Quick Summary Your plant can hit every dispatch target and still lose margin. The leak hides inside the volume, which is why nobody spots it.Most of the money a factory loses goes out through nine valves. They are purchase rates, weighbridge slips, stores, scrap, power, spares, job work, credit notes and GST input credit.Statutory audit reviews last year’s books. Internal audit for manufacturing companies watches the plant while the money is still walking out.According to the ACFE 2026 global study, fraud alone eats about 5% of revenue a year. Everyday waste comes on top of that.Each month you wait, the same leak runs again on every shift. It rarely shrinks by itself.

Picture a Monday review at a ₹180 crore engineering components maker. Three plants, two shifts. Dispatch beat its target for the quarter, and the room is waiting for good news.

Then the CFO puts the gross margin on screen. It slipped by two points.

Nobody stole a truck or fiddled the ledger. The money walked out in small, boring ways that no job description asked anyone to watch.

A supplier nudged his rate up 3%, and no one checked it against last quarter. The scrap dealer paid last month’s copper price. And a job worker returned 940 kg out of 1,000, calling the rest process loss.

Run finance at a growing plant and you’ve probably sat through this meeting. You can feel the leak. Pointing to it is the hard part.

Finding it is exactly what internal audit for manufacturing companies is for. It tracks where value slips out between the purchase order and the dispatch gate, then puts a rupee number on each gap so someone owns the fix.

This guide gives you a leak map, a six step method, a quick self check and a 90 day plan.

Direct Answer: What is internal audit for manufacturing companies? It’s an independent, risk based internal audit of how a plant buys, stores, makes and sells. Auditors test controls on live operations, measure losses in rupees and push fixes through before the year closes. That’s how it catches process leaks like scrap, stock gaps and rate creep, which financial statements rarely show. Ever caught yourself saying “the numbers feel off, but I can’t prove it”? Keep reading.

Why Factory Leaks Stay Invisible

Big frauds grab headlines. Small leaks quietly cost you money, and they’re harder to catch because they look like normal work.

For its 2026 report, the ACFE studied 2,402 fraud cases across 143 countries. Manufacturing cases had a median loss of $170,000 each, with inventory theft, billing fraud and corruption at the top of the list.

The typical scheme ran for 12 months before anyone caught it. That’s a whole year of one leak, shift after shift.

Volume Hides Variance

On a busy floor, a 1.5% overuse of raw material looks like noise. Run it for 12 months across three plants, though, and it turns into a number your board would ask about.

It never gets flagged, because no one owns the gap between the BOM and the actual issue slip.

Your Data Lives in Different Rooms

Purchase data sits in your ERP. Stores keeps a separate register, security logs the gate passes, and the weighbridge prints slips of its own.

Then there’s the night shift supervisor, with a notebook only he can read.

Leaks live in the gaps between these records.

Trust Fills In for Controls

Fast growing companies run on trust. In many of them, one person raises the purchase order, approves it and books the invoice.

Your people may well be honest. The system still has a hole in it.

ACFE found that a lack of internal controls helped 33% of frauds happen, and management override of controls helped another 19%.

Statutory Audit Sits Outside the Plant

Your statutory auditor gives an opinion on the financial statements, and that job matters. It was never built to trace a missing coil of steel, though, or a scrap rate sitting ₹4 a kilo below market.

Try this today Ask finance for one number. You want actual raw material consumption against BOM standard for the last 90 days. If nobody can produce it within a day, you’ve found your first control gap.

The Plant Leak Map: Nine Places Money Quietly Escapes

Most cost leakage in manufacturing runs through the same nine valves. A sharp manufacturing internal audit checks these first.

Leak point	How it shows up	Red flag to watch	What the auditor tests
Procurement	Rate creep, split POs, one favoured vendor	Price variance against last purchase	Rate trend review, vendor concentration check
Goods receipt and weighbridge	Short supply billed in full	Gaps between gross and net weight	Match each slip to GRN and invoice
Stores and inventory	Phantom stock, shrinkage, dead stock	Book stock against physical count	Surprise counts, ageing analysis
Yield and scrap	Excess consumption, scrap sold cheap	Actual use against BOM	Yield reconciliation, scrap rate review
Power and utilities	Idle load, unmetered lines	Units per tonne of output	Meter reconciliation by shift
Maintenance and spares	Repeat buys, spares that walk away	Spares cost per machine hour	Issue slip tracing, breakdown log review
Job work and contract labour	Material not returned, padded headcount	Job work return ratio	Challan reconciliation, gate entry against attendance
Dispatch, discounts, credit notes	Unapproved discounts, backdated credit notes	Credit notes as a share of sales	Approval trail, price master review
GST input tax credit	Unclaimed or blocked credit, vendor mismatch	Gap between books and GSTR 2B	Monthly ITC reconciliation

Here’s what three of them look like on a real floor.

The Weighbridge Trick

A truck of steel rolls in and the gate records its gross weight. Instead of weighing the empty truck today, someone copies the tare weight from last month’s trip. The difference gets billed in full.

During an inventory audit, the auditor matches every weighbridge slip to the GRN and the supplier invoice. Odd patterns show up fast, like the same tare weight for 30 trips in a row.

Trucks don’t usually diet that consistently.

Scrap Is Cash in Disguise

Plenty of plants sell scrap to one dealer at a rate fixed years ago. The auditor checks the realised rate against market rates, then reconciles scrap generated with scrap sold.

If your scrap dealer knows your yield better than your MIS does, you have a problem.

GST Credit You Already Paid For

Unclaimed input tax credit is your own money, parked with the government. Every month, the audit reconciles your purchase books with GSTR 2B and flags vendors who file late. Their delay becomes your mismatch.

If a mismatch ever turns into a notice, this guide on replying to GST DRC 01 notices covers your first moves.

Worth sharing “Factories rarely lose money through one big hole. They lose it through nine small valves left half open.”

Statutory Audit vs Internal Audit for Manufacturing Companies

These two get mixed up all the time. Here’s the plain difference.

Point	Statutory audit	Internal audit
Purpose	Gives an opinion on the financial statements	Finds and fixes process and control gaps
Timing	After the year ends	During the year, often quarterly or monthly
Focus	Books and disclosures	Plant, stores, vendors, systems and people
Reports to	Shareholders	Board or audit committee
Output	Audit report and opinion	Findings with rupee impact, owners and deadlines
Leak detection	Limited by design	Its core job

You need both.

A strong internal audit in the manufacturing industry also speeds up the statutory audit, since your auditor runs into fewer surprises. For a department by department view of scope, this procurement to dispatch guide lays it out area by area.

How to Run a Leak Hunt in Six Steps

This is how a risk based internal audit runs on an actual plant. Each step has one trap worth avoiding.

1. Rank Risks by Rupees at Stake

Begin where spend and volume are highest, even when other areas are easier to audit. A ₹40 crore annual steel buy deserves more attention than the canteen contract. The usual trap is auditing last year’s areas again because the file already exists.

2. Pull the Full Data Trail

Pull purchase, stores, production and sales data out of the ERP. Add the weighbridge, gate and power meter records on top. The trap here is trusting summary reports someone else prepared for you.

3. Walk the Floor

Run surprise stock counts, visit the scrap yard and read the meters yourself. Data shows you patterns. The floor shows you the truth.

ACFE found that companies with surprise audits had median fraud losses 50% lower than those without. Don’t fall for the trap of announcing the count a week ahead.

4. Test Every Transaction, Not 25 Samples

Simple analytics can scan your entire year for duplicate invoices, round amounts, weekend entries and vendors sharing a bank account. ACFE reports that proactive data monitoring goes with 53% lower median losses.

Picking samples by hand is the trap, because people reach for the tidy ones.

5. Put a Rupee Number on Every Finding

Management acts on money, and adjectives rarely move it. “Weak scrap controls” earns a polite nod. “₹38 lakh a year below market rate” gets a meeting by Friday.

Watch for the classic trap, a 60 page report with no totals.

6. Assign an Owner and Retest in 90 Days

A finding without a name and a date comes back next year with a new file number. Give every observation one owner, one deadline and one retest. The trap is closing findings on a promise rather than on evidence.

Can Your Own Team Handle This?

Honestly, parts of it, yes. Your finance team can handle the BOM variance and the GSTR 2B match.

Where it usually falls apart is independence and time. People who run a process find it hard to audit that same process, and month end close always wins the fight for their hours.

That gap is where internal audit outsourcing or internal audit cosourcing fits in, with an outside team working alongside your staff.

From a Yearly Snapshot to Live Monitoring

Tools will keep changing, but the idea stays the same. You want to spot leaks while they’re still small, long before a report shows them a year later.

Continuous Auditing on ERP Data

Continuous auditing runs rules over your ERP every day, flagging rate jumps, duplicate vendor masters and approvals made at 2 a.m. Everything they need is already sitting in your ERP. The rules just read it.

Machine Data as Audit Evidence

If your plant runs MES or IoT sensors, you can compare machine output with material issued. Say the machines report 9,200 units and stores issued enough for 10,000. That’s a question worth asking.

AI and Anomaly Detection

AI tools can catch odd approval chains and price patterns that people miss. The controls around those tools are lagging behind, though.

In a 2026 survey of 3,285 audit leaders in 132 countries, the Institute of Internal Auditors’ Foundation found digital disruption, including AI, rated a top risk by 58%, up 10 points. Yet only 11% reported full audit coverage of it.

Most companies are adopting AI faster than they audit it.

What Technology Won’t Replace

Judgement, for a start. The floor walk, too, and the chat with the night shift supervisor who knows which machine “always runs a bit hungry.” A dashboard can’t smell burnt coolant, and it never will.

Who Gains When the Leaks Stop

• Promoters and MDs win back margin, a stronger valuation story and more confidence from lenders.
• CFOs and finance teams close books faster, face fewer audit surprises and price products on real cost data.
• Plant heads see better yield, fewer material disputes and clear ownership on the floor.
• Honest employees get fair systems that protect them from blame when something goes missing.
• Boards and audit committees get documented oversight and a cleaner compliance record.

Is Internal Audit Mandatory? The Section 138 Snapshot

Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, sets the floor. These are the companies that must appoint an internal auditor.

• Every listed company, whatever its size.
• Unlisted public companies with, in the preceding financial year, paid up capital of ₹50 crore or more, turnover of ₹200 crore or more, bank or financial institution borrowings above ₹100 crore at any point, or deposits of ₹25 crore or more at any point.
• Private companies with turnover of ₹200 crore or more, or bank or financial institution borrowings above ₹100 crore at any point, in the preceding financial year.

Two more rules reach right into your plant. CARO 2020 asks your statutory auditor to report on physical verification of inventory, and on discrepancies of 10% or more in any class of stock.

It also asks them to check if the quarterly stock statements you file with banks for working capital limits above ₹5 crore agree with your books. A weak stores process shows up right there.

In the cases the Act prescribes, directors and auditors must also comment on internal financial controls. If you need the controls side mapped and tested, start with this page.

Does your plant also fall under the cost records rules? Read up on manufacturing cost audit compliance before your next filing.

My own take is simple. Treat the legal threshold as the floor and never the goal, because leaks don’t wait for you to cross ₹200 crore.

Five Mistakes That Make Internal Audit Toothless

1. Reporting to the person being audited. The auditor should answer to the board or audit committee, never to the plant head.
2. Using a generic checklist. A foundry and a pharma unit leak in very different places.
3. Auditing once a year. Leaks happen every shift, so a yearly visit only catches the echo of the event.
4. Reporting observations without rupee impact. No number means no priority.
5. Skipping the follow up. An unchecked fix is just a nicer sentence in next year’s report.

What a Specialist Partner Brings to the Table

A good outside partner brings three things your team rarely has to spare: independence, plant specific test scripts and time.

PKC’s internal audit team runs outsourced and cosourced audits for ₹100 crore plus companies across multiple plants and branches. Every engagement follows a risk based plan, and each observation is tracked until it’s closed.

In one published engagement for a ₹600 crore energy company, the review turned up 30+ process and control gaps across purchase, finance, inventory and sales.

A finding only matters once someone fixes the process behind it. That’s why the audit side connects to PKC’s manufacturing practice, which works on BOM costing, stock management and process audits.

A problem spotted in stores then ends up as a changed SOP instead of a line in a file.

Your First 90 Days

Window	What happens	What you get
Days 1 to 30	Risk ranking by rupee exposure, data access, plant visits	A leak map built for your plants
Days 31 to 60	Fieldwork on the top three leak points, surprise counts, reconciliations	Tested evidence, not opinions
Days 61 to 90	Rupee based report, owner assignment, first retest	A short list of fixes with names and dates

Quick Self Check: Is Your Plant Leaking?

Just answer yes or no, and be honest. Nobody’s watching.

1. Do you reconcile actual consumption against BOM every month?
2. Has anyone run a surprise stock count in the last six months?
3. Do you know your scrap rate against the current market rate?
4. Does someone outside sales approve credit notes?
5. Do you match GST input credit with GSTR 2B every month?
6. Do job work challans close within a fixed number of days?
7. Does your internal auditor report straight to the board or audit committee?

Your score Three or more “no” answers point to active leaks worth checking this quarter. At five or more, the leak is probably bigger than you think.

Frequently Asked Questions

Is internal audit mandatory for manufacturing companies in India?

It depends on size and listing status. Under Section 138 and Rule 13, every listed company needs one.

A private company needs one if turnover reached ₹200 crore or bank borrowings crossed ₹100 crore in the preceding year. Unlisted public companies have four tests, including ₹50 crore paid up capital and ₹25 crore in deposits.

How often should a manufacturing company do an internal audit?

Most plants run a quarterly cycle. For high risk areas like stores, scrap and procurement, monthly checks or continuous monitoring work better.

A yearly audit alone is too slow for a plant running three shifts, because a leak can repeat hundreds of times before anyone looks.

What does an internal auditor check in a factory?

The auditor checks purchase rates, goods receipts, weighbridge slips, stock counts, yield against BOM, scrap sales, power use, spares, job work challans, credit notes and GST input credit.

They also look at who approves what. Weak segregation of duties lets small leaks grow.

How is internal audit different from statutory audit for a manufacturer?

Statutory audit gives an opinion on your financial statements after the year ends, and it reports to shareholders. Internal audit works during the year, testing your plant processes and controls and reporting to the board.

One certifies the books. The other finds where money leaks before it reaches the books.

Should a manufacturer outsource internal audit or build an in house team?

Large groups with steady audit work often build a small in house team. Mid sized manufacturers with several plants usually do better with an outsourced or cosourced model.

You get independence and specialist skills without the full time cost, and your finance team stays focused on closing the books.

How do you pick an internal audit firm for a manufacturing company?

Look for ICAI registered auditors who have manufacturing clients, plant floor testing methods and rupee based reporting. Ask to see a sample report and a 90 day plan.

PKC Management Consulting is one option for ₹100 crore plus manufacturers, offering outsourced and cosourced audits across multiple plants.

The Leak You Find This Quarter Stops Repeating

Think back to that Monday review. Dispatch hit target and margin slipped anyway, with nothing dramatic behind it.

A rate crept up, a slip got copied and a scrap price went stale.

That’s the real case for internal audit for manufacturing companies. Leaks hide inside normal work, so finding them takes a system rather than suspicion. Once you catch one, it stops running on every shift after that.

Not sure where your plant leaks most? Pull the 90 day consumption gap from earlier first. Then schedule an appointment with PKC’s risk advisory team and walk through the numbers together.

About the author This article was written by the risk advisory desk at PKC Management Consulting, a Chennai based, ICAI registered CA and management consulting firm that has worked with ₹100 crore plus companies since 1988.

EDITOR FLAGS (remove before publishing)

.

• Brand inclusion (Step 16): this is not a listicle, so the brand appears in the partner section, the FAQ on choosing a firm, the CTA and the author bio. Total brand mentions: 5. No superlatives, per the ICAI guideline.
• Anecdotes: the Monday review, the ₹38 lakh scrap figure and the 9,200 unit example are illustrative. Swap in a real, anonymised story from a PKC partner for stronger E E A T.
• Not used: PKC’s site claims such as “up to 40% fewer control gaps” were left out because the site gives no method behind them.
• Verify at publishing: Rule 13 thresholds and CARO 2020 clauses against current MCA notifications. Run the ZeroGPT check, which cannot run from here.