Advisory support can help design the framework and reporting calendar.

Scenario 3: A group preparing for an acquisition

The buyer wants to understand the target’s control environment before closing. A diagnostic review of financial close, related-party dealings and key controls helps to price known exposures and plan post-deal integration. Related transaction support is described under mergers and acquisitions.

Key GRC Priorities for CEOs, CFOs and Audit Committees

Senior leaders should judge GRC by the value it delivers, not by the number of policies written. Five priorities help.

  1. Align GRC with strategy. Build risk thinking into planning, capital allocation, expansion and transformation initiatives.
  2. Strengthen risk ownership. Define who owns each significant risk, which controls manage it and what happens when a control fails.
  3. Improve risk visibility. Give management timely and actionable information on significant risks, weaknesses and remediation progress.
  4. Invest in technology deliberately. Adopt tools against defined needs, data governance requirements and measurable benefits.
  5. Evaluate assurance effectiveness. Give the board and audit committee visibility of assurance coverage, independence, significant findings and corrective actions.

How to Measure GRC Effectiveness

Use indicators that show whether controls are working. Read them against the organisation’s risk appetite, business model and maturity.

Indicator What it tells you
Share of critical risks with named owners Whether accountability is real
Time taken to remediate high-risk findings Whether management acts on audit results
Recurrence of significant control deficiencies Whether root causes are being fixed
Share of key controls operating effectively Quality of the control environment
Compliance exception trends Whether the compliance process is improving
Timeliness of risk reporting to management Quality of risk information
Coverage of critical processes by risk assessments Gaps in visibility
Results of continuity and incident response exercises Preparedness for disruption

A high number of completed audits does not, on its own, show effective risk management. Better evidence is fewer repeat control failures, faster remediation, stronger ownership and clearer visibility of significant exposures.

How to Choose a Risk Advisory or Internal Audit Provider

The selection decision affects the quality of assurance you receive. Use this sequence.

  1. Confirm independence: the provider must not be your statutory auditor for the same company, and should not take on management responsibilities.
  2. Check qualifications and standards: ask who leads the work, their credentials and the standards they follow.
  3. Look for relevant experience in your sector and process areas.
  4. Ask how risk-based plans are built and how findings are tracked to closure.
  5. Understand the use of data analytics and the controls around client data.
  6. Review the scope, deliverables, reporting lines and fees in writing.
  7. Check that the team can support the audit committee and board reporting you need.
  8. Ask how the provider will help you move from findings to sustainable fixes, not only report exceptions.

How SBC Supports Risk Advisory Services in India

Steadfast Business Consulting LLP (SBC) offers risk advisory under its Financial and Risk Advisory Services. The published governance, risk and compliance offerings include enterprise risk management, internal audit transformation, outsourcing or co-sourcing, control testing, SOP development and business process improvement. SBC also lists internal audit, internal financial controls compliance, risk assessment, process and operational audits, diagnostic reviews, cost optimisation and forensic audit and investigations among its services.

Depending on the organisation’s needs, support may include:

  1. Enterprise risk management: assessing business risks and strengthening risk management processes.
  2. Internal audit services: independent and objective reviews of systems, processes and controls.
  3. Internal financial controls: designing the framework, documenting risk and control matrices and testing controls for design and effectiveness.
  4. SOP development: documenting processes, responsibilities and control requirements.
  5. Process and operational reviews: identifying gaps, inefficiencies and improvement opportunities.
  6. Internal audit transformation: moving to a more risk-focused, structured and data-driven audit approach.

Where a business also needs finance leadership, SBC’s virtual CFO services can sit alongside risk work. The right scope depends on the organisation’s risk profile, operating model, regulatory environment and management priorities, and independence requirements should be checked before any engagement.

Frequently Asked Questions About Risk Advisory, GRC and Internal Audit

1. What are risk advisory services?

Risk advisory services help organisations identify, assess and manage business risks, evaluate internal controls, strengthen governance and improve compliance. Depending on the provider and engagement, they may include enterprise risk management, internal audit, control testing, process documentation and business process improvement.

2. What is Governance, Risk and Compliance (GRC)?

GRC is an integrated approach that aligns governance, risk management and compliance activities with business objectives. It helps organisations set accountability, manage risks, monitor controls and meet applicable requirements.

3. Why is a GRC framework important for businesses?

A GRC framework improves risk visibility, strengthens internal controls, supports compliance, clarifies responsibilities and helps management make informed decisions. It also improves coordination between management, risk functions and assurance providers.

4. What is Enterprise Risk Management (ERM)?

ERM is an organisation-wide approach to identifying, assessing, prioritising and responding to risks that may affect strategic and operational objectives. It helps management see significant risks across functions instead of looking at each in isolation.

5. Is a risk management policy mandatory for Indian companies?

Section 134(3)(n) of the Companies Act, 2013 requires the board’s report to include a statement on the development and implementation of a risk management policy. The top 1,000 listed entities by market capitalisation must also constitute a Risk Management Committee under Regulation 21 of the SEBI LODR Regulations. Check applicability for your entity.

6. Which companies must have an internal auditor?

Under section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014, listed companies and unlisted public and private companies that cross prescribed thresholds must appoint an internal auditor. Verify the current thresholds on the MCA website.

7. Can the statutory auditor also be the internal auditor?

No. Section 144 of the Companies Act, 2013 prevents a statutory auditor from providing specified services, including internal audit, to the company it audits.

8. What is the role of internal audit in GRC?

Internal audit provides independent and objective assurance on governance, risk management and internal controls. It evaluates control effectiveness, identifies weaknesses and recurring issues, and reports to management and the audit committee while keeping its independence.

9. What are the lines of defence in risk management?

The IIA’s Three Lines Model describes governing body oversight, management’s first and second line roles, and internal audit as the third line. Some organisations extend this into five lines by adding external assurance providers and regulators. The model is guidance and should be adapted to the organisation.

10. How can technology improve GRC?

Integrated GRC platforms, analytics and automation can improve risk reporting, monitor control performance, identify unusual transactions and track remediation. AI-enabled tools may help with analysis when supported by reliable data, governance and human oversight.

11. How can a business measure GRC effectiveness?

Use indicators such as critical-risk ownership, control effectiveness, remediation timelines, recurring findings, compliance exceptions and the quality and timeliness of risk reporting. Interpret them against the organisation’s risk appetite and objectives.

12. How can SBC support GRC and internal audit initiatives?

SBC offers financial and risk advisory services that include enterprise risk management, internal audit transformation, control testing, SOP development and business process improvement. The scope can be aligned with an organisation’s requirements and risk priorities.

Conclusion: Building Resilience Through Risk Advisory

Risk advisory services in India help organisations turn governance, risk management and compliance into a working system rather than a set of documents. When people, processes, technology and assurance are connected, accountability is clearer, risk visibility improves and decisions are better informed.

The objective is not more controls for their own sake. It is smarter controls, clear ownership, timely risk information and effective oversight. If you would like to review your governance, risk management and internal control arrangements, you can contact the SBC team to discuss your requirements.

Disclaimer

This article is provided for general informational and educational purposes only. It should not be considered legal, tax, financial or professional advice. Laws, regulations, thresholds and timelines, including those under the Companies Act, 2013, the SEBI Listing Regulations, the CERT-In directions and the Digital Personal Data Protection Act, 2023 and Rules, 2025, may change. Readers should verify the latest information from the relevant government and official sources, and should consult a qualified professional for advice specific to their circumstances. Examples and scenarios are simplified illustrations and do not describe any actual client.

CategoriesAudit
bySanjeeb Dey

Definitive Guide to Modernizing the Risk and Control Matrix | 90-Day Roadmap

SBC | Audit & Assurance | Risk Advisory

Modernizing the Risk and Control Matrix (RCM): A 90-Day Roadmap to Turn an Audit Burden into a Strategic Advantage

Written by: Sanjeeb Dey | Director – Audits & Assurance | SBC

Quick answer: A Risk and Control Matrix (RCM) is a structured record that links each business objective to its material risks, the controls that mitigate them, the people accountable for them and the evidence that shows they work. Modernizing an RCM means removing duplicate and obsolete controls, naming accountable roles, defining evidence up front and testing high-volume controls with data. It does not mean having fewer controls for their own sake. Legally required controls stay, and the aim is better risk coverage with less friction.

Most finance and audit teams I speak to describe their RCM the same way: it is a large spreadsheet that gets updated when the auditors ask for it. It is accurate on the day it is signed off and out of date soon afterwards. Controls pile up, owners are listed by department, and nobody can say with confidence which risks are covered twice and which are not covered at all.

That is a missed opportunity. A well-built RCM answers a question that management, the audit committee and the auditors all share: what can materially go wrong, what stops or detects it, who owns the response, and what evidence shows the control is operating? This guide explains how to rebuild the RCM around those questions, how Indian law frames the requirement, and how to do it in 90 days. It sits within SBC’s wider work on risk advisory services in India.

What Is a Risk and Control Matrix (RCM)?

An RCM documents, in one structure, the relationship between what the business is trying to achieve, what could prevent it, and how the organisation manages that exposure. The COSO Internal Control – Integrated Framework treats internal control as relevant to operations, reporting and compliance, which is a useful reminder that the RCM is a management tool first and an audit document second.

A modern RCM links five things in sequence: business objective, risk, control, evidence and assurance. The sequence matters because it forces every control to justify itself against a risk, and every assurance conclusion to rest on evidence.

RCM field Question it answers Example
Business objective What is the process meant to achieve? Pay suppliers accurately and on time
Risk statement What could go wrong, and with what consequence? Duplicate invoices lead to overpayment and cash leakage
Control objective and description What does the control do about the risk? System blocks payment of an invoice with the same vendor, number and amount
Control type and nature Is it preventive, detective or corrective, manual or automated? Preventive, automated
Frequency How often does it operate? Every invoice
Owner and reviewer Who performs it, and who reviews it? Accounts payable lead; finance controller
Evidence What proves it operated? System log of blocked invoices and manual overrides
Testing approach and exception criteria How is it tested, and what counts as a failure? Population test of override log; any unapproved override is an exception
Remediation owner and residual risk Who fixes failures, and what risk remains? Head of procurement; low

Not every organisation needs every field at the same depth. The principle is to include enough structure to support management decisions without turning the RCM into an encyclopedia.

Why Indian Companies Need a Modern RCM

There is no statutory form called an RCM in India. The legal requirement is about internal financial controls, and the RCM is the usual way companies document and evidence them. The anchors below show why the quality of that document matters.

Requirement Source Why it matters for the RCM
Directors of a listed company state that internal financial controls are adequate and operating effectively Section 134(5)(e), Companies Act, 2013 Directors need evidence behind the statement, not only a document
Board’s report covers the adequacy of internal financial controls with reference to the financial statements Rule 8(5)(viii), Companies (Accounts) Rules, 2014 The RCM supports the disclosure
Statutory auditor reports on internal financial controls over financial reporting Section 143(3)(i), Companies Act, 2013 Control design and operating evidence face external scrutiny
Internal audit for prescribed companies; scope, periodicity and methodology decided by the Audit Committee or Board Section 138 and Rule 13, Companies (Accounts) Rules, 2014 Internal audit can plan around the risk and control picture instead of a fixed annual cycle
Audit committee and risk oversight for listed entities SEBI LODR Regulations, 2015 Committees need exceptions and residual risk, not hundreds of control descriptions
Effective communication between statutory auditors and those charged with governance NFRA circular dated 7 January 2026 Better risk and control information improves that dialogue

The statutory text of the Companies Act is available on India Code, and ICSI publishes section-wise references such as section 138 and Rule 13. Listed entities should also read the SEBI LODR Regulations on audit committees and risk management, and the NFRA circular on auditor and audit committee communication. SBC’s note on NFRA’s auditor and audit committee communication series explains how this plays out in practice.

Section 138 applies to every listed company, and to unlisted public and private companies that cross thresholds on paid-up capital, turnover, borrowings or deposits measured against the preceding financial year. Rule 13(2) leaves scope, periodicity and methodology to the Audit Committee or Board. That discretion is what makes a risk-based and data-supported approach possible.

The Anatomy of a Broken RCM

Four patterns turn up in almost every RCM that has outgrown its usefulness.

1. Compliance becomes the architecture

Most RCMs start for good reasons: a new reporting requirement, a regulator’s request, an auditor’s observation. The trouble starts when every requirement becomes another row, another approval and another evidence request, and nobody steps back to ask what risk the whole structure manages.

Procurement is the usual example. A traditional matrix lists vendor onboarding approval, purchase-order approval, invoice verification, payment authorisation and periodic reconciliation. Each is valid. But the matrix may say little about the risks management actually worries about: vendor concentration, conflicts of interest, unauthorised commitments, duplicate vendors, or a change of supplier bank details just before payment. The matrix is full, but the risk view is thin.

The first principle of modernization is therefore to start with the risk, not the control. A control exists because a defined risk exists, and evidence exists because management needs to know the control operated.

2. Control bloat accumulates quietly

Control environments rarely get bloated in a single event. One year a reconciliation is added after an exception. The next year a second-level review is added after a missed approval. A system issue produces a manual spreadsheet check. Each decision looks reasonable. Five years later the company may be paying for several controls that detect the same failure after it has already happened.

A rationalization exercise asks four questions of every control:

  1. What risk does it mitigate?
  2. Is that risk still material?
  3. Does another control already give equivalent coverage?
  4. Can technology reduce the manual effort without weakening the control objective?

The answer may be to retain, redesign, consolidate, automate or remove the control, and the decision should rest on evidence. Rationalization is not a headcount exercise, and it should never be sold to management as a guaranteed saving.

3. Diffused ownership creates invisible gaps

“Finance owns it” is not a control owner, and neither is “IT owns it”. A department can be accountable for a process, but the RCM must say who performs the control, who reviews it, what evidence is retained and who fixes an exception. This also reflects the IIA Three Lines Model, which separates management’s responsibilities from independent internal audit assurance. The RCM should make those distinctions visible instead of folding ownership, oversight and assurance into one generic “owner” field.

4. Static maintenance produces a moving target

Systems, vendors, structures and regulations change between audit plans. A company can move to a new ERP, outsource payroll, acquire a business or add an AI-enabled workflow between two risk assessments. If the RCM is updated only when internal audit prepares its next annual plan, it describes a process that may no longer exist. The IIA Global Internal Audit Standards, effective from 9 January 2025, are principle-based for this reason: they expect the function to respond to organisational context and changing risk.

What a Modern Risk and Control Matrix Looks Like

Anchor every risk statement to a business objective

A weak risk statement is a label. A strong one explains the consequence for the business, which in turn makes the right preventive and detective controls easier to identify.

Weak statement Stronger statement
Invoices may be incorrect. Incorrect or duplicate supplier invoices may cause overpayment, misstated expenses and avoidable cash leakage.
Access may be misused. Unauthorised access to the ERP may allow changes to vendor bank details and fraudulent payments.
Assets may be missing. Untagged or unreconciled fixed assets may lead to misstated carrying values and undetected disposals.

The same logic applies to strategic objectives. A manufacturer improving production reliability should link equipment failure, maintenance gaps, inventory inaccuracy and supply interruption to that objective. A technology company growing through cloud products will probably find identity access, data integrity, third-party risk and change management among its core risks. ISO 31000 describes a common approach to identifying, analysing, evaluating, treating, monitoring and communicating risk, and the COSO Enterprise Risk Management framework connects risk with strategy and performance. Both support designing the RCM around the business as it runs today.

Distinguish preventive, detective and corrective controls

These three types serve different purposes and need different evidence and testing.

Control type Purpose Example Typical evidence
Preventive Stop the event before it occurs Role-based system access Access matrix and system configuration
Detective Identify a failure after it occurs Review of unusual privileged-user activity Review report, exceptions and sign-off
Corrective Restore the process and address the root cause Access-remediation workflow after a breach Ticket, root-cause note and closure approval

All three may be necessary, but a matrix that lists only detective controls in a high-risk process is telling you something. The ICAI Standards on Internal Audit include standards on internal controls, risk management, governance and compliance, and an RCM that makes the link between risk, control design and assurance explicit supports that professional conversation.

Make evidence part of the control design

The most common design weakness is describing what people should do without describing what proves they did it. “Finance reviews the vendor master monthly” is incomplete. A stronger version says what triggers the review, who performs it, which report is reviewed, which exceptions are investigated, where the evidence is kept and how the review is evidenced. The ICAI Technical Guide on Risk-Based Internal Audit discusses the relationship between risk and internal controls, including control activities such as review, approval, physical counts and segregation of duties. The control statement should describe the actual risk-mitigating activity, not just the intended policy outcome.

Control Rationalization: Reduce Complexity Without Reducing Coverage

Rationalization is often misread as control reduction. The sounder framing is coverage optimization. A control can be removed only when the risk is still adequately addressed by something else, when no legal or contractual requirement is compromised, and when the process owner and assurance team understand the change.

A practical review sorts every control into one of five buckets.

Bucket What it means Usual action
Critical key controls Directly mitigate a material risk Keep central to the RCM and test regularly
Supporting controls Help key controls work but are not themselves critical Keep in process documentation, outside the executive view
Duplicate controls Detect or prevent the same failure as another control Consolidate
Obsolete controls Address a risk or process that no longer exists Retire, with documented rationale
Technology candidates Rules-based, high-volume or data-rich Automate or move to continuous testing

Worked example: procure-to-pay

Suppose a company has seven controls in procure-to-pay. The first task is not to cut seven to four. It is to map each control to the risk it covers and ask what coverage would be lost without it. The decisions below are illustrative.

Control Main risk covered Review question Illustrative decision
Vendor onboarding approval Fictitious or conflicted vendors Is any other preventive control over vendor creation in place? Retain; add a conflict-of-interest check
Purchase-order approval Unauthorised commitments Is the authority matrix enforced by the system? Retain; enforce limits in workflow
Three-way match Overpayment, payment for goods not received Is the match system-enforced? Retain
Payment maker-checker Unauthorised or erroneous payment Is segregation of duties intact? Retain
Quarterly sample review of duplicate payments Duplicate payments If analytics tests every invoice, does the sample add coverage? Consolidate into analytics
Monthly manual review of vendor bank changes Fraudulent bank-detail changes Are changes blocked by workflow and approved independently? Redesign as a workflow control with an exception report
Quarterly procurement compliance review Policy deviations Which risks does it duplicate? Retain, scoped to exceptions

If there were no preventive control over conflicted vendor creation, removing a detective control in that area would open a gap. The rationale for each change matters as much as the revised matrix, because it lets internal audit, management and the audit committee understand why the control environment differs from last year.

Guardrails for rationalization

  1. Never remove a control that a law, regulation or contract requires.
  2. Retire a control only after confirming the risk is covered elsewhere or no longer exists.
  3. Record the reason for every removal, consolidation or redesign.
  4. Agree the change with the process owner before assurance teams are told.
  5. Do not present rationalization as a cost-saving promise.

Ownership and Accountability: From Department Names to Named Roles

A modern RCM identifies the operational owner, the reviewer where one is needed and the remediation owner for exceptions. Frequency should follow the risk, not habit: a high-risk control may need to operate continuously, while another may be monthly or event-triggered.

Role Responsibility Test of a good assignment
Control operator Performs the control Has the system access and training to do it
Reviewer Checks the control was performed and exceptions were handled Independent of the operator
Remediation owner Fixes failures and closes issues Has authority to approve the fix and escalate
Risk or compliance function Sets method and challenges the first line Does not operate the control
Internal audit Provides independent assurance Does not own the controls it assures

A control assigned to someone who cannot access the report, approve the exception or escalate a failure is not well designed. In automated environments, ownership may be shared across process owners, application owners, data teams and information security, but the accountability chain should still be explicit.

Continuous Monitoring: Moving Beyond the Annual Snapshot

Sampling remains appropriate where judgement, interviews or complex documentation are needed. High-volume, rules-based transactions are increasingly suited to automated testing, and that is where continuous monitoring becomes practical.

Four controls are natural starting points:

  1. Duplicate payments.
  2. Vendor master data changes.
  3. Transactions above delegated authority.
  4. System access that remains active after an employee exits.

These can often be written as rules and run against the full population. The result is not 100% assurance. It is broader detection coverage, faster exception identification and better use of human review time. SBC’s article on population testing versus audit sampling covers the difference in detail. The NIST Cybersecurity Framework 2.0 shows the same trend towards outcome-based risk management in security, and the same thinking applies to access, incident response, change management and third-party security controls in an RCM.

Continuous monitoring versus continuous auditing

Continuous monitoring Continuous auditing
Owner Management Internal audit
Position Embedded in the business process Independent of the process
Purpose Flag control breakdowns as they occur Provide ongoing independent testing of controls and transactions
Typical method Process-embedded alerts and dashboards Automated audit scripts and audit-owned dashboards

The distinction protects independence. Internal audit should not become the owner of controls it later needs to assure. A mature model uses both: management monitoring helps run the business, and internal audit tests independently whether governance, risk management and controls work as intended. For a deeper view of how internal audit makes that shift, read Is Internal Audit Ready for Continuous Risk Intelligence?

GRC Technology and Data: Fix the Taxonomy Before the Tool

A GRC platform can centralise risk registers, control libraries, ownership, testing, exceptions and remediation. But software does not create a mature control environment. If risk statements are unclear, moving them from Excel into a platform creates a more expensive spreadsheet. A sensible order of work is:

  1. Define what counts as a key control.
  2. Set evidence standards.
  3. Name control owners.
  4. Agree how exceptions are categorised and escalated.
  5. Only then decide which workflows benefit from technology.

Data quality matters as much as the interface. A dashboard showing zero exceptions is not reassuring if the data feed is incomplete, a business unit is excluded or a rule is misconfigured. Continuous monitoring therefore needs periodic validation of data completeness, rule logic, interfaces and exception handling. For asset-heavy businesses, SBC’s 360° Fixed Asset Management approach shows how capitalisation, tagging, reconciliation and physical verification create the transaction-level data that control monitoring depends on.

Connecting RCM Modernization to IFC, ICFR and SOX

For organisations working under internal financial controls, ICFR or SOX expectations, modernization must keep the controls that support financial reporting while improving how evidence and exceptions are managed. The goal is not a separate RCM for each framework. It is one coherent control architecture with clear mappings to each obligation.

In India this means treating the RCM as the supporting structure for the internal financial controls that directors, auditors and the audit committee must form a view on. For listed entities, it also helps leadership move from reviewing dozens of control descriptions to discussing the exceptions, residual risks and remediation priorities that matter. Evidence should also be usable by someone who was not involved in creating the control: source reports, approvals, exception logs, access records and remediation evidence should be kept in a consistent structure so a reviewer can follow the trail from transaction to conclusion.

The 90-Day RCM Modernization Roadmap

Treat this as a practical starting framework, not a universal timetable. Size, control maturity, data quality, technology architecture and regulatory complexity will decide how quickly each phase can be completed.

Phase Focus Output
Days 1–30 Rationalization and pruning Rationalized control inventory and prioritized gap list
Days 31–60 Calibration and accountability Revised RCM with owners, evidence standards and exception rules
Days 61–90 Continuous monitoring pilot Working monitoring rules, dashboard and remediation workflow

Days 1–30: Rationalization and pruning

The first month is about understanding what exists. Do not begin by buying software. Collect the control inventory across critical cycles and identify which controls are actually key to material risks.

  1. Inventory existing RCMs across finance, procurement, sales, HR, IT, operations and other critical processes.
  2. Map each material control to a clearly worded business risk and objective.
  3. Identify duplicate, overlapping, obsolete and low-value controls.
  4. Identify material risks that have no meaningful control coverage.
  5. Check whether process or system changes have made documented controls outdated.
  6. Classify controls as preventive, detective or corrective, and as manual, automated or hybrid.

Day 30 output: a rationalized control inventory and a prioritized gap list. Management should see where the control environment is overly complex and where the organisation is exposed.

Days 31–60: Calibration and accountability

In the second phase the surviving control set becomes operationally stronger. Recalibrate risk ratings, clarify ownership and standardise evidence. This is also the stage to test whether controls prevent the most important risks or merely document compliance after the fact.

  1. Define the control owner and reviewer for each key control.
  2. Confirm the frequency and any triggering events for each control.
  3. Specify the evidence expected and where it is retained.
  4. Review the balance of preventive and detective controls in high-risk processes.
  5. Identify controls suitable for automation or continuous testing.
  6. Define exception severity, escalation and remediation rules.

Day 60 output: a revised RCM that a process owner can operate, an auditor can test and management can understand.

Days 61–90: Continuous monitoring integration

Begin with a small number of high-volume, rules-based controls where reliable data exists and where exception detection will make a visible difference. Good pilots include duplicate payments, purchase-order compliance, vendor master changes and access removal after exit.

  1. Create read-only, governed data connections where appropriate.
  2. Build monitoring rules and validate them against known historical exceptions.
  3. Set thresholds so alerts are meaningful rather than excessive.
  4. Assign named owners to investigate and remediate exceptions.
  5. Build a dashboard showing open exceptions, ageing, repeat failures and remediation status.
  6. Revalidate data completeness, rule logic and workflow performance periodically.

Day 90 output: a working pilot. A pilot usually teaches more than a large programme launched without learning, because it exposes false positives, data limits, ownership gaps and workflow friction before the model is extended.

How to Measure Whether the Modernized RCM Is Working

The RCM itself should be measured, or modernization becomes another project that produces documents but not better risk management. A small scorecard works better than a long list of activity metrics.

Indicator How to measure What it tells you
Risk coverage Share of material risks mapped to at least one key control Whether significant risks are covered
Ownership clarity Key controls without a named owner and reviewer Whether accountability is real
Control efficiency Average number of controls per material risk, and the number retired or consolidated with reasons Whether duplication is falling
Evidence quality Time taken to retrieve evidence for a sample of controls Whether evidence is usable outside the process
Test coverage Share of key controls tested on the full population Breadth of detection
Exception handling Ageing of open exceptions and share closed on time Whether remediation gets stuck
Repeat findings Recurrence of the same significant deficiency Whether root causes are being fixed
Alert quality Proportion of alerts that turn out to be genuine exceptions Whether monitoring rules are well tuned
Currency Time taken to update the RCM after a major process or system change Whether the matrix is still current

Set the baseline in the first 30 days and review the scorecard each quarter. A high number of controls or tests is not evidence of maturity. Quality of risk coverage, clarity of ownership, reliability of evidence and speed of exception response are closer to the real management outcome.

Common Mistakes to Avoid During RCM Modernization

  1. Buying a GRC platform before fixing the risk and control taxonomy.
  2. Equating fewer controls with a better control environment.
  3. Assigning ownership to departments instead of accountable roles.
  4. Automating a poorly designed manual control without first validating the risk logic.
  5. Using dashboards that show activity but not risk significance or root cause.
  6. Assuming 100% population testing means 100% assurance.
  7. Letting internal audit become the operational owner of controls it later needs to assure.
  8. Ignoring legal, contractual or regulatory controls during rationalization.
  9. Failing to document why controls were removed, consolidated or redesigned.
  10. Updating the RCM once a year while the underlying process changes every month.

Practical Questions for Leadership

Question Why it matters
When did we last remove a control because the risk had gone away? A control that exists only because it always has may no longer give meaningful coverage
Can every key control be traced to a material business risk? If not, the matrix is activity-led, not risk-led
Can we name the individual who owns every key control? Department-level accountability is too slow when an exception needs action
Can internal audit get reliable evidence without chasing several teams? Ease of retrieving evidence is itself an indicator of control maturity
Which controls could be tested across the full population? High-volume, rules-based activities are natural candidates for automated monitoring
What changed in the RCM after our last major system or business-model change? A static RCM can be inaccurate even when it looks perfectly formatted

The Boardroom Value of a Modern RCM

A well-designed RCM gives the audit committee and senior management a more useful view of risk. Instead of pages of control descriptions, leadership can focus on four questions:

  1. Which material risks are increasing?
  2. Which key controls are failing?
  3. Which exceptions keep recurring?
  4. Where is remediation getting stuck?

That is a better conversation than whether the matrix has 400 or 600 rows. The long-term opportunity is risk intelligence: a regularly refreshed picture of where exposure is rising, where controls are failing and where management attention is needed. The accountability model stays the same. The RCM lets management manage, risk functions challenge and internal audit provide independent assurance.

How SBC Approaches RCM Modernization

SBC starts from the organisation’s risk profile and operating model, not from a technology product. The practical sequence is to understand the existing risk and control framework, find where coverage is duplicated or incomplete, define accountable owners, strengthen evidence and then introduce analytics where the data supports it.

This sits within SBC’s Financial and Risk Advisory Services, which cover enterprise risk management, internal audit transformation, outsourcing or co-sourcing, control testing, SOP development, business process improvement and internal financial controls compliance under the Companies Act, 2013. The aim is not to turn every process into an automated dashboard. It is to build an RCM that is proportionate to risk and useful to the business.

Independence deserves a word. Under section 144 of the Companies Act, 2013 a statutory auditor cannot provide internal audit services to the company it audits, and internal audit should not operate the controls it assures. Check these points before any engagement.

Frequently Asked Questions About the Risk and Control Matrix

1. What is a Risk and Control Matrix (RCM)?

An RCM is a structured record that links business objectives and risks to the controls designed to mitigate them, together with ownership, frequency, evidence and testing information.

2. What is the difference between an RCM and a risk register?

A risk register lists risks, their ratings and treatment plans. An RCM goes further by mapping each risk to specific controls, owners, evidence and tests. Many organisations keep both and link them.

3. Is an RCM mandatory in India?

No statute names a form called an RCM. However, the Companies Act, 2013 requires the board’s report to address the adequacy of internal financial controls, requires directors of listed companies to state that such controls are adequate and operating effectively, and requires the statutory auditor to report on internal financial controls over financial reporting. Companies commonly use an RCM to document and evidence those controls.

4. Why should companies modernize their RCM?

Processes, systems, regulations and risk profiles change. A static RCM becomes overly complex, outdated or disconnected from material risks, which weakens both management decisions and assurance.

5. Does modernizing the RCM mean removing controls?

Not necessarily. Modernization means improving risk coverage and reducing unnecessary complexity. Some controls are removed or consolidated, while others are redesigned or strengthened.

6. What should a modern RCM include?

At minimum: the risk statement, control objective, control activity, owner, reviewer where applicable, frequency, evidence, exception criteria and remediation responsibility. Organisations may add risk ratings, systems, testing method and residual risk.

7. What is the difference between continuous monitoring and continuous auditing?

Continuous monitoring is a management activity embedded in operations. Continuous auditing is performed by internal audit using frequent or automated analysis to evaluate controls and transactions and provide independent assurance.

8. Can every control be automated?

No. Controls involving professional judgement, complex investigations, qualitative assessment or nuanced walkthroughs may still need human testing and review.

9. Does 100% population testing give 100% assurance?

No. Automated testing still depends on complete and reliable data, correct rule configuration, functioning interfaces and effective exception handling.

10. How long does RCM modernization take?

A 90-day roadmap is a reasonable starting framework, but the actual duration depends on the organisation’s scale, control maturity, systems, data quality and regulatory requirements.

11. Who owns the RCM?

Management owns the risks, the controls and the RCM that documents them. Internal audit uses the RCM to plan and perform independent assurance, and should not own the controls it assures.

12. How often should an RCM be updated?

Review it at least once a year and after any major system, process, vendor, structure or regulatory change. Event-driven updates matter more than the calendar.

Conclusion: The Future Is a Smarter RCM

A Risk and Control Matrix should help the business understand and manage risk. It should not exist because an auditor once asked for a spreadsheet. The strongest RCMs make the relationship between objectives, risks, controls, evidence and accountability visible and usable.

Modernization is less about digitizing the document and more about redesigning the control environment around risk. Rationalize what is redundant. Strengthen what is material. Clarify who owns what. Automate where data and logic are reliable. Keep deep-dive audit work where human judgement is essential. The organisations that do this well will not be the ones with the largest RCM. They will be the ones whose RCM tells management, clearly and quickly, what matters, what is changing and where action is needed.

A question for leadership: is your RCM mainly an audit requirement, or is it an operating tool that management uses to understand risk and protect the business? If you would like to review yours, you can contact the SBC team.

Disclaimer

This article is provided for general informational and educational purposes only. It should not be considered legal, tax, financial or professional advice. Laws, regulations, thresholds and professional standards, including those under the Companies Act, 2013, the SEBI Listing Regulations and NFRA circulars, may change. Readers should verify the latest information from the relevant government and official sources, and should consult a qualified professional for advice specific to their circumstances. Examples and decisions shown in this article are simplified illustrations and do not describe any actual client.

CategoriesAudit
byJayasri P

Population Testing vs Audit Sampling: What Changed

Written by Sanjeeb Dey · Statutory references current to the Companies Act, 2013 and applicable IFC requirements.

Quick answer: The deciding difference is residual uncertainty: population testing examines every transaction and leaves no untested portion, while sampling tests a subset and carries sampling risk. Population testing now suits high-volume structured data and Internal Financial Controls testing under section 143(3)(i) of the Companies Act 2013; sampling still suits small, unstructured or judgement-led populations.

For most of my career, sampling has been the backbone of how audit work gets done: you pick a statistically defensible sample size, test it rigorously, extrapolate the results and issue an opinion with an appropriate level of assurance. It is a methodology built on sound statistical theory that has served the profession well for decades.

But something has changed. Fundamentally. Presently, data generated by our clients in the form of millions of transactions recorded over a multitude of interacting systems no longer requires our selective approach but instead allows for full testing of the data. Now we are faced with yet another issue: in case we can test 100% in entirety, should we still stick to sampling as our default practice?

From witnessing this transition play out in our projects, I have learned ten key lessons about what is causing it, what it changes, and what further work needs to be done in the profession.

What is the difference between audit sampling and population testing?

Audit sampling Population testing
Coverage A statistically selected subset Every transaction in the population
Conclusion Extrapolated to the population Observed directly
Residual uncertainty Sampling risk remains No untested portion exists
Effort profile Manual testing of each selected item Automated screening, manual investigation of exceptions
Best suited to Small, unstructured or judgement-heavy populations High-volume structured transactional data
Detects clustered anomalies Only if the cluster happens to be sampled Yes, by design

Why has the business case for sampling flipped?

Sampling exists because testing everything used to be impractical: too expensive, too time-consuming, too manual. That constraint is disappearing.

With modern data-extraction tools and audit data analytics platforms, pulling and testing an entire population of transactions is often no more effortful than pulling a sample, and sometimes faster. When the cost of full-population testing approaches the cost of sampling, the argument for sampling weakens considerably. We are no longer choosing sampling because it is efficient; we are choosing it, in some cases, purely out of habit.

Does 100% testing mean 100% manual effort?

No. This is the single biggest misconception I encounter, even among experienced auditors.

Population testing does not mean assessing each transaction manually, because the workflow is fundamentally different. Automated scripts and analytics tools screen the entire population against defined criteria: duplicate payments, threshold breaches, unusual approval patterns and weekend postings. Only the exceptions are flagged. Human judgement is then applied where it actually matters, investigating the anomalies rather than rubber-stamping the routine.

This is a redistribution of effort. Not a multiplication of it.

How does population testing remove sampling risk?

Every auditor who has had to defend a sample size in the face of questions from a sceptical member of the Audit Committee knows the follow-up question that is bound to come: “But what about those transactions that you never looked at?” This question stems from sampling and is entirely unavoidable and legitimate from the perspective of statistics. Sampling risk, by definition, means there is a chance the sample does not represent the population accurately.

Testing the population sidesteps the problem altogether. Once each and every transaction has been tested, there is no question what the untested segment could be made up of because there is no untested segment left.

What issues does sampling miss that population testing catches?

This is, in my view, the most compelling argument for the shift.

Control failures and fraud are rarely distributed evenly in populations but tend to cluster together purposely to avoid detection, and a sample of 30 or 60 transactions, however statistically sound, can miss a pattern that only becomes visible when you look at all 50,000.

We have seen this firsthand. Anomalies that would never have surfaced in a traditional sample-based approach became immediately apparent once the full population was run through an analytics script: a handful of unusual entries, invisible in isolation, but glaring once compared against the whole.

The same principle applies in terms of physical verification. By sampling a fixed asset register, you assess whether or not the sampled assets exist; physical verification and tagging of the full asset base aids in identifying the non-existent ones.

How does population testing affect IFC testing in India?

For Indian companies, this is where the shift bites: in internal financial controls over financial reporting, or ICFR.

Under section 143(3)(i) of the Companies Act 2013, the statutory auditor must report on whether the company has appropriate internal financial controls in relation to its financial statements, and whether these controls are operating effectively. The ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting provides guidelines on how this testing is carried out.

Operating effectiveness is an evidential question, and where a control applies to a high-volume, structured transaction stream, testing the full population produces direct evidence of every instance in which the control did or did not operate, whereas a sample produces only an inference about everything it did not touch. As management and auditors converge on analytics-based testing of the same control populations, a documented Risk and Control Matrix supported by full-population results is materially stronger evidence than the same matrix supported by an extrapolation.

What skills does an auditor need for population testing?

Traditional sampling required a solid grounding in statistical theory, including confidence levels, tolerable error rates and sample size calculations. Population testing requires something different: comfort with data extraction, scripting, query languages and visualisation tools.

This does not make statistical knowledge irrelevant, but it does mean the day-to-day skillset of an auditor is shifting, and increasingly our teams need people who can write a SQL query or build a Python script for anomaly detection, just as much as they need people who understand internal controls frameworks. The ICAI Internal Audit Standards Board, which issues the Standards on Internal Audit, is the body Indian functions should watch as this expectation formalises.

Why do data access and data quality become the new bottleneck?

Once the testing itself is no longer the constraint, the constraint moves upstream, to data access and data quality.

Full-population testing is only as good as the completeness and accuracy of the underlying dataset. If a client’s ERP system exports incomplete records, or if access negotiations with IT take three weeks, that becomes the actual bottleneck in the engagement, not the analysis itself. A growing share of our engagement planning now goes into data scoping and access logistics rather than sample design. The principle is the same as for fixed asset register: the results of the analysis depend on the quality of the data being analysed.

How does population testing change what assurance means?

There is a meaningful difference between telling an Audit Committee “we tested a representative sample and found no material exceptions” and telling them “we tested every single transaction in the population and found no material exceptions.”

The latter is a categorically stronger assurance statement, and clients and regulators increasingly recognise the difference. As population testing becomes more common, the bar for what counts as sufficient assurance is quietly rising, and firms that stick exclusively to sampling may find themselves needing to justify that choice, rather than the other way around.

How does population testing lead to continuous auditing?

Once you have built the scripts and analytics needed to test 100% of a population for a point-in-time audit, you are most of the way toward being able to run that same testing on a rolling, continuous basis.

This is where population testing and continuous risk intelligence intersect, because the infrastructure built for one supports the other, so that a control testing script built for an annual audit can, with modest adaptation, become a monthly or even daily monitoring routine, turning a static engagement into an ongoing assurance capability that the client did not have to build twice.

Does population testing replace professional judgement?

No. I want to be careful not to overstate this shift.

Population testing tells you what happened across every transaction, but it does not automatically tell you why, or whether a flagged anomaly represents a genuine control failure, a one-off exception, or perfectly legitimate business activity. Judgement-intensive areas, including complex estimates, related-party transactions and areas requiring interviews and process walkthroughs, still depend heavily on experienced auditors applying professional scepticism.

Population testing is a far more powerful tool for surfacing what deserves attention, but it does not replace the judgement needed to interpret what is found.

What does the transition actually require?

You cannot simply resolve to do more analytics. You need to take the necessary steps to invest in technology, build the data access infrastructure, train existing staff and, in some cases, hire people with different skills from those of traditional auditors.

Firms that treat this as a checkbox, running one analytics script on one engagement and calling it a transformation, will see limited results. The firms that genuinely benefit are the ones building the capability systematically:

  • Standardised scripts that can be reused across engagements
  • A data access playbook that speeds up negotiations with client IT functions
  • A training pipeline that builds these skills into every new hire, rather than relegating them to a small specialist team

Where does that leave sample-based auditing?

To be clear, I do not think sampling is going away entirely, nor should it. There are still engagements where the underlying population is genuinely too small or too unstructured for full-population testing to add meaningful value, and there are judgement-based audit areas where sampling was never really the constraint to begin with.

But for high-volume, structured, transactional data, which is the bread and butter of so much control testing work, the default is shifting, and shifting quickly.

The question every audit and risk advisory function should be asking is not whether to ever use population testing, because that question has largely been answered. The real question, for each engagement, each control and each population of data, is whether sampling is still the right default, or whether it is simply the default we have never gotten around to reconsidering.

What is the path forward?

As a firm, we have started treating population testing as the starting assumption for structured transactional testing, with sampling as the deliberate exception rather than the automatic default. That is a meaningful reversal of how most of us were trained. It requires new tools, new skills and, admittedly, some discomfort in retiring methodologies that have served the profession reliably for a long time.

But the payoff is real: stronger assurance, fewer blind spots, and testing capabilities that lay the groundwork for the kind of continuous, forward-looking risk intelligence our clients are increasingly asking us to deliver.

The transition from sample auditing to population testing is not just a technical advancement of the method but is an important step towards the kind of assurance that the clients, Audit Committees and regulators will begin to expect as the norm instead of an exception. The firms and functions that start developing this competence now will be the ones defining the standard that the rest will have to catch up to.

How SBC applies population testing

Steadfast Business Consulting (SBC) believes that the function performed by internal audit and governance should be transformed from mere compliance exercise to a useful source of risk and control intelligence. SBC’s Financial and Risk Advisory practice applies data analytics across the internal audit process, control testing, Internal Financial Controls compliance under the Companies Act 2013 and forensic audit and investigations, coupled with standard operating procedure development and business process improvement. Rule 13 of the Companies (Accounts) Rules 2014 enables the internal auditor to be external to the company, which is what allows this work to be delivered on a co-sourced basis.

The starting point is not technology but an honest reading of where your risk intelligence currently stands and where it must be headed. If your organisation is questioning whether sampling is still the right default, the SBC internal audit team would be glad to discuss the opportunity.

Frequently Asked Questions

What is full-population testing in audit?

Full-population testing studies all transactions in a specified dataset against predetermined criteria instead of testing a representative sample and extrapolating findings. Automated scripts review the full population and reveal discrepancies, so auditors can focus on identifying anomalies instead of testing regular transactions.

Is population testing better than sampling?

Population testing is generally more advantageous when it comes to high-volume structured transaction data because it removes sampling risk and captures irregularities in clusters. The practicality of sampling is presumed to hold true when the population is small or unstructured, or if the audit inquiry of interest turns on professional judgement rather than the transaction features.

Does population testing satisfy IFC testing requirements?

Section 143(3)(i) of the Companies Act 2013 requires reporting on whether internal financial controls operate effectively. Population testing produces direct evidence of every instance in which a control operated, which is stronger evidence of operating effectiveness than an extrapolation from a sample.

What is sampling risk?

Sampling risk is the possibility that a selected sample does not accurately represent the population from which it was drawn, so that the auditor’s conclusion differs from the conclusion that testing the entire population would have produced. Population testing eliminates it, because no untested portion remains.

What skills do auditors need for data-driven testing?

In order to be successful, auditors must master data extraction skills, possess knowledge of query languages, be able to script for detecting discrepancies as well as use visualisation tools, plus know standard internal control concepts. Statistical theory remains relevant, but the practical bottleneck has moved from sample design to data access and data quality.

Disclaimer: This article is intended for general information and does not constitute professional advice. Statutory positions are stated as at 3 September 2026 and readers should confirm current requirements before acting.

CategoriesAudit
byJayasri P

Is Internal Audit Ready for Continuous Risk Intelligence?

Written by Sanjeeb Dey · Statutory references current to the Companies Act, 2013 and applicable IFC requirements.

Quick answer: No, internal audit is not yet ready, and the obstacle is capability rather than law. Section 138 of the Companies Act 2013 prescribes no interval for internal audit, and Rule 13(2) of the Companies (Accounts) Rules 2014 leaves periodicity and methodology to the Audit Committee or the Board. The annual plan is a convention, not a statutory requirement.

The annual audit plan was designed for a world where risks changed slowly. That world no longer exists. For decades internal audit has followed a familiar rhythm: build a risk-based annual plan, present it to the Audit Committee, execute it quarter by quarter and report findings after the fact. It is a model that served organisations well, until the risk landscape stopped waiting for the planning cycle. Cyber threats now emerge overnight, regulatory changes land with little warning and supply chains buckle in days rather than quarters. By the time a traditional audit is scoped, fielded and reported, the risk it was designed to catch may already have evolved into something else entirely.

Having watched the tension between the level of assurance stakeholders want and the speed at which risk actually moves, I set out below ten realities that each audit function must accept in order to shift from the current model of annual planning to a continuous risk intelligence model.

Does Indian law require the internal audit plan to be annual?

No. Most discussions of continuous auditing miss this point. It matters more in India than the global commentary suggests.

According to Section 138(1) of the Companies Act 2013, certain types of companies must appoint an internal auditor who can either be a chartered accountant or cost accountant or any other professional as per the decision of the Board. Section 138(2) empowers the government to specify how the internal audit should be done, but the by-laws drafted by it are silent about the frequency of internal audits.

In contrast, Rule 13(2) of the Companies (Accounts) Rules 2014 states that the internal audit scope, operation, periodicity, and methodology will be decided along with the internal auditor by the Audit Committee or Board.

Periodicity is therefore a governance decision taken by your Audit Committee rather than a constraint imposed by statute. A function that moves to continuous risk intelligence is not straining against the Companies Act but exercising a discretion the Act deliberately left open.

Which companies must appoint an internal auditor?

Rule 13(1) sets the thresholds, all tested against the preceding financial year:

Company type Trigger for mandatory internal audit
Listed company Every listed company, with no threshold
Unlisted public company Paid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point; or outstanding deposits of ₹25 crore or more at any point
Private company Turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point

The Explanation to Rule 13 also confirms that the internal auditor may or may not be an employee of the company, which is what makes outsourced and co-sourced internal audit models available to Indian companies.

Why is the annual audit plan becoming a historical document?

By design, a risk-based internal audit plan is a snapshot: a best guess at what risks matter, frozen at a single point in time and usually built months before execution even begins. The problem is that risk does not freeze. Thus, a plan that is approved in December might have become obsolete by March when regulations change, a merger occurs, or a system migration takes place.

This does not mean annual planning is obsolete; it means annual planning can no longer be the only mechanism for prioritising audit work. It must instead become a living document, revisited continuously rather than dusted off once a year.

Should risk assessment move from periodic to perpetual?

Yes. The shift is one of supplementation, not replacement.

Most functions still run their formal risk assessment once or twice a year, as a structured exercise involving interviews, surveys and workshops that is thorough but slow. Continuous risk intelligence flips the model: risk data is captured constantly, from operational metrics, control failures, incident logs and external signals, so that risk scores update in near real time rather than annually. The point is not to abandon structured risk assessments but to surround them with an always-on pulse of the organisation’s risk environment.

Why is data analytics no longer optional in internal audit?

Internal audit teams that still rely primarily on sampling and manual testing are structurally incapable of achieving continuous assurance, because there are simply not enough hours in the year.

Analytics changes the equation: instead of testing 30 transactions out of 30,000, audit teams can test all 30,000, flag anomalies automatically and redirect human judgement toward the exceptions that actually matter. This requires investment in tools, in data access and in skills, but the payoff is a level of coverage and speed that manual testing cannot match. The same logic already applies in asset-heavy environments, where a structured approach to fixed asset management produces the transaction-level data that continuous testing depends on.

What is the difference between continuous auditing and continuous monitoring?

These terms get used interchangeably. They should not be. They serve different purposes, sit with different owners and produce different kinds of evidence.

Continuous monitoring Continuous auditing
Owner Typically management Internal audit
Position Embedded into business processes Independent of the process
Purpose Flag control breakdowns as they happen Ongoing independent testing of controls and transactions
Typical method Process-embedded alerts and dashboards Automated audit scripts and audit-owned dashboards

A mature internal audit function does not simply rely on management’s monitoring; it builds its own independent continuous auditing capability, while also learning to treat management’s monitoring data as a risk signal in its own right.

What does the Audit Committee actually want from internal audit?

Expectations from Boards and Audit Committees are changing: though a report on the failures of the past quarter does provide some value, it is ultimately focused on history, whilst Committees now prefer a more forward-thinking perspective to understand better what risks are on the rise, where the controls show signs of weakness, and which additional areas need attention in future.

This is a fundamental repositioning of internal audit’s value proposition, from a rearview mirror to something closer to a radar system. It is also, under Rule 13(2), a conversation the Audit Committee is statutorily entitled to have with you about methodology and periodicity. The expectations placed on that dialogue are already visible in NFRA communication between auditors and Audit Committees, where the regulator has pressed for substantive rather than procedural exchange.

Why does technology risk break the traditional audit cycle?

Cloud migrations, artificial intelligence adoption, third-party integrations and cybersecurity threats evolve on a timeline measured in weeks, not the twelve to eighteen month cycle typical of a traditional IT audit rotation, which means that a system touched once every year or two is effectively audited as a version of itself that may no longer exist when the report is issued. Technology risk, more than almost any other risk category, demands continuous visibility rather than periodic deep dives.

How are talent requirements changing for internal auditors?

Continuous risk intelligence is not merely a technology upgrade. It is a talent transformation. Auditors need to be comfortable with data querying, with visualisation tools and, increasingly, with understanding how artificial intelligence and machine learning models work well enough to audit them, because the traditional profile of an auditor skilled primarily in controls testing and documentation review, however valuable it remains, is no longer sufficient on its own.

Forward-thinking functions now hire data scientists, engineers and analytics specialists alongside traditional auditors, and cross-train existing staff to bridge the gap. The ICAI Internal Audit Standards Board, which issues the Standards on Internal Audit, is the reference point Indian functions should be tracking as this expectation formalises.

Why do data silos block continuous risk intelligence?

Continuous risk intelligence depends on access to live data from ERP systems, GRC platforms, incident management tools, HR systems and external threat intelligence feeds. Yet in many organisations this data lives in disconnected silos, each with its own owner, format and access restrictions, and each requiring a separate negotiation before internal audit can see it.

Building the capability is as much an organisational and political challenge as a technical one. It requires data access agreements, data governance standards, and often the persuasion of other functions that sharing data with internal audit benefits everyone. Our guide to compliance, documentation and risk management sets out how that documentation layer is usually built.

Can third-party risk still be reviewed once a year?

No. Annual vendor risk assessments have become insufficient because of the speed with which third-party risks can emerge, as various incidents such as data breaches at a vendor, geopolitical disruptions and financial distress on the part of a key supplier can occur within a matter of weeks.

Continuous risk intelligence extends monitoring beyond the four walls of the organisation, incorporating real-time signals about vendor financial health, news events and even social sentiment. Many audit functions still lag here, treating third-party risk as a compliance exercise rather than a live risk category demanding ongoing attention.

Is continuous risk intelligence a replacement for traditional audits?

No. This is perhaps the most important point of all. Continuous risk intelligence does not mean abandoning traditional audit engagements. Deep-dive audits, control testing and independent assurance work still matter, especially for risks that require nuanced professional judgement, complex fraud investigation or detailed process walkthroughs that automation cannot fully replicate.

The future is not continuous risk intelligence instead of annual audit plans but a hybrid model. Continuous monitoring and analytics feed a dynamic, frequently updated risk register, which in turn informs a more agile audit plan, one that can pivot mid-year when new information demands it rather than waiting for the next annual cycle.

How mature is your internal audit function?

A simple maturity test for the internal audit process, against which most Indian functions we encounter sit at Level 1 or Level 2.

Level Stage What it looks like
1 Periodic audit Annual risk assessment, sample-based testing, periodic reporting
2 Data-enabled audit Analytics-supported testing, exception reporting, improved audit coverage
3 Continuous assurance Continuous monitoring, automated control testing, risk-based alerts
4 Dynamic risk intelligence Real-time risk sensing, predictive analytics, integrated governance intelligence
5 Strategic risk intelligence Assurance supported by artificial intelligence, continuous risk intelligence, predictive control insights, board-level risk foresight

The dilemma facing the Chief Audit Executives, Chief Financial Officers, and Audit Committees is not if internal audit employs artificial intelligence but how rapidly it can notice a significant swing in risk, how quickly that signal can reach those who can implement change, and how quickly managers will react. Auditors who can answer the question will not necessarily be the auditors who perform the most audits. Rather, those auditors are the ones who combine business acumen with risk knowledge, technological skills, data analytics expertise, and professional judgement to indicate what the control is, how the data determines whether the control works, what signals indicate the risk situation is shifting, and what the management team must do before the risk crystallises. That is the transition from internal audit as an assurance function to internal audit as a risk intelligence partner.

So, is internal audit ready?

Honestly? Not yet. Not universally. Many functions are still investing heavily in traditional planning cycles, manual testing and annual risk assessments, while continuous risk intelligence remains a conference-session aspiration rather than daily practice. But the direction of travel is unmistakable, because organisations generate risk-relevant data faster than ever, stakeholders expect faster insight, and the tools for continuous assurance have never been more accessible.

The functions that will thrive are the ones that start now, by building analytics capabilities, breaking down data silos, upskilling their people, and reshaping their relationship with the Audit Committee from “here is what happened” to “here is what is coming.” The annual audit plan is not disappearing. But it can no longer stand alone. When risks move in real time, assurance cannot remain static. The next generation of internal audit will be defined not by how many audits it completes but by how early it helps the organisation see what is coming.

How SBC works with internal audit functions

Steadfast Business Consulting (SBC) views internal audit and governance not as a mere periodic compliance process but as the development of a dynamic risk and control intelligence function. SBC’s Financial and Risk Advisory practice serves listed and unlisted companies in the areas of internal audit, ongoing internal audit transformation, co-sourcing, control testing, enterprise risk management, SOP development and Internal Financial Controls compliance under the Companies Act 2013. The starting point is not technology but an honest assessment of the current status of the risk intelligence capability of the organisation. If the organisation is now thinking of moving to continuous risk intelligence, the SBC internal audit team would be glad to discuss the opportunity.

Frequently Asked Questions

Is an annual internal audit plan legally required in India?

No. Section 138 of the Companies Act 2013 prescribes no interval for internal audit. Rule 13(2) of the Companies (Accounts) Rules 2014 assigns the scope, functioning, periodicity and methodology to the Audit Committee or the Board, in consultation with the internal auditor. An annual cycle is a professional convention.

Does a listed company need to cross a threshold before internal audit applies?

No. Rule 13(1) of the Companies (Accounts) Rules 2014 applies to every listed company with no threshold at all. The turnover, borrowing, paid-up capital and deposit tests apply only to unlisted public companies and private companies, and each of those tests is measured against the preceding financial year.

Can internal audit rely on management’s monitoring data?

Not as a substitute for its own testing. Continuous monitoring is owned by management and embedded in the process, so it is not independent evidence. A mature function builds its own continuous auditing capability and treats management’s monitoring data as a risk signal in its own right, rather than as assurance.

Can an internal auditor be an employee of the company?

Yes. The Explanation to Rule 13 of the Companies (Accounts) Rules 2014 states expressly that the internal auditor may or may not be an employee of the company. This is what permits outsourced and co-sourced internal audit arrangements in India.

Does continuous risk intelligence replace deep-dive audits?

No. Deep-dive audits remain necessary for risks requiring nuanced professional judgement, complex fraud investigation and detailed process walkthroughs. The realistic model is hybrid, in which continuous analytics feed a dynamic risk register that informs a more agile audit plan.

Disclaimer: This article is intended for general information and does not constitute professional advice. Statutory positions are stated as at 3 September 2026 and readers should confirm current requirements before acting.

CategoriesAudit SBC
bySBC

PAS-6 Reconciliation of Share Capital Audit Report (Half-Yearly)

PAS-6 Reconciliation of Share Capital Audit Report (Half-Yearly)

Home > PAS-6 Reconciliation of Share Capital Audit Report (Half-Yearly)

PAS-6 Reconciliation of Share Capital Audit Report (Half-Yearly)

Introduction to Form PAS-6

What is Form PAS-6?

• A half-yearly audit report filed with the Registrar of Companies (ROC).

• Introduced under Rule 9A(8) of Companies (Prospectus and Allotment of Securities) Rules, 2014 in 10th September 2018.

• Certified by a practicing Company Secretary (CS) or Chartered Accountant (CA).

Purpose

• Verify issued capital against shares in Demat (NSDL/CDSL) and physical form.

• Report discrepancies and changes in share capital (e.g., bonus issues, ESOPs, buybacks).

• Ensure compliance with mandatory dematerialization for applicable companies.

• Ensures transparency in share capital by reconciling issued capital with Demat and physical shares.

Applicability Non-Applicability
Unlisted Public Limited Companies w.e.f. 02nd October 2018. Notification (MCA vide General Circular G.S.R. 376(E). dated 22nd May 2019)
• Nidhi Company
• Government Company
• Wholly Owned Subsidiary Company of Public Company
• Small Private Limited Companies

Timelines for Filing

Companies having ISIN Period for which Form PAS-6 is to be filed Due Date
Before 31st March 2025
April 1 – September 30
29th November
Before 31st March 2025
October 1 – March 31
30th May
After 1st April 2025 and before 30th June 2025
Private Limited Companies (other than small companies) not having ISIN & dematerialize their shares on or before 30th June 2025 must file for the half-year within 60 days ending 30th September 2025.
29th November 2025

Penalties for Non-Compliance

As per Section 450 of the Companies Act, 2013: Company and every officer in default:

• ₹10,000 and

• ₹1,000 per day for continuing default (Maximum: ₹2,00,000 for company and ₹50,000 for officer)

What is Dematerialization of Shares?

Dematerialization of shares is the process of converting physical share certificates into electronic form, stored in a digital account with a depository, such as the National Securities Depository Limited (NSDL) or Central Depository Services Limited (CDSL) in India

Aspect Listed Public Companies Unlisted Public Companies Private Companies
Applicability
Mandatory for all listed public companies under SEBI guidelines.
Mandatory for Unlisted public companies under MCA notification G.S.R. 853(E)
Mandatory for certain classes of private companies under MCA notification G.S.R. 802(E).
Regulatory Authority
Securities and Exchange Board of India (SEBI)
Ministry of Corporate Affairs (MCA)
Ministry of Corporate Affairs (MCA)
Threshold Criteria
Not applicable
Not applicable
Private companies (excluding small companies) with: • Share capital ≥ ₹4 crore and
• Turnover ≥ ₹40 crore
Applicability of PAS-6
Mandatory to file PAS-6
Mandatory to file PAS-6
Mandatory to file PAS-6 refer timelines for filing table
Verification & Process Oversight
Done by RTA (Registrar and Transfer Agent) under SEBI supervision
Done by RTA, but under MCA oversight if demat is mandated
Done by RTA, but under MCA oversight if demat is mandated

Important Note:

The deadline for dematerialization of shares by non-small private limited companies has been extended i.e., 30 June 2025. As per MCA General Circular G.S.R. 131(E) dated 12th February 2025, it is now mandatory for all non-small private limited companies to convert their physical share certificates into dematerialized form.

FAQ’s

Q1. What is the ISIN code?

ISIN (International Securities Identification Number) is a unique 12-digit alphanumeric code used to identify securities. Each country’s National Numbering Agency (NNA) issues ISINs. In India,

• NSDL issues ISINs for most securities, under SEBI’s direction.

• RBI handles ISIN allotment for government securities.

Q2. What is a Small Company?

A Small Company in India, as per the Companies Act, 2013 (Section 2(85)), is a private company with a

• Paid-up Share Capital of up to ₹4 crore and Turnover of up to ₹40 crore,

Q3. What is a not a Small Company?

1. A public company.

2. A holding or subsidiary company.

3. A Section 8 (charitable) company.

4, A company governed by a special Act (e.g., banking or insurance).

Q4. Is PAS-6 now applicable to private limited companies?

Yes, w.e.f. 1st July 2025, Non-Small Private Companies are required to file Form PAS-6. Therefore, they need to file for the half year ending September 2025 first time. i.e., before November 2025

Q5. Can a company file PAS-6 without having dematerialized its shares?

Obtaining an ISIN is mandatory as you must mention the ISIN number in the Form PAS-6,but shares can be in physical form.

Q6. Should a company file form PAS-6 for various securities separately?

Yes, as only one ISIN can be inserted in the form PAS-6. Thus, for various types and classes of securities different forms are needed to be furnished. A company must furnish the form PAS-6 for every ISIN issued to it.

Q7. Should PAS-6 be filed if there is no change in shareholding?

Yes, it must be filed for every applicable half-year regardless of changes.

Q8. Can a company issue shares in physical form?

No. As per Rule 9A(1)(a) of the Companies (Prospectus and Allotment of Securities) Rules, 2014, a company is under obligation to issue fresh securities only in the Demat form.

CONTACT US

RELATED POSTS