What an internal audit is, and how it differs from a statutory audit
A statutory audit gives an opinion on whether the financial statements are true and fair, for shareholders and the ROC. An internal audit is a different exercise entirely — it examines whether a specific process, control or department is working the way management intends, and reports its findings to management or the audit committee, not externally. The two aren't substitutes for each other, and a company subject to Section 138 still needs its statutory audit as well.
Because it isn't filed publicly, the scope of an internal audit is set by the company itself — a full review of financial controls, a focused look at procurement, an examination of a branch office, or a check on whether a newly implemented process is actually being followed. This flexibility is the main reason businesses commission one voluntarily even when it isn't legally required.
When internal audit is mandatory under Section 138
| Company type | Mandatory if any one applies (preceding financial year) |
|---|---|
| Listed company | Always mandatory — no threshold to meet |
| Unlisted public company | Paid-up share capital ≥ ₹50 crore, OR turnover ≥ ₹200 crore, OR outstanding loans/borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the year, OR outstanding deposits of ₹25 crore or more at any point during the year |
| Private company | Turnover ≥ ₹200 crore, OR outstanding loans/borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the year — private companies are tested on only these two limbs, not paid-up capital or deposits |
A private company well below both thresholds is not required to have an internal audit under Section 138 — a distinction worth being precise about, since a fair amount of content online incorrectly applies the paid-up-capital and deposits tests to private companies as well, when Rule 13 only applies those to unlisted public companies.
Typical scope of an internal audit engagement
- Financial controls — segregation of duties, approval limits, and whether transactions are recorded and authorised the way policy says they should be.
- Procurement and vendor management — whether purchases follow an approved process, and whether vendor payments reconcile against agreed terms.
- Inventory and fixed assets — physical verification against records, and controls over movement and disposal.
- Payroll and statutory compliance — whether PF, ESI, TDS and professional tax are being deducted and deposited correctly and on time.
- Branch or location-specific review — where a business has multiple sites, an internal audit can focus on one location at a time rather than the whole company at once.
- Follow-up on a specific concern — a suspected control gap, an unusual pattern in expenses, or a process that changed recently and hasn't been tested since.
How an internal audit engagement runs
-
Scoping with the board or audit committee
The areas to be covered, the frequency of review, and the reporting format are agreed with the board or audit committee before work begins — for a mandatory engagement, this should be revisited at least annually.
-
Risk assessment
Within the agreed scope, higher-risk areas are identified so testing effort is directed where it matters most, rather than spread evenly regardless of risk.
-
Testing and fieldwork
Transactions, controls and processes are tested against what policy says should happen, with findings recorded as they're identified.
-
Reporting to management
Findings, their significance, and recommended action are set out in a report to the board or audit committee — internal audit reports are advisory, so it's then for management to decide what to act on.
-
Follow-up on prior findings
A good internal audit programme checks, at the next review, whether previous recommendations were actually implemented — otherwise the same finding tends to repeat every cycle with no real change.
Practical notes from our engagements
- Scope agreed too broadly to be useful. "Review everything" produces a thin report on everything rather than a useful one on anything. A focused scope — one process, one location, one control area — generally finds more that's actually actionable.
- The same findings repeating every year. Where a recommendation isn't followed up at the next review, it tends to reappear unchanged — the follow-up step is often where the actual value of the exercise is won or lost.
- Mandatory applicability checked once and never revisited. Turnover and borrowing levels change year to year; a private company that crosses ₹200 crore turnover or breaches the ₹100 crore borrowing threshold partway through a year becomes covered by Section 138 for that year, even if it wasn't the year before.
- Internal audit confused with the statutory auditor's work. The statutory auditor and the internal auditor serve different purposes and, under Section 144(b), generally cannot be the same firm for the same company — treating internal audit as something the statutory auditor will "also cover" is a common and mistaken assumption.
How we handle internal audit engagements
We start by agreeing a scope specific enough to be useful — one process, one location, or one control area, rather than an unfocused general review — and confirm the reporting format the board or audit committee actually wants. Findings are reported as they're identified where something needs urgent attention, rather than saved entirely for a single year-end report, and we check follow-through on prior findings at each subsequent review rather than treating each engagement as a fresh start.
Related services
Frequently asked questions
Is internal audit mandatory for every private company?
No. A private company is only required to have one under Section 138 if its turnover was ₹200 crore or more in the preceding year, or if its outstanding bank/financial institution borrowings exceeded ₹100 crore at any point during that year.
Does a private company also get tested on paid-up capital or deposits?
No — those two tests apply only to unlisted public companies under Rule 13. Private companies are tested on turnover and borrowings only.
Can the internal auditor be an employee of the company?
Yes. The requirement that the internal auditor be a Chartered Accountant or Cost Accountant 'in practice' was removed in 2017, and the rules explicitly allow the internal auditor to be an in-house employee.
Can our statutory auditor also act as our internal auditor?
Generally no — Section 144(b) restricts the statutory auditor from providing internal audit services to the same company, to preserve independence.
How often does an internal audit need to happen?
There's no fixed statutory frequency — the board or audit committee decides this in consultation with the internal auditor, commonly quarterly or half-yearly for companies where it's mandatory.
What happens to internal audit findings — are they made public?
No. Internal audit reports go to the board or audit committee and are not filed with any regulator or made public, unlike a statutory audit report.
If our company falls below the Section 138 thresholds this year, can we stop having an internal audit?
The requirement is assessed against the preceding financial year's figures each year, so a company that drops below both thresholds is no longer mandatorily covered for that year, though many boards choose to continue voluntarily.
Is a voluntary internal audit worth doing if it's not legally required?
Many businesses find it useful specifically because it isn't constrained by a statutory format — it can be scoped to whatever concern management actually has, from a single process to a specific location.