Statutory Audit: Appointment, Rotation and What the Report Has to Say
Every company incorporated in India has its financial statements audited. What varies is not whether there is an audit but what the auditor has to report on, and that is decided by a set of thresholds, one of which moved substantially on 1 December 2025 and changed which companies carry three separate obligations. Not all three work the same way, and one of them is not a reporting obligation at all.
- Appointment, term and the rotation rules
- Eligibility, the twenty-company cap and the indebtedness bars
- The small company definition and the three obligations it switches off
- Internal financial controls reporting, and the conjunction that decides it
Term, rotation and resignation
Section 139(1) requires a company at its first annual general meeting to appoint an auditor to hold office from the conclusion of that meeting until the conclusion of its sixth annual general meeting, subject to the applicable provisions of the Act. Annual ratification by members is no longer required: the Companies (Amendment) Act 2017 omitted that requirement with effect from 7 May 2018, not on enactment, and the corresponding ratification provisions in rule 3(7) were omitted with it. A client's secretarial templates can therefore drop annual ratification as a statutory agenda item, though appointment or reappointment at the end of the term remains a separate requirement. The board appoints the first auditor within thirty days of registration, failing which members do so within ninety days. A casual vacancy is filled by the board within thirty days, and where it arises from a resignation the appointment also needs member approval within three months.
Rotation under section 139(2) applies to listed companies and prescribed classes: an individual may serve one term of five consecutive years and a firm two terms of five consecutive years, with a five-year cooling off period.
| Class subject to rotation | Threshold |
|---|---|
| Listed companies | All |
| Unlisted public companies | Paid-up share capital of ₹10 crore or more |
| Private companies | Paid-up share capital of ₹50 crore or more, increased from ₹20 crore with effect from 22 June 2017 by notification G.S.R. 621(E) |
| Any company below those capital thresholds | Public borrowings from banks or financial institutions, or public deposits, of ₹50 crore or more |
| One person companies and small companies | Excluded from rotation entirely |
On resignation, section 140(2) requires the outgoing auditor to file a statement within thirty days with the company and the Registrar, in Form ADT-3. The penalty for failing to comply is ₹50,000 or the auditor's remuneration, whichever is less, plus ₹500 for each day after the first during which the failure continues, subject to a maximum of ₹2 lakh. The maximum was reduced from ₹5 lakh by section 29 of the Companies (Amendment) Act 2020 with effect from 21 December 2020, and the earlier figure is still widely quoted.
Who may not be your auditor
| Bar | Limit |
|---|---|
| Indebtedness to the company, by the auditor, a relative or a partner | Exceeding ₹5 lakh. Exactly ₹5 lakh does not trigger it |
| Guarantee or security for a third party's indebtedness to the company | Exceeding ₹1 lakh |
| Securities of the company held by a relative | Face value exceeding ₹1 lakh |
| Number of company audits per person | Twenty counted company audits per individual auditor or partner, excluding one person companies, dormant companies, small companies and private companies with paid-up share capital below ₹100 crore. Exactly ₹100 crore is not excluded on that ground. The private company exclusion is conditional: it depends on the company not being in default in filing its financial statements under section 137 or its annual return under section 92, a condition added by G.S.R. 583(E) of 13 June 2017 |
| Other services | Section 144 prohibits a defined list of non-audit services to the company, its holding company and its subsidiary |
Small company status, and what it switches off
With effect from 1 December 2025, by G.S.R. 880(E), the financial thresholds for small company status rose from ₹4 crore to ₹10 crore in paid-up share capital and from ₹40 crore to ₹100 crore in turnover. Both limits must be satisfied, and turnover is measured by the profit and loss account for the immediately preceding financial year. A public company, a holding or subsidiary company, a section 8 company or a company governed by a special Act can never be a small company however small it is. The notification changes eligibility going forward; it does not erase an obligation or a default that arose before 1 December 2025, so check the applicability date and the exemption conditions of each obligation separately before advising a client that one has fallen away.
The change matters far beyond the definition itself, because small company status switches off several things at once.
The auditor's report order does not apply
Small companies are outside the Companies (Auditor's Report) Order 2020 altogether, along with banking and insurance companies, section 8 companies, one person companies and a narrow class of small private companies.
Internal financial controls reporting does not apply
A small company is outside the section 143(3)(i) reporting obligation. See the next section, which is where the real difficulty lies.
Statutory internal audit does not apply
The section 138 obligation does not reach a small company, though guide 3 explains why the auditor's report order can still ask about an internal audit system.
Rotation and the cash flow statement fall away
Neither the rotation rules nor the requirement to include a cash flow statement in the financial statements applies.
For an FY 2025-26 audit, small company status is assessed against the revised limits. They were already operative at the 31 March 2026 reporting date and the notification does not defer them to FY 2026-27. Two points are commonly got wrong: the two tests are measured on different periods, and the auditor's signing date is not what decides it.
| Test | The relevant figure for FY 2025-26 |
|---|---|
| Paid-up share capital | As at 31 March 2026, not exceeding ₹10 crore |
| Turnover | The profit and loss account for FY 2024-25, not exceeding ₹100 crore |
| The other conditions | The exclusions in section 2(85), including holding and subsidiary companies, must also be satisfied |
The three consequences are not identical and should be taken one at a time. A qualifying small company is outside the auditor's report order under paragraph 1(2)(iv), so its FY 2025-26 report carries no such annexure. The separate reporting on internal financial controls under section 143(3)(i) can fall away, but only where the filing-compliance condition attached to the private company notification is also met: small company status on its own is not enough. Rotation is different again. Rule 5 excludes small companies, but rotation governs appointment and tenure rather than whether a paragraph appears in a report, so it is assessed at the relevant appointment or rotation event, and the December amendment does not cure a rotation breach that arose before it.
One framing to avoid, because it is the one we nearly used. This is not relief for every report signed after 1 December 2025. Signing an earlier year's report after that date does not bring that year within the revised limits.
The conjunction that decides it
Section 143(3)(i) requires the auditor to report on the adequacy and operating effectiveness of internal financial controls with reference to financial statements. Private companies have an exemption, and the exemption is the single most misquoted provision in Indian company law.
It is 'and', not 'or'
The exempting notification as gazetted joins the two limbs of the private company exemption with 'or'. A corrigendum corrected it, and the operative word is and. The corrigendum directs that for the words "statement or" the words "statement and" be read, in paragraph 5, column (3), item (ii) of G.S.R. 583(E) of 13 June 2017. It was published as S.O. 2218(E) of 13 July 2017 and it is not carried by the free source most people reach first. So the exemption applies to a private company which is a one person company or a small company, OR which has turnover less than ₹50 crore as per the latest audited financial statement AND aggregate borrowings from banks, financial institutions or any body corporate at any point during the financial year less than ₹25 crore. Exactly ₹50 crore of turnover, or exactly ₹25 crore of borrowings, fails the respective test. The practical consequence: a private company with turnover of ₹30 crore and borrowings of ₹40 crore is not exempt. Read as 'or' it would be.
The exemption is also conditional on the company not being in default in filing its financial statements or its annual return, a condition that attaches to the whole exemption notification rather than to this clause alone. A company that is behind on filings loses the exemption along with everything else in that notification.
One further distinction worth keeping straight. The board's responsibility statement on internal financial controls under section 134(5)(e) applies to listed companies, and 'internal financial controls' in that context is a broader concept than 'internal financial controls with reference to financial statements' which the auditor reports on. They are not the same thing and should not be conflated in a board paper.
Applicability, and the clauses that bite
The Companies (Auditor's Report) Order 2020 is dated 25 February 2020 and, as gazetted, applies to financial years commencing on or after 1 April 2019. It was deferred twice and first applied to financial years commencing on or after 1 April 2021, so FY 2021-22 was the first year of application. The first deferral was the Companies (Auditor's Report) Amendment Order 2020, S.O. 1219(E) of 24 March 2020, which moved the starting date from 1 April 2019 to 1 April 2020. The second was the Companies (Auditor's Report) Second Amendment Order 2020, S.O. 4588(E) of 17 December 2020, which moved it again to 1 April 2021. Any reference to the order should be qualified with 'where the order applies', because the exclusions are wide.
Two clauses generate most of the friction in practice. Clause 3(xi) requires reporting on any fraud by or on the company noticed or reported during the year, on whether a fraud report was filed with the Central Government, and on whether whistle-blower complaints were considered. Clause 3(xiv) requires reporting on whether an internal audit system commensurate with the size and nature of the business exists, and whether internal audit reports were considered. That second one bites even where the statutory internal audit obligation does not apply, which surprises a lot of companies.
Separately, and not part of the order at all, rule 11(g) of the audit rules requires the auditor to report on the accounting software audit trail. That obligation has no small company exclusion. It is dealt with on the accounts outsourcing pages.
What is in force, and what was deferred
| Standard | Status in August 2026 |
|---|---|
| Standards on auditing 800, 805 and 810, revised | Issued 7 February 2024, effective for financial years beginning on or after 1 April 2024, so fully in force for FY 2025-26. |
| Quality management standards 1 and 2 | Deferred. Issued 14 October 2024 with an original effective date of 1 April 2026. By announcement dated 31 March 2026 that effective date was deferred until further announcement, and the existing quality control standard continues to apply. The revised standard on engagement quality that interlocks with them has not been brought into force either. |
| Standard on auditing 600, revised, on group audits | Not in force. The oversight authority recommended a revised standard with a proposed effective date of 1 April 2026, expressly subject to Central Government approval. A proposed date does not itself bring a standard into force. The Institute continues to publish the existing standard on using the work of another auditor, and no operative notification was located. Reporting during 2026 has anticipated a later notification with effectiveness from 1 April 2027, but that is reported intention rather than law. Any transition follows the applicable ministry notification and its own commencement provisions. This is the item on these pages most likely to change without warning, and it changes group audit responsibility materially. |
Where to go next
Audit and Assurance Services
Back to the main page: the full range of engagements, how we work, and how to reach us.
Tax Audit and the Move to the Income-tax Act 2025
The thresholds for FY 2025-26 under the old Act, what section 63 of the new Act does differently, the change of substance that widens who gets audited, and the consolidated form that replaces three.
Internal Audit, Risk-based Audit and Compliance Audit
When internal audit is a statutory obligation and when it is a management choice, who may hold the role, how a risk-based plan is actually built, and how this sits alongside our governance and internal control work.
Forensic Audit, Fraud Reporting and Investigation
The statutory fraud reporting duty and its two thresholds, the timetable that starts the day a suspicion forms, the standards a forensic engagement is conducted under, and what a forensic engagement is not.
Due Diligence, Information System Audit and ESG Assurance
Three assurance engagements that are not statutory audits: what a buyer's diligence should now cover after two years of legal change, where information system audit is mandated, and the sustainability assurance regime including the independence bar that decides who can do it.
Send an enquiry
If you want one check from this page, it is whether your private company is actually exempt from internal financial controls reporting. Read with 'and' rather than 'or', a lot of companies are not.
Position as at 15 September 2026. Reviewed every six months.
This page is general information, not professional advice. Audit obligations in India turn on thresholds that moved recently and on standards whose effective dates have been deferred more than once. The small company definition changed on 1 December 2025, the Income-tax Act 2025 replaced the 1961 Act on 1 April 2026, two quality management standards were deferred on 31 March 2026, and a revised group audit standard has been proposed but not notified. Whether a particular obligation applies to you depends on your own numbers at your own year end. Take professional advice before acting on anything on this page. We are happy to be that adviser, but we do not act on a web page, ours or anyone else's, without one.