Karamthulla & AssociatesChartered Accountants
info@karamassociates.com+91 95059 39143

Internal audit under section 138: who must appoint one

Listed companies always need an internal auditor. Private and unlisted public companies need one once they cross thresholds based on the preceding financial year.

The thresholds

Section 138 of the Companies Act, 2013, read with rule 13 of the Companies (Accounts) Rules, 2014, requires these companies to appoint an internal auditor:

Type of companyInternal audit required if, in the preceding financial year
Listed companyAlways
Unlisted public companyPaid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any time; or outstanding deposits of ₹25 crore or more at any time
Private companyTurnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore at any time

The borrowing test looks at any point in the preceding year. A company that borrowed above ₹100 crore for even a short period, then repaid, still needs an internal auditor for the following year.

Who can be appointed

  • A chartered accountant or a cost accountant, whether or not in practice, or another professional decided by the Board
  • The internal auditor may or may not be an employee of the company
  • The company's statutory auditor cannot be its internal auditor (section 144)

Scope and reporting

The Audit Committee, or the Board where there is no Audit Committee, decides the scope, frequency and methodology of internal audit in consultation with the internal auditor. Findings are reported to the Audit Committee or Board, and the statutory auditor will consider them in planning the audit.

Below the thresholds

Many companies appoint an internal auditor before the law requires one. Common reasons are investor or lender requests, preparing for a listing, or a Board that wants an independent view of controls as the business grows. A voluntary internal audit follows the same structure: a risk assessment, an annual plan and regular reports to the Board.

References

  • Companies Act, 2013, sections 138, 144 and 177
  • Companies (Accounts) Rules, 2014, rule 13

This note is general information on the law as at October 2026. It is not advice for any specific situation.