Internal Audit Requirements under the Companies Act, 2013

Internal Audit Requirements under the Companies Act, 2013

While the statutory auditor reports to shareholders on financial statements, the internal auditor works within the company to continuously test and strengthen internal controls, risk management, and operational efficiency. The Companies Act, 2013 made internal audit a formal statutory requirement for certain companies, recognising its importance in preventing fraud and mismanagement before it reaches the financial statements.

Every Listed Company

Mandatorily required to appoint an internal auditor, regardless of size.

Unlisted Public Companies

•      Paid-up share capital of ₹50 crore or more during the preceding financial year, or

•      Turnover of ₹200 crore or more during the preceding financial year, or

•      Outstanding loans/borrowings from banks/public financial institutions exceeding ₹100 crore at any point during the preceding financial year, or

•      Outstanding deposits of ₹25 crore or more at any point during the preceding financial year.

Private Companies

•      Turnover of ₹200 crore or more during the preceding financial year, or

•      Outstanding loans/borrowings from banks/public financial institutions exceeding ₹100 crore at any point during the preceding financial year.

The internal auditor may be a chartered accountant (whether engaged in practice or not), a cost accountant, or such other professional as the Board may decide. Notably, unlike the statutory auditor, an internal auditor can be an employee of the company, giving companies flexibility to build an in-house internal audit function.

The Act does not prescribe a rigid checklist; instead, the Audit Committee (or the Board, where there is no Audit Committee) formulates the scope, functioning, periodicity and methodology for conducting the internal audit, tailored to the company's size, industry, and risk profile. Common areas covered include evaluation of internal financial controls, compliance with laws and policies, efficiency of operations, and safeguarding of assets.

•      Waiting until turnover crosses the threshold before starting to plan the internal audit function, causing a compliance gap.

•      Appointing the statutory auditor's firm (or a closely related firm) for internal audit, breaching Section 144.

•      Treating internal audit as a pure compliance checkbox without acting on its findings.

•      Failing to formally define the scope through the Audit Committee, leaving internal audit's mandate unclear.

Q1. Is internal audit the same as statutory audit?

No, statutory audit is an independent, external examination of financial statements for shareholders, while internal audit is a continuous, internal function focused on controls, risk, and operational efficiency, reporting typically to the Audit Committee or Board.

Q2. Can the statutory auditor also act as the internal auditor of the same company?

No, the statutory auditor is barred from rendering internal audit services to the company under Section 144, which lists internal audit among the prohibited non-audit services for the statutory auditor.

Q3. Does a small private company need an internal auditor?

Not unless it crosses the prescribed turnover or borrowing thresholds under Rule 13; most small and mid-sized private companies fall outside the mandatory internal audit requirement.

Q4. Who decides the frequency of internal audit?

The Audit Committee (or Board, if there is no Audit Committee) decides the periodicity, which could be quarterly, half-yearly, or as otherwise found appropriate for the company's risk profile.

Q5. Can internal audit be outsourced to a professional firm instead of hiring in-house staff?

Yes, companies commonly outsource internal audit to independent professional firms (chartered accountancy or cost accountancy firms), which is explicitly permitted under Section 138.

Q6. Does internal audit apply to newly incorporated companies immediately?

Applicability is generally based on the preceding financial year's figures, so a newly incorporated company typically becomes subject to the requirement only once it has a preceding financial year's data crossing the thresholds.

Q7. Is there a prescribed format for the internal audit report?

Unlike the statutory audit report, there is no single prescribed statutory format for internal audit reports; the format and periodicity are decided by the Audit Committee/Board based on the company's needs.

Internal audit is increasingly viewed not just as a compliance box to tick but as a genuine value-add function that helps management spot control weaknesses early. Companies approaching the prescribed thresholds should plan to build or outsource this function well before it becomes mandatory.