Internal financial controls and internal audit
Two obligations sit behind almost every conversation about internal control in India, and they are routinely blended into one. One is a duty on directors of listed companies. The other is a duty on the auditor, and it is narrower than its name suggests. Getting them apart is the difference between knowing what you have to do and assuming the auditor will tell you.
When statutory internal audit becomes compulsory
Section 138 of the Companies Act, read with Rule 13 of the Companies (Accounts) Rules 2014, requires an internal auditor for three classes of company.
Every listed company, with no size test at all.
Every unlisted public company which, during the preceding financial year, had paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point, or outstanding deposits of ₹25 crore or more at any point.
Every private company which, during the preceding financial year, had turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point. There is no paid-up capital limb and no deposits limb for a private company. This is worth stating plainly, because a good deal of published material presents one combined table for public and private companies and the notified rule does not work that way.
Under section 138(1), the internal auditor may be a chartered accountant, a cost accountant or another professional selected by the Board to conduct the internal audit of the company’s functions and activities. The internal auditor may be an individual, a partnership firm or a body corporate, and may or may not be an employee of the company, so an in-house function satisfies the requirement. For this purpose, "chartered accountant" and "cost accountant" include persons holding the respective qualifications, whether or not they are engaged in practice. Those last points come from Rule 13 of the Companies (Accounts) Rules 2014 and its Explanation, rather than from section 138(1) itself.
One further detail that matters in practice: it is the audit committee, or the board where there is no committee, that must formulate the scope, functioning, periodicity and methodology in consultation with the internal auditor. An internal audit plan set by management alone, without that involvement, does not meet the rule however good the plan is.
Two internal financial controls obligations, not one
This is the single most misstated area in Indian internal control practice, so it is worth being slow about.
The directors’ obligation. Section 134(5)(e) applies specifically "in the case of a listed company". It requires the Directors’ Responsibility Statement of a listed company to state that the directors have laid down internal financial controls to be followed by the company and that those controls are adequate and operating effectively. This particular reporting declaration does not apply to unlisted companies, although they may remain subject to separate internal control and auditor reporting requirements under other provisions.
The auditor’s obligation. Section 143(3)(i) requires the statutory auditor’s report to state whether the company has adequate internal financial controls with reference to financial statements in place and whether those controls operated effectively. Unlike the directors’ declaration under section 134(5)(e), this reporting requirement is not confined to listed companies. However, specified categories of private companies are exempt, subject to the conditions prescribed by the Central Government, which the next section sets out.
Why the difference matters. The directors’ obligation uses the broader expression "internal financial controls", covering operational discipline, adherence to company policies, safeguarding of assets, prevention and detection of fraud and error, accounting records and reliable financial information. The auditor’s obligation is narrower: it concerns "internal financial controls with reference to financial statements". The auditor therefore opines on controls relevant to financial reporting, including operational, compliance, IT and entity level controls only to the extent that they affect financial reporting. An unmodified financial statement audit opinion, or even an unmodified opinion under section 143(3)(i), should not be presented to the Board as assurance that the company’s entire operational and compliance control environment is effective.
The Explanation to section 134(5)(e) defines internal financial controls broadly. The definition covers the orderly and efficient conduct of business, adherence to company policies, safeguarding of assets, prevention and detection of fraud and error, accuracy and completeness of accounting records, and timely preparation of reliable financial information. That is a faithful paraphrase rather than a quotation: if you need the statutory text itself, take it from the bare Act.
The private company exemption, and the word that decides it
The reporting requirement under section 143(3)(i) does not apply to a private company that is a one person company or a small company. It also does not apply to another private company where both its turnover, according to the latest audited financial statement, is less than ₹50 crore and its aggregate borrowings from banks, financial institutions or any body corporate remained below ₹25 crore at every point during the financial year. The exemption is subject to the applicable annual filing condition: it is available only to a private company which has not defaulted in filing its financial statements or annual return with the Registrar.
The conjunction is decisive, and it is easy to get wrong. The two conditions are cumulative. A private company qualifies under this threshold based exemption only if its turnover is below ₹50 crore and its aggregate borrowings remained below ₹25 crore throughout the financial year. For example, a private company with turnover of ₹300 crore and borrowings of only ₹10 crore does not qualify, because it fails the turnover condition. Subject to any other applicable exemption, its statutory auditor must report under section 143(3)(i).
Do not work from the uncorrected text of G.S.R. 583(E) of 13 June 2017. As originally published, that notification separates the turnover and borrowing limbs with "or", which would make the exemption far wider than it is. It was corrected by MCA Corrigendum S.O. 2218(E) of 13 July 2017. The cumulative "and" reading above is the correct one. This is worth knowing because the uncorrected text is still what many reproductions of the notification show.
One further trap worth knowing even once the above is settled. The borrowings test in Rule 13 (internal audit) and the borrowings test in this exemption are not the same test. Rule 13 says "from banks or public financial institutions". The exemption says "from banks or financial institutions or any body corporate", which is materially wider and picks up intra-group lending. Copy, and spreadsheets, that blend the two produce the wrong answer.
Finally, watch the definition of "small company" as a moving part. Because the exemption is keyed to that defined term, any change to the small company thresholds automatically changes who is exempt from internal financial controls audit reporting. The Corporate Laws (Amendment) Bill 2026, introduced in Lok Sabha on 23 March 2026 and referred to a Joint Parliamentary Committee, proposes exactly such a change. It is a Bill and not law, and we have not treated it as such anywhere on this website.
What the auditor reports about your internal audit function
Separately from the internal financial controls opinion, the Companies (Auditor’s Report) Order 2020 requires the auditor to comment on the internal audit function itself.
Where CARO 2020 applies, clause 3(xiv) requires the statutory auditor to report whether the company has an internal audit system commensurate with the size and nature of its business, and whether the statutory auditor considered the internal auditors’ reports for the period under audit.
That opening qualification matters: CARO does not apply to every company. Certain companies are excluded under paragraph 1(2) of the Order. And the clause does not independently require a CARO-covered company to appoint an internal auditor. The appointment obligation is determined separately, under section 138 read with Rule 13, as set out above. Clause 3(xiv) requires the statutory auditor to report on the internal audit system actually applicable to or maintained by the company.
CARO 2020 was notified on 25 February 2020 by S.O. 849(E) and applies to financial years commencing on or after 1 April 2021, its original commencement having been deferred. If you see 1 April 2019 quoted, including on a government page that has not been revised, that is the superseded original position. The Order remains operative as of August 2026.
The practical consequence of the second limb is easy to miss: your internal audit reports are read by the statutory auditor, who must say whether they were considered. An internal audit function that produces findings management quietly parks is not an internal matter.
Assurance beyond the financial statements
Independent assurance is increasingly asked for over information that never touches the financial statements: sustainability data, service organisation controls, a customer’s security questionnaire. The governing question is always the same one this guide started with, namely who is opining on what, against which criteria, and at what level of assurance.
The clearest Indian example is SEBI’s BRSR Core. Since SEBI’s circular of 28 March 2025, listed entities within the glide path must mandatorily undertake assessment or assurance of the BRSR Core. This replaced the earlier requirement of mandatory reasonable assurance, and a good deal of published material has not caught up. The glide path itself did not change: the top 150 listed entities from FY 2023-24, the top 250 from FY 2024-25, the top 500 from FY 2025-26 and the top 1,000 from FY 2026-27.
Two points bear directly on an internal audit function. First, the exercise is profession agnostic and need not be performed by a chartered accountant. Second, and more important for anyone reading this guide: the internal auditor of the listed entity or of its group entities cannot be appointed to provide BRSR Core assurance or assessment. The statutory auditor can be, subject to the independence conditions. If your internal audit function has been asked to take this on, that is a problem to raise before the engagement letter, not after.
Send an enquiry
Tell us where you are: whether you have crossed the internal audit threshold, whether you are unsure which internal financial controls obligation actually applies to you, or whether an internal audit function exists and nobody is confident it is testing the right things. A partner replies within one business day.
This page is general information, not professional advice. Indian corporate law positions and MCA notifications change frequently, and how any of this applies depends on your company’s specific facts. Take professional advice before acting on anything on this page. We are happy to be that adviser, but we do not act on a web page, ours or anyone else’s, without one.