When does internal audit apply?

Which companies need an internal auditor?

Rule 13 of the Companies (Accounts) Rules, 2014 names the companies that must appoint an internal auditor under section 138 of the Companies Act, 2013. Every listed company is in that class, with no turnover or capital floor. An unlisted public company and a private company are in only if a preceding-year figure in the rule is met. Meeting one figure is enough.

Which public company tests apply?

An unlisted public company needs an internal auditor if, during the preceding financial year, any one of four figures in rule 13(1)(b) is met. Paid-up share capital of ₹50 crore or more counts. Turnover of ₹200 crore or more counts. Outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point count. Outstanding deposits of ₹25 crore or more at any point count. A loan from a person who is not a bank or a public financial institution is not that borrowing test.

Which private company tests apply?

A private company has two tests, in rule 13(1)(c), not four. Turnover of ₹200 crore or more during the preceding financial year is one. Outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during that year is the other. Paid-up capital and deposits are not private-company triggers, even when those figures would catch an unlisted public company.

Capital and turnover are read for the preceding financial year as a whole. Borrowings and deposits are read at any point of time during that year, so a short spike can matter. The borrowing line is "exceeding", so exactly ₹100 crore does not meet it. The rule's own words are "exceeding one hundred crore rupees or more". Deposits, by contrast, are "twenty five crore rupees or more", so exactly ₹25 crore does meet that public-company test.

An International Financial Services Centre company is a further carve-out. G.S.R. 8(E) and G.S.R. 9(E), dated 4 January 2017, apply section 138 to an IFSC public company and an IFSC private company only if the articles provide for it. Rule 13 does not override that articles condition.

Who may be the internal auditor?

Section 138(1) says the internal auditor shall be a chartered accountant or a cost accountant, or such other professional as the Board decides. Rule 13(1) allows an individual, a partnership firm, or a body corporate. The explanation to the rule, substituted by the Companies (Accounts) Amendment Rules, 2016 (notification dated 27 July 2016), says a chartered accountant or a cost accountant need not be in practice, and the internal auditor may or may not be an employee of the company.

A practising firm is allowed. An in-house chartered accountant is also allowed, if the Board appoints that person. If the Board uses the "such other professional" limb in section 138(1), the resolution should name that person and why the Board treats that person as a professional.

Who sets the internal audit scope?

The Audit Committee, or the Board if there is no Audit Committee, sets the scope. Rule 13(2) says that body shall, in consultation with the internal auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit. Section 138(2) leaves the manner and the intervals of the audit, and the report to the Board, to the rules. A one-line appointment letter that never states scope or how often the work is done does not meet rule 13(2).

This is not the cost audit under section 148. Cost audit has its own turnover bands, its own auditor, and Forms CRA-2 and CRA-4. Crossing a cost-audit threshold does not appoint your internal auditor, and appointing an internal auditor does not satisfy a cost audit.

Can the statutory auditor do internal audit?

No. Section 144 says an auditor appointed under the Act shall not render internal audit, directly or indirectly, to the company, its holding company, or its subsidiary. For a firm, that includes the firm itself, its partners, a parent, subsidiary or associate entity, and any entity in which the firm or a partner has significant influence or control, or whose name, trade mark or brand the firm or a partner uses. Board approval of other services cannot put internal audit back on the permitted list.

The internal auditor and the statutory auditor are different appointments. If the same firm signs both, the internal-audit appointment is the one that has to move.

What penalty applies under section 450?

Section 138 does not write its own fine. A contravention for which the Act sets no other penalty falls under section 450. The Companies (Amendment) Act, 2020 substituted that section with effect from 21 December 2020. The company and every officer in default, or any other person in default, is liable to a penalty of ₹10,000. If the contravention continues, a further penalty of ₹1,000 applies for each day after the first. The cap is ₹2 lakh for a company and ₹50,000 for an officer in default or any other person.

Check the class tests against the preceding year's audited figures before the Board treats internal audit as optional. A change to rule 13 would come as an MCA notification. The MCA updates feed is the place to see that notification beside the section text.