Does your company need an internal auditor?
Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 set the tests. Each one looks at the preceding financial year.
| Company | Internal audit is mandatory if |
|---|---|
| Listed company | Always |
| Unlisted public company | Any one of: paid-up capital ₹50 crore or more; turnover ₹200 crore or more; bank or financial institution borrowings above ₹100 crore at any time in the year; deposits ₹25 crore or more at any time in the year |
| Private company | Turnover ₹200 crore or more, or bank or financial institution borrowings above ₹100 crore at any time in the year |
The borrowing test uses the peak balance during the year, not the 31 March figure. A working-capital limit that touched ₹110 crore in October counts.
Below these limits, many companies still appoint an internal auditor because their bank, investors or board ask for one, or simply to stop leakages. Read our note on internal audit under Section 138.
Who can be your internal auditor
- A Cost and Management Accountant or a Chartered Accountant, or another professional chosen by the Board. We have both on the team.
- Your statutory auditor cannot provide internal audit services to the same company.
- The Audit Committee, or the Board, sets the scope, frequency and method in consultation with the internal auditor.
What we test
- Procure-to-pay: vendor creation and bank-detail changes, purchase approvals, three-way match, duplicate and advance payments.
- Inventory and production: physical verification, stock with job workers, scrap and yield against norms, slow-moving and obsolete stock.
- Order-to-cash: credit limits, discounts outside policy, unbilled dispatches, receivables ageing and collections.
- Payroll: attendance, overtime, joiners and leavers, PF and ESI.
- Statutory compliance: whether GST, TDS, PF, ESI and MSME payment timelines are actually met, not just filed.
- IT and audit trail: who can post and edit entries, and whether the accounting software's audit trail is on.
- Related-party transactions: approvals, pricing and disclosure.
What you receive
- Risk assessment and annual audit plan, approved by the Audit Committee or Board.
- Quarterly internal audit reports: observations ranked by risk, the rupee impact where we can measure it, root cause and an agreed action with an owner and date.
- Action-taken tracking: we follow up last quarter's points before raising new ones.
- A short presentation to the Audit Committee or promoters, and support for the statutory auditor's CARO 3(xiv) review.
Guides from our team
Short notes from our team on the rules, deadlines and the mistakes we see most often.
Internal audit under Section 138: who needs it, and what it should actually test
The ₹200 crore and ₹100 crore triggers, who can be appointed, how CARO 3(xiv) exposes a token audit, and where to focus.
Read note →Running a manufacturing company in Noida or NCR? Why you need a CMA
Noida and NCR factories often know their sales but not the cost of one unit. Where the law requires a Cost Accountant, the costing error that hides loss-making products, and ten things a CMA does on the factory floor.
Read note →Beyond compliance: what your cost audit report tells you that your balance sheet doesn't
Your statutory auditor tells you whether you made a profit. The cost audit report shows which product made it, how much capacity sits idle, and which line is quietly losing money. With a worked example.
Read note →Cost audit for FY 2025-26: who it applies to, and the CRA-2 and CRA-4 deadlines
Rule 3 and Rule 4 thresholds, who is exempt, the 180-day and 30-day clocks, and the CFO penalty the 2026 Bill proposes.
Read note →Frequently asked questions
Our private company's turnover crossed ₹200 crore last year. When do we need an internal auditor?
For the current financial year. The test uses last year's numbers, so appoint the internal auditor now and cover the full year in the audit plan.
Can a CMA be our internal auditor?
Yes. Section 138 allows a Cost Accountant, a Chartered Accountant or another professional decided by the Board. For manufacturers, a cost-trained auditor is often the better fit because the leakages are in stores, scrap and production.
Can our statutory auditor also do the internal audit?
No. Section 144 bars the statutory auditor from providing internal audit services to the same company.
What happens if we don't appoint an internal auditor?
The statutory auditor reports it under CARO 2020, clause 3(xiv), which lenders and investors read, and the Act's general penalty applies to the company and its officers.
We are below the limits. Is internal audit still useful?
Often, yes. Banks, investors and growing promoters use it to catch leakages in purchases, inventory and collections. We offer a lighter quarterly review for smaller companies.
This page is general information, current as of October 2026, and not advice for your specific situation. Laws, forms and due dates change — speak to us before acting on it.