Statutory Audit Checklist for FY 2025-26 — CARO 2020 & Schedule III Compliance
Every company subject to statutory audit faces one question: are we ready? This checklist covers CARO 2020's 21 reporting clauses, the 2021 Schedule III amendments, and the five control areas auditors scrutinise most in mid-size companies during FY 2025-26.
Harun Raaj
Chartered Accountant · Harun Raaj & Associates
Every company subject to statutory audit under the Companies Act 2013 faces one recurring question: are we ready? Audit readiness is not about passing — it is about having controls tight enough that your auditor can complete fieldwork efficiently, without observations escalating to the board.
This guide covers CARO 2020's 21 reporting clauses, the March 2021 Schedule III amendments, and the five areas where we see the most observations in companies with revenues between ₹25 Cr and ₹500 Cr.
The Statutory Basis
Statutory audit under the Companies Act 2013 (Sections 139–148) is mandatory for every company that does not meet the small company threshold under Section 2(85) — paid-up capital not exceeding ₹4 Cr and turnover not exceeding ₹40 Cr.
CARO 2020 (MCA Notification S.O. 849(E), issued under Section 143(11)) requires auditors to report on 21 specific matters. An adverse comment on any clause is a qualification. The most consequential clauses for mid-size companies are covered below.
The 2021 Schedule III amendments (effective from 1 April 2021) added eight new mandatory disclosures: ageing schedules for debtors and creditors, title deed disclosures, promoter shareholding reconciliation, benami transaction disclosures, CSR obligation accounting, and virtual digital asset holdings.
The Five CARO 2020 Clauses That Drive Most Observations
Clause 3(xiii) — Related Party Transactions
Your auditor must confirm whether transactions with related parties under Section 188 are at arm's length and properly approved. Interest-free advances to subsidiaries, associate companies, or promoter entities trigger scrutiny under Section 2(22)(e) deemed dividend provisions. Every RPT needs a board resolution, arm's length price documentation, and a running register.
Penalty: Section 188(5) — ₹5 lakh per non-compliant transaction.
Clause 3(xvii) — Cash Transactions Exceeding ₹2 Lakh
Section 269ST prohibits receipt of ₹2 lakh or more in cash from a single person in a single day. The test is cumulative — separate invoices under ₹2 lakh from the same party on the same day aggregate. The penalty under Section 271DA is 100% of the amount received. Auditors test this against POS records and bank statements.
Clause 3(vi) — Physical Verification of Inventory
The auditor must comment on whether inventory was physically verified during the year and whether the frequency is adequate. An unobserved count is not a count for audit purposes. If discrepancies between physical and book stock were not reconciled and explained, expect an observation. Consistent inventory shortfalls are a gateway to presumptive additions under Section 69B.
Clause 3(ix)(c) — Utilisation of Funds Raised
If your company raised debt or equity in FY 2025-26, you must demonstrate funds were used for the stated purpose. Maintain a funds utilisation register: source, amount, date drawn, purpose, and supporting voucher. Any diversion — even temporary — must be reported by the auditor.
Clause 3(xiv) — Internal Audit System
Companies with turnover exceeding ₹200 Cr or outstanding loans/borrowings above ₹100 Cr are mandated under Rule 13 of the Companies (Accounts) Rules, 2014 to appoint an internal auditor. The auditor will verify whether internal audit reports were reviewed by the Audit Committee and whether significant findings were acted upon.
The 2021 Schedule III Additions — What Companies Miss
A Worked Example: Zero Observations from Six
A ₹80 Cr auto-components manufacturer in Andhra Pradesh came to us after their FY 2023-24 audit generated six observations, including a CARO qualification on inventory and a management letter comment on related-party controls.
Five changes over twelve months:
1. Monthly closing discipline. Moved from quarterly to monthly book close with a 10-day cutoff. Eliminated three recurring cut-off errors.
2. Perpetual inventory count. Quarterly counts for the top 50 SKUs (75% of inventory value), documented on count sheets, with CA sign-off. Auditors relied on these at year-end.
3. Related-party register. Every RPT logged before execution: board resolution, arm's length price, Section 188 compliance. No retroactive reconstruction.
4. Cash receipt control. Daily reconciliation of cash receipts against the ₹2 lakh limit. Automated flag when cumulative receipts from one party approached the threshold.
5. Pre-audit AI risk scan. 60 days before fieldwork, we run the trial balance through our risk-scoring tool: TDS mismatches against Form 26AS, abnormal expense ratios, unreconciled inter-company balances. We resolve what we find before the auditors see it.
Result: Zero CARO observations. Zero management letter comments. Audit completed 11 days ahead of deadline.
How HRA Approaches Statutory Audit
Our statutory audit process is built on three principles: AI-assisted risk identification before fieldwork, a 21-point CARO readiness review 90 days before year-end, and a zero-observation target built into our engagement mandate.
See our Audit & Assurance services →
Frequently Asked Questions
Q: Which companies are exempt from CARO 2020?
Small companies (paid-up capital ≤ ₹4 Cr AND turnover ≤ ₹40 Cr), one-person companies, banking companies, insurance companies, and Section 8 companies are exempt from CARO 2020.
Q: When must the statutory audit for FY 2025-26 be completed?
Financial statements must be laid before the AGM under Section 137. For most companies, the AGM is due by 30 September 2026. Practically, audited financials are needed by that date to file the annual return (AOC-4) with the MCA.
Q: What is the penalty for not appointing a statutory auditor?
Under Section 147, a fine of ₹25,000 to ₹5 lakh on the company, and ₹10,000 to ₹1 lakh on every officer in default.
Q: Can my internal auditor also act as statutory auditor?
No. Section 138 specifically prohibits the internal auditor from being the statutory auditor or a partner/employee of the statutory auditor firm.
Q: What triggers a tax audit under Section 44AB in addition to the Companies Act audit?
For companies, a tax audit under Section 44AB is triggered when turnover exceeds ₹1 Cr (₹10 Cr if at least 95% of transactions are digital). Both audits are typically conducted simultaneously, with the statutory auditor certifying Form 3CA/3CD.
---
Prepared by Harun Raaj & Associates, Chartered Accountants, Visakhapatnam. For a personalised audit readiness assessment, contact our team.
---
See Also
Frequently Asked Questions
What are the 21 reporting clauses in CARO 2020 that auditors must check?+
CARO 2020 (MCA Notification S.O. 849(E), issued under Section 143(11)) requires auditors to report on 21 specific matters. The article identifies five clauses that drive most observations in mid-size companies: Clause 3(xiii) on related party transactions under Section 188, Clause 3(xvii) on cash transactions exceeding ₹2 lakh under Section 269ST, and Clause 3(vi) on physical verification of inventory. An adverse comment on any clause is a qualification.
How do Schedule III amendments 2021 affect statutory audit disclosures?+
The March 2021 Schedule III amendments (effective from 1 April 2021) added eight new mandatory disclosures: ageing schedules for debtors and creditors, title deed disclosures, promoter shareholding reconciliation, benami transaction disclosures, CSR obligation accounting, and virtual digital asset holdings. These disclosures are now required in the financial statements for all companies subject to statutory audit.
What is the penalty for related party transactions not at arm's length under Section 188?+
Under Clause 3(xiii) CARO 2020, auditors must confirm whether transactions with related parties under Section 188 are at arm's length and properly approved. Section 188(5) imposes a penalty of ₹5 lakh per non-compliant transaction. Interest-free advances to subsidiaries, associates, or promoter entities require board resolution, arm's length price documentation, and a running register.
What are the rules for cash transactions over 2 lakh rupees in statutory audit?+
Section 269ST prohibits receipt of ₹2 lakh or more in cash from a single person in a single day, as covered in Clause 3(xvii) CARO 2020. The test is cumulative — separate invoices under ₹2 lakh from the same party on the same day aggregate toward the limit. The penalty under Section 271DA is 100% of the amount received. Auditors test this against POS records and bank statements.
Which companies are exempt from statutory audit requirements under Companies Act 2013?+
Under the Companies Act 2013 (Sections 139–148), statutory audit is mandatory for every company that does not meet the small company threshold under Section 2(85). Small companies are those with paid-up capital not exceeding ₹4 Cr and turnover not exceeding ₹40 Cr. All other companies must comply with statutory audit requirements.
What audit readiness controls should companies implement before statutory audit?+
The article emphasizes that audit readiness is about having controls tight enough that auditors can complete fieldwork efficiently without observations escalating to the board. Key controls include proper documentation for related party transactions (board resolutions and arm's length pricing), monitoring of cash transactions under Section 269ST, physical verification procedures for inventory per Clause 3(vi), and maintaining registers for all required disclosures under the 2021 Schedule III amendments.
Need help with this?
Our team handles the paperwork. You focus on your business.