Audit and assurance: statutory, tax, internal, IFC and systems audit
Independent audits and reviews for companies, LLPs, partnership firms, proprietors, trusts and co-operative societies. Each audit is planned around the business and its risks, carried out under the Standards on Auditing issued by ICAI, and reported clearly.
Scope
What the work covers
An audit is only as useful as the understanding behind it. Ryan Vaz, FCA has spent much of his career inside finance functions as a CFO and finance controller, and brings that view to the audit: where controls are bypassed in practice, which balances need the closest look, and which findings management actually needs to act on.
Data analytics is used to test full ledgers rather than small samples where that adds assurance, with every exception reviewed by the audit team. Independence rules are applied strictly: the firm does not act as statutory auditor and internal auditor for the same entity, and does not audit work it has prepared.
- Statutory audit of companies under the Companies Act, 2013, and of LLPs, partnership firms and other entities
- Tax audit under the Income-tax Act, with the audit report in Form 3CA or 3CB and particulars in Form 3CD
- Internal audit: process reviews, control testing and risk-based audit plans, including for companies required to appoint an internal auditor
- Internal financial controls (IFC): documentation of processes and risk and control matrices, design review and testing of operating effectiveness, supporting the auditor's reporting on IFC under section 143(3)(i) and the directors' responsibility statement under the Companies Act, 2013
- Information systems audit: IT general controls, user access, segregation of duties and ERP controls in SAP, Oracle, Tally and other systems
- Stock and receivables audits for banks and lenders, and physical verification of inventory and fixed assets
- Audit of charitable trusts, NGOs and educational institutions, including income tax audit reports for exempt entities
- Audit of co-operative housing societies (see the separate service page)
- Certifications required by banks, regulators and government departments
- Forensic audit and fact-finding reviews (see the separate service page)
Approach
How the work is done
Plan
The engagement starts with an understanding of the business, its systems and its risks, and an audit plan and timetable agreed with management.
Test
Controls and balances are tested through inquiry, inspection, confirmation and data analytics, with work documented to ICAI's Standards on Auditing.
Discuss
Findings are discussed with management while there is still time to correct errors or explain differences, before the report is finalised.
Report
The audit report is issued with a separate management letter on control weaknesses and practical improvements.
Getting started
Records to keep ready
- Trial balance, ledgers and the previous year's audited financial statements
- Bank statements, confirmations and loan documents
- Fixed asset register, inventory records and valuation working
- Statutory registers, minutes and returns filed during the year
- GST, TDS and income tax returns and challans for the year
Background
Ryan Vaz, FCA is a Fellow Chartered Accountant and Certified Forensic Accountant (ICAI) with more than 25 years of CFO-level experience, including ERP implementations in SAP and Oracle, which informs both financial and information systems audits. See experience and expertise.
Fees
Fees depend on the scope of work, the volume and condition of records and the time required, and are confirmed in writing in an engagement letter before work begins.
Questions about audit and assurance
What is the difference between a statutory audit and an internal audit?
A statutory audit is required by law and gives an independent opinion on whether the financial statements present a true and fair view. An internal audit is a continuing review of processes and controls for management and the board. The two must be done by different firms for the same entity.
Who needs a tax audit?
A tax audit is required when business turnover or professional receipts exceed the limits set in the Income-tax Act, and in certain other cases, such as when presumptive income is declared below the prescribed rate. The report is filed on the e-filing portal in Form 3CA or 3CB with Form 3CD.
What are internal financial controls (IFC)?
Internal financial controls are the policies and procedures a company uses to ensure orderly and efficient conduct of its business, safeguard its assets, prevent and detect fraud and error, and keep accurate and complete accounting records. The Companies Act, 2013 requires the statutory auditor of most companies to report on whether adequate IFC with reference to financial statements exist and operate effectively, so companies need them documented and tested.
What is an information systems audit?
An information systems audit reviews whether the computer systems that record transactions are reliable: who can access them, whether duties are separated, how changes are controlled and whether data is backed up and secure. It is often carried out alongside the financial audit or after a new ERP goes live.
When is the tax audit report due for FY 2025-26?
For FY 2025-26 the due date for the tax audit report was extended by CBDT from 30 September 2026 to 21 October 2026, and the return due date for audit cases to 21 November 2026. See the compliance calendar for current dates.
Contact
Phone +91 95384 16161 or email ryan@vazassociates.in. Office opposite Maxus Mall, L.T. Road, Borivali West, Mumbai 400092. Work can also be handled remotely.