"Internal audit is just a smaller statutory audit": what Section 138 actually requires
Most promoters believe internal audit is a rehearsal for the statutory audit, or that their statutory auditor can simply do both. Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 says otherwise. Internal audit is a separate, continuous, Board-facing function with its own scope and reporting line, and Section 144 expressly bars the statutory auditor from performing it. This piece sets out exactly which companies are caught — including the borrowing test that measures peak outstanding at any point during the preceding year rather than the year-end balance, which catches companies whose closing balance sheet looks modest. It explains how internal audit differs structurally from statutory audit under Section 143 and from tax audit under Section 63 of the Income-tax Act, 2025, walks through four real scenarios including group structures and NRI-promoted companies, and gives a seven-step appointment checklist. It closes with the penalty position under Section 450 and the CARO 2020 clause (xiv) exposure that lenders and acquirers actually read.
Harun Raaj
Chartered Accountant · Harun Raaj & Associates
Ask most promoters of a mid-sized Indian company what internal audit is and you will hear some version of this: "It's the same checking the statutory auditor does, just done earlier in the year so there are no surprises in March." A second version is even more common — "our statutory auditor also does our internal audit, so we're covered." Both are wrong, and the second one is not merely wrong, it is a compliance failure that sits in plain sight on the company's own filings.
Section 138 of the Companies Act, 2013 does not create a rehearsal for the statutory audit. It creates a separate, ongoing, management-facing function with a different objective, a different reporting line, and a statutory bar on the statutory auditor performing it. Companies that miss the mandate discover it in one of two unpleasant ways: the statutory auditor qualifies the CARO 2020 report, or the Registrar issues a show-cause notice under Section 450 for a default with no specific penalty attached.
Here is what the section actually says, who it catches, and what to do if you have crossed the threshold without noticing.
What the law actually says
Section 138(1) of the Companies Act, 2013 requires "such class or classes of companies as may be prescribed" to appoint an internal auditor, who "shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board." Section 138(2) empowers the Central Government to prescribe the manner and intervals in which the internal audit shall be conducted and reported to the Board.
The prescription lives in Rule 13 of the Companies (Accounts) Rules, 2014. Internal audit is mandatory for:
Every listed company — no threshold at all. If the company is listed, Section 138 applies from day one.
Every unlisted public company that, during the preceding financial year, had any one of: paid-up share capital of ₹50 crore or more; turnover of ₹200 crore or more; outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the year; or outstanding deposits of ₹25 crore or more at any point during the year.
Every private company that, during the preceding financial year, had either: turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the year.
Read the private-company test carefully, because two traps hide in it. First, private companies are tested only on turnover and borrowings — paid-up capital and deposits do not trigger the mandate. Second, the borrowing test says "at any point of time during the preceding financial year." A company that drew a ₹110 crore facility in June, repaid it down to ₹40 crore by March, and closed the year with a modest balance sheet is still caught. The year-end figure is irrelevant. This single word — "any point" — is the most frequently missed clause in Rule 13.
The Explanation to Rule 13 gives the internal auditor's qualification some flexibility: the internal auditor "may or may not be an employee of the company." So an in-house internal audit head is permitted, and so is an outsourced firm. What is not permitted is the statutory auditor doing it.
That bar comes from Section 144 of the Companies Act, 2013, which lists services a statutory auditor cannot render to the auditee, its holding company, or its subsidiary. Clause (b) of Section 144 names "internal audit" explicitly. There is no materiality carve-out and no waiver by board resolution. If your statutory auditor is also signing your internal audit reports, the company is in breach of Section 144 and the auditor is in breach of professional standards — and it will show up when the next auditor rotation or peer review happens.
A note on the tax side, since this is where the confusion usually compounds. Internal audit under Section 138 is entirely separate from tax audit. Tax audit — historically Section 44AB of the Income-tax Act, 1961 — now sits at Section 63 of the Income-tax Act, 2025, with the audit report filed in the forms prescribed under the Income-tax Rules, 2026. ITA 2025, in force from 1 April 2026, also replaced the "previous year / assessment year" language with a single Tax Year. Neither Section 63 of ITA 2025 nor Section 143 of the Companies Act discharges the Section 138 obligation. Three audits, three statutes, three purposes.
How internal audit actually differs from statutory audit
The difference is not scale. It is the question each audit is trying to answer.
Statutory audit asks: are the financial statements true and fair? Section 143 of the Companies Act, 2013 directs the auditor's opinion at the financial statements as a whole, for a completed year, addressed to the members. CARO 2020 bolts on twenty-one specific reporting clauses. The output is an opinion, delivered once, after the year closes.
Internal audit asks: are the controls working, and is the business running the way the Board thinks it is? The scope is set by the Board (or the Audit Committee under Section 177, where one exists), not by statute. It runs continuously through the year. It covers things a statutory auditor will never look at — vendor onboarding discipline, whether purchase orders precede invoices, whether the sales team is granting credit outside policy, whether IT access is revoked when an employee exits, whether statutory dues are being computed correctly before they become a Section 143 qualification.
Three structural consequences follow:
Reporting line. The statutory auditor reports to the members. The internal auditor reports to the Board or the Audit Committee — inside the company, not outside it.
Timing. Statutory audit is retrospective and periodic. Internal audit is concurrent. A finding raised in July can be fixed by September and never becomes a March problem.
Consequence of a finding. A statutory audit finding becomes a qualification or an emphasis of matter, visible to lenders, regulators, and acquirers. An internal audit finding becomes an action item. This is precisely why the two functions must be independent — an auditor cannot objectively opine on controls he himself designed and tested during the year.
Clause (xiv) of CARO 2020 closes the loop: the statutory auditor must report whether the company has an internal audit system commensurate with the size and nature of its business, and whether the internal audit reports were considered by the statutory auditor. A company that is caught by Rule 13 and has appointed no internal auditor gets an adverse CARO comment. Banks read CARO. So do due-diligence teams.
Practical implications
Scenario one — the borrowing spike. A Bengaluru private company manufacturing auto components has turnover of ₹140 crore in FY 2025-26 and a sanctioned working capital limit of ₹120 crore. Peak utilisation in October touched ₹104 crore before falling back to ₹55 crore by year-end. Turnover is below ₹200 crore, so the first test fails. But borrowings exceeded ₹100 crore at a point during the preceding financial year, so the second test is satisfied. Internal audit is mandatory for FY 2026-27. The company almost certainly does not know this, because its year-end balance sheet shows ₹55 crore.
Scenario two — the crossing-year timing. A Chennai private company crosses ₹200 crore turnover for the first time in FY 2025-26. Rule 13 tests the preceding financial year, so the obligation attaches to FY 2026-27. The Board should appoint the internal auditor early in FY 2026-27, not in March 2027 when someone notices. An internal audit conducted for eleven days of the year is not an internal audit.
Scenario three — the group structure. A listed holding company has an unlisted private subsidiary with ₹30 crore turnover and no borrowings. The holding company needs internal audit because it is listed. The subsidiary, tested on its own numbers, does not. Section 138 applies company by company, not group by group. But if the same firm is statutory auditor of the holding company, Section 144 bars it from internal audit of the subsidiary too — the prohibition extends to holding and subsidiary companies.
Scenario four — the NRI-promoted company. Where an NRI or foreign promoter holds the company, internal audit findings on FEMA compliance carry outsized weight. Share allotments to non-residents require Form FC-GPR within 30 days of allotment; share transfers between residents and non-residents require Form FC-TRS within 60 days. These are exactly the items a well-scoped internal audit catches while the compounding cost is still small. By the time a statutory auditor flags it in CARO, the delay is already a year long and the RBI compounding application is the only route out.
Step by step: what to do
- Test both preceding-year thresholds honestly. Pull turnover from the audited financials of the preceding year. For borrowings, pull the maximum outstanding at any point during the year from bank statements or the CC/OD account ledger — not the closing balance. This one step resolves most cases.
- If caught, pass a Board resolution appointing the internal auditor. Section 138 read with Rule 13 requires the appointment to be made by the Board. The resolution must name the auditor, the term, and the remuneration.
- File Form MGT-14 where required. Section 179(3)(k) read with Rule 8 of the Companies (Meetings of Board and its Powers) Rules, 2014 covers Board resolutions on specified matters; public companies filing MGT-14 for the internal auditor appointment should do so within 30 days of the resolution.
- Confirm the appointee is not your statutory auditor, nor a network firm of your statutory auditor. Section 144 is absolute. Get a written independence confirmation on file.
- Have the Board or Audit Committee approve a written scope and reporting frequency. Section 138(2) makes the manner and intervals a Board matter. Quarterly reporting is the practical norm; a company with a live borrowing covenant should consider monthly. Put the scope in writing — an undocumented scope is the first thing a regulator asks for.
- Ensure the reports actually reach the Board and are minuted. An internal audit report that never gets tabled fails the substance of Section 138 even if the appointment is on record. Minute the tabling, the discussion, and the action taken on each significant finding.
- Share the internal audit reports with the statutory auditor. CARO 2020 clause (xiv) requires the statutory auditor to state whether the reports were considered. Withholding them produces a qualification you did not need.
See Also
Frequently Asked Questions
If we cross the threshold mid-year, do we appoint immediately or from the next year?
From the next financial year. Rule 13 tests the preceding financial year's figures. Cross ₹200 crore turnover in FY 2025-26 and the internal audit obligation runs for FY 2026-27. Appoint at the start of that year, not at its end.
Can our Chief Financial Officer be the internal auditor?
No. The CFO owns the processes being audited, which destroys independence. Section 138 read with Rule 13 contemplates a chartered accountant, cost accountant, or other professional decided by the Board. An employee can be the internal auditor (Explanation to Rule 13 permits it) but must sit outside the finance function's control and report to the Board or Audit Committee, not to the CFO.
What is the penalty for not appointing an internal auditor?
Section 138 carries no specific penalty, so Section 450 of the Companies Act, 2013 applies — a fine up to ₹10,000 on the company and every officer in default, with ₹1,000 per day for continuing default. The larger cost is the adverse CARO 2020 clause (xiv) comment in your audited financials.
Does a tax audit under ITA 2025 cover the internal audit requirement?
No. Tax audit (now Section 63 of ITA 2025, previously Section 44AB) examines whether books support the return of income. It says nothing about internal controls. Section 63 of ITA 2025, Section 143 of the Companies Act, and Section 138 of the Companies Act are three separate obligations.
Which companies must appoint an internal auditor under Section 138?
Every listed company (no threshold). Every unlisted public company with turnover ≥₹200 crore, or paid-up capital ≥₹50 crore, or borrowings >₹100 crore at any point, or deposits ≥₹25 crore. Every private company with turnover ≥₹200 crore or borrowings >₹100 crore at any point during the preceding FY.
Need help with this?
Our team handles the paperwork. You focus on your business.