Is internal audit compulsory for you
Only if you are a company, and then only if you fall in one of the classes in Rule 13 of the Companies (Accounts) Rules, 2014. Section 138 itself names no threshold: it leaves the classes to the rules.
The Rule 13 thresholds
Each test in the table looks at the preceding financial year. Crossing any one line in your class is enough.
| Class of company | When an internal auditor is compulsory |
|---|---|
| Every listed company | Always, with no threshold |
| Unlisted public company | Paid-up share capital of ₹50 crore or more during the preceding financial year, or turnover of ₹200 crore or more during the preceding financial year, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year, or outstanding deposits of ₹25 crore or more at any point during the preceding financial year |
| Private company | Turnover of ₹200 crore or more during the preceding financial year, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year |
Reading the thresholds
Four points decide most cases, and they are the ones that get read wrongly.
- Private companies have two tests, not four. Paid-up capital and deposits do not apply to a private company. A private company with ₹80 crore of paid-up capital and ₹60 crore of turnover is outside section 138.
- "At any point during" is not a year-end test. A borrowing that touched ₹105 crore in August and was ₹70 crore on 31 March still crosses the line. Check the peak, not the balance sheet.
- It is the preceding year that counts. You test last year's figures to decide this year's obligation, which means you usually know a year in advance.
- Borrowings are from banks or public financial institutions. A loan from a director, a group company or an NBFC that is not a public financial institution is not the same thing, and the classification has to be checked rather than assumed.
If you are an LLP, a partnership firm, a proprietorship, a trust or a society, section 138 does not reach you at all. Any internal audit you have is voluntary, or a lender's or funder's condition. That does not make it pointless: see the section on voluntary internal audit below.
Who can be your internal auditor
A chartered accountant or a cost accountant, or another professional the board decides on. This is wider than most people expect, and narrower in one respect.
Section 138(1) says the internal auditor shall be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board. The section's definitions require the chartered accountant or cost accountant to hold a valid certificate of practice under section 6(1) of their respective Act. Rule 13 adds an explanation that the internal auditor may or may not be an employee of the company.
So three arrangements are all lawful:
| Arrangement | What it looks like | What to watch |
|---|---|---|
| An external firm | A practising CA or cost accountant firm engaged for the year | Independence is easy, business knowledge takes a cycle to build |
| An in-house internal audit team | Employees reporting to the audit committee, not to the finance head | The reporting line is what makes it worth anything |
| Another professional chosen by the board | For example an engineer for a plant-heavy process review | The board's decision should be minuted, with the reason |
One arrangement is not lawful: your statutory auditor cannot do it. Section 144 lists internal audit among the services an auditor may not render, directly or indirectly, to the company it audits or to that company's holding or subsidiary company. For a firm the bar reaches its partners, its associate entities and anything carrying its brand. So if Regikart is your statutory auditor, your internal audit goes elsewhere, and the reverse is also true.
Who sets the scope, and who the report goes to
The audit committee, or the board where there is no audit committee, in consultation with the internal auditor. That is Rule 13(2), and it settles four things: scope, functioning, periodicity and methodology.
In practice that means a written internal audit plan approved before the year starts, covering which processes and locations are in scope, how often each is visited, what testing approach is used, and how findings are reported and followed up. Section 138(2) lets the Central Government prescribe the manner and intervals in which the audit is conducted and reported to the board, so the reporting line runs to the board, not to the management being reviewed.
The last point is the one that decides whether the function works. An internal auditor who reports to the finance head is reviewing their own reporting line. Where there is an audit committee under section 177, the committee should approve the plan, receive the reports, and be able to speak to the internal auditor without management present.
What an internal auditor does that a statutory auditor does not
Different question, different output, different reader.
| Internal audit | Statutory audit | |
|---|---|---|
| The question asked | Do the controls and processes work, and where is the risk | Do the financial statements give a true and fair view |
| Governing law | Section 138 and Rule 13, for the classes covered | Sections 139 to 147, for every company |
| Appointed by | The board, or the audit committee | The members, at the annual general meeting |
| Timing | Continuing through the year, on an approved plan | After the year end, on the closed books |
| Output | Observations, root causes, recommendations, management responses, follow-up status | An opinion on the accounts, plus CARO 2020 where it applies |
| Who reads it | The audit committee and the board | Members, lenders, the Registrar, anyone reading the accounts |
| Can be the same firm? | No. Section 144 bars the statutory auditor from internal audit |
The two also differ in what they are looking for. A statutory auditor tests whether a number in the accounts is right. An internal auditor asks how a wrong number could get in and not be caught, and whether it has happened elsewhere. See statutory audit, tax audit and secretarial audit for the other three audits a company may face.
What we actually look at
The plan is built on your risks, not on a template. These are the areas most plans include, and what we test in each.
- Purchase to pay. Vendor onboarding and duplicate vendor masters, purchase order and approval limits, three-way matching of order, receipt and invoice, advances outstanding, and payments made outside the approval route.
- Order to cash. Credit limits and who can override them, pricing and discount authority, credit notes, ageing and the escalation that is supposed to follow it, and cash sales controls.
- Inventory and fixed assets. Physical verification against records, movement documentation, scrap and rejection handling, and assets that exist in the ledger but not on the floor.
- Payroll and people. Joiners and leavers reaching payroll on time, attendance to payroll flow, reimbursement claims, and statutory deductions matching the returns. See payroll services.
- Statutory compliance. Whether GST, TDS and ROC obligations are being met on time and reconciled, not just filed. See compliance calendar.
- Related party and cash transactions. Whether they are identified, approved and recorded, because this is where a statutory audit qualification usually starts.
- Access and segregation of duties. Who can create a master, post an entry and release a payment, and whether one person can do all three.
- Follow-up on last cycle. Whether the observations you accepted last quarter were actually closed.
Where a process is heavily system-driven, the test moves from vouchers to configuration: approval workflows, user roles and what the software will let someone do without a second pair of eyes.
What a report looks like
A finding, not an essay. Each observation in our report carries the same six fields, so a director can read a page and know what to decide.
| Field | What it says |
|---|---|
| Observation | What we found, with the sample and the period tested |
| Risk | What it can cost: money, tax exposure, a qualification, a stoppage, a penalty |
| Root cause | Why it happened, which is usually a missing control rather than a person |
| Recommendation | The specific change, at the level of who does what and when |
| Management response | The owner's own words, with an owner's name and a date |
| Status | Open, in progress or closed, carried forward to the next report |
Findings are rated so that the board can see the shape of the quarter at a glance, and the same rating scale is used all year. We agree the scale with the audit committee before the first cycle rather than inventing it in the first report.
Internal audit and internal financial controls are not the same thing
They overlap, and they are separate obligations with separate readers.
Internal financial controls are the controls themselves, and section 143(3)(i) requires the statutory auditor to report on their adequacy and operating effectiveness. Some private companies are outside that reporting: see the internal financial controls section on statutory audit for the exemption and its conditions.
Internal audit is a function that tests controls, including but not only financial ones, and reports to the board. A company can be outside section 138 and still be inside internal financial controls reporting, or the other way round. The two questions are asked separately, and we answer both in the applicability note at the start of an engagement.
Internal audit is also not due diligence, which is a one-off review for a transaction with a buyer or investor as its reader, and not a secretarial audit, which is a company secretary's report on compliance with company and securities law.
When a voluntary internal audit earns its fee, and when it does not
We would rather scope you out than sell a cycle you do not need. Below the Rule 13 limits, internal audit is worth buying when one of these is true.
- Cash or inventory is handled by people you cannot personally supervise, particularly across more than one location.
- A specific loss has happened: a fraud, a large write-off, a stock difference nobody can explain, or a tax demand that came from a process failure.
- You are preparing for funding, a sale or a bank facility, and want the process problems found before someone else finds them. Note that a transaction review is due diligence, and it is a different engagement.
- A statutory audit has been qualified, or your auditor has raised the same point two years running.
- You are growing past the point where the promoter can be the control.
It is usually not worth buying when the books are not yet reliable, when a single owner still approves every payment personally, or when the real problem is that nobody is doing the bookkeeping. In those cases fix the base layer first: see accounting services.
Fees
Fee on quote after a free review. There is no government fee for an internal audit, and nothing is filed with any department.
| Item | Position |
|---|---|
| Regikart professional fee, internal audit | Fee on quote after a free review |
| Government fee | No government fee |
| Statutory audit of the same company | Not available alongside internal audit, because of section 144. See statutory audit |
| Bookkeeping or monthly accounting | Separate service, see accounting services |
| A one-off review for a transaction | See due diligence |
Professional fees exclude GST at 18%. Government fees, where they apply, are paid at actuals to the department and are shown separately. Fees verified on 27 September 2026.
What moves the quote: the number of locations and whether visits are needed, transaction volume, how many processes are in the approved plan, the review frequency the audit committee wants, the systems in use, and whether a first-cycle risk assessment has to be built from scratch. We put the plan and the fee in writing before the first cycle.
Why boards bring this to Regikart
Regikart is a CA and CS firm serving 250+ clients, with offices in Kolkata (head office), Delhi and Bengaluru. This page is reviewed by CA Deepak Jaiswal.
- Applicability in writing, before the sales conversation. The Rule 13 test is done first, and if section 138 does not apply we tell you that.
- The plan is agreed with the committee or board, not with management. The reporting line is what makes an internal audit worth its fee.
- Findings a director can act on. Every observation carries risk, root cause, a named owner and a date, and last cycle's items are tracked to closure.
- Independence respected. Where we are your statutory auditor, we will not take the internal audit, and we will say why.
- The compliance side is in the same firm. GST, TDS and ROC obligations can be tested against what was actually filed.