Internal Audit

Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, mandates internal audit for prescribed classes of companies. Every listed company must appoint an internal auditor. Among unlisted public companies, internal audit is mandatory where any of the following thresholds is met in the preceding financial year: paid-up share capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point, or outstanding deposits exceeding ₹25 crore at any point. For private companies, the trigger is turnover of ₹200 crore or more, or outstanding loans/borrowings from banks or public financial institutions exceeding ₹100 crore, in the preceding financial year.

The internal auditor may be a chartered accountant (in practice or not), a cost accountant, or such other professional as the Board may decide, and may be an individual, a partnership firm, or a body corporate; the Audit Committee (or the Board, where none exists) determines the scope, functioning, periodicity and methodology of the internal audit.

A critical independence rule under Section 144(b) of the Companies Act, 2013 bars a company's statutory auditor from also rendering internal audit services to the same company, directly or indirectly. Companies not meeting the above thresholds may adopt internal audit voluntarily as good governance practice, though it is not a statutory requirement for them. Non-compliance with Section 138 read with Rule 13 exposes the company and officers in default to the general penalty provisions applicable to contravention of the Companies Act.

Internal audit is the independent examination of a company's processes, controls and records — the examination the board and the management use to know whether the business is running as it is supposed to. For the companies covered by the Companies Act 2013, internal audit is mandatory under Section 138 read with Rule 13 of the Companies (Accounts) Rules 2014, which requires the prescribed classes of companies — the listed companies, the unlisted public companies above the turnover and the borrowing thresholds, and the private companies above the prescribed limits — to appoint an internal auditor, whether the chartered accountant or a firm of the accountants. The audit tests the financial controls, the operations, the compliance and the governance.

The internal audit is the early-warning system of the business. The external audit reports on the annual financial statements; the internal audit reports on the machinery — the purchases, the payments, the inventory, the receivables, the compliance with the Act and the regulations. The findings are the small problems found before they become the big ones, and the internal audit calendar is the discipline that finds them.

The cost of the missing internal audit is the surprise at the external audit and beyond: the controls that failed, the compliance that lapsed, the fraud that went unnoticed — each discovered late and expensively. The companies that run the internal audit find the problems in the quarter they happen; the ones that do not find them at the statutory audit or the investigation.

This service is for companies required to appoint an internal auditor under Section 138 and Rule 13, and for those that choose to run one. We design the internal audit plan around the business's risks, test the controls and the processes, report the findings with the recommendations, track the remediation, and coordinate with the statutory auditor so the internal audit work feeds the external audit cleanly.