Guidance note to Auditors

Guidance Note to Auditors: Funding Disclosure Norms Under Schedule III, CARO 2020 and ICAI's Reporting Framework for FY 2025-26

For every statutory audit closing on or after 1 April 2021, auditors carry a non-negotiable obligation: examine every material fund flow, test whether the company is acting as an intermediary for a third party, verify the end-use of significant borrowings, and confirm that Schedule III disclosures on funding are complete and accurate. ICAI's guidance — reinforced through its Implementation Guides on CARO 2020 and the Schedule III Amendment, 2021 — makes clear that boilerplate language in the audit report is no longer adequate. This post maps out exactly what auditors must do, clause by clause, for the FY 2025-26 audit cycle.

The Regulatory Architecture: Why Funding Disclosure Has Become Central to Every Statutory Audit

The obligation to disclose fund flows in granular detail is not new, but the current framework has significantly sharper teeth than its predecessor. Three instruments work together to create the current compliance environment.

The Companies (Schedule III) Amendment, 2021 — effective 1 April 2021 — inserted mandatory disclosure notes into Schedule III of the Companies Act, 2013, applicable to both Division I (Indian GAAP) and Division II (Ind AS) companies. These require notes disclosing loans or advances to promoters, directors, KMPs and related parties; transactions with struck-off companies; investments in benami property; undisclosed income admitted in tax assessments; and the two funding-via-intermediary clauses that are now the centre of gravity of every funding disclosure review.

Companies (Auditor's Report) Order, 2020 (CARO 2020) — applicable from FY 2020-21 — introduced 21 sub-clauses requiring explicit auditor reporting on loans, end-use of borrowings, related-party transactions, fraud, non-cash dealings with directors, and the company's ability to service its debt. Several of these clauses directly overlap with Schedule III disclosures, creating a dual obligation: management must disclose, and the auditor must independently verify and report.

ICAI's Implementation Guides and Standards on Auditing — particularly SA 240 (Fraud), SA 550 (Related Parties), SA 580 (Written Representations), SA 505 (External Confirmations), and SA 705/706 (Modified Reports) — define the audit procedures and reporting standards that underpin this framework. ICAI's Auditing and Assurance Standards Board (AASB) has issued a dedicated Implementation Guide on CARO 2020 and supplementary guidance on the Schedule III amendment. Auditors who have not read these documents are carrying professional risk into their current engagements.

The Two Funding-via-Intermediary Clauses That Have Transformed Audit Practice

These clauses, inserted into Schedule III in 2021, have generated more audit complexity per line of text than almost any other amendment in recent memory. Both are mandatory disclosure notes, and auditors must test and report on them independently.

Clause A — Funds Advanced Through Intermediaries ("Funding Out")

A company must disclose whether it has advanced, loaned, or invested funds — from borrowed funds, share premium, or any other source — to any person or entity (the "Intermediary") with the understanding, written or otherwise, that:

• The Intermediary will directly or indirectly lend or invest those funds in a third party identified by or on behalf of the company (the "Ultimate Beneficiary"), or
• The Intermediary will provide any guarantee, security, or similar obligation on behalf of the Ultimate Beneficiary.

Where such an arrangement exists, management must disclose the name of the Intermediary, the amount advanced, the name of the Ultimate Beneficiary, and whether applicable regulatory compliance — under the Companies Act, FEMA, PMLA, SEBI regulations — has been achieved.

Clause B — Funds Received Through Intermediaries ("Funding In")

The mirror obligation: a company must disclose whether it has received funds from any party (the "Funding Party") with the understanding that the company will lend, invest, or provide guarantees to an Ultimate Beneficiary identified by the Funding Party. This clause specifically catches structures where a promoter routes equity capital through a related holding company — which then invests in the operating company — with conditions attached about the ultimate destination of those funds.

The single most important word in both clauses is "understanding — whether recorded in writing or otherwise." This is deliberate and expansive. A verbal assurance, an email thread, a WhatsApp message, or a consistent pattern of round-trip cash flows can all constitute an "understanding" in law. Auditors cannot conclude that no arrangement exists simply because no formal agreement was signed.

CARO 2020 Clauses That Directly Overlap With Schedule III Funding Disclosures

The following sub-clauses of CARO 2020 are the primary independent reporting obligations in this space:

Clause 3(iii) — Loans and Advances: The auditor must report whether loans, advances in the nature of loans, guarantees, or security provided to companies, firms, LLPs or any other parties are at terms not prejudicial to the company's interest; whether repayment schedules have been stipulated; whether repayments are regular; and whether overdue amounts exceeding Rs. 5 lakhs have been pursued for recovery.

Clause 3(ix) — Use of Borrowings: Sub-clause (b) requires the auditor to state whether term loans were applied for their stated purpose. Sub-clause (c) requires reporting on use of short-term funds for long-term purposes. Sub-clauses (d) and (e), added by the 2022 amendment to CARO 2020, require the auditor to report on whether the company has taken funds from any entity on account of obligations of its subsidiaries, associates, or joint ventures; and whether the company has raised loans pledging securities held in subsidiaries or associates.

Clause 3(xiii) — Related Party Transactions: The auditor must confirm whether all related-party transactions comply with Sections 177 and 188 of the Companies Act, 2013, and whether disclosures in the financial statements meet the requirements of applicable accounting standards.

Clause 3(xv) — Non-Cash Transactions with Directors: Requires reporting on compliance with Section 192 of the Companies Act, 2013 for any arrangement where the company or its directors exchange assets at values other than cash consideration.

Clause 3(xvi) — Registration Under RBI Act: Requires the auditor to report whether a company that is required to be registered under Section 45-IA of the Reserve Bank of India Act, 1934 has obtained such registration. This becomes relevant when a company's primary activity shifts toward lending or investing — which is precisely the profile that the intermediary clauses are designed to detect.

Step-by-Step Audit Procedures for Funding Disclosures

The following procedure can be adapted directly into your audit programme for any FY 2025-26 engagement.

Step 1: Obtain Clause-Specific Management Representations

Under SA 580, management representation letters must address each material Schedule III disclosure. Generic representations ("all material matters have been disclosed") are insufficient. For funding disclosures, the letter must explicitly confirm:

1. Whether the company has advanced or received funds through any intermediary arrangement, written or verbal, at any point during the year.
2. Whether all related-party relationships and transactions have been identified, disclosed, and approved in compliance with Sections 177 and 188.
3. Whether any transactions have been conducted with struck-off companies, and whether these are disclosed in the Schedule III notes.
4. Whether all borrowings have been applied for their stated purposes, with no diversion to promoter accounts or group entities.
5. Whether any immovable property is held under a name other than the company's, or whether any income has been offered in a tax settlement that was previously undisclosed in the books.

Step 2: Map Every Related-Party Fund Flow

Using the Related Party Master obtained from management under SA 550:

1. Extract all transactions between the company and each related party from the general ledger — do not rely solely on what management volunteers.
2. Cross-reference against board resolutions, shareholder approvals (Section 188 where applicable), loan agreements, and interest registers.
3. Compare interest rates on loans to promoters and KMPs against the company's own marginal cost of borrowing. If the rate charged is materially lower, assess whether Section 185 has been complied with, and whether the terms are prejudicial to the company under CARO 3(iii).
4. Verify that financial statement note disclosures match the ledger — opening balances, during-the-year movements, peak balances, and closing balances must all align.

Step 3: Run MCA V3 Master Data Checks for Struck-Off Companies

Every significant vendor, customer, debtor, investee, and lender counterparty should be verified on the MCA V3 portal (www.mca.gov.in) under "View Company/LLP Master Data" to confirm their status is not "Strike Off." This check must be run as close to the audit signing date as possible — a company active in April 2025 could be struck off by March 2026.

If a struck-off counterparty is identified:

• Quantify the aggregate value of all transactions during the year and the balance outstanding at year-end.
• Confirm whether Schedule III notes disclose the name, nature of transactions, and outstanding balance.
• Assess whether any outstanding debtors or loans from struck-off entities require provision for irrecoverability.
• Report under CARO 3(iii) if the relationship involves loans or advances.

Step 4: Trace End-Use of Major Borrowings

For each significant term loan or working capital drawdown during the year:

1. Obtain the sanction letter and identify the stated purpose.
2. Trace the credit entry in the company's bank account to the specific lender disbursement.
3. Track outflows from that account — within a commercially reasonable timeframe — to payments consistent with the stated purpose (capital expenditure invoices, raw material suppliers, etc.).
4. Flag any cash transfers to related parties, promoter accounts, or entities without an obvious operational connection to the stated purpose.
5. Where end-use cannot be substantiated for the full amount, report under CARO 3(ix)(b) and quantify the untraced portion.

Step 5: Apply Round-Tripping Signals to Your Ledger Review

Round-tripping — funds circulating back to their origin to create artificial revenues, inflate receivables, or disguise equity as debt — is the primary economic harm that the Schedule III intermediary clauses are designed to detect. Watch for:

• Equal and offsetting entries between two or more related entities, particularly between 15 March and 15 April of each financial year.
• Loans advanced at or near year-end that are repaid within the first fortnight of the new year, with no interest or minimal interest collected.
• High-value inter-company receivables with no underlying operational rationale (no invoices, no delivery records, no contracts).
• Share subscriptions funded by advances from group entities rather than independent external investors.

Step 6: Assess Cross-Border Fund Flows for FEMA Compliance

Where the company has received FDI or made ODI:

• Verify that Form FC-GPR, FC-TRS, APR, or FLA returns (as applicable) have been filed on the RBI's FIRMS portal.
• For outbound investments, confirm ODI filings and compliance with RBI's Master Direction on ODI.
• Non-compliance with FEMA is reportable under CARO 3(xvi).

Transactions with Struck-Off Companies — A Persistent Audit Hotspot

Section 248 of the Companies Act, 2013 governs the removal of defunct companies from the Register of Companies. Once struck off, a company loses legal standing — which means any outstanding receivable from it is effectively an unsecured claim against a non-existent entity, and any guarantee provided by it may be legally unenforceable.

In practice, struck-off counterparties appear in audit files for three main reasons: the counterparty was struck off after the transaction was entered into; vendor or customer databases were not reconciled against MCA records; or promoter group structures included dormant shell companies that fell into default status.

For large-volume audits, a systematic CIN-based match between the company's debtor/vendor ledger and the MCA data is worth the investment. For smaller audits, sample at minimum the top 20 vendors, top 20 customers, and all investees for MCA status verification.

Common Mistakes and Pitfalls to Avoid

Treating "understanding" as meaning "written agreement." The clause is explicit: written or otherwise. An email thread, a verbal instruction confirmed in a subsequent action, or a pattern of behaviour is sufficient to establish an understanding in law. Do not give a clean opinion based solely on the absence of a signed agreement.

Accepting a generic management representation letter. A blanket "all disclosures are complete" representation does not discharge your SA 580 obligation for these clauses. Clause-specific representations are required.

Thin sampling on related-party transactions. SA 550 requires you to understand the nature and economic substance of related-party relationships — not just to test a sample. In promoter-driven structures with multiple group entities, a full-population test is often necessary.

Running the struck-off company check at the planning stage only. MCA status changes throughout the year. A check run in May 2025 may not reflect a strike-off completed in January 2026. Run the check again immediately before signing the report.

Partial end-use tracing. Confirming that the first payment after a loan drawdown went to the stated purpose, then stopping, is not sufficient for CARO 3(ix)(b). The full amount must be traced to its economic destination.

Boilerplate CARO reporting. Peer reviewers and the Financial Reporting Review Board (FRRB) of ICAI now specifically examine CARO reports for generic, copy-paste language. Every sub-clause answer must reflect the specific facts of the company under audit.

Worked Example: Detecting a Funding-via-Intermediary Arrangement

Consider the following scenario, representative of what appears in practice in promoter-driven mid-market audits:

Company A (the auditee, a manufacturing company) shows a loan advanced of Rs. 3,00,00,000 to Company B (a trading company, 30% held by Company A's promoter family) on 28 March 2026, at 9% per annum. Company B's own balance sheet — obtained as a related-party confirmation — shows the Rs. 3 crore liability and simultaneously shows an investment of Rs. 2,90,00,000 made into Company C (a startup, 100% held by Company A's promoter) on 30 March 2026.

The audit trail the auditor must build:

1. Flag the timing. Two days separate Company A's loan to Company B and Company B's investment in Company C. Both occur within three days of year-end. This is a textbook intermediary signal.
2. Obtain Company B's board resolution for the investment in Company C. Does it reference any instruction or direction from Company A or its management? Does it state an independent commercial rationale?
3. Issue a third-party confirmation to Company B under SA 505, asking explicitly whether they had any understanding — oral or written — that the Rs. 3 crore from Company A was to be invested in Company C or any entity identified by Company A.
4. Review Company A's board minutes for the loan to Company B. Is the stated purpose "intercompany lending for working capital"? If so, does the application of funds match?
5. Compute the economic substance. Company A has effectively placed Rs. 2,90,00,000 of capital into Company C — a promoter-owned entity — while booking it as a loan receivable from Company B. The annual interest income at 9% on Rs. 3 crore is Rs. 27,00,000. The question is whether Company B, a trading company, can independently service this debt if Company C does not perform.
6. If the arrangement is confirmed as an intermediary structure: Management must disclose Company B as the Intermediary and Company C as the Ultimate Beneficiary in Schedule III notes. If management declines, the auditor must issue a qualified opinion under SA 705 — the financial statements do not include disclosures required by Schedule III that are material.
7. CARO 3(iii) reporting: State that a loan of Rs. 3,00,00,000 has been advanced to Company B; that the end-use of those funds — based on Company B's confirmed investment in Company C — raises concerns about whether the arrangement serves Company A's commercial interest; and set out the facts. Do not soften this into a generic "the loan is secured and repayable on demand" answer.

Reporting in the Statutory Audit Report

Where management has made adequate, substantiated disclosures and the auditor's procedures confirm their completeness, reporting is affirmative. Where gaps exist, the available tools under SA 705 and SA 706 are:

An audit file for FY 2025-26 that cannot produce documented evidence of a structured approach to each of these clauses — procedures performed, evidence obtained, management representations received, conclusions reached — is exposed in peer review and FRRB examination. The FRRB has specifically listed funding disclosure and CARO reporting quality as examination priorities in recent review cycles.

Key Takeaways

• The intermediary clauses cover verbal and implied arrangements. The absence of a formal agreement is not sufficient to conclude no such arrangement exists. Audit procedures must actively test for round-tripping and unexplained inter-company fund flows.
• CARO 2020 creates an independent reporting obligation running parallel to Schedule III. Clauses 3(iii), 3(ix)(b)–(e), 3(xiii), 3(xv), and 3(xvi) are the primary overlap zones with the funding disclosure framework.
• MCA V3 master data checks for struck-off companies must be performed as close to the audit signing date as possible. Status can change at any point in the financial year.
• Management representation letters must be clause-specific. A general "all disclosures are complete" representation does not satisfy SA 580 for Schedule III funding clauses.
• Loans to promoters and KMPs require both a Schedule III disclosure note and a CARO 3(iii) report. The interest rate must be compared to the company's marginal cost of borrowing to assess whether terms are prejudicial to the company's interest.
• End-use verification requires tracing the full amount of significant borrowings to their economic destination — a partial trace to the first outflow is not sufficient for CARO 3(ix)(b) purposes.
• Boilerplate CARO language is a quality-review liability. Every sub-clause answer must be tailored to the specific facts of the company under audit. Peer review and FRRB examination of audit files is actively targeting generic reporting in the FY 2025-26 audit cycle.