How Internal Audits Help Businesses Prevent Revenue Leakage And Improve Controls

How Internal Audits Help Businesses Prevent Revenue Leakage And Improve Controls

Every business, irrespective of its size, loses a portion of its earnings in places it rarely looks. A discount that was never approved, a delivery that was never invoiced, a credit note raised without supporting documents, an input tax credit that lapsed because of a missed deadline: none of these appears as a separate line in the profit and loss account, yet together they quietly erode margins. This silent erosion is what finance professionals call revenue leakage. In a year when India has moved to a new Income-tax Act, a more data-driven GST regime and tighter expectations on internal financial controls, leakage is no longer only a commercial concern; it is also a compliance and reputational risk. Internal audit is the function best placed to detect leakage early, fix its root causes and keep it from returning. Unlike a statutory audit, which expresses an opinion on whether the financial statements give a true and fair view, an internal audit examines how the business actually runs, day by day and transaction by transaction. This article explains how internal audits help management prevent revenue leakage, strengthen controls and stay aligned with the latest legal developments that every business owner, CFO and audit committee should know.

Understanding Revenue Leakage

Revenue leakage is any loss of income that a business was entitled to earn or collect but did not, because of errors, weak processes, oversight gaps or deliberate manipulation. It rarely arrives as one large event. It usually builds up through small, repeated slippages that go unnoticed because nobody owns the end-to-end process. Common examples include prices in the invoice that differ from the approved price list, customers billed for fewer units than were dispatched, contractual escalations and renewals that are never applied, free services extended beyond the agreed scope, expired credit periods with no follow-up, and incentives or rebates paid twice. On the tax side, leakage takes the form of eligible input tax credit not claimed in time, interest and late fees paid because of poor tracking, and deductions disallowed for want of documentation. Studies of mid-sized organisations consistently show that even a one to three per cent leakage on turnover can wipe out a large part of the net margin. The difficulty is that leakage hides in the gaps between departments: sales commits, operations delivers, finance bills, and no one reconciles all three. An internal audit deliberately crosses these boundaries, tracing a transaction from the customer order to the cash in bank, and therefore sees what each department individually cannot.

Internal Audit and Statutory Audit: A Clear Distinction

Business owners often assume that the annual statutory audit will catch leakage. It usually will not, because its objective and materiality threshold are different. A statutory auditor tests whether the financial statements are free from material misstatement; an internal auditor tests whether processes and controls are designed and operating effectively, regardless of whether the numbers are materially wrong. Under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014, prescribed classes of companies must appoint an internal auditor, who may be a Chartered Accountant, a Cost Accountant or another professional the Board considers suitable. These include all listed companies, and unlisted public and private companies that cross the prescribed thresholds of paid-up capital, turnover, bank borrowings or deposits in the preceding financial year. Companies should verify the current thresholds against the Rule each year. In addition, the statutory auditor reports under the Companies (Auditor's Report) Order, 2020 on whether the company has an internal audit system commensurate with its size and business. LLPs, partnership firms and proprietary concerns are not covered by Section 138, but a growing number of them appoint internal auditors voluntarily because lenders, investors and acquirers increasingly ask for internal audit reports during due diligence.

Where Leakage Hides: The Order-to-Cash Cycle

The order-to-cash cycle is where most revenue leakage originates, and it is therefore the first area an internal auditor examines. The review begins with master data: are customer prices, discount slabs, credit limits and payment terms approved, locked in the system and changed only through a documented workflow? The auditor then matches sales orders to dispatch records and dispatch records to invoices, looking for shipments that were never billed, services delivered but not invoiced, and unbilled work-in-progress that stays open for months. Credit notes, rate differences and write-offs are sampled for proper authorisation and supporting evidence, since these are the commonest routes for both genuine errors and misappropriation. Contract compliance testing checks that agreed escalations, minimum commitments, penalties and renewal charges have actually been billed. Finally, the receivables ageing is analysed to see whether collection follow-ups are timely, whether advances are properly adjusted, and whether customers continue to be supplied despite breaching credit limits. Each of these tests converts a vague worry about leakage into a specific, quantified finding, such as the number of invoices issued below approved price and the rupee value forgone, which gives management a clear basis for corrective action.

Procure-to-Pay and Expense Controls

Revenue protection is only half the story; profit is equally lost when money leaves the business unnecessarily. The procure-to-pay cycle is therefore reviewed alongside order-to-cash. Internal auditors examine the vendor master for duplicate or dormant vendors, vendors sharing bank accounts or addresses with employees, and unapproved changes to bank details, which is a frequent route for payment fraud. They perform three-way matching of purchase orders, goods receipt notes and vendor invoices to identify quantity and rate variances that were paid without challenge. Duplicate invoices, advances that were never adjusted, and payments released ahead of due dates, which drain working capital, are identified through data analytics rather than manual sampling. Expense claims, travel reimbursements and petty cash are tested against policy limits and supporting documents. The review also looks at segregation of duties: the person who creates a vendor should not approve the payment, and the person who raises a purchase request should not receive the goods. Weak segregation is among the most common control gaps and the most common precursor of fraud. By closing these gaps, businesses protect cash flow and also strengthen the reliability of the financial information on which the Board and lenders rely.

GST: Tax Leakage and Recent Developments

GST has become a major source of leakage because errors now translate quickly into cash outflow. The Invoice Management System and the amendment facility in Form GSTR-1A mean that supplier-side corrections flow to the recipient's GSTR-2B, so unreconciled or unaccepted invoices can reduce eligible credit. The portal has also introduced system blocks, including restrictions on filing GSTR-3B where credit claimed in the reclaim table exceeds the balance in the relevant ledger. E-invoicing remains mandatory for businesses above the prescribed turnover threshold of five crore rupees, taxpayers with turnover of ten crore rupees or more must report e-invoices on the IRP within thirty days of the invoice date, and six-digit HSN reporting applies to larger taxpayers. The GST Appellate Tribunal is now operational, with benches commencing work, which gives businesses a second appellate forum but also signals that departmental scrutiny will continue. Draft revised GSTR-1, GSTR-1A and IFF forms have been released for public consultation from 1 November 2026, with the revised forms proposed to take effect from 1 April 2027. An internal audit of GST tests monthly reconciliations of books with GSTR-1, GSTR-3B and GSTR-2B, time limits for claiming credit under Section 16(4), reversals required when suppliers have not paid or filed, and the accuracy of HSN and rate classification after the recent rate rationalisation.

The Income-tax Act, 2025: What Changes for Controls

The Income-tax Act, 2025 came into force on 1 April 2026 and replaces the Income-tax Act, 1961. The concepts of previous year and assessment year are replaced by a single Tax Year, the number of sections has been reduced significantly and the chapters consolidated, and TDS and TCS provisions have been restated and rationalised for specified transactions. The Government has described the change as a simplification exercise that keeps the underlying tax policy and rates intact, but for businesses the practical impact on controls is considerable. Every internal reference in the company's compliance manuals, TDS master data, tax audit checklists and ERP tax codes that cites an old section number now needs to be mapped to the corresponding provision of the new Act and the Rules framed under it. An internal audit should verify that TDS and TCS are deducted and collected at the correct rate on the correct base, that deposits and returns are timely, and that payment-linked deduction conditions, such as those relating to dues payable to micro and small enterprises, are tracked in the books. Interest, fees and disallowances caused by missed deductions are a direct and avoidable form of leakage, which makes this one of the most valuable areas for review during the transition year.

Companies Act Requirements: Internal Financial Controls and Audit Trail

The Companies Act places the responsibility for internal financial controls squarely on the Board. Directors of listed companies must state that adequate controls are in place and operating effectively, and the statutory auditor reports on the adequacy and operating effectiveness of internal financial controls over financial reporting under Section 143(3)(i). A further requirement that has changed how finance teams work is the audit trail rule. Since 1 April 2023, companies using accounting software must use software that records an edit log of every change, with the audit trail enabled throughout the year and not capable of being switched off. The statutory auditor reports on this under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014. Internal audit supports compliance by testing whether the feature is genuinely enabled across all modules and any third-party systems, whether access and privileged-user rights are controlled, and whether edit logs are preserved as required. Regulatory developments continue: the Companies Amendment Bill proposals reported in 2026, which include a longer cooling-off period before an outgoing auditor can provide non-audit services, and proposed relaxations for smaller companies, should be tracked, as their final form may change what internal audit must cover.

Technology, Data Analytics and Continuous Auditing

Traditional internal audit relied on sampling a few dozen transactions and hoping the sample would reveal the problem. Modern internal audit tests entire populations. Using extracts from the ERP or accounting system, auditors can run analytics across every invoice, credit note, vendor payment and journal entry in a few hours. Typical tests include price and discount outliers against the master, invoices posted but never delivered, sequence gaps in documents, duplicate payments, journal entries posted on weekends or near period ends by senior users, round-sum entries and unusual reversals. For GST, the same approach reconciles books with the portal data automatically and flags missing or mismatched invoices before the monthly return is filed. Continuous auditing takes the idea further by running selected tests monthly or even weekly, so that leakage is stopped within days rather than discovered after the year closes. The audit-trail requirement makes this far more effective because every change is now logged. Technology does not replace professional judgement; it directs the auditor's attention to the exceptions that matter, and it lets the internal audit team spend its time on understanding root causes and recommending practical fixes instead of ticking vouchers.

The Internal Audit Process: From Risk Assessment to Follow-up

A well-run internal audit follows a structured process. It begins with a risk assessment that identifies the processes with the highest financial exposure and the weakest controls, and this feeds a risk-based annual audit plan approved by the audit committee or the Board. For each process the auditor documents the flow through walkthroughs and prepares a risk and control matrix that links each risk to the control meant to address it. The auditor then tests the design of those controls and whether they operated consistently through the period. Findings are rated by severity, quantified wherever possible, and discussed with process owners before the report is finalised so that recommendations are practical and accepted. The report sets out the observation, the root cause, the financial impact, the recommended action, the owner and a timeline. Importantly, the process does not end with the report: a follow-up review verifies that agreed actions have actually been implemented. The profession's framework continues to evolve, and the ICAI's Internal Audit Standards Board has invited comments on draft revised internal audit checklists, which signals a continuing emphasis on consistent, high-quality practice. Firms that follow the Standards on Internal Audit give their clients work that is documented, defensible and comparable year after year.

Business Benefits of a Strong Internal Audit Function

The benefits of effective internal audit extend well beyond the recovery of leaked revenue, although that alone often pays for the audit many times over. Recoveries of unbilled revenue, wrongly granted discounts, duplicate payments and lapsed credits improve profitability immediately. Stronger controls reduce the chance of errors and fraud, and visible oversight is itself a deterrent, because employees know that exceptions will be found. Timely compliance reduces interest, late fees, penalties and disputes, and shortens the period management spends on departmental queries. Better receivables discipline improves cash flow and lowers dependence on working-capital borrowing. Clean, reconciled records make statutory audit smoother and faster, reducing audit fees and last-minute adjustments. Lenders, private equity investors and prospective acquirers place significant weight on a track record of internal audit, and businesses that can show it often secure finance on better terms and complete due diligence more quickly. Internally, process owners gain clarity on what is expected of them, and the Board and audit committee gain independent assurance that the business is being run in line with its policies. In short, internal audit converts compliance spending into a measurable return.

Practical Steps Businesses Can Take Now

Businesses do not need to wait for a year-end exercise to begin reducing leakage. Start by mapping your revenue process from enquiry to collection and identifying who owns each step. Clean up the master data: price lists, customer credit limits, vendor details and tax codes should be reviewed and approved at defined intervals. Insist that credit notes, write-offs, manual journals and bank-detail changes require independent approval. Reconcile sales registers with dispatch records and GST returns every month, not once a year. Update your tax compliance calendar, TDS mapping and ERP configuration for the Income-tax Act, 2025, and review the Invoice Management System workflow so that a named person accepts or rejects supplier invoices every month. Confirm that your accounting software's audit trail is switched on and cannot be disabled. Create a simple dashboard of leakage indicators, such as the number of invoices below approved price, unbilled deliveries, overdue receivables and ITC mismatches, and review it at the management meeting. Finally, schedule a risk-based internal audit, even if your company is not covered by Section 138, because an independent review often reveals what management has stopped seeing.

Conclusion: Turn Controls into a Competitive Advantage

Revenue leakage is rarely dramatic, which is precisely why it is so costly. It thrives where processes are unclear, controls rely on individuals rather than systems, and nobody looks across departmental boundaries. At the same time, the regulatory environment has become less forgiving: the Income-tax Act, 2025 is now in force, GST depends heavily on data matching and invoice-level acceptance, and the Companies Act expects documented internal financial controls and a tamper-proof audit trail. An internal audit brings these threads together. It identifies where money is being lost, explains why, quantifies the impact and gives management a practical roadmap to fix the problem and keep it fixed. For growing businesses, it is also a sign of governance maturity that lenders, investors and customers recognise. Our firm offers risk-based internal audits, GST and income-tax compliance reviews, internal financial control assessments and data-analytics-led leakage studies tailored to your industry and size. To discuss how an internal audit can protect your margins and strengthen your controls, please contact our team for a consultation.

Disclaimer: This article is for general information only and does not constitute professional advice. Thresholds, rates and due dates are subject to change; please consult us before acting on any specific matter.