Most companies treat internal audit as a statutory formality: appoint an auditor, receive a report, file it. Yet when a fraud, a cash crunch or a regulatory notice surfaces, the first question the Board asks is usually “Why didn't internal audit catch this?” This guide explains what a good internal audit function does, when the law makes it mandatory, and how the Board and Audit Committee should use it.
Internal audit is an independent, risk-based review of a company's processes and controls that reports to the Audit Committee or Board. Under Section 138 of the Companies Act, 2013 it is mandatory for all listed companies and for unlisted and private companies above set turnover, borrowing, capital or deposit limits. Its purpose is to warn the Board early, not to tick a compliance box.
What internal audit really does for governance
Corporate governance decides who approves, who checks and who is accountable. Internal audit tests whether those rules actually work on the ground, transaction by transaction. A well-run function plays three roles:
When is internal audit mandatory? Section 138 and Rule 13
Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 requires an internal auditor if the company meets any one of the limits below, tested on the preceding financial year.
| Type of company | Internal audit is mandatory if |
|---|---|
| Listed company | Always |
| Unlisted public company | Paid-up capital ≥ ₹50 crore, or turnover ≥ ₹200 crore, or bank/FI loans and borrowings > ₹100 crore at any time, or deposits ≥ ₹25 crore at any time |
| Private company | Turnover ≥ ₹200 crore, or bank/FI loans and borrowings > ₹100 crore at any time |
Who can be appointed? A Chartered Accountant or Cost Accountant (in practice or not), or another professional chosen by the Board. It can be an employee or an outside firm. The Audit Committee, or the Board where there is no committee, fixes the scope, frequency and method of the audit in consultation with the internal auditor.
Internal audit is voluntary, but companies raising funds, seeking higher bank limits, facing investor due diligence or planning a listing usually adopt it early. Investors and lenders expect it.
The Audit Committee: where internal audit gets its teeth
A report has value only if someone with authority acts on it. Under Section 177, an Audit Committee is required for listed companies and for public companies with paid-up capital of ₹10 crore or more, turnover of ₹100 crore or more, or aggregate loans, borrowings, debentures or deposits above ₹50 crore. Listed entities must also follow Regulation 18 of the SEBI (LODR) Regulations.
1. Approves a risk-based plan
The committee approves where internal audit will focus, based on risk, so the audit does not repeat the same checklist every year.
2. Protects independence
It meets the internal auditor directly, including without management where needed, so sensitive issues reach the Board unfiltered. In listed companies it also reviews the appointment and removal of the chief internal auditor.
3. Oversees internal financial controls
It evaluates internal financial controls and risk management systems. This supports the directors' responsibility statement under Section 134(5)(e) and the statutory auditor's reporting under Section 143(3)(i).
4. Enforces accountability
Overdue audit points are escalated, assigned to named owners and tracked until closed.
Internal audit vs statutory audit
| Point | Internal audit | Statutory audit |
|---|---|---|
| Law | Section 138 | Sections 139–148 |
| Purpose | Improve controls and manage risk | Opinion on the financial statements |
| Reports to | Audit Committee / Board | Shareholders |
| Frequency | Continuous, often quarterly | Annual |
| Outlook | Forward-looking, preventive | Historical |
| Who | CA, CMA or other professional; can be an employee | Independent CA firm only |
The two are linked: under clause 3(xiv) of CARO 2020, the statutory auditor reports whether the company has an internal audit system suited to its size and business, and whether the internal audit reports were considered.
How to set up an effective internal audit function
- Map the risks. List the processes where money, data or compliance can go wrong: revenue, procurement, payroll, cash, inventory, statutory compliance.
- Prepare a risk-based annual plan and get it approved by the Audit Committee or Board.
- Fix the reporting line. The internal auditor should report functionally to the Audit Committee, not only to the CFO whose area is being audited.
- Agree a reporting format that ranks findings by risk (high, medium, low) with a clear owner and deadline for each.
- Track closure in an action-taken report reviewed at every Audit Committee meeting.
- Re-test closed points to confirm the fix actually works.
Practical internal audit checklist
Red flags that signal weak governance
- Management overrides: approval limits bypassed, back-dated approvals, one person both initiating and approving.
- Repeat observations: the same issue reported audit after audit with no action.
- Weak documentation: unsigned agreements, informal arrangements, missing records.
- Related party transactions without prior approval or not at arm's length.
- Profit without cash: reported profits alongside persistent cash stress and rising receivables or stock. See cash flow vs profit.
- Compliance as an afterthought: last-minute filings, with interest and penalties treated as a normal cost.
A mid-sized manufacturer's internal audit found that the same vendor existed twice in the system under slightly different names. Over 14 months, 11 invoices had been paid twice. The fix was simple: a duplicate-vendor check at onboarding and a system block on duplicate invoice numbers. The lesson is that small process gaps, not large thefts, cause most leakages.
Follow-up: where governance is truly tested
Finding an issue is half the job. Every observation needs an owner, an action and a deadline. Closure should fix the root cause, be backed by evidence (an updated SOP, a system change, sample transactions) and be re-tested. Points that stay open should go to the Audit Committee. Good governance is measured not by reports issued but by issues resolved.
Frequently asked questions
Is internal audit mandatory for private companies in India?
Yes, once the private company crosses either limit in the preceding financial year: turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions of more than ₹100 crore at any time. Below these limits it is voluntary.
What is the difference between internal audit and statutory audit?
Statutory audit is an annual, external opinion to shareholders on whether the financial statements are true and fair. Internal audit is a continuous, risk-based review of processes and controls that reports to the Audit Committee or Board and aims to prevent problems, not only report on them.
Who can be appointed as an internal auditor?
A Chartered Accountant or Cost Accountant, whether or not in practice, or another professional decided by the Board. The internal auditor may be an employee of the company or an outside firm, but the company's statutory auditor cannot act as its internal auditor.
What does the Audit Committee do in relation to internal audit?
It approves the risk-based internal audit plan, reviews significant findings, tracks whether management closes observations on time and protects the internal auditor's independence. In listed companies it also reviews the adequacy of the internal audit function and the appointment of the chief internal auditor.
How often should internal audit be carried out?
The law leaves this to the Audit Committee or Board. Most companies follow a quarterly cycle, with high-risk areas such as cash, procurement and revenue reviewed more often.
What is the penalty for not appointing an internal auditor?
Section 138 has no separate penalty, so the general penalty under Section 450 applies: ₹10,000, plus ₹1,000 per day of continuing default, up to ₹2 lakh for the company and ₹50,000 for each officer in default. The statutory auditor may also report the gap under CARO 2020.
Can internal audit detect fraud?
Internal audit is not a forensic investigation, but a risk-based internal audit is usually the first place fraud indicators surface: management overrides, back-dated approvals, duplicate vendors and unexplained cash gaps.
Conclusion
Internal audit is not about fault-finding; it is about future-proofing the organisation. Section 138 makes it compulsory for larger companies, but its value comes from three things: a risk-based plan, an Audit Committee that engages with the findings, and disciplined follow-up until every issue is closed.
Need a fresh look at your internal controls?
H K Davra & Co. supports companies with risk-based internal audit, internal financial controls testing and Audit Committee reporting.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.