Last reviewed: 13 November 2026. Every year, around the time statutory audit begins, the same question reaches us from private company directors: “Our auditor says we also need an internal auditor. Is that true?” The honest answer is that for most private companies it is not, but for the ones that have grown quickly, borrowed heavily or crossed ₹200 crore of turnover, it is mandatory, it is tested on the previous year’s numbers, and a missed appointment surfaces in the statutory auditor’s own report. This guide sets out the exact test under Section 138 and Rule 13, how to measure it, worked examples, who can be appointed, what the audit must cover, and the penalty position.
In this guide
- What Section 138 and Rule 13 actually say
- Applicability by type of company
- How to measure the thresholds
- Three worked examples
- Who can be the internal auditor
- Scope, periodicity and reporting
- Link with statutory audit, CARO 2020 and IFC
- Penalty for non-compliance
- Appointment checklist
- A practical annual audit plan
- Common mistakes
- What the 2026 Amendment Bill means for now
- Frequently asked questions
1. What Section 138 and Rule 13 actually say
Section 138(1) provides that such class or classes of companies as may be prescribed shall appoint an internal auditor, who shall be a chartered accountant or a cost accountant (whether in practice or not), or such other professional as the Board may decide, to conduct the internal audit of the functions and activities of the company. Section 138(2) allows the Central Government to prescribe the manner and intervals of the audit and its reporting to the Board.
The classes are prescribed in Rule 13(1) of the Companies (Accounts) Rules, 2014. Rule 13(2) then says the Audit Committee, or the Board where there is no Audit Committee, shall in consultation with the internal auditor formulate the scope, functioning, periodicity and methodology of the internal audit. The Explanation to the rule adds two clarifications: the internal auditor may or may not be an employee of the company, and “chartered accountant” or “cost accountant” includes one not engaged in practice.
The section has been in force since 1 April 2014. For IFSC public and private companies, Section 138 applies only if the articles so provide (GSR 8(E) and 9(E) dated 4 January 2017). We read these from the Companies Act text and the notified rule; the rule has been amended in 2016 and the thresholds below are those in force today.
2. Applicability by type of company
| Class of company | Internal auditor mandatory if… |
|---|---|
| Every listed company | Always, without any threshold |
| Unlisted public company | Any one of: paid-up share capital ₹50 crore or more; turnover ₹200 crore or more; outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point; outstanding deposits ₹25 crore or more at any point – all in the preceding financial year |
| Private company | Either: turnover ₹200 crore or more in the preceding financial year; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point in the preceding financial year |
| Private company below both limits | Not mandatory under Section 138. The Board may still appoint voluntarily |
| LLP, partnership, proprietorship | Not covered by Section 138. Voluntary, or required by a lender or investor |
Two points are worth stressing because they are the usual source of confusion. First, paid-up capital and deposits are not tests for a private company; a private company with ₹80 crore of paid-up capital but modest turnover and little bank debt is outside the rule. Second, the section speaks of a class of companies: it does not depend on whether the company is a subsidiary of a larger group, although group policy may demand an internal audit anyway.
3. How to measure the thresholds
| Item | How we apply it |
|---|---|
| Look-back year | Figures of the preceding financial year. Crossing the limit in FY 2025-26 makes the requirement apply to FY 2026-27. A company that crosses in FY 2026-27 is first caught in FY 2027-28 |
| Turnover | Turnover as defined in Section 2(91): the gross amount of sale or supply of goods or services, or both, during the year. Take it from the audited financial statements, not from GST returns |
| Borrowings | Outstanding loans or borrowings from banks and public financial institutions, tested at any point of time during the year, not only at the balance sheet date. Include term loans, cash credit, overdraft and working capital limits actually drawn |
| Not named in the rule | Loans from directors, shareholders, group companies or NBFCs that are not public financial institutions. We read the rule strictly, but document the classification of each lender if the company is near the limit |
| Wording of the borrowing limit | The text says “exceeding one hundred crore rupees or more”. For safety treat ₹100 crore itself as the trigger |
| Newly incorporated company | No preceding financial year exists in the first year, so the test cannot be met in year one |
The “any point of time” wording for borrowings matters. A company with a modest closing loan balance can still be caught if a bridge facility or seasonal working-capital peak crossed ₹100 crore in the middle of the year. Pull the month-end bank statements and sanction letters; do not rely on the year-end schedule alone. A disciplined monthly close, such as the one in our month-end close checklist, makes this peak easy to evidence.
4. Three worked examples
| Case | Facts for the preceding year | Position |
|---|---|---|
| A – Trading company | Private limited. Turnover ₹212 crore. Bank borrowings peak ₹40 crore. Paid-up capital ₹5 crore | Mandatory. Turnover of ₹200 crore or more is enough on its own; the low borrowings do not help |
| B – Capital-intensive manufacturer | Private limited. Turnover ₹150 crore. Term loan and cash credit from banks reach ₹104 crore in January, closing at ₹92 crore | Mandatory. Borrowings exceeded ₹100 crore at a point during the year, even though the closing balance is below it |
| C – Founder-funded company | Private limited. Turnover ₹190 crore. Bank loans peak ₹60 crore. Unsecured loans from directors and a group company ₹70 crore. Paid-up capital ₹85 crore | Not mandatory. Turnover is below ₹200 crore, bank borrowings are below ₹100 crore, and capital, director loans and group loans are not tests for a private company. Document the analysis; revisit next year |
Reading Case C carefully. It is the kind of facts on which a lender or an investor will still ask for internal audit as a covenant even though Section 138 does not. Treat the statute as the floor, not the ceiling.
5. Who can be the internal auditor
Section 138(1) permits a chartered accountant, a cost accountant, or “such other professional as may be decided by the Board”. The Explanation to Rule 13 confirms that the person need not be an employee, and that a CA or CMA not in practice qualifies. Rule 13(1) as amended in 2016 also allows the appointment of an individual, a partnership firm or a body corporate. Four practical constraints apply:
- Not the statutory auditor. Section 144 bars the statutory auditor from providing internal audit services to the company, its holding company or its subsidiary. This is the most common slip in small structures where one CA firm does everything.
- Independence in substance. An employee who also runs the function being audited, such as the head of accounts, cannot credibly audit it. Where an employee is appointed, reporting should be to the Board or Audit Committee, not to the CFO.
- Competence for the sector. Choose on the basis of experience in the company’s processes, such as inventory-heavy manufacturing, project accounting or export documentation, rather than only on fees.
- Board resolution. The appointment, terms and remuneration should be approved by the Board and minuted, with an engagement letter that defines scope, access, timelines and reporting lines.
6. Scope, periodicity and reporting
Neither the Act nor the rule fixes a template. Rule 13(2) leaves scope, functioning, periodicity and methodology to the Audit Committee or the Board, in consultation with the internal auditor. A statutory Audit Committee under Section 177 is required only for specified public companies, so in a private company the Board itself normally fixes the scope. What an examiner, a lender or the statutory auditor will expect to see is:
- A risk-based annual internal audit plan approved before the year begins, covering the main processes rather than a random review.
- Periodic reports, usually quarterly for companies near the threshold and half-yearly otherwise, each with findings, risk rating, management response, owner and due date.
- Follow-up on earlier observations, so that closed and open points are visible to the Board.
- Working papers that support each finding, retained for review by the statutory auditor.
- Board discussion of the reports, minuted. An internal audit that is never tabled adds little comfort.
The ICAI’s Standards on Internal Audit give the professional framework for planning, evidence and reporting, and are the reference most internal auditors follow.
7. Link with statutory audit, CARO 2020 and internal financial controls
Internal audit is not a standalone compliance; the statutory auditor tests it. Under the Companies (Auditor’s Report) Order, 2020, Clause 3(xiv) requires the auditor to report, for companies where Section 138 is applicable, whether the company has an internal audit system commensurate with its size and nature of business, and whether the reports of the internal auditors for the period under audit were considered. A company that was required to appoint an internal auditor and did not will therefore see the gap in the auditor’s report itself, which lenders and investors read.
The auditor’s report on internal financial controls over financial reporting under Section 143(3)(i) is a related but separate matter. It applies to all companies, with an MCA exemption (notification of 13 June 2017) for private companies whose turnover is below ₹50 crore and borrowings below ₹25 crore. An internal audit programme that tests key controls produces evidence the statutory auditor can use, and helps a company defend its controls position. For the statutory side of the relationship, see our guide to statutory audit applicability and auditor appointment.
Two other threads connect here. Where an accounting system is used, the audit-trail requirement under Rule 3(1) is itself a control that internal audit should test; our note on the audit trail rule for accounting software sets out what to check. And related-party dealings are a natural internal audit area, as covered in Section 188 compliance.
8. Penalty for non-compliance
Section 138 does not contain its own penalty provision, so the general penalty in Section 450 applies. The company and every officer in default are liable to a penalty of ₹10,000, and where the contravention continues, a further ₹1,000 for each day, subject to the maximum amounts stated in Section 450. Adjudication is before the Registrar of Companies and penalties have been imposed on both the company and its officers in reported orders for non-appointment of an internal auditor. The practical exposure is wider than the penalty: an adverse CARO comment, lender questions and the risk that undetected control failures grow into a larger loss.
9. Appointment checklist
| Step | Action | Evidence to keep |
|---|---|---|
| 1 | After the audited accounts are signed, test turnover and the peak bank borrowings for the year just ended | Threshold working with lender-wise monthly balances |
| 2 | If either limit is met, decide the internal auditor: individual, firm or an independent professional | Proposal, independence declaration, confirmation that the person is not the statutory auditor |
| 3 | Board meeting: approve the appointment, remuneration and scope | Minutes and Board resolution |
| 4 | Issue the engagement letter covering scope, access to records, reporting lines and timelines | Signed engagement letter |
| 5 | Approve a risk-based audit plan and calendar for the year | Audit plan with quarter-wise coverage |
| 6 | Table each report before the Board; record management responses and action dates | Reports, minutes, action tracker |
| 7 | Provide reports to the statutory auditor for CARO clause 3(xiv) | Reports filed with audit documentation |
We are not aware of any ROC e-form that must be filed on appointment of an internal auditor, unlike Form ADT-1 for statutory auditors. The Board resolution and minutes are the record. Confirm this against the MCA portal at the time of appointment.
10. A practical annual audit plan
A plan that reviews everything shallowly each year is less useful than one that rotates deeper coverage across high-risk areas. A mid-sized private company might use a plan along these lines, adjusted for its own risk assessment:
| Area | Frequency | Key tests |
|---|---|---|
| Procure-to-pay | Quarterly | Purchase order approvals, three-way match, vendor master changes, duplicate payments, MSME vendor payments within the due period |
| Order-to-cash | Quarterly | Price master, credit limits, revenue cut-off, receivable ageing, credit notes and post-sale discounts |
| Inventory and fixed assets | Half-yearly | Stock count observation, valuation, slow-moving stock, asset register reconciliation, capitalisation policy |
| Payroll and HR | Half-yearly | Joiner and leaver controls, statutory deductions, attendance to payroll tie-out |
| Statutory compliance | Quarterly | GST reconciliations, TDS deduction and deposit, PF and ESIC, ROC filings calendar |
| Treasury and banking | Quarterly | Bank reconciliations, signing authority, loan covenant compliance, cheque and e-payment controls |
| Related-party and Board matters | Annual | Identification of related parties, approvals, arm’s-length support, register maintenance |
| IT and access controls | Annual | User access, segregation of duties, backup, audit trail enabled in the accounting software |
The same reports should feed the management information pack the Board already receives; a good monthly pack, as described in our guide to MIS reporting for MSMEs, makes it easier to see which numbers the internal audit needs to challenge. Companies approaching the threshold that want a smoother transition often engage an independent professional on a voluntary basis a year early.
11. Common mistakes
- Testing the wrong year. Applying current-year turnover instead of the preceding year, or the reverse. The trigger is the year just ended.
- Using the closing loan balance. The borrowing test is at any point of time during the year.
- Importing the public company tests. Treating paid-up capital or deposits as relevant to a private company.
- Appointing the statutory auditor. The one firm doing audit, tax and internal audit breaches Section 144.
- Annual formality. A single short report signed shortly before the statutory audit. The rule expects a periodic, risk-based audit with Board review.
- Ignoring group or lender requirements. The statute may not apply, but a sanction letter, investor agreement or parent policy often does.
- No follow-up. Repeat findings across years with no owner or date signal a weak control environment to the statutory auditor.
12. What the 2026 Amendment Bill means for now
The Corporate Laws (Amendment) Bill, 2026 was introduced in the Lok Sabha on 23 March 2026 and referred to a Joint Parliamentary Committee. As on 13 November 2026 it is a Bill, not law, and the thresholds in Rule 13 as currently notified are unchanged. This guide does not depend on any proposed amendment. If the rule changes, the preceding-year look-back and the threshold table above are what to revisit first. Directors should not pause an appointment that is due today in the expectation of future relief.
Frequently asked questions
Is internal audit mandatory for every private limited company?
No. Under Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014, a private company needs an internal auditor only if its turnover in the preceding financial year was ₹200 crore or more, or its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point in that year. Below both limits, there is no statutory requirement.
Do paid-up capital and deposits matter for a private company?
No. The paid-up capital (₹50 crore) and deposits (₹25 crore) tests apply only to unlisted public companies. A private company is tested on turnover and bank or public financial institution borrowings alone.
Do loans from directors, shareholders or NBFCs count towards the ₹100 crore borrowing test?
The rule refers to loans or borrowings from banks or public financial institutions. Unsecured loans from directors, shareholders or group companies are not named in the rule. We read the test strictly on bank and public financial institution borrowings, but a company close to the limit should document how it classified each lender.
Can our statutory auditor also act as internal auditor?
No. Section 144 of the Companies Act prohibits the statutory auditor from rendering internal audit services to the company, its holding company or subsidiary. The internal auditor must be a different person or firm.
Can an employee of the company be the internal auditor?
Yes. The Explanation to Rule 13 says the internal auditor may or may not be an employee of the company. The person must still be a chartered accountant, a cost accountant, or another professional decided by the Board, and should be independent of the functions audited.
Is there an MCA form to file when an internal auditor is appointed?
We are not aware of any ROC e-form prescribed for the appointment of an internal auditor. The appointment is made by Board resolution and recorded in the minutes, with an engagement letter defining scope. Confirm against the current MCA portal before relying on this.
What is the penalty if a company that needs an internal auditor does not appoint one?
Section 138 has no specific penalty clause, so the residual penalty under Section 450 applies: ₹10,000 on the company and every officer in default, with ₹1,000 for each day of continuing contravention, subject to the caps in that section. Separately, the statutory auditor reports on the internal audit system under CARO 2020.
Does an LLP need an internal audit under the Companies Act?
No. Section 138 and Rule 13 apply to companies. The LLP Act, 2008 has no equivalent provision. An LLP may still appoint an internal auditor voluntarily, for example when a lender or investor asks for it.
Does the Corporate Laws (Amendment) Bill, 2026 change the internal audit thresholds?
As on 13 November 2026 the Bill, introduced in the Lok Sabha on 23 March 2026 and referred to a Joint Parliamentary Committee, is not law. The thresholds in Rule 13 as currently notified continue to apply. We will update this guide if rules change.
We help companies keep clean monthly books, reconciliations and MIS, so that whoever is appointed as internal auditor starts from reliable records.
Bookkeeping Services Zoho Books Set-up Talk to usThis article summarises internal audit applicability under Section 138 of the Companies Act 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 as understood on the date of review. General information, not advice on your specific facts – confirm details against the current rules and MCA portal and consult us or your professional advisor before acting. CA Somesh Chandak & Associates, FRN 158694W.