Which companies must appoint an internal auditor?
A company must appoint an internal auditor when it is in a class named in section 138 and the accounts rules. Every listed company is in that class. An unlisted public company or a private company is in it only when a threshold in the preceding financial year is crossed. Other companies may appoint one. They are not required to.
Which companies are covered?
The tests are alternatives. Crossing any one line in a row is enough. The figures are for the immediately preceding financial year.
| Company | When section 138 applies |
|---|---|
| Listed company | Every listed company. |
| Unlisted public company | Paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any time, or outstanding deposits of ₹25 crore or more at any time. |
| Private company | Turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any time. |
Who may be the auditor?
Section 138 says the internal auditor is a chartered accountant or a cost accountant, whether in practice or not, or such other professional as the board decides. The person may be an employee. A firm may be appointed. The board decides the scope, the period, and the manner of the audit.
Where does the report go?
The internal auditor reports to the board. The report covers the risks and the control weaknesses the audit found, and the recommendations. It is not a form that is uploaded in place of the financial statements. The board considers it. Where the company has an audit committee, the reporting line the board sets can run through that committee.
What is it not?
It is not the statutory audit. Appointment of the statutory auditor, and the auditor’s report on the financial statements, are on the company audit page. CARO 2020, where it applies, is a statement in that statutory report. A company outside section 138 can still be under the statutory audit. A company inside section 138 still has the statutory audit as well.
Frequently asked questions
Four questions cover a private company, the statutory audit, AOC-4, and an employee.
Must every private company appoint one?
No. A private company is covered only when its turnover is ₹200 crore or more, or its outstanding bank or institutional borrowings exceed ₹100 crore, in the preceding financial year.
Is this the statutory audit?
No. The statutory audit is the audit under section 139 and the report under section 143. An internal audit is a separate appointment under section 138.
Is the report filed as AOC-4?
No. The internal auditor reports to the board. Form AOC-4 is the filing of the financial statements, which is a different document.
Must the auditor be an employee?
No. The internal auditor may be an employee of the company or a firm in practice. The board decides the appointment within section 138.
Sources
The duty to appoint an internal auditor is section 138 of the Companies Act, 2013. The classes of company are Rule 13 of the Companies (Accounts) Rules, 2014.