Internal Audit Checklist for a Manufacturing Company
Last updated: 16 October 2026
Quick Answer: The internal audit checklist for a manufacturing company tests seven processes: procurement, stores, production, sales, payroll, fixed assets, and cash, bank and ERP access. Each line states the control to check, the evidence to inspect and the risk if the control fails, so every finding traces to stock, cash or margin.
Most templates ranking for this search are quality-system or safety checklists. They do not show an MD or CFO whether purchases, stock, scrap and receivables are under control. This guide closes that gap with an internal audit checklist for manufacturing plants, ready for a spreadsheet.
Which Processes Should the Checklist Cover?
Seven, because they are where a plant's money moves:
- Procurement
- Stores and inventory
- Production and job work, including scrap
- Sales and receivables
- Payroll and contract labour
- Fixed assets
- Cash, bank and ERP access
The checklist draws on, but does not replace, the plant's ISO 9001, safety and pollution control audits: a rising rejection rate or a lapsed licence is a control finding too.
Which Laws Shape an Internal Audit Checklist for Manufacturing Units?
- Companies Act, 2013. Section 138 requires prescribed classes of companies to appoint an internal auditor. Rule 13 of the Companies (Accounts) Rules, 2014 covers every listed company and sets the tests for unlisted ones, and rule 13(2) leaves scope and periodicity to the audit committee or board.
- CARO 2020. Where it applies, the statutory auditor reports on physical verification of inventory and property, plant and equipment, and on bank stock statements where working capital limits above ₹5 crore are secured on current assets. It also reports whether the internal audit system suits the size and nature of the business.
- GST on job work. Section 143 of the CGST Act allows one year for inputs and three years for capital goods to come back from a job worker or be supplied from its premises; supply from those premises needs them declared as the principal's additional place of business, unless the job worker is registered or the goods are notified by the Commissioner. On sufficient cause, the Commissioner may extend the one-year period by up to a year and the three-year period by up to two. Goods not back in time count as supplied on the day they were sent out. The limits do not apply to moulds and dies, jigs and fixtures, or tools.
Internal Audit Checklist Format: Columns, Evidence and Ratings
A usable internal audit checklist format holds one row per check and the same columns for every process.
| Column | What goes in it |
|---|---|
| Process | For example, stores: issue to production |
| Check | The controls, as one pass or fail test |
| Evidence | The register, report or log read |
| Sample | Period and number of items tested |
| Risk | The loss if the control fails |
| Result and rating | Pass or fail; high, medium or low |
| Owner and date | Who fixes it, by when |
Process-by-Process Checks for a Manufacturing Plant
These rows are illustrative; the purchase audit checklist expands procurement into 30 checks. Add rows for your sites and sector: textile, dairy, engineering and other sectors each carry their own risks.
Procurement (indent to pay)
| Check | Evidence | Risk |
|---|---|---|
| Each PO follows an approved indent and a quotation or rate contract, within the approver's limit | PO register against the delegation of authority; comparative statements | Split orders; inflated prices; a favoured vendor |
| Dues to micro and small suppliers clear by the written agreed date, at most 45 days from acceptance or deemed acceptance, else within 15 days | Ageing of Udyam-registered vendors | Monthly compound interest, at three times the bank rate RBI notifies |
| New vendors and changes to a vendor's bank account are approved outside the purchase team and checked against a bank letter or cancelled cheque | Vendor master change log; approvals | Payments diverted to a false or altered account |
| Goods received notes match the PO for quantity and accepted quality before the bill is booked | GRN, PO and bill match report | Payment for short or rejected supplies |
| Debit notes for rejections, shortages and price differences are raised and recovered | Rejection register; debit notes | Losses absorbed without recovery |
| Supplier advances are approved, aged and adjusted against bills | Advance ageing | Old unadjusted advances; funds parked with a related vendor |
| Rate contracts are renewed on time and compared with recent quotes | Rate contract register; recent quotations | Prices above the market after a contract lapses |
Stores and inventory
| Check | Evidence | Risk |
|---|---|---|
| Receipts and issues are posted the same day; counts run at set intervals and variances are explained before adjustment | GRN dates; count sheets; CARO 2020 flags discrepancies of 10% or more per class | Book stock not on the floor; theft written off as variance |
| Stock and debtor statements filed with the bank, monthly or quarterly as the sanction sets, agree with the books | Statements against the ledgers | Wrong drawing power; an adverse CARO remark |
| Issues to production are made only against approved material requisitions | Requisitions against issue entries | Unauthorised consumption |
| Stock with job workers, depots and third-party warehouses is confirmed in writing at set intervals | Signed stock confirmations | Stock that exists only in the books |
| Items with no movement beyond the company's cut-off are aged and reviewed for write-down | Ageing by last movement date; write-down approvals | Overstated inventory and profit |
| Stores access is restricted, and gate inward and outward entries agree with receipts and issues | Gate registers; stores access list | Material leaving without documents |
Production, quality and job work
| Check | Evidence | Risk |
|---|---|---|
| Issues to each production order stay within the bill of materials plus approved excess | Issues against standard consumption | Hidden yield loss |
| Scrap and rejections are weighed by shift and matched to scrap sales | Scrap register, weighbridge slips, invoices | Scrap sold off the books |
| Job-work goods are tracked by challan and return within the GST time limits | Challan register; job-worker stock confirmations | Tax on a deemed supply; lost stock |
| Production orders are closed when complete, and work in progress is valued at its actual stage | Open order list; WIP valuation sheet | Old open orders hiding variances |
| Yield and consumption variances above a set tolerance are investigated and signed off | Variance reports with sign-off | Leakage accepted as normal loss |
| Rejections and rework are recorded with their cost and cause | Quality reports; rework register | Repeated rejection cost that no one sees |
Sales and receivables (order to cash)
| Check | Evidence | Risk |
|---|---|---|
| Invoice rates and discounts match the approved price list; dispatches above a credit limit need a named approver | Discount approvals; credit-block release log | Revenue leakage; bad debts |
| Every gate outward entry has an invoice; post-period credit notes are reviewed | Outward register; next-month credit notes | Unbilled dispatches; inflated sales |
| New customers and changes to credit limits are approved by finance, not by sales | Customer master change log | Credit to weak or related buyers |
| Receivables are aged monthly, overdue accounts are followed up and provisions follow a written policy | Ageing; follow-up log; provision working | Bad debts recognised late |
| Sales returns are received through an inward entry and matched to credit notes | Returns inward register; credit notes | Credit notes without goods coming back |
| Customer balances are confirmed at intervals | Balance confirmations | Disputed or fictitious balances |
| E-invoices and e-way bills, where required, agree with the sales invoice | GST portal reports against the sales register | Penalties; detained consignments |
Payroll and contract labour
| Check | Evidence | Risk |
|---|---|---|
| Wages follow gate or biometric attendance; contractor bills match gate headcount and PF and ESI challans | Attendance, wage register, challans and bills | Wages for absent workers; labour not supplied |
| PF and ESI are deposited by the due dates | Challans against payroll | Interest and penalties |
| Joiners, leavers and pay changes are approved by HR and reach payroll in the same month | Joiner and leaver forms; payroll change report | Pay to people who have left |
| Overtime is approved in advance and checked against attendance | Overtime approvals; attendance | Inflated overtime |
| Full and final settlements are worked out and approved before release | Settlement workings; approvals | Overpayment on exit |
| TDS on salaries is worked out and deposited by the due dates | TDS workings; challans | Interest and penalties |
Fixed assets
| Check | Evidence | Risk |
|---|---|---|
| The register shows location, tag and quantity, assets are verified at intervals, and disposals are approved | Register against tags; verification report; sale invoices | Missing assets; assets sold without a record; an adverse CARO remark |
| Machines follow the preventive maintenance plan; repairs are not capitalised | Maintenance log; capital work-in-progress vouchers | Breakdowns; overstated profit |
| Capital spending follows an approved budget, and capitalisation dates match the date each asset was put to use | Capex approvals; installation reports | Depreciation from the wrong date |
| Capital work-in-progress is aged and stalled projects are reviewed | Capital work-in-progress ageing | Idle spending carried as an asset |
| Insurance covers every asset location at a current value | Insurance schedule against the register | Uninsured loss |
Cash, bank and ERP access
| Check | Evidence | Risk |
|---|---|---|
| ERP user rights are reviewed quarterly; no shared IDs, and no one both creates vendors and releases payments | User list and role matrix; review sign-off | Fraud through a segregation of duties breach |
| Bank reconciliations are reviewed monthly and old reconciling items are cleared | Signed reconciliations; bank statements | Unrecorded or diverted payments |
| Payments are released under dual control, and surplus funds are invested only within board-approved limits | Bank portal approval log; investment register | Unauthorised transfers; risky placements |
| Petty cash is counted by surprise and kept within an approved imprest | Surprise count sheets | Shortages; personal use of cash |
| The accounting software keeps an audit trail of every change, and it has not been switched off | Audit trail settings and change report | Back-dated or altered entries |
| Data backups are taken on schedule and a restore is tested | Backup logs; restore test record | Data loss after a system failure |
Where the company is also building an information security management system, these access rows overlap with the controls set during ISO 27001 implementation.
Stock statements that disagree with the books surface in a bank stock audit; an outside team can carry out the physical verification of stock and fixed assets.
How Is the Checklist Run and Reported?
- Pick the rows. Rank processes by value and past findings.
- Walk one transaction. Follow a live document from gate to ledger.
- Fill the Sample column. Pull samples from the system, not from files prepared for the audit.
- Rate and draft. ICAI's Standard on Internal Audit 310 asks for findings ranked by significance and reviewed by management in draft. The standards are recommendatory today; ICAI has announced they will become mandatory from a date to be notified.
- Close the Owner and date column. Retest failed rows next cycle; report open items to the board.
Who Should Run the Checklist?
Three models work, provided the tester does not run the process:
- In-house: a team reporting to the audit committee or board.
- Outsourced: an external firm appointed as internal auditor.
- Co-sourced: finance runs monthly checks; an outside firm tests high-risk rows quarterly.
Section 144 of the Companies Act, 2013 bars the auditor who reports on the accounts from also carrying out the internal audit.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, follows a process-based approach in line with the COSO framework. Its internal audit for manufacturing companies reviews purchasing (indent to pay), sales (order to cash), inventory, and accounts and finance, drawing on a library of more than 1,500 risks and controls. Its five-step process is set out on the internal audit services in Coimbatore page.
Before appointing any outside firm, take up references; what clients say about Astral Business Consulting LLP shows the evidence worth asking for.
Need These Checks Tested?
To arrange this, speak to the Integrated Audit division of Astral Business Consulting LLP.
Frequently Asked Questions
Does ICAI publish a ready-made checklist for factories?
Yes, a generic one. ICAI's illustrative Internal Audit Checklist (second edition, February 2024), issued by the board now called the Internal Audit Standards Board, is built on risk and control matrices, including order to cash for manufacturing, purchase to pay for direct material, inventory management and fixed assets. It is not plant-specific, so companies add rows for job work, scrap and sector risks.
Should the checklist be kept in Excel or in audit software?
Excel suits one plant and one audit team, provided every row keeps its evidence reference and the file is version-controlled. Multi-plant groups gain from software that tracks samples, owners and open findings across cycles.
How often should each process be tested?
Test high-risk rows such as stores, scrap and job work every quarter, and lower-risk rows once or twice a year. The annual internal audit plan sets the cycle, and a row that keeps failing moves to the shorter one.
Does a dairy or food plant need different checks?
The seven processes stay, but the rows change. A dairy adds milk procurement against fat and solids-not-fat (SNF) readings, chilling losses and route-wise collections. A food unit adds batch traceability and expiry write-offs.