Internal Audit Applicability Under the Companies Act 2013: Section 138 Explained

Internal Audit Applicability Under the Companies Act 2013: Section 138 Explained

Ask ten business owners what "internal audit" means and you'll probably get ten different answers — some think it is the same as the statutory audit, others assume it's only for giant corporations with huge finance teams. In reality, internal audit under the Companies Act is a specific, well-defined requirement, and whether it applies to you depends on some very concrete numbers: your turnover, your borrowings, and your public deposits.

If you've been wondering whether your company needs to appoint an internal auditor this year, or you just want to understand what this compliance actually involves, this guide walks you through everything in plain language, without the legal jargon overload.

What is Internal Audit Under Section 138

Internal audit is an ongoing, independent evaluation of a company's internal controls, risk management processes, financial reporting systems, and operational efficiency. Unlike a statutory audit (which happens once a year and results in an opinion on the financial statements) or a secretarial audit (which checks legal and procedural compliance), internal audit is meant to be a continuous management tool — helping the company spot weaknesses, inefficiencies, or fraud risks before they become serious problems.

Section 138 of the Companies Act, 2013, read with the Companies (Accounts) Rules, makes it mandatory for certain classes of companies to appoint an internal auditor, who can be either a chartered accountant, a cost accountant, or such other professional as the Board may decide, and who may be an employee of the company (unlike the statutory auditor, who must be independent and external).

The internal auditor's job is essentially to look inward at how the company runs day-to-day — are approvals being taken correctly, are internal controls over cash and inventory strong, are there red flags in vendor payments, is the company following its own policies — and report these findings to management and the Board (often through the Audit Committee, where one exists) on a regular basis, not just once a year.

Why Internal Audit Matters

Internal audit is often misunderstood as a "regulatory tick-box," but its real value goes much further.

• Catches operational problems early: Internal auditors typically review processes throughout the year, so issues like weak vendor controls, duplicate payments, or unauthorised expenses get caught quickly rather than being discovered a year later during the statutory audit.
• Strengthens internal controls: A good internal audit function helps management identify where controls are weak — for example, in inventory management, cash handling, or IT access — and fix them before they cause real financial loss.
• Supports the statutory auditor's work: A well-functioning internal audit process often makes the annual statutory audit smoother, because many control weaknesses have already been identified and addressed.
• Fraud detection and deterrence: Regular internal reviews act as a deterrent against fraud and misuse of company funds, since employees and vendors know that transactions are being periodically scrutinised.
• Better decision-making for the Board: Internal audit reports give the Board and Audit Committee visibility into operational risk that a purely financial statutory audit would not surface.
• Regulatory compliance: For companies where it is mandatory, simply not having an internal auditor is itself a violation, regardless of how well the company is otherwise run.

For growing companies, internal audit is also a maturity signal — it shows lenders, investors, and other stakeholders that the company takes governance seriously, well before it is legally forced to.

Who Needs Internal Audit — Applicability & Thresholds

Section 138 does not apply to every company. It applies to prescribed classes of companies, and the classification depends on whether the company is listed, unlisted public, or private, and on specific financial thresholds relating to:

• Turnover in the preceding financial year.
• Outstanding loans or borrowings from banks or public financial institutions at any point during the preceding financial year.
• Outstanding deposits accepted from the public at any point during the preceding financial year.
• Paid-up share capital, for certain categories of companies.

As a general pattern under the Companies (Accounts) Rules:

• Every listed company must appoint an internal auditor, regardless of size.
• Every unlisted public company meeting prescribed thresholds of paid-up capital, turnover, borrowings, or deposits in the preceding financial year must appoint one.
• Every private company meeting prescribed (typically higher) thresholds of turnover or borrowings must also appoint an internal auditor.

Because these rupee thresholds are set out in the Companies (Accounts) Rules and have been subject to amendment, it is important to verify the current applicable thresholds for turnover, borrowings, and deposits rather than relying on a number you may have seen a few years ago. A company that was below the threshold last year could easily cross it this year purely due to growth, making internal audit suddenly applicable.

If your company does not currently meet any of the prescribed thresholds, internal audit is not legally mandatory — but many well-run companies choose to set up an internal audit function voluntarily well before they are required to, simply because of the operational benefits.

What's Involved — Scope & Documentation

An internal audit engagement typically covers a wide operational footprint, not just financial statements. Common areas of review include:

• Internal control systems over cash, bank transactions, inventory, and fixed assets.
• Purchase and procurement processes, including vendor selection, approvals, and payment cycles.
• Sales and receivables processes, including credit control and collections.
• Payroll and employee expense reimbursement controls.
• Compliance with internal policies and delegation of authority matrices.
• IT systems and access controls, particularly around financial data.
• Statutory compliance tracking (though this often overlaps with what a secretarial audit also checks).
• Related party transactions and approval trails.
• Fixed asset registers and physical verification.
• Risk management processes and fraud risk indicators.

The scope, frequency, and methodology of internal audit are decided by the Board, often in consultation with the Audit Committee, and are typically documented in an internal audit charter or plan at the start of each year.

Step-by-Step Internal Audit Process

1. Board/Audit Committee determines scope: The Board (or Audit Committee, if constituted) decides the scope, periodicity, and methodology of internal audit for the year.
2. Appointment of internal auditor: A chartered accountant, cost accountant, or other qualified professional is appointed — either an external firm or, in many cases, a qualified internal employee.
3. Internal audit plan preparation: The auditor prepares a risk-based internal audit plan identifying which departments, processes, or locations will be reviewed and when.
4. Fieldwork and testing: The auditor examines transactions, tests controls, interviews process owners, and verifies documentation across the audit period (often quarterly rather than just annually).
5. Draft observations shared with management: Preliminary findings are shared with relevant department heads for their response and clarification.
6. Management response and action plan: Departments respond to observations, and corrective action plans are agreed upon with timelines.
7. Internal audit report presented: A formal report is presented to the Audit Committee or Board, typically each quarter, summarising findings, risk ratings, and management responses.
8. Follow-up on previous observations: Subsequent internal audit cycles track whether earlier recommendations have actually been implemented.
9. Annual summary: At year-end, a consolidated view of internal audit findings across the year often feeds into the Board's overall assessment of internal financial controls.

Cost, Fees & Penalties (2026)

Professional fees: Internal audit costs vary enormously based on company size, number of locations, complexity of operations, and whether it is a one-time annual review or an ongoing quarterly engagement. Some companies use an in-house team (salaried cost) while others outsource to a CA or CS firm (professional fee based on scope and frequency). Because there is no fixed government fee for this and pricing is entirely engagement-based, get a specific quote for your company's size and sector rather than assuming a standard figure — always verify the current rate with your service provider.

Penalties for non-compliance: If a company that falls within the prescribed classes under Section 138 fails to appoint an internal auditor, this amounts to non-compliance with the Companies Act, and the company along with officers in default can face penalties under the general penalty provisions of the Act. Because penalty amounts are periodically revised through amendments, please verify the current penalty figures applicable rather than relying on older figures.

Indirect costs of skipping internal audit: Even where not legally mandatory, companies that skip internal audit voluntarily often pay a hidden price later — undetected control weaknesses, vendor fraud, or payment errors that could have been caught early and cost far more to fix after the fact.

Timeline & Frequency

Unlike statutory or secretarial audit, which are typically annual, internal audit is meant to be a continuous process.

• Many companies conduct internal audit quarterly, with findings reported to the Audit Committee or Board at each quarterly meeting.
• Some companies, especially smaller ones just crossing the threshold, may conduct it half-yearly, though more frequent reviews are generally considered better practice.
• The appointment of the internal auditor for the year is usually done at the start of the financial year, often at the first Board meeting after the AGM.
• There is no single fixed "due date" for a report the way there is for MR-3 or the statutory audit report — instead, the internal audit function is expected to operate throughout the year, with periodic reporting.

Because the specific frequency and reporting cadence can be tailored by the Board, and rules around what qualifies as adequate internal audit coverage can be clarified through future amendments, it's worth verifying current guidance with your compliance advisor when setting up your internal audit calendar.

Internal Audit vs Other Types of Audit

• Internal audit (Section 138): Ongoing, focuses on internal controls and operational risk; auditor can be an employee or external professional (CA, CS, or cost accountant); applies to prescribed classes based on turnover, borrowings, or deposits.
• Statutory audit (Companies Act): Annual, focuses on true and fair financial statements; must be an independent, external Chartered Accountant; applies to virtually all companies.
• Secretarial audit (Section 204): Annual, focuses on legal and procedural compliance; conducted by a practicing Company Secretary; applies to listed companies and companies crossing specific size thresholds.
• Tax audit (Income Tax Act): Annual, focuses on compliance with income tax law; conducted by a Chartered Accountant; applies once turnover crosses prescribed limits under the Income Tax Act.

The simplest way to remember the difference: internal audit is about how well the company runs internally, all year round; statutory and tax audits are about whether the year-end numbers and tax position are correct; secretarial audit is about whether legal procedures were followed correctly.

Common Mistakes Companies Make

• Not tracking threshold crossings: Companies often don't realise that a good growth year in turnover or a large loan taken during the year has pushed them into mandatory internal audit territory.
• Treating internal audit as a once-a-year formality instead of the continuous process it is meant to be.
• Appointing an internal auditor without a clear scope or charter, leading to a vague, low-value engagement.
• Not involving the Audit Committee (where one exists) in reviewing internal audit findings, missing an important governance layer.
• Ignoring repeated observations: If the same control weakness shows up quarter after quarter without being fixed, it signals a serious governance gap.
• Confusing internal audit with statutory or secretarial audit, leading to duplication of effort in some areas and complete gaps in others.
• Under-resourcing the internal audit function, especially in fast-growing companies where operational complexity is increasing faster than the audit coverage.

FAQ

Is internal audit mandatory for all companies under the Companies Act?

No. Internal audit under Section 138 is mandatory only for prescribed classes of companies — generally listed companies and unlisted public or private companies that cross specified thresholds of turnover, borrowings, deposits, or paid-up capital. Companies outside these thresholds are not legally required to appoint an internal auditor, though many still choose to.

Who can be appointed as an internal auditor?

An internal auditor can be a chartered accountant, a cost accountant, or such other professional as the Board may decide. Unlike a statutory auditor, an internal auditor can also be an employee of the company, and does not need to be fully independent from it.

How is internal audit different from statutory audit?

Statutory audit is an annual, independent examination of financial statements conducted by an external Chartered Accountant, mandatory for nearly all companies. Internal audit is an ongoing review of internal controls and operations, applicable only to companies crossing certain thresholds, and can be performed by an in-house or external professional.

What thresholds trigger mandatory internal audit for a private company?

Private companies become subject to mandatory internal audit once they cross prescribed thresholds of turnover or outstanding borrowings from banks or financial institutions in the preceding financial year. Because these figures are set out in the Companies (Accounts) Rules and can be revised, always verify the current applicable thresholds.

How often should internal audit be conducted?

While the law does not always prescribe an exact frequency for every company, quarterly internal audit reporting to the Audit Committee or Board is common practice, especially for larger companies. Some smaller companies opt for half-yearly reviews, though more frequent audits generally give better risk visibility.

What happens if a company fails to appoint a mandatory internal auditor?

Failure to appoint an internal auditor where required under Section 138 amounts to non-compliance with the Companies Act, exposing the company and officers in default to penalties under the Act's general penalty provisions. It's advisable to verify current penalty amounts with a compliance professional.

Can the same person be the internal auditor and the statutory auditor?

No. The statutory auditor is required to be independent of the company and generally cannot simultaneously provide certain internal audit services to the same company, in order to preserve independence in the financial audit. Companies should keep these two roles separate and appoint different professionals or firms.

Does internal audit replace the need for a secretarial audit?

No. Internal audit and secretarial audit serve different purposes and are governed by different sections of the Companies Act. A company may need both, one, or neither, depending on which specific thresholds and categories it falls into, so applicability should be checked separately for each.

How Legal Suvidha Makes This Effortless

This is exactly the kind of process where one wrong document, a mismatched detail, or a missed deadline turns into a rejection, a resubmission, or a running penalty. Legal Suvidha handles the whole thing end-to-end so you can focus on your business.

• Fixed, all-inclusive price quoted upfront — professional fee plus government fee, itemised, with no hidden charges appearing later.
• A dedicated Chartered Accountant / Company Secretary who owns your case from the first call to the final certificate.
• Proactive updates and deadline alerts at every stage — we do not disappear after payment.
• Trusted by 10,000+ founders with a 4.9/5 rating and a multi-disciplinary team of CAs, CSs and lawyers.

Talk to a Legal Suvidha expert today for a free consultation and an exact, transparent quote on WhatsApp — and get it done right the first time.