Duties and Responsibilities of an Auditor Under the Companies Act 2013

Duties and Responsibilities of an Auditor Under the Companies Act 2013

If you run a company in India, you have probably heard your accountant or a well-meaning relative say "get your books audited" without really explaining what that means. Most business owners think an auditor is just someone who checks whether the numbers add up. In reality, an auditor carries a legal responsibility that goes far beyond arithmetic - one that protects shareholders, lenders, employees, and the government from being misled by a company's financial statements.

Whether you are a founder appointing your first statutory auditor, a director trying to understand what you can and cannot ask your auditor to do, or simply someone curious about how corporate accountability works in India, this guide breaks down an auditor's duties and responsibilities in plain language - and tells you where things usually go wrong.

What Are the Duties and Responsibilities of an Auditor

An auditor, in the context of a company registered under the Companies Act 2013, is an independent professional - typically a Chartered Accountant or a firm of Chartered Accountants - appointed to examine a company's books of account and financial statements, and to report whether they present a true and fair view of the company's financial position.

The role is not advisory in the way a consultant's role is. An auditor is a statutory watchdog appointed under law, and their duties are laid down primarily in Sections 139 to 148 of the Companies Act 2013, supported by the Companies (Audit and Auditors) Rules, and the Standards on Auditing issued by the Institute of Chartered Accountants of India (ICAI).

Broadly, an auditor's responsibilities fall into a few buckets:

• Reporting duty - forming and expressing an opinion on whether financial statements give a true and fair view
• Duty to report fraud - flagging suspected fraud to the Board, Audit Committee, or in serious cases, directly to the Central Government
• Duty under CARO - additional reporting on specific operational and financial matters, where the Companies (Auditor's Report) Order applies
• Duty of due diligence and professional skepticism - not merely accepting management's word, but verifying and testing it
• Duty of confidentiality alongside disclosure - maintaining professional confidentiality while still disclosing material irregularities as required by law

It helps to remember that an auditor does not prepare the financial statements - that is management's job. The auditor examines what management has prepared and tells shareholders whether they can rely on it.

Why an Auditor's Role Matters So Much

Company financial statements are used by many people who are not in the room when decisions are made - shareholders deciding whether to invest more, banks deciding whether to extend a loan, vendors deciding whether to extend credit, and tax authorities checking whether the right tax has been paid. None of these people can personally verify a company's books. They rely on the auditor's signature and report as an assurance that the numbers are genuine.

This is why an auditor's duties are backed by law rather than left to professional courtesy. If an auditor is careless, complicit, or simply lazy in their checks, real financial harm can follow - shareholders may lose money, banks may extend loans against inflated assets, and fraud can continue undetected for years. Several well-known corporate scandals in India, both large and small, have eventually come down to a failure of proper audit oversight.

For a business owner, understanding this matters for a very practical reason: your auditor's report is often the first document a bank, investor, or regulator reads when assessing your company. A qualified or adverse opinion (where the auditor flags concerns) can affect your ability to raise funds, get loans, or even retain certain licenses. Cooperating properly with your auditor, rather than treating the audit as a formality, protects your own business interests.

When and to Whom These Duties Apply

Every company registered under the Companies Act 2013 - private limited, public limited, one person company, or Section 8 company - is required to appoint a statutory auditor, with limited exceptions and thresholds that may apply to smaller entities under specific rules. The auditor's duties apply for the entire tenure of appointment, which is typically for a period as decided by the shareholders, subject to rotation requirements for certain classes of companies.

Key points on applicability:

• The first auditor of a company is usually appointed by the Board within a short window after incorporation, and subsequent auditors are appointed or ratified by shareholders at general meetings.
• Certain classes of companies (based on paid-up capital, turnover, or public borrowings, as prescribed) must rotate individual auditors and audit firms after specified terms, to preserve independence.
• CARO reporting requirements apply based on the company's size, nature, and whether it is a private or public company - smaller private companies below certain thresholds may be exempt from some CARO clauses, but it is important to verify applicability each year since thresholds are revised from time to time.
• Auditors of listed companies and certain other classes of companies have enhanced reporting duties, including reporting on internal financial controls.

If you are a director or promoter, it is worth checking each financial year whether your company falls into a category with enhanced audit obligations, since the thresholds and rules are periodically updated.

What an Auditor Needs From the Company

For an auditor to fulfill their duties properly, the company must provide full and timely access to records. Auditors are legally entitled to access all books, vouchers, and information they consider necessary, and can seek explanations from officers of the company. In practice, the following are commonly required:

• Complete books of account, ledgers, and trial balance for the financial year
• Bank statements and bank reconciliation statements
• Copies of all major contracts, loan agreements, and related-party transaction details
• Fixed asset register and details of additions or disposals during the year
• Statutory registers maintained under the Companies Act
• Details of statutory dues - GST, TDS, PF, ESI - along with proof of payment
• Board and shareholder meeting minutes relevant to financial matters
• Confirmation of balances from debtors, creditors, and banks
• Details of any pending litigation, contingent liabilities, or related disputes
• Management representation letter confirming completeness of information provided

A company that delays providing these documents, or provides incomplete records, is not just inconveniencing the auditor - it can result in the auditor qualifying their report, which can have real consequences for the company's credibility.

Step-by-Step: How the Statutory Audit Process Typically Works

1. Appointment of auditor - The Board or shareholders formally appoint the auditor, and the company files the required intimation with the Registrar of Companies, typically through the prescribed e-form.
2. Engagement and planning - The auditor issues an engagement letter, understands the business, and plans the audit approach based on materiality and risk areas.
3. Interim or preliminary checks - For larger companies, auditors may conduct interim visits during the year to test internal controls and transactions on a sample basis.
4. Year-end audit fieldwork - After the financial year closes, the auditor examines the final books, verifies balances, tests significant transactions, and seeks explanations for anomalies.
5. Verification of statutory compliance - The auditor checks compliance with applicable laws, including tax deductions, statutory registers, and related-party disclosures.
6. Fraud assessment - If the auditor has reason to believe an offense involving fraud has been or is being committed, they follow the reporting mechanism prescribed under the Act - reporting to the Board or Audit Committee first, and if not satisfactorily addressed and above a prescribed threshold, reporting to the Central Government.
7. CARO reporting (where applicable) - The auditor prepares responses to the specific matters listed in the Companies (Auditor's Report) Order, covering areas like fixed assets, inventory, loans, statutory dues, and more.
8. Drafting the audit report - The auditor forms an opinion - unmodified, qualified, adverse, or disclaimer of opinion - and drafts the audit report along with any annexures.
9. Signing and submission - The auditor signs the report, which is then placed before shareholders at the Annual General Meeting along with the financial statements.
10. Filing with the Registrar - The audited financial statements, along with the auditor's report, are filed with the Registrar of Companies within the prescribed timeline, generally through the relevant annual filing forms.

Throughout this process, the company's finance team and the auditor need to work closely, but always maintaining the auditor's independence - the auditor should never simply "sign off" on management's version without independent verification.

Cost of Statutory Audit in 2026

Audit fees in India are not fixed by law in most cases (except for some categories where fee structures are prescribed) and depend on several factors:

• Size and complexity of the company's operations and transaction volume
• Number of locations, branches, or subsidiaries
• Whether CARO reporting and internal financial controls reporting apply
• The reputation and scale of the audit firm engaged
• Whether it is a first-time audit or a recurring engagement

As a rough sense of range for small and medium private companies, professional fees can start from a modest figure for very small, low-transaction companies and go up significantly for companies with complex operations, multiple compliance requirements, or listed status. Please verify the current rate with a practicing Chartered Accountant or with Legal Suvidha, since fee benchmarks vary by city, industry, and the scope of work involved, and government-side filing fees (such as ROC filing fees) are separate from the professional audit fee.

Timeline and Key Due Dates

• The first auditor is typically appointed within a short window from the date of incorporation, as prescribed under the Act.
• Auditors for subsequent years are usually appointed or ratified at the Annual General Meeting (AGM).
• The AGM itself must generally be held within a prescribed period from the end of the financial year, commonly cited as within six months of the financial year-end, subject to any extension granted by the Registrar.
• Financial statements and the auditor's report must be filed with the Registrar of Companies within the prescribed number of days from the AGM, through the applicable annual filing forms.
• Auditors have a continuing duty to report fraud "immediately" or within a short prescribed period upon forming a suspicion, in cases that meet the threshold for reporting to the Central Government.

Because these timelines can shift slightly with amendments and government notifications, it is wise to confirm the exact current deadlines applicable to your company each year rather than relying on last year's dates.

Auditor's Duties vs Director's Duties - Key Distinctions

• Who prepares vs who verifies - Directors and management prepare the financial statements; the auditor independently examines and reports on them.
• Responsibility for fraud prevention vs detection - Preventing fraud through internal controls is primarily management's responsibility; the auditor's duty is to exercise professional skepticism and report suspected fraud detected during the audit.
• Approval vs opinion - Financial statements are approved by the Board and adopted by shareholders; the auditor only expresses an independent opinion on whether they are true and fair, not an approval.
• Employment relationship - Directors are part of the company's management; a statutory auditor must be independent and cannot be an employee or have specified relationships or interests in the company.
• Liability differs - Directors can be held liable for mismanagement or breach of fiduciary duty; auditors can be held liable for professional negligence, misconduct, or complicity in fraud, with separate disciplinary proceedings possible before the ICAI or the National Financial Reporting Authority (NFRA) for larger companies.

Understanding this distinction matters because business owners sometimes expect the auditor to "manage" compliance the way an internal accountant would. That is not the auditor's job - and expecting it can create friction and false comfort.

Common Mistakes Companies and Auditors Make

• Treating the statutory audit as a year-end formality instead of an ongoing compliance discipline
• Providing incomplete or last-minute records, forcing rushed audit work and increasing the risk of oversight
• Appointing an auditor without checking independence requirements, such as prohibited relationships or existing engagements that could create a conflict
• Not rotating auditors when required, especially for companies that cross the prescribed thresholds
• Ignoring or delaying action on issues the auditor has flagged in management letters, assuming they are minor
• Auditors failing to maintain adequate documentation of the work performed, which becomes a serious problem if the audit is later scrutinized
• Confusing internal audit with statutory audit - the two serve different purposes and cannot substitute for each other
• Not filing the necessary auditor appointment or resignation forms with the Registrar within the prescribed time, leading to technical non-compliance
• Assuming CARO does not apply without actually checking the current exemption thresholds for the relevant financial year

FAQ

What is the primary duty of a statutory auditor?

The primary duty is to examine the company's financial statements and express an independent opinion on whether they present a true and fair view of the company's financial position and performance, in accordance with applicable accounting standards and the Companies Act 2013.

Is an auditor responsible for detecting all fraud in a company?

Not entirely. An auditor is required to exercise due professional care and skepticism, and to report suspected fraud that comes to their notice during the audit. However, preventing fraud through strong internal controls is primarily management's responsibility, and an audit is not designed to guarantee that every fraud will be uncovered.

What is CARO and when does it apply?

CARO, the Companies (Auditor's Report) Order, requires auditors of specified companies to report on additional matters such as fixed assets, inventory verification, loans and guarantees, statutory dues, and more. Applicability depends on the company's size, nature, and certain exemption thresholds, so it is important to verify whether CARO applies to your company for the relevant financial year.

Can an auditor be held personally liable for errors in the audit?

Yes. An auditor can face professional and legal consequences for negligence, misconduct, or complicity in misstatement, including disciplinary action by the ICAI, penalties under the Companies Act, and in serious cases, proceedings before the National Financial Reporting Authority for certain classes of companies.

How is a statutory auditor different from an internal auditor?

A statutory auditor is an independent, externally appointed professional whose report goes to shareholders and regulators, focused on whether financial statements are true and fair. An internal auditor is typically engaged by the company itself to review internal processes, controls, and efficiency, and reports to management or the Audit Committee rather than to shareholders at large.

What happens if a company does not appoint an auditor on time?

Non-appointment of an auditor within the prescribed timeline is a compliance lapse that can attract penalties on the company and its officers, and can also trigger the Registrar's power to appoint an auditor in certain circumstances. It is best to address any delay immediately rather than let the gap continue.

Do small private companies need to worry about CARO and fraud reporting?

Many CARO clauses have exemption thresholds for smaller private companies, but fraud reporting duties generally apply regardless of company size once fraud is suspected. Since thresholds change periodically, it is important to check current applicability each year rather than assuming last year's exemption still holds.

Can the same person serve as auditor for many years without rotation?

For companies that fall under prescribed rotation rules - generally larger or listed companies, and certain other classes as notified - individual auditors and audit firms must be rotated after a specified term. Smaller companies outside these thresholds may not be subject to mandatory rotation, but appointment still needs periodic shareholder ratification as required.

How Legal Suvidha Makes This Effortless

This is exactly the kind of process where one wrong document, a mismatched detail, or a missed deadline turns into a rejection, a resubmission, or a running penalty. Legal Suvidha handles the whole thing end-to-end so you can focus on your business.

• Fixed, all-inclusive price quoted upfront — professional fee plus government fee, itemised, with no hidden charges appearing later.
• A dedicated Chartered Accountant / Company Secretary who owns your case from the first call to the final certificate.
• Proactive updates and deadline alerts at every stage — we do not disappear after payment.
• Trusted by 10,000+ founders with a 4.9/5 rating and a multi-disciplinary team of CAs, CSs and lawyers.

Talk to a Legal Suvidha expert today for a free consultation and an exact, transparent quote on WhatsApp — and get it done right the first time.