What Is an Internal Audit?

Internal audit is an independent evaluation of an organization’s internal controls, governance, and financial processes aimed at ensuring compliance, preventing fraud, and improving operational efficiency.

It is mandated for certain companies to protect stakeholders, foster transparency, and support effective risk management.

Applicability – Companies Required to Appoint Internal Auditor

As per Rule 13 of the Companies (Accounts) Rules, 2014), the following companies are mandatorily required to appoint an Internal Auditor:

1. Every Listed Company
   • All listed companies must appoint an internal auditor, irrespective of capital/turnover.
2. Unlisted Public Companies having:
   • Paid-up share capital of ₹50 crore or more during the preceding financial year, OR
   • Turnover of ₹200 crore or more during the preceding financial year, OR
   • Outstanding loans or borrowings from banks/public financial institutions of ₹100 crore or more at any point of time during the preceding financial year, OR
   • Outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year.
3. Private Companies having:
   • Turnover of ₹200 crore or more during the preceding financial year, OR
   • Outstanding loans or borrowings from banks/public financial institutions of ₹100 crore or more at any point of time during the preceding financial year.

Mandatory Nature & Timing

• Appointment is mandatory for companies meeting the specified criteria.
• Existing companies newly covered by these thresholds must comply within six months of meeting them.
• There is no requirement for the internal auditor to be a company employee.

Who Can be an Internal Auditor?

• The Internal Auditor may or may not be an employee of the company.
• The role can be assigned to:
  • Chartered Accountant (CA) (whether in practice or employment),
  • Cost Accountant (CMA), OR
  • Any other professional as decided by the Board of Directors.

Appointment & Procedure

• The Board of Directors appoints the Internal Auditor by passing a Board Resolution.
• The scope, functions, periodicity, and methodology of the internal audit are to be determined by the Audit Committee (if constituted) or the Board.
• There is no prescribed form (like MGT-7A or AOC-4) for filing with ROC regarding appointment of Internal Auditor.
• However, it must be disclosed in the Board’s Report.

How Internal Audit Helps Companies

• Risk Management: Identifies and mitigates risks in operations.
• Ensures Compliance: Assesses compliance with laws, rules, and internal policies.
• Improves Controls: Strengthens internal controls and procedures, reducing errors and fraud.
• Corporate Governance: Enhances accountability, decision-making, and transparency for stakeholders.
• Data Integrity: Supports accurate and timely financial reporting.
• Protects Shareholder Interests and adds value by proactively spotting inefficiencies and gaps.

Consequences of Non-Compliance

• Non-compliance with Section 138 attracts penalties under Section 450 (punishment where no specific penalty is provided):
  • Company: ₹25,000 penalty.
  • Officers in default: ₹5,000 penalty each.
• Apart from penalties, absence of internal audit may weaken governance and lead to frauds/mismanagement going undetected.

Section 138 of Companies Act, 2013 makes Internal Audit compulsory for listed companies and large unlisted public/private companies (based on thresholds).
It must be conducted by a CA, CMA, or other professional (employee or external). It is governance-focused, helping management strengthen internal controls, ensure compliance, and mitigate risks. Non-compliance attracts penalties.