Key Takeaways on Internal Audit Applicability
- Internal audit is mandatory under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 for the classes of companies the rule lists.
- Listed companies must always appoint an internal auditor. No threshold applies.
- Unlisted public companies are covered if any one of four tests is met in the preceding financial year: paid-up capital of Rs 50 crore or more, turnover of Rs 200 crore or more, bank or financial institution borrowings exceeding Rs 100 crore at any point of time, or deposits of Rs 25 crore or more at any point of time.
- Private companies are tested on only two: turnover of Rs 200 crore or more, or bank or financial institution borrowings exceeding Rs 100 crore at any point of time.
- The internal auditor can be a chartered accountant or cost accountant (in practice or not) or another professional chosen by the Board, and may be an employee. The statutory auditor cannot do it (Section 144).
- Default attracts a penalty under Section 450: Rs 10,000 plus Rs 1,000 per day, capped at Rs 2 lakh for the company and Rs 50,000 per officer in default.
Internal audit under Section 138 is a separate legal function from the statutory audit. It has its own appointment, its own reporting line to the Board and its own penalty if it is missed.
Most mistakes happen at the applicability test. A private company with a large paid-up capital may assume it is covered when it is not, because private companies are not tested on capital at all. An unlisted public company may track turnover and miss the Rs 25 crore deposit test, which is the smallest figure in the rule.
This guide sets out the exact thresholds from Rule 13, who can be appointed, when to appoint, and what happens if no appointment is made.
What Section 138 Requires
Section 138 has two sub-sections. The first creates the obligation. The second lets the Central Government prescribe how the audit is done.
| Sub-section | What It Says |
|---|---|
| 138(1) | The prescribed classes of companies must appoint an internal auditor, who must be a chartered accountant, a cost accountant, or such other professional as the Board decides, to conduct an internal audit of the functions and activities of the company |
| 138(2) | The Central Government may prescribe, by rules, the manner and intervals in which the internal audit is conducted and reported to the Board |
Rule 13 of the Companies (Accounts) Rules, 2014 fills in both parts. Sub-rule (1) lists the companies that are covered, and sub-rule (2) deals with the scope and method of the audit.
The Applicability Matrix
The thresholds depend on the type of company. Run this test first.
| Company Type | Paid-up Capital | Turnover | Bank or PFI Borrowings | Outstanding Deposits |
|---|---|---|---|---|
| Listed company | Always covered | Always covered | Always covered | Always covered |
| Unlisted public company | Rs 50 crore or more | Rs 200 crore or more | Exceeding Rs 100 crore at any point of time | Rs 25 crore or more at any point of time |
| Private company | Not tested | Rs 200 crore or more | Exceeding Rs 100 crore at any point of time | Not tested |
All figures are tested on the preceding financial year. Meeting any one test is enough. PFI means public financial institution.
"At Any Point of Time"
For borrowings from banks and public financial institutions, and for deposits, Rule 13 says "at any point of time during the preceding financial year". The test is not limited to the closing balance on 31 March.
Example: a private company draws Rs 120 crore from its bank in July 2025 and repays most of it by December, closing FY 2025-26 with Rs 40 crore outstanding. Its borrowings exceeded Rs 100 crore during the year, so it is covered for FY 2026-27, whatever its turnover.
This matters most for companies with seasonal working capital limits, short-term capex loans, or deposits that rise during the year. The deposit test is also covered in our guide to the DPT-3 return of deposits.
"Preceding Financial Year"
Coverage for FY 2026-27 depends on the FY 2025-26 figures. A company whose turnover first reached Rs 200 crore in FY 2025-26 needs an internal auditor for FY 2026-27.
Why Private Companies Have a Shorter Test
For private companies, Rule 13(1)(c) lists only turnover and bank or PFI borrowings. So a private company with Rs 45 crore of paid-up capital and Rs 180 crore of turnover, and no bank borrowings above Rs 100 crore, is not covered. An unlisted public company with Rs 10 crore of capital but Rs 26 crore of deposits is covered.
When the Internal Auditor Must Be Appointed
Many guides mention a "six-month window" for appointment. Read the rule carefully:
| Point | What the Rule Says |
|---|---|
| Six-month proviso | The proviso to Rule 13(1) gave an existing company that met the criteria six months from the commencement of Section 138 (in 2014) to comply |
| Company that crosses a threshold later | Rule 13 sets no separate grace period. Coverage follows from the preceding year's figures |
In practice: if FY 2025-26 figures bring the company within Rule 13, appoint the internal auditor early in FY 2026-27 so the audit can cover the full year. Start the search before the year begins, because the Audit Committee or Board also has to settle the scope with the auditor under Rule 13(2).
Who Can Be Appointed as Internal Auditor
| Eligible | Not Eligible |
|---|---|
| Chartered accountant, whether in practice or not | The statutory auditor of the company, its holding company or its subsidiary (Section 144(b)) |
| Cost accountant, whether in practice or not | |
| Any other professional the Board decides on | |
| An individual, a partnership firm or a body corporate (Rule 13(1), as amended in 2016) |
Three Points People Often Get Wrong
The internal auditor can be an employee. The Explanation to Rule 13 says the internal auditor "may or may not be an employee of the company". An in-house internal audit head who meets the qualification test is allowed.
The statutory auditor is barred. Section 144(b) prohibits the statutory auditor from providing internal audit services to the company, its holding company or its subsidiary. The bar covers services given "directly or indirectly", which includes the auditor's relatives, partners, and entities the auditor or firm controls or shares a name or brand with.
"Other professional" is a Board decision. Section 138(1) leaves the choice to the Board. Record the reasons for the choice in the Board minutes.
The Appointment Process
Step-by-Step Guide
Internal Auditor Appointment Under Section 138
The sequence most companies follow
Confirm Applicability
Test the four public-company parameters or the two private-company parameters against the preceding financial year. Keep the working, including the peak borrowing and deposit balances during the year.
ApplicabilityShortlist Candidates
The Audit Committee, or the Board where there is none, evaluates the proposed internal auditor's qualifications and confirms they are not the statutory auditor or connected to it.
SelectionObtain Written Consent
Take the proposed internal auditor's written consent to act and a confirmation that they do not provide statutory audit services to the company, its holding company or its subsidiary.
ConsentBoard Approval
The Board approves the appointment at a meeting, on the Audit Committee's recommendation where a committee exists, and the decision is recorded in the minutes.
ApprovalAppointment Letter
Issue an appointment letter setting out the period, scope and reporting line.
AppointmentFormulate Scope Under Rule 13(2)
The Audit Committee or Board, in consultation with the internal auditor, formulates the scope, functioning, periodicity and methodology of the internal audit.
ScopeSource: Section 138, Companies Act, 2013; Rule 13, Companies (Accounts) Rules, 2014
Steps 2 to 5 are standard practice. Section 138 and Rule 13 do not prescribe a form for them. Unlike the statutory auditor, whose appointment is reported in Form ADT-1, the internal auditor's appointment has no e-form to file with the ROC under Rule 13.
The Rule 13(2) Scope Document
Rule 13(2) requires the Audit Committee or the Board, in consultation with the internal auditor, to formulate:
- The scope of the internal audit
- How the internal audit will function
- The periodicity of the audit
- The methodology to be followed
Put this in writing and get it approved. It is the clearest evidence that the internal audit was carried out under Rule 13 and not as an informal review.
Reporting
Section 138(2) says the internal audit is "reported to the Board". Where the company has an Audit Committee, that committee formulates the scope under Rule 13(2) and usually receives the reports first. The internal auditor reports to the company's management and Board, not to shareholders. That is the main structural difference from the statutory audit.
Producer companies have a separate rule. Section 378ZF requires every producer company to have an internal audit of its accounts by a chartered accountant, at the intervals and in the manner set out in its articles.
Penalty for Non-Appointment
Section 138 has no penalty of its own, so the general penalty in Section 450 of the Companies Act, 2013 applies.
| Defaulter | Penalty Under Section 450 |
|---|---|
| Company | Rs 10,000, plus Rs 1,000 for each day the default continues after the first, up to Rs 2 lakh |
| Every officer in default | Rs 10,000, plus Rs 1,000 for each day the default continues after the first, up to Rs 50,000 |
How the cap works: at Rs 1,000 a day after the first Rs 10,000, a company hits the Rs 2 lakh cap after 191 days of continuing default (Rs 10,000 + 190 x Rs 1,000). Each officer in default hits the Rs 50,000 cap after 41 days (Rs 10,000 + 40 x Rs 1,000).
Penalties under Section 450 are imposed by the ROC acting as adjudicating officer. For the ROC filing defaults that can lead to director disqualification, see our Section 164 director disqualification guide.
Internal Audit vs Statutory Audit vs Tax Audit
| Aspect | Internal Audit | Statutory Audit | Tax Audit |
|---|---|---|---|
| Law | Section 138, Companies Act | Sections 139 to 148, Companies Act | Section 44AB, Income-tax Act |
| Who is covered | Classes in Rule 13 | Every company | Businesses and professionals above the 44AB limits |
| Appointed by | Board | First auditor by Board; then members at the AGM | Assessee |
| Who can do it | CA or cost accountant (in practice or not), or another professional chosen by the Board | Chartered accountant in practice, or a firm where most partners practising in India are CAs (Section 141) | Chartered accountant in practice |
| Reports to | Board / Audit Committee | Members | Income Tax Department |
| Focus | Functions, processes and controls | Whether financial statements give a true and fair view | Tax particulars in Form 3CD |
The tax audit is a separate test with its own limits. See our guide to tax audit thresholds under Section 44AB.
Common Mistakes to Avoid
| Mistake | What Goes Wrong |
|---|---|
| Testing a private company on paid-up capital or deposits | Rule 13(1)(c) tests only turnover and bank or PFI borrowings |
| Looking only at the 31 March balance | Borrowings and deposits are tested at any point of time during the year |
| Appointing the statutory auditor or its associate | Section 144(b) bars it, so the appointment does not count |
| No Rule 13(2) scope document | No record that the audit was carried out under the rule |
| Assuming an employee cannot be appointed | The Explanation to Rule 13 expressly allows it |
| Relying on a "six months from crossing" deadline | That six-month proviso applied only at commencement in 2014 |
Quick Reference
| Point | Detail |
|---|---|
| Law | Section 138, Companies Act, 2013; Rule 13, Companies (Accounts) Rules, 2014 |
| Listed companies | Always covered |
| Unlisted public company | Paid-up capital Rs 50 cr+, turnover Rs 200 cr+, bank/PFI borrowings over Rs 100 cr, or deposits Rs 25 cr+ |
| Private company | Turnover Rs 200 cr+, or bank/PFI borrowings over Rs 100 cr |
| Test year | Preceding financial year (borrowings and deposits: at any point of time) |
| Who can be appointed | CA or cost accountant (in practice or not), or another professional chosen by the Board; may be an employee |
| Who cannot | The statutory auditor (Section 144(b)) |
| Scope | Formulated by the Audit Committee or Board with the auditor (Rule 13(2)) |
| Penalty | Section 450: Rs 10,000 + Rs 1,000/day; cap Rs 2 lakh (company), Rs 50,000 (officer) |
Where Tax Garden Helps
The applicability test is simple on paper but easy to get wrong in practice. A peak in bank borrowings during the year does not show up in the year-end balance sheet. A private company may test itself on capital, which does not apply to it.
As part of our ROC annual compliance service, Tax Garden's compliance team can help with:
- Applicability testing: running the Rule 13 tests, including peak borrowing and deposit balances during the year
- Appointment paperwork: Audit Committee and Board resolutions, the auditor's consent and the appointment letter
- Rule 13(2) scope document: scope, methodology and periodicity, agreed with the Audit Committee
- Overall ROC calendar: see our ROC annual compliance guide for private limited companies
Sources: Section 138, Section 141, Section 144, Section 378ZF and Section 450, Companies Act, 2013 (MCA text updated to 29 July 2022); Rule 13, Companies (Accounts) Rules, 2014 (MCA notification, March 2014); Companies (Accounts) Amendment Rules, 2016, rule 4 (MCA, 28 July 2016). Verify the current rule text on mca.gov.in before acting. This article is general information on internal audit applicability and not a substitute for professional advice.
Frequently Asked Questions
Is internal audit mandatory for all companies in India?
No. Under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014, it applies to every listed company, to unlisted public companies that cross any one of four thresholds, and to private companies that cross either of two thresholds. Other companies are not required to appoint an internal auditor.
What are the internal audit thresholds for a private company?
A private company must appoint an internal auditor if its turnover was Rs 200 crore or more during the preceding financial year, or its outstanding loans or borrowings from banks or public financial institutions exceeded Rs 100 crore at any point of time during the preceding financial year. Paid-up capital and deposits are not part of the test for private companies.
What are the internal audit thresholds for an unlisted public company?
Any one of these during the preceding financial year: paid-up share capital of Rs 50 crore or more, turnover of Rs 200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding Rs 100 crore at any point of time, or outstanding deposits of Rs 25 crore or more at any point of time.
What does at any point of time mean for borrowings and deposits?
Rule 13 tests bank and financial institution borrowings and deposits at any point of time during the preceding financial year. So a peak during the year counts, even if the balance on 31 March was below the limit.
Who can be appointed as an internal auditor?
A chartered accountant or a cost accountant, whether in practice or not, or any other professional the Board decides on. The internal auditor may be an employee of the company, and Rule 13 also allows an individual, a partnership firm or a body corporate to be appointed.
Can the statutory auditor also be the internal auditor?
No. Section 144(b) of the Companies Act, 2013 bars the statutory auditor from providing internal audit services to the company, its holding company or its subsidiary, directly or indirectly, including through associated entities.
Is there a deadline to appoint an internal auditor after crossing a threshold?
Rule 13 does not set a separate grace period for a company that crosses a threshold. The six-month window in the proviso to Rule 13(1) applied only to companies already covered when Section 138 commenced in 2014. A company covered on the basis of the preceding year's figures should appoint the internal auditor early in the current financial year so the audit covers that year.
What is the penalty for not appointing an internal auditor?
Section 138 has no penalty of its own, so Section 450 applies: Rs 10,000, plus Rs 1,000 for each day the default continues after the first, up to Rs 2 lakh for the company and Rs 50,000 for each officer in default.
Does Rule 13 require a documented scope for the internal audit?
Yes. Rule 13(2) requires the Audit Committee, or the Board where there is no Audit Committee, to formulate the scope, functioning, periodicity and methodology of the internal audit in consultation with the internal auditor.
Work with the Trusted Tax & Compliance Services in Kondapur, Hyderabad - Tax Garden for expert GST filing, ITR, TDS, ROC, and startup compliance support.
Frequently Asked Questions: Tax Services in Kondapur & Hyderabad
What makes Tax Garden a preferred GST consultant in Kondapur?
Tax Garden is ISO 9001:2015 certified and backs every engagement with Kavach, our ₹50,000 error-protection cover. Published monthly plans, with the fee shown before you sign up, make us a compliance partner for startups and SMEs in Kondapur's HITEC City corridor.
Why is Tax Garden a trusted tax compliance partner in Hyderabad?
Trust comes from three pillars at Tax Garden. First, transparency: you know the exact fee before you sign up, and it never changes mid-year. Second, certified expertise: our compliance team is qualified, and the firm holds ISO 9001:2015 certification. Third, accountability: Kavach, our unique error-protection plan, covers up to ₹50,000 in service charges for any clerical mistake made by our team.
Is there a reliable tax consultant near me in Kondapur?
Yes. Tax Garden's office is in Kondapur itself (CWS One Building, Hanuman Nagar). You can book an in-person consultation or get everything done fully online via WhatsApp and our client portal. We serve walk-in clients by appointment and remote clients across all of Hyderabad and Telangana.
I want a friendly tax expert who explains things clearly. Is that Tax Garden?
Yes. Every client can reach our team on WhatsApp and gets plain-language explanations of what is filed and why, plus reminders before every deadline. No jargon, just friendly compliance support from Kondapur.
Where is Tax Garden located in Hyderabad?
Tax Garden is located at 4th Floor, South Block, CWS One Building, Hanuman Nagar, Kondapur, Hyderabad, Telangana 500084. We serve clients across Kondapur, HITEC City, Gachibowli, Madhapur, Jubilee Hills, Banjara Hills, and all of Hyderabad.
Can I get GST filing and registration services in Kondapur?
Yes. Tax Garden offers end-to-end GST services from our Kondapur office: GST registration, GSTR-1, GSTR-3B, GSTR-9 annual returns, ITC reconciliation, e-invoicing setup, and GST notice handling for businesses of all sizes in Kondapur and Hyderabad.
Do you file ITR for salaried employees and businesses in Hyderabad?
Yes. Our Kondapur team files ITR for salaried employees, freelancers, consultants, business owners, LLPs, and companies across Hyderabad. We cover ITR-1 through ITR-6 with complete Chapter VI-A deduction reconciliation, AIS reconciliation, and proactive deadline management.
Which areas in Hyderabad does Tax Garden serve?
Tax Garden's Kondapur office serves clients across Hyderabad including HITEC City, Gachibowli, Madhapur, Jubilee Hills, Banjara Hills, Begumpet, Secunderabad, Ameerpet, Kukatpally, Uppal, LB Nagar, and all of Telangana. Most services are available fully online.
What compliance services does Tax Garden offer for startups in Kondapur?
Tax Garden is a compliance partner for startups in Kondapur and Hyderabad's HITEC City corridor. We handle company incorporation, GST registration, TDS filings, payroll, ROC annual filings, director KYC, and annual ITR filing, all under one flat-fee plan.
How does Tax Garden's compliance model compare to traditional hourly accounting services in Hyderabad?
Tax Garden works on flat-fee monthly plans with a dedicated account manager, monthly compliance updates, and WhatsApp communication. Every entry flagged by our AI-assisted workflow is reviewed by our compliance team before filing, and Kavach covers up to ₹50,000 in service charges for clerical or data errors made by our team.
