"The statutory audit is just a formality": what Section 143 and CARO 2020 actually require your auditor to verify

Ask most promoters of a small private limited company what the statutory audit is, and you will hear some version of: "It's the thing the CA signs so we can file with the ROC." A second common claim is that a company with no turnover, or a dormant one, does not need an audit at all. Both are wrong, and the second one is expensive — because the audit obligation under the Companies Act, 2013 attaches to the company, not to its revenue.

The statutory audit is not a stamp. Section 143 imposes a defined set of enquiries the auditor must make, matters the auditor must state an opinion on, and a fraud-reporting duty that runs directly to the Central Government over the promoter's head. Layered on top of that, the Companies (Auditor's Report) Order, 2020 — CARO 2020, notified by the MCA on 25 February 2020 under Section 143(11) after consultation with NFRA — requires a separate annexure answering 21 specific clauses. If your auditor's report is three paragraphs long with no annexure, something has gone wrong.

What the law actually says

Section 139 requires every company — private, public, one-person, dormant, revenue or no revenue — to appoint an auditor. There is no turnover threshold. This is the point most owners get wrong: the tax audit under Section 44AB of the Income-tax Act (now read alongside the ITA 2025 framework) has a turnover trigger; the statutory audit under the Companies Act does not.

Section 143(1) gives the auditor a right of access to all books, accounts and vouchers, and a duty to enquire into six specific matters:

• whether loans and advances made on the basis of security have been properly secured and whether the terms are prejudicial to the interests of the company or its members;
• whether transactions represented merely by book entries are prejudicial to the company's interests;
• whether the company (other than an investment or banking company) has sold shares, debentures or other securities at a price lower than their purchase price;
• whether loans and advances have been shown as deposits;
• whether personal expenses have been charged to the revenue account;
• where shares were allotted for cash, whether the cash was actually received, and if not, whether the position stated in the books is correct and not misleading.

That last one deserves emphasis. Share subscription money that was never actually paid in — a common informality in closely held companies — is a specific matter the auditor is statutorily required to look at.

Section 143(3) lists what the auditor must state in the report: whether all information and explanations were obtained; whether proper books of account have been kept; whether the balance sheet and profit and loss account agree with those books; whether the financial statements comply with the accounting standards; the observations or comments on financial transactions that have an adverse effect on functioning; whether any director is disqualified under Section 164(2); and — the clause that catches companies with weak processes — whether the company has adequate internal financial controls with reference to financial statements and the operating effectiveness of those controls.

Section 143(12) is the one nobody reads until it bites. If the auditor, in the course of performing duties, has reason to believe that an offence of fraud involving an amount of Rs.1 crore or above is being or has been committed against the company by officers or employees, the auditor must report it to the Central Government — first to the Board or Audit Committee seeking a reply within 45 days, then forwarding the matter to the Ministry in Form ADT-4 within 15 days of receiving (or not receiving) that reply. Frauds below Rs.1 crore are reported to the Board or Audit Committee and disclosed in the Board's Report. Failure to comply attracts a penalty on the auditor under Section 143(15) — which is precisely why an auditor who starts asking uncomfortable questions is doing the job correctly, not being difficult.

CARO 2020 applies to the auditor's report under Section 143 for financial years commencing on or after 1 April 2021, and therefore squarely to FY 2025-26 audits being conducted now. It does not apply to: a banking company, an insurance company, a Section 8 company, a one-person company, or a small company. It also exempts a private limited company that satisfies all of the following — paid-up capital plus reserves and surplus not exceeding Rs.1 crore at the balance sheet date; total borrowings from any bank or financial institution not exceeding Rs.1 crore at any point during the year; and total revenue (including revenue from discontinuing operations) not exceeding Rs.10 crore in the financial year. Miss any one limb and CARO applies in full.

The 21 clauses cover, among other things: property, plant and equipment and title deeds of immovable property; physical verification of inventory and discrepancies of 10% or more in any class of inventory; working capital limits above Rs.5 crore sanctioned against current assets and whether quarterly returns filed with banks agree with the books; investments, loans and guarantees; compliance with Sections 185 and 186; deposits; cost records under Section 148; statutory dues and disputed dues; unrecorded income surrendered in income-tax proceedings; default in repayment of borrowings and wilful defaulter status; end-use of term loans; funds raised on short term applied for long term purposes; preferential allotment and private placement; fraud reported during the year and whistle-blower complaints considered; Nidhi company matters; related party transactions under Section 188; internal audit system; non-cash transactions with directors under Section 192; NBFC registration under Section 45-IA of the RBI Act; cash losses in the current and immediately preceding financial year; auditor resignation and the issues raised by the outgoing auditor; material uncertainty on meeting liabilities within one year of the balance sheet date; and CSR unspent amounts under Section 135.

Practical implications

Your bank returns are now an audit item. Clause 3(ii)(b) of CARO 2020 requires the auditor to compare the quarterly stock and debtor statements filed with the bank against the books, where sanctioned working capital limits exceed Rs.5 crore. Companies routinely inflate stock statements to preserve drawing power, then file accurate audited accounts. CARO forces the discrepancy into the auditor's report, where the bank's credit team reads it.

Title deeds are a reportable item. If the registered office building sits on land still in the promoter's personal name, or in the name of a predecessor firm never formally transferred, clause 3(i)(c) requires disclosure of the property description, gross carrying value, the name of the holder, and since when it has been held.

Director disqualification is checked at audit. Section 143(3)(g) requires the auditor to report whether any director is disqualified under Section 164(2). If another company where your director sits has failed to file annual returns for three consecutive years, that director's DIN is affected — and it surfaces here.

Statutory dues get itemised. Clause 3(vii) requires reporting of undisputed statutory dues — GST, provident fund, ESI, income tax, TDS, customs, cess — outstanding for more than six months from the date they became payable. A company routinely running two months behind on PF is fine for this clause; one that has let TDS slip past six months is named in the report.

Cash losses are named. Clause 3(xvii) requires the auditor to state whether the company incurred cash losses in the current financial year and in the immediately preceding one, with amounts. Two consecutive years of cash losses in a report a lender is reading is a material fact you should know is coming.

What to do

• Confirm your CARO position before the audit starts. Compute paid-up capital plus reserves, peak borrowings during the year, and total revenue. If any of the three limbs is breached, plan for the full 21-clause annexure and the documentation it demands.
• Reconcile bank stock statements to your books quarter by quarter, now, not in the last week of the audit. Where they differ, prepare the written reconciliation — the auditor will ask for it.
• Fix title deeds. Get immovable property registered in the company's name, or accept that it will appear in the annexure every year until you do.
• Clear statutory dues older than six months. GST, TDS, PF and ESI. This is the cheapest CARO clause to clean up.
• Document your internal financial controls. Section 143(3)(i) requires an opinion on both adequacy and operating effectiveness. A one-page process note per cycle — purchases, sales, payroll, cash — is the minimum an auditor can test against.
• Run a Section 164(2) check on every director across all their directorships before signing off.
• Get the appointment paperwork right. Auditor appointed at the AGM, Form ADT-1 filed within 15 days of the appointment. An unfiled ADT-1 is a defect that surfaces years later during due diligence.

See Also

• Internal Audit Under Section 138 of Companies Act 2013: Who Must Do It and What It Must Cover
• Forensic Audit in India: When Courts & Lenders Require One, What Evidence Counts, and Your CA's Liability
• Tax Audit Under Section 44AB: Threshold, Forms 3CB vs 3CD, and Rs.1.5 Lakh Penalty

Need help with this?

Our team handles the paperwork. You focus on your business.