Your Company Is Growing. But Is Anyone Watching the Blind Spots?

A mid-sized construction company discovered a vendor billing for materials never delivered — for three years. The loss exceeded Rs. 48 lakhs. What caught it? Not the statutory auditor. Not the management. The internal audit function did.

If your company does not have an internal audit function, you may be flying blind — and the Companies Act, 2013 may already require you to have one.

What Is Internal Audit?

An internal audit is an independent review of a company’s financial transactions, operational processes, internal controls, and compliance framework. Unlike the statutory audit — which checks whether the financials are true and fair — internal audit asks a different question: Are our systems and controls actually working as we think they are?

It is not about catching wrongdoers. It is about building a resilient, efficient, and trustworthy business before problems become losses.

When Is It Mandatory? — Section 138, Companies Act 2013

Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, makes internal audit mandatory for the following categories:

Listed Companies

  •  All companies listed on any recognised stock exchange in India.

Unlisted Public Companies — if any one of the following applies:

  •  Paid-up share capital of Rs. 50 crore or more

  •  Turnover of Rs. 200 crore or more

  •  Outstanding loans or borrowings from banks or financial institutions of Rs. 100 crore or more

  •  Outstanding deposits of Rs. 25 crore or more

Private Companies — if any one of the following applies:

  •  Turnover of Rs. 200 crore or more

  •  Outstanding loans or borrowings of Rs. 100 crore or more

Important: Thresholds are assessed based on the preceding financial year’s figures. Companies should review applicability every year before April 1st — do not wait for the auditor to flag it.

Who Can Be Appointed?

The Board of Directors is responsible for appointing the internal auditor. Eligible persons include a Chartered Accountant (CA), a Cost and Management Accountant (CMA), or any other professional as the Board decides. The appointment can be an individual, a firm, or an in-house function — though an external appointment is generally preferred for independence.

 Practical Benefits — Beyond Just Compliance

1.  Early Fraud Detection: Tests transactions and verifies vendor activity — catching irregularities before they become material losses.

2.  Stronger Internal Controls: Identifies gaps in approvals, access rights, and duty segregation — reducing both errors and deliberate manipulation.

3.  Regulatory Compliance Assurance: Covers GST, TDS, labour law, FEMA and more — giving management confidence that all obligations are being met on time.

4.  Operational Efficiency: Highlights redundant steps and bottlenecks in processes — reducing costs and improving turnaround times.

5.  Better Board Decisions: Provides the Board and Audit Committee with reliable ground-level data beyond what management reports alone can offer.

6.  Lender and Investor Confidence: Banks view a robust internal audit function as a sign of governance maturity — it can positively influence credit terms and investor perception.

7.  Risk Mapping: Maps operational, financial, and compliance risks — and tracks whether the mitigation measures are actually working.

Consequences of Non-Compliance

Failure to comply with Section 138 exposes the company and its directors to the following consequences:

  •  Fine up to Rs. 25,000 under Section 450 of the Companies Act.

  •  Each officer in default can be fined up to Rs. 25,000 personally.

  •  Non-compliance may trigger inspections and investigations by the Registrar of Companies.

  •  Risk of disqualification under Section 164 of the Act.

  •  For listed companies, the Audit Committee bears direct regulatory accountability.

  •  Affects credit ratings, lender relationships, and investor trust.

Practical Guide: Getting Internal Audit Right

  •  Risk-Based Plan: Prioritise high-risk areas — procurement, payroll, cash handling — rather than auditing everything with equal depth.

  •  Define Scope in Writing: The Board or Audit Committee must specify departments, periods, and frequency before the audit begins.

  •  Ensure Independence: The internal auditor must report directly to the Board or Audit Committee — not to the CFO. Independence is what makes findings credible.

  •  Insist on an ATR: Every audit report must be followed by an Action Taken Report with named owners and deadlines. Without an ATR, the audit is just documentation.

  •  Annual Eligibility Check: Assign the CS or CFO to verify threshold applicability every year before April 1st.

  •  Use Technology: Rely on ERP exception reports and data analytics tools. Manual sampling alone misses systemic issues.

  •  Go Beyond Compliance: Ask your auditor for process improvement insights, not just a list of what went wrong.

The Bottom Line

Internal audit is not a cost centre. It is a control mechanism that protects your business from the inside. Companies that embed it early build stronger governance, attract better credit terms, and avoid the kind of surprises that derail growth at the worst possible time. The question is not whether you should do this — it is whether you can afford not to.