Auditor Selection Rules

Auditor Selection Rules

Selecting a statutory auditor in India is a Board-level governance decision governed by Sections 139 to 148 of the Companies Act 2013, the Companies (Audit and Auditors) Rules 2014, NFRA regulations, and — for listed entities — SEBI's Listing Obligations and Disclosure Requirements (LODR) framework. In FY 2026-27, with the National Financial Reporting Authority actively conducting Audit Quality Reviews and the MCA tightening filing enforcement on its V3 portal, every director and company secretary must understand the full lifecycle of auditor appointment: who qualifies, how long they can serve, when they must rotate, what services they cannot render, and exactly which forms must be filed by when. Errors in any of these steps expose the Board to penalties, invalid audit opinions, and multi-regulator scrutiny.

The Mandatory Appointment Framework: Section 139

Section 139 governs the complete lifecycle of auditor appointment — from the company's first day of existence through every AGM cycle thereafter.

First Auditor

The Board of Directors must appoint the company's first auditor within 30 days of incorporation. If the Board fails to act within this window, the obligation shifts to members, who must appoint the first auditor at an Extraordinary General Meeting (EGM) within 90 days of incorporation. The first auditor holds office until the conclusion of the first Annual General Meeting.

This timeline is frequently missed by startups that are focused on product and fundraising. The 90-day clock runs from the date of incorporation certificate — not from the date the founders first meet, nor from the date of the first board meeting.

Subsequent Auditors

At each AGM, members appoint the auditor for a term of five consecutive years. Upon appointment, the company must:

1. Obtain the auditor's written consent and a certificate that the appointment is in accordance with Section 141
2. Pass the ordinary resolution at the AGM
3. File Form ADT-1 on the MCA V3 portal within 15 days of the AGM

ADT-1 is the company's filing — not the auditor's. The Company Secretary or authorised director is responsible for it. Late filing attracts additional fees under the Companies (Registration of Offices and Fees) Rules 2014, with the multiplier escalating steeply beyond 30 days. Prolonged non-filing crosses into Section 137 prosecution territory for officers in default.

Casual Vacancy

If a mid-term vacancy arises — through the auditor's death, disqualification, or removal — the Board must fill it within 30 days. Members must then ratify or replace the Board-appointed auditor at the next general meeting within three months of the Board's appointment. Where the vacancy arises from resignation, the Board's authority to fill it is subject to additional scrutiny — the Registrar of Companies (RoC) and, in NFRA-covered companies, NFRA itself, look closely at resignation-triggered vacancies to rule out management pressure.

Auditor Rotation: Section 139(2) and Rule 5

Mandatory rotation applies to:

• All listed companies
• Unlisted public companies with paid-up share capital of ₹10 crore or more
• Private companies with paid-up share capital of ₹50 crore or more
• Any company with public deposits of ₹50 crore or more
• Any company with borrowings from banks or public financial institutions of ₹50 crore or more

If your company falls into any of these categories, the rotation clock is running — and it started from 1 April 2017 (the date the rotation rules came into force). Many companies that transitioned in 2017 are now approaching the end of a second firm-term in FY 2026-27. Boards must check tenure status before the next AGM.

Rotation Limits at a Glance

The Common-Partners Trap

Rule 6 of the Companies (Audit and Auditors) Rules 2014 restricts the incoming firm from having common partners with the outgoing firm. If Partner A was a key audit engagement partner at Firm X (outgoing) and also practises with Firm Y (incoming), Firm Y is barred from accepting the appointment.

Companies that "rotate" to a loosely affiliated firm without running a common-partner verification are creating a latent defect in the appointment. If discovered — by NFRA during an Audit Quality Review, or by a lender's due diligence — the appointment may be found invalid, requiring a fresh appointment process and potentially a re-audit.

Practical fix: Require the incoming firm to certify in writing, before the Audit Committee recommendation is finalised, that no common partners exist with the outgoing firm. Attach this certificate to the Audit Committee minutes.

Who Qualifies: Eligibility Under Section 141

To be appointed as statutory auditor, a person or firm must satisfy three conditions simultaneously:

1. Qualification: Must be a Chartered Accountant (CA) holding a Certificate of Practice from the Institute of Chartered Accountants of India (ICAI). For a firm, the majority of partners practising in India must be CAs in practice.
2. Entity type: Where the audit client is a body corporate, only a firm (partnership or LLP) of CAs is eligible. An individual CA cannot ordinarily be appointed auditor of a public company.
3. Audit limit cap: An individual CA or a partner of a CA firm can hold statutory audit appointments in a maximum of 20 companies at any point in time. One Person Companies (OPCs), small companies (as defined under the Companies Act), and dormant companies are excluded from this count.

The 20-audit ceiling is a live limit — not a career ceiling. If a signing partner is already at 19 audits and accepts your appointment, they are compliant. If the firm later adds another partner to that person's signing list, the firm must track and manage the cap. Firms exceeding the cap face ICAI disciplinary action alongside Section 147 penalties on the company.

Disqualifications: Section 141(3)

Section 141(3) disqualifies the following categories from acting as statutory auditor, both at appointment and on a continuing basis:

• A body corporate other than a Limited Liability Partnership (LLP)
• An officer or employee of the company
• A partner or employee of any officer or employee of the company
• A person or their relative holding securities or interest in the company exceeding ₹1 lakh in face value
• A person or their relative indebted to the company for more than ₹5 lakh, or who has furnished a guarantee or security of more than ₹1 lakh to or on behalf of a third party in relation to the company
• A person or relative who is a director or key managerial personnel (KMP) of a company that is an officer, employee, or agent of the audit client
• Any person who renders services prohibited under Section 144
• Any person convicted of fraud within the preceding ten years from the date of conviction

These disqualifications are continuing — if a disqualification arises mid-term, the auditor must vacate office immediately under Section 141(4) and file Form ADT-3. The company is then left with a casual vacancy requiring urgent Board action.

The ₹1 lakh securities threshold and ₹5 lakh indebtedness threshold are tripped more often than companies realise in family-owned structures, where the promoter-auditor relationship goes back decades and small cross-holdings or informal loans are commonplace. An annual independence declaration — signed by the auditor and reviewed by the Audit Committee — should verify these thresholds every year.

Section 144: Prohibited Services and Why the List Is Absolute

Section 144 prohibits the statutory auditor — and any entity in which the auditor, their firm, or any partner of the firm has a significant interest — from providing the following services to the company, its holding company, or any subsidiary:

1. Accounting and book-keeping services
2. Internal audit
3. Design and implementation of financial information systems
4. Actuarial services
5. Investment advisory services
6. Investment banking services
7. Rendering of outsourced financial services
8. Management services
9. Any other service as may be prescribed

The prohibition is absolute — there is no materiality threshold, no de minimis exception, and no waiver available from the Audit Committee. Rendering even one prohibited service triggers disqualification under Section 141(3)(i), which means the audit opinions signed during that period are legally deficient.

For listed companies, SEBI LODR Regulation 18 additionally requires the Audit Committee to pre-approve all non-audit services before engagement — including services by affiliates or network firms of the statutory auditor. The pre-approval policy must be documented and reviewed annually.

Worked Example: When Non-Audit Services Invalidate Two Years of Accounts

Scenario: Precision Components Pvt. Ltd. has paid-up share capital of ₹65 crore — above the ₹50 crore rotation threshold. Its statutory audit firm has been engaged for FY 2024-25 and FY 2025-26. In both years, the same firm's advisory team ran the company's internal audit function at a consolidated annual fee of ₹4.80 lakh.

What went wrong:

• Internal audit is explicitly prohibited under Section 144.
• From the date the internal audit engagement letter was signed, the firm became disqualified under Section 141(3)(i).
• The statutory audit opinions for both FY 2024-25 and FY 2025-26 are legally deficient — signed by a disqualified auditor.
• The company must appoint a new, eligible auditor, obtain fresh audit opinions on both years' accounts, and refile the relevant annual returns on MCA V3.

Estimated cost of the error:

• Fresh audit (two years): ₹8–12 lakh depending on firm and complexity
• MCA penalty on the company under Section 147: minimum ₹25,000, up to ₹5 lakh
• Penalty on every officer in default: minimum ₹10,000 and up to ₹1 lakh, or imprisonment up to 1 year, or both
• Additional filing fees for refiling annual returns: as per MCA V3 fee schedule (multiplier-based, potentially significant for 2-year delay)
• Lender scrutiny: the company's working capital limit is up for renewal — its bank will not accept accounts with a defective audit opinion as compliant financials
• NFRA referral risk: the firm may face an NFRA investigation if registered under NFRA jurisdiction

How to prevent this: Maintain a Group Services Restriction Matrix — a simple spreadsheet that lists every CA firm engagement across all entities in the group and flags any engagement against the Section 144 prohibited list. Update it before signing any new engagement letter.

Filing Obligations: ADT-1, ADT-2 and ADT-3

Form ADT-1 — Appointment

• Who files: The company (through Company Secretary or authorised director)
• When: Within 15 days of the AGM at which appointment is made
• Portal: MCA V3
• Attachments required: Auditor's written consent + certificate of compliance with Section 141

Common failure: The Company Secretary treats ADT-1 as a low-priority post-AGM task. Set an internal deadline of Day 10 after the AGM to give yourself a 5-day buffer before the MCA deadline.

Form ADT-2 — Removal Before Expiry of Term

Removing an auditor mid-term requires Central Government approval — precisely to prevent managements from removing inconvenient auditors. The step-by-step process:

1. Board passes a resolution recommending removal
2. Company files Form ADT-2 with the MCA (via MCA V3) within 30 days of the Board resolution, stating reasons
3. Central Government gives the auditor an opportunity to be heard
4. Central Government grants or refuses approval
5. Upon approval, company passes a special resolution at a general meeting
6. Company files the special resolution on MCA V3 (Form MGT-14)

Do not attempt removal before following every step. An improperly removed auditor can challenge the removal in court, and all audit work conducted by a replacement appointed without Central Government approval is procedurally defective.

Form ADT-3 — Resignation

When an auditor resigns, the obligation falls on the auditor, not the company:

• File Form ADT-3 with the RoC within 30 days of resignation
• ADT-3 must contain full reasons for resignation and any outstanding matters the auditor believes need to be brought to members' or creditors' attention
• Penalty for failure to file: minimum ₹50,000 and up to ₹5 lakh on the auditor under Section 140(2)

The company's Company Secretary should confirm ADT-3 filing within 30 days of receiving any resignation letter. Until ADT-3 is filed, the MCA records show an inconsistency — a vacancy that regulators and lenders may flag during due diligence.

Audit Committee Role: Section 177 and SEBI LODR

For listed companies and other prescribed classes, the Audit Committee under Section 177 is the mandatory gateway for all auditor-related decisions. The Audit Committee must:

• Recommend auditor appointment, re-appointment, rotation, and fees to the Board before any resolution is placed before members
• Obtain and review the auditor's annual written declaration of independence, confirming no disqualification under Section 141
• Pre-approve all non-audit services (for listed entities, this is a SEBI LODR Regulation 18(3)(iv) requirement)
• Review auditor observations, qualifications, and management responses before the Board approves the financial statements
• Assess CARO 2020 findings, particularly on internal financial controls (ICFR) under Section 143(3)(i), before signing off

Unlisted companies where an Audit Committee is mandatory under the Companies Act must not skip the recommendation step — placing auditor appointment directly before members without an Audit Committee recommendation is a procedural defect that RoC flags during scrutiny of annual filings.

NFRA Oversight: What It Means in Practice

The National Financial Reporting Authority (NFRA), constituted under Section 132, has jurisdiction over:

• All listed companies
• Unlisted public companies with net worth of ₹500 crore or more, or turnover of ₹1,000 crore or more, or total outstanding loans or borrowings of ₹500 crore or more (verify against NFRA's current jurisdiction notification, as thresholds may be updated)
• Companies specifically referred to NFRA by the Central Government

NFRA can investigate auditors independently of ICAI, debar an auditor for up to 10 years, and impose significant monetary penalties. From a company's perspective:

• Your NFRA-registered auditor's Annual Return is a public document — check it. Adverse quality findings on your file are visible to sophisticated investors and lenders.
• NFRA Audit Quality Reviews (AQRs) of your audit file can trigger follow-on MCA or SEBI inquiries directed at the company, not just the auditor.
• The Audit Committee should explicitly include NFRA compliance status as an agenda item at the annual auditor reappointment discussion.

Fraud Reporting: Section 143(12)

The auditor's obligations extend beyond the audit opinion. Under Section 143(12) read with Rule 13:

• If the auditor suspects fraud involving ₹1 crore or more, they must report directly to the Central Government (through MCA) within 60 days of forming the belief
• For suspected fraud below ₹1 crore, the auditor reports to the Audit Committee or Board within 2 days, and the Audit Committee or Board then has 45 days to report to the Central Government
• In both cases, a simultaneous report to the Audit Committee is required

A Section 143(12) report from your auditor will almost certainly trigger an MCA inquiry and potentially a Special Audit under Section 210A. Boards that engage with the auditor early — and initiate prompt internal investigation — are in a materially better position than those who receive a Central Government notice first.

Common Mistakes and How to Avoid Them

Mistake 1: Missing the ADT-1 15-day window The AGM is over, everyone is exhausted, and ADT-1 gets pushed to "next week" until it is 40 days late. Fix: Make ADT-1 filing a Day-10 post-AGM action item on a written checklist, assigned to a named person, not "the CS team generally."

Mistake 2: Assuming rotation rules don't apply to private companies Founders of private companies that have raised VC funding and capitalised retained earnings often cross ₹50 crore paid-up capital without triggering an internal compliance review. Fix: Add a paid-up capital tracker to your annual board reporting dashboard.

Mistake 3: Letting group companies use the statutory auditor for book-keeping support Section 144's prohibition extends to the holding company and all subsidiaries. A subsidiary using the parent's statutory auditor for accounts-writing services — even informally — triggers disqualification. Fix: Group Services Restriction Matrix, reviewed quarterly.

Mistake 4: Skipping the common-partner verification at rotation Incoming firms are selected on reputation and fee competitiveness. Nobody runs the common-partner check. The appointment is defective. Fix: Require a written certification from the incoming firm before the Audit Committee meeting at which the recommendation is finalised.

Mistake 5: Treating casual vacancies as informal A director informally asks a CA friend to "look at the books" while a formal appointment is pending. This creates an unauthorised signatory situation. Fix: Follow the 30-day Board appointment / 3-month member approval sequence precisely, and file ADT-1 immediately upon Board appointment.

Key Takeaways

• Section 139 governs the full appointment lifecycle. File Form ADT-1 within 15 days of AGM; missing this window triggers escalating MCA additional fees and officer liability. First auditor: 30-day Board / 90-day EGM deadline. Casual vacancy: 30-day Board + 3-month member approval.
• Rotation under Section 139(2) applies to private companies with paid-up capital ≥ ₹50 crore — not just listed and unlisted public companies. Individual CAs rotate after 5 years; firms after 10. Run a common-partner certification before appointing the incoming firm.
• Section 141(3) disqualifications are continuing, not one-time checks. The ₹1 lakh securities threshold and ₹5 lakh indebtedness threshold require annual verification — especially in family-owned and promoter-led structures. Disqualification mid-term immediately voids the auditor's standing.
• Section 144's prohibited services list — including internal audit, book-keeping, and management services — is absolute. There is no de minimis carve-out. Rendering a prohibited service, even through a related entity, retroactively disqualifies the auditor and invalidates the audit opinion.
• ADT-2 (removal) requires Central Government approval; ADT-3 (resignation) is the auditor's own obligation, with a ₹50,000–₹5 lakh penalty for non-filing. The Company Secretary must track both.
• Audit Committees are the mandatory gateway for listed companies and prescribed classes. The recommendation to the Board, annual independence declaration review, and non-audit service pre-approval are legal requirements, not best practices.
• NFRA oversight is public and consequential: NFRA Audit Quality Review findings on your file are visible in the auditor's public annual return and can invite multi-regulator attention. Factor NFRA compliance into your auditor reappointment assessment every year.