—Guide
Internal Audit Under Section 138: Who Needs It and What It Covers
Which companies must appoint an internal auditor under Section 138, the thresholds for private companies, and what an internal audit typically reviews.
Internal audit is an independent review of how a company actually runs: its processes, controls and compliance. For larger companies it's a legal requirement; for others, a practical tool. This guide explains who must have one and what it covers.
Who Must Appoint an Internal Auditor
Under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014, the following must appoint an internal auditor:
- Every listed company.
- Every unlisted public company with, in the preceding financial year, paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or financial institutions of ₹100 crore or more, or outstanding deposits of ₹25 crore or more.
- Every private company with, in the preceding financial year, turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or financial institutions of ₹100 crore or more.
Who Can Be the Internal Auditor
A Chartered Accountant, a cost accountant, or another professional decided by the board — whether an employee or an outside firm. The statutory auditor can't be the internal auditor.
What the Board Decides
The audit committee, or the board where there's no committee, decides the scope, functioning, periodicity and methodology of the internal audit, in consultation with the internal auditor.
What Internal Audit Typically Covers
- Procure-to-pay: purchase approvals, vendor selection, payments.
- Order-to-cash: pricing, discounts, billing completeness, collections.
- Inventory: stock controls, counts, expiry and obsolescence.
- Payroll: attendance, salary changes, statutory deductions.
- Fixed assets: acquisition, tagging, verification.
- Statutory compliance: GST, TDS, labour laws and regulatory filings.
- IT: user access and system controls.
How It Reports
Internal audit reports go to the audit committee or board, usually quarterly, with findings rated by severity and management's agreed actions.
Beyond Compliance
Even where it isn't required, internal audit helps growing companies find leakage, strengthen controls and prepare for investment. Many choose a lighter, risk-focused internal audit well before they cross the thresholds.
Getting Help
Think Filing provides outsourced internal audit for companies, with risk-based plans and quarterly reporting to the board.