Internal audit is one of those requirements companies cross into without noticing. Nobody files a form to say it applies. The trigger is last year's numbers, and the first anyone hears of it is often the statutory auditor asking for internal audit reports that don't exist.
Here's who needs one under Section 138 of the Companies Act, 2013, who can do it, and what a useful internal audit actually tests.
Who must appoint an internal auditor
Rule 13 of the Companies (Accounts) Rules, 2014 sets the thresholds. Each test looks at the preceding financial year.
- Every listed company, whatever its size.
- Unlisted public companies meeting any one of these: paid-up share capital of ₹50 crore or more; turnover of ₹200 crore or more; outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point during the year; or outstanding deposits of ₹25 crore or more at any point during the year.
- Private companies meeting either of these: turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any point during the year.
The borrowing test uses the peak balance during the year, not just the balance on 31 March. A working-capital limit that touched ₹110 crore in October counts, even if you repaid most of it by March.
So if a private company's FY 2025-26 turnover crossed ₹200 crore, it needs an internal auditor in place for FY 2026-27 — the year that's already half over.
Who can be the internal auditor
- A Chartered Accountant, a Cost Accountant, or another professional the Board decides on. The person may be an employee or an outside firm.
- Not your statutory auditor. Section 144 bars the statutory auditor from providing internal audit services to the same company.
- The Audit Committee, or the Board where there is no committee, sets the scope, frequency and method of the internal audit, in consultation with the internal auditor.
Where a weak internal audit shows up
It shows up in your statutory audit report. Under CARO 2020, clause 3(xiv), the statutory auditor has to report whether the company has an internal audit system that matches its size and nature of business, and whether the internal audit reports were considered. A one-page report written in March to tick the box usually gets noticed there. Lenders and investors read that clause.
The Act's general penalty under Section 450 also applies: ₹10,000, plus ₹1,000 for each day the default continues. That is capped at ₹2 lakh for the company and ₹50,000 for each officer in default.
What a useful internal audit actually tests
The law doesn't list the areas. That's the Board's call, and it's where most of the value is. For a typical Delhi NCR manufacturer or trader, we'd start here:
- Procure-to-pay — vendor creation and changes to vendor bank details, purchase approvals, three-way match, and duplicate payments.
- Order-to-cash — credit limits, discounts given outside policy, unbilled dispatches, and receivables ageing.
- Inventory — physical verification against the books, slow-moving and obsolete stock, and goods lying with job workers.
- Statutory compliance — whether GST, TDS, PF/ESI and MSME payment timelines are actually being met, not just filed.
- IT and audit trail — who can post and edit entries, and whether the accounting software's audit trail is on and working. That trail has been mandatory since April 2023, and the statutory auditor reports on it.
- Related-party transactions — approvals, arm's-length pricing and disclosure.
A good internal audit report ranks its findings by risk, names an owner and a date for each fix, and checks last quarter's findings before raising new ones.
Below the threshold?
Plenty of companies below ₹200 crore still run one, usually because a bank, an investor or a parent company asks for it. A risk-based review once or twice a year costs far less than finding a fraud or a ₹40 lakh GST credit reversal during due diligence.
How Vitt-Marg helps
We work out whether Section 138 applies to you and agree a risk-based scope with your Audit Committee or Board. Then we run the internal audit quarterly or half-yearly, with documented working papers and a findings tracker your statutory auditor can rely on for CARO. If you are already appointed as someone's statutory auditor, we'll confirm there's no Section 144 conflict before we start.
General information, current as of October 2026, not advice for a specific case. Company-law rules and thresholds change often — check with us before acting on it.