Short Answer:
Internal audit is mandatory in India for prescribed classes of companies under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014. Every listed company is covered, while specified unlisted public and private companies are covered when they meet the applicable turnover, paid-up capital, borrowing or deposit thresholds.
Internal Audit Applicability Thresholds at a Glance
What Is Internal Audit Applicability?
Internal audit applicability means determining whether a company is required to appoint an internal auditor under Section 138 of the Companies Act, 2013.
Section 138 requires prescribed classes of companies to conduct an internal audit of their functions and activities. The specific classes of companies covered by this requirement are prescribed under Rule 13 of the Companies (Accounts) Rules, 2014.
Companies Act, 2013 → Section 138 → Rule 13 → Company Category → Applicable Thresholds
The three major categories to consider are:
- Listed companies
- Unlisted public companies
- Private companies
The applicability thresholds are different for each category.
Which Financial Year Is Considered?
The applicable financial criteria are assessed based on the preceding financial year, as specified in Rule 13. For example, to determine applicability for FY 2025-26, the figures from FY 2024-25 should be reviewed.
For borrowing and deposit criteria, Rule 13 refers to the amount outstanding at any point of time during the preceding financial year. Therefore, the company should review whether the prescribed threshold was reached at any point during that year.
1. Internal Audit Applicability for Listed Companies
Every listed company is covered by the internal audit requirement under Rule 13.
Unlike unlisted public and private companies, applicability for a listed company is not dependent on crossing the financial thresholds applicable to the other categories.
Therefore, a listed company should not use the financial thresholds applicable to unlisted companies as the basis for determining whether internal audit applies.
2. Internal Audit Applicability for Unlisted Public Companies
For an unlisted public company, internal audit becomes applicable if the company meets any one of the prescribed criteria during the relevant preceding financial year.
Key Point:
These are alternative applicability triggers. If an unlisted public company meets even one of the prescribed criteria, the internal audit requirement applies.
Example
Suppose an unlisted public company has:
- Paid-up share capital: ₹30 crore
- Turnover: ₹230 crore
- Bank borrowings: ₹60 crore
- Deposits: ₹10 crore
The company does not meet the paid-up capital, borrowing or deposit thresholds. However, its turnover is ₹230 crore, which exceeds the ₹200 crore threshold. Therefore, the internal audit requirement applies.
3. Internal Audit Applicability for Private Companies
Is internal audit mandatory for private companies? Not for every private company.
Under Rule 13, a private company is covered when it meets either of the following criteria during the relevant preceding financial year:
Example
Consider a private company with:
- Turnover: ₹250 crore
- Bank borrowing: ₹40 crore
The borrowing threshold is not met. However, turnover is above ₹200 crore. Therefore, the internal audit requirement applies.
Internal Audit Requirement Under Section 138
Appointment of Internal Auditor
Section 138(1) requires prescribed companies to appoint an internal auditor.
Who can be the internal auditor? The internal auditor may be:
- A Chartered Accountant
- A Cost Accountant
- Any other professional as decided by the Board
What form can the internal auditor take? The appointment may be of:
- An individual
- A partnership firm
- A body corporate
The internal auditor may or may not be an employee of the company. However, Section 144(b) of the Companies Act, 2013 prohibits a company’s statutory auditor from concurrently serving as its internal auditor.
Scope and Frequency
Under Rule 13(2), the Audit Committee or Board, in consultation with the Internal Auditor, determines:
- Scope of internal audit
- Functioning and audit methodology
- Periodicity of audits
A practical audit plan may also consider:
- Business risks
- Previous audit findings
- Regulatory requirements
- Process changes
- Control weaknesses
- New products or systems
- Changes in the organization’s risk profile
Why Is Internal Audit Required?
Internal audit is more than an exercise for checking accounting records.
A well-designed internal audit function gives management and the Board greater visibility into whether the organization’s controls, processes, risks and compliance activities are working as intended.
Internal audit can help evaluate:
- Internal control effectiveness
- Risk management
- Compliance with policies and regulations
- Financial and operational processes
- Protection of assets
- Operational efficiency
- Corrective actions
- Governance processes
Internal Audit vs Statutory Audit: What’s the Difference?
Internal Audit Applicability: Practical Examples
Example 1: Listed Company
Company A is listed on a stock exchange. Result: The internal audit requirement applies under Rule 13.
Example 2: Unlisted Public Company
Company B has: Paid-up capital: ₹40 crore, Turnover: ₹180 crore, Bank borrowings: ₹120 crore, Deposits: ₹10 crore. The company crosses the applicable borrowing criterion. Result: Internal audit requirement applies.
Example 3: Private Company
Company C has: Turnover: ₹150 crore, Bank borrowings: ₹50 crore. Neither applicable threshold is reached. Result: The mandatory Section 138/Rule 13 appointment requirement does not arise solely from these criteria.
Internal Audit Applicability Checklist
Company Classification
- ☐ Is the company listed?
- ☐ Is it an unlisted public company?
- ☐ Is it a private company?
For Unlisted Public Companies
- ☐ Is paid-up share capital ₹50 crore or more?
- ☐ Is turnover ₹200 crore or more?
- ☐ Are bank/PFI borrowings ₹100 crore or more at any point during the preceding financial year?
- ☐ Are outstanding deposits ₹25 crore or more at any point during the preceding financial year?
For Private Companies
- ☐ Is turnover ₹200 crore or more?
- ☐ Are bank/PFI borrowings ₹100 crore or more at any point during the preceding financial year?
If Internal Audit Applies
- ☐ Determine the internal audit framework
- ☐ Appoint the internal auditor
- ☐ Define the audit scope
- ☐ Establish audit methodology
- ☐ Determine periodicity
- ☐ Conduct the audit
- ☐ Report findings
- ☐ Track corrective actions and follow-up
Non-Compliance and Penalties
The Companies Act, 2013 does not prescribe a separate penalty specifically for failure to appoint an internal auditor under Section 138. Where no specific penalty is provided for a contravention, Section 450 may apply as a residuary provision. It provides for a penalty of ₹10,000, with an additional ₹1,000 for each day of continuing contravention, subject to the statutory maximum limits.
The actual consequences of non-compliance should be assessed based on the specific facts and applicable provisions of the Companies Act, 2013.
Mandatory Internal Audit vs Voluntary Internal Audit
Not being legally required to appoint an internal auditor does not mean internal audit has no business value.
A company may voluntarily establish an internal audit function because of:
- Rapid business growth
- Multiple business locations
- Complex operations
- Increasing regulatory requirements
- Higher transaction volumes
- Technology dependency
- Third-party/vendor dependency
- Investor or lender expectations
- Need for stronger internal controls
Key Takeaway:
Legal applicability tells you whether internal audit is mandatory. Business need determines whether internal audit is valuable.
Common Mistakes in Assessing Internal Audit Applicability
1. Assuming Internal Audit Is Only for Listed Companies
It isn’t. Certain unlisted public and private companies can also fall within the prescribed criteria.
2. Assuming Every Private Company Needs an Internal Auditor
Private companies need to assess the applicable turnover and borrowing criteria.
3. Looking Only at Turnover
For unlisted public companies, applicability can arise through paid-up capital, turnover, borrowings or deposits.
4. Treating Internal Audit as Statutory Audit
The two audits have different objectives and scopes.
5. Treating Internal Audit as a Year-End Exercise
An effective internal audit function should operate according to a defined scope, methodology, periodicity and follow-up process.
Internal Audit Applicability Decision Guide
- ₹50 cr paid-up capital
- ₹200 cr turnover
- ₹100 cr borrowings
- ₹25 cr deposits
- ₹200 cr turnover
- ₹100 cr borrowings
Frequently Asked Questions
Conclusion
Internal audit applicability in India is not the same for every company. The requirement primarily depends on Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014.
Companies should reassess applicability based on their company category and the relevant financial criteria rather than assuming that internal audit is required—or not required—based solely on their current turnover.
The key thresholds covered in this guide are:
- Listed company: Covered
- Unlisted public company: ₹50 crore paid-up capital, ₹200 crore turnover, ₹100 crore applicable borrowings (at any point during the preceding financial year), or ₹25 crore deposits (at any point during the preceding financial year)
- Private company: ₹200 crore turnover or ₹100 crore applicable borrowings (at any point during the preceding financial year)
Ready to Streamline Your Internal Audit Process?
Centralize audit planning, evidence, observations, action tracking and reporting with ASPIA Internal Audit Management.
