Section 138 of the Companies Act, 2013 requires certain companies to appoint an internal auditor to audit their functions and activities. Rule 13 of the Companies (Accounts) Rules, 2014 identifies those companies.
Which companies must appoint
| Class of company | Threshold (any one, in the preceding financial year) |
|---|---|
| Every listed company | No threshold |
| Unlisted public company | Paid-up share capital ₹50 crore or more; or turnover ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any time; or outstanding deposits of ₹25 crore or more at any time |
| Private company | Turnover ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any time |
A company that falls below these thresholds may still choose to have an internal audit.
Who can be the internal auditor
The internal auditor may be a Chartered Accountant or a Cost Accountant, whether or not in practice, or another professional decided by the Board. The internal auditor may be an employee of the company. The statutory auditor of the company cannot be its internal auditor.
Scope and reporting
The Audit Committee, or the Board where there is no committee, decides the scope, functions, periodicity and method of the internal audit in consultation with the internal auditor.
A typical risk-based plan
- Understand the business: processes, systems, past audit findings.
- Assess risk: rate each process by its financial size and likelihood of error or fraud.
- Plan coverage: cover high-risk processes every quarter, others on rotation.
- Test controls: walkthroughs followed by sample testing.
- Report: observation, risk, root cause, recommendation and management’s response with a timeline.
- Follow up: confirm that agreed actions were implemented.
Internal audit also supports the directors’ responsibility statement on internal financial controls under section 134(5)(e).