Internal Audit Services
Internal audit is a year-round, independent check on whether your controls and records work. Under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014, it is compulsory for listed companies and for larger unlisted public and private companies. We check whether it applies to you, agree the scope with your board and report findings you can act on.
What it is
The statutory auditor looks at your accounts once a year, after the year is over. An internal auditor looks at how the business runs while the year is still going: who approves purchases, whether stock counts match the books, whether vendor payments follow your rules. Problems get fixed in the same year.
Section 138(1) of the Companies Act, 2013 requires prescribed classes of companies to appoint an internal auditor, who must be a chartered accountant, a cost accountant or another professional decided by the board. Rule 13(1) of the Companies (Accounts) Rules, 2014 sets the classes. Rule 13(2) says the audit committee or the board, in consultation with the internal auditor, decides the scope, functioning, periodicity and methodology of the audit.
Who it applies to
You are listed
Listing alone triggers Section 138, whatever your turnover or borrowings. An SME-platform listing counts too.
You are an unlisted public company
Any one of four tests in the preceding financial year: paid-up capital, turnover, bank borrowings or deposits. Cross one and internal audit applies.
You are a larger private company
Only two tests apply: turnover, and borrowings from banks and public financial institutions. Paid-up capital and deposits do not count.
Check the thresholds
| Test (Rule 13(1)) | Unlisted public company | Private company |
|---|---|---|
| Paid-up share capital | ₹50 crore or more during the preceding financial year | Not a test |
| Turnover | ₹200 crore or more during the preceding financial year | ₹200 crore or more during the preceding financial year |
| Outstanding loans or borrowings from banks or public financial institutions | Exceeding ₹100 crore at any point of time during the preceding financial year | Exceeding ₹100 crore at any point of time during the preceding financial year |
| Outstanding deposits | ₹25 crore or more at any point of time during the preceding financial year | Not a test |
Every listed company is covered under Rule 13(1)(a), with no threshold. The tests look back one year: for 2026-27, you check your 2025-26 figures.
Here is the catch: the words “at any point of time”. Take a Faridabad steel trader whose cash-credit and term loans touched ₹105 crore for six weeks before Diwali, then fell to ₹80 crore by 31 March. It is covered, even though the balance sheet shows less.
Why it matters
Answer your statutory auditor
CARO 2020 clause 3(xiv) requires the statutory auditor to report whether the company has an internal audit system commensurate with its size and nature, and whether the internal auditors’ reports were considered.
Find leaks early
Duplicate vendor payments, slow-moving stock and input credits missed in your GST returns are cheaper to fix in July than to explain in May.
Give the board an honest view
Directors answer for the company’s controls. An internal audit report tells them in writing where the controls hold and where they fail.
Documents required
To test applicability
- Audited financial statements of the preceding financial year
- Monthly bank statements of loan and cash-credit accounts
- Whether the company is listed, and its paid-up capital
To plan the audit
- Organisation chart and delegation of authority
- Existing policies: purchase, sales, credit, inventory, HR
- Previous internal audit reports and CARO remarks
To carry it out
- Read-only access to Tally or the ERP, with books kept up to date
- GST, TDS and payroll returns for the period
- Stock records, fixed asset register and contracts
How it works
Check whether Section 138 applies
We check the Rule 13 tests against your previous year’s figures, including peak bank borrowings during the year, and tell you in writing whether Section 138 applies.
Agree the scope with the board
Under Rule 13(2), the audit committee or board decides the scope, periodicity and method with us. We propose a risk-based plan that puts most effort where the money moves.
Test the controls on the ground
We walk through purchase-to-pay, order-to-cash, inventory, payroll and PF/ESI compliance and tax filings, test samples and check that what happens matches the written policy.
Report and agree who fixes what
Each observation comes with its risk, a recommendation and management’s response, plus an owner and a target date. In practice, a short report the board reads beats a long one it files away.
Close last cycle’s points
The next cycle starts by checking whether last cycle’s actions were completed. Open points go back to the board.
Timelines
Test at the start of each year
Applicability depends on the preceding financial year. Once the previous year’s accounts are ready, check the tests and appoint the internal auditor for the new year.
Report as often as the board decides
The law fixes no single due date. Rule 13(2) leaves periodicity to the audit committee or board: quarterly or half-yearly reporting is common.
Finish before the statutory audit
The statutory auditor considers the internal audit reports for CARO clause 3(xiv). Have the year’s reports ready before the year-end audit begins.
What happens if you skip it
Pay up to ₹2 lakh under Section 450
Section 138 carries no penalty of its own, so the general penalty in Section 450 applies: ₹10,000, plus ₹1,000 for each day the default continues, up to ₹2 lakh for the company and ₹50,000 for each officer in default.
Carry a CARO remark
The statutory auditor reports under clause 3(xiv) whether an internal audit system exists. A negative remark is visible to lenders and investors who read your audit report.
Let weak controls run unchecked
With nobody testing the controls, errors build up until a year-end audit or a tax notice brings them out.
Frequently asked questions
Is internal audit mandatory for a private limited company?
Only if it crosses a Rule 13 threshold. A private company must appoint an internal auditor if its turnover was ₹200 crore or more in the preceding financial year, or if its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point of time during that year. Below both limits, internal audit is optional, and you are free to choose it anyway.
Who can be appointed as an internal auditor?
A chartered accountant, a cost accountant or another professional decided by the board, under Section 138(1). The internal auditor may be an employee of the company or an outside firm. Many companies outsource the role to a CA firm for independence. Either way, the board records the appointment and approves the scope.
Can our statutory auditor also do the internal audit?
No. Section 144 of the Companies Act, 2013 bars the statutory auditor from providing internal audit services to the company, directly or indirectly, along with services such as bookkeeping and management services. The two roles must sit with different people. If we are your internal auditor, your statutory audit stays with another firm, and the other way round.
Which year’s figures decide whether internal audit applies?
The preceding financial year’s. For 2026-27, check turnover, paid-up capital, borrowings and deposits for 2025-26. Turnover and paid-up capital come from the audited accounts. Borrowings and deposits are tested “at any point of time” during that year, so look at the peak balance in the monthly bank statements, not just the 31 March figure.
How often should the internal audit be done?
As often as your audit committee or board decides. Rule 13(2) leaves the scope, functioning, periodicity and methodology to them, in consultation with the internal auditor. Quarterly reporting suits most mid-sized companies, because issues get fixed within the same year. Smaller companies doing it voluntarily often start half-yearly and move to quarterly as they grow.
What is the penalty for not appointing an internal auditor?
Section 138 has no penalty of its own, so Section 450 applies: ₹10,000 plus ₹1,000 a day while the default continues, capped at ₹2 lakh for the company and ₹50,000 for each officer in default. The statutory auditor will also report the gap under CARO 2020 clause 3(xiv). Appointing an internal auditor as soon as you cross a threshold avoids both.
Is internal audit the same as a tax audit?
No. A tax audit under Section 44AB of the Income-tax Act, 1961 checks books for income-tax purposes and ends in a prescribed report filed on the Income Tax e-filing portal. Internal audit under Section 138 tests a company’s controls and processes through the year and reports to the board. A company can need both, and the same CA firm can do both, as long as it is not the statutory auditor.
Does an internal audit report have to be filed with the ROC?
No, internal audit reports go to the audit committee or the board, not to the ROC. They are internal documents. The statutory auditor reviews them for CARO 2020, and the board uses them to decide on actions. Keep them with the board papers, because an inspector or lender may ask to see them.
Should a company below the thresholds still have an internal audit?
Often, yes. A mid-sized company usually has enough transactions for leaks to go unnoticed, but not enough staff to separate every duty. Think of a Ballabgarh auto-components maker that grew fast on one large customer. A light internal audit of purchases, stock and receivables catches most problems. You choose the scope and frequency, since the law does not prescribe them for voluntary audits.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
There is no government fee for an internal audit. Our fee depends on the number of locations, the processes in scope and how often you want reports.
Ready to begin?
Send us last year’s balance sheet and bank statements, and we will tell you whether Section 138 applies and what a sensible scope looks like.