Audit Committee and Vigil Mechanism Under Section 177: Composition, Powers and Disclosure

Not every company needs an audit committee, but every board should know whether its company is one that does. Section 177 of the Companies Act, 2013 builds the committee that stands between the board and the numbers: it watches the auditors, the financial statements, related party deals, inter-corporate loans and internal controls. The same section requires a separate whistle-blowing channel, called the vigil mechanism. This guide walks through what the section says, in order, and where the reader must look beyond the Act itself.

Legal basis: Companies Act, 2013, s.177, read with rules 6 and 7, Companies (Meetings of Board and its Powers) Rules, 2014.

Who must constitute an audit committee

The Board of Directors of "every listed public company" and "such other class or classes of companies, as may be prescribed" must constitute an Audit Committee (s.177(1), Companies Act 2013). The Act itself does not say which unlisted companies are in the prescribed class. That is left to rule 6 of the Companies (Meetings of Board and its Powers) Rules, 2014, which, like the Nomination and Remuneration Committee rule, names listed companies and certain classes of public companies defined by their size. The rule measures size on the figures in the last audited financial statements.

This guide does not repeat the monetary limits. They sit in subordinate legislation that has been amended over time, so read the current text of rule 6 on the official portal, or ask your Company Secretary, before concluding that a public company falls inside or outside the net. A private company is not in the classes the Act names, but its articles or an investor agreement may still require a committee by contract.

Test the class every year. The test is applied to a moving set of figures, so last year's answer is not a safe assumption.

Composition

The committee must have a minimum of three directors, with independent directors forming a majority (s.177(2)). A proviso adds that a majority of the members, including the Chairperson, must have the ability to read and understand a financial statement. The test is practical literacy, not a formal qualification: the Act asks whether the person can read and understand the statements.

Committees that existed before the Act commenced had one year to reconstitute themselves on this footing (s.177(3)). That transition has long passed and matters only as history.

The eight terms of reference

The committee acts under written terms of reference set by the Board. Those terms must, among other things, include the following eight items (s.177(4)).

Recommending the appointment, remuneration and terms of appointment of the company's auditors.
Reviewing and monitoring the auditor's independence and performance, and the effectiveness of the audit process.
Examining the financial statement and the auditors' report on it.
Approving transactions with related parties, or any later modification of them.
Scrutinising inter-corporate loans and investments.
Valuing undertakings or assets of the company, wherever necessary.
Evaluating internal financial controls and risk management systems.
Monitoring the end use of funds raised through public offers and related matters.

The related party item carries four provisos, and they are the part most often misread.

Omnibus approval. The committee may give omnibus approval for related party transactions the company proposes to enter into, subject to conditions the rules prescribe.
Transactions outside s.188. Where a transaction is not one referred to in section 188 and the committee does not approve it, the committee makes its recommendations to the Board.
Unapproved transactions up to ₹1 crore. If a director or officer enters into a transaction of an amount not exceeding one crore rupees without the committee's approval, and the committee does not ratify it within three months of the transaction, the transaction is voidable (the committee can cancel it). If the transaction is with a related party to any director, or was authorised by any other director, that director must indemnify the company against any loss it incurs.
Holding and wholly owned subsidiary. The clause does not apply to a transaction, other than one referred to in section 188, between a holding company and its wholly owned subsidiary.

In practice the committee's work on this item feeds on other records the company already keeps: the register of related party contracts, the record of loans and investments, and the financial statements.

Powers to call for comments and to investigate

The committee may call for the auditors' comments on internal control systems, the scope of audit (including the auditors' observations), and the financial statement before it goes to the Board. It may also discuss related issues with the internal and statutory auditors and with management (s.177(5)). In plain terms, the committee sees the draft before the Board does and can question both auditors and management about it.

It also has authority to investigate any matter relating to the s.177(4) items, or any matter the Board refers to it. For that purpose it may obtain professional advice from external sources and has full access to the information contained in the company's records (s.177(6)). It needs no further permission to take outside advice.

The auditors and the key managerial personnel have a right to be heard at committee meetings when the committee considers the auditor's report, but they have no right to vote (s.177(7)).

What the Board's report must say

The Board's report under section 134(3) must disclose the composition of the Audit Committee. Where the Board has not accepted a recommendation of the committee, that must also be disclosed in the report, along with the reasons (s.177(8)). The effect is that a board which overrules its committee has to put its reasons in a document that members read. Directors considering such a step on related party approvals or auditor appointments should expect the reasons to be published.

The vigil mechanism

Every listed company, and such class or classes of companies as may be prescribed, must establish a vigil mechanism for directors and employees to report genuine concerns, in the manner prescribed (s.177(9)). The prescribed classes for this purpose are a separate list from the committee classes. A company can be in one and outside the other, and a listed company is in both. Read rule 7 of the 2014 Rules for the classes and the working rules, and check the current text before relying on any figure.

Section 177(10) sets two requirements for the mechanism:

it must give adequate safeguards against victimisation of the people who use it; and
it must make provision for direct access to the chairperson of the Audit Committee in appropriate or exceptional cases.

The details of establishing the mechanism must be disclosed on the company's website, if it has one, and in the Board's report.

Rule 7 of the original 2014 Rules adds working detail. Companies that must have an audit committee oversee the vigil mechanism through it, and a committee member with a conflict of interest in a given case is to step aside. Other companies in the class have the Board nominate a director to play the committee's role for this purpose. The rule also lets the committee, or the nominated director, take suitable action, including reprimand, against a director or employee who repeatedly files frivolous complaints. Confirm the current wording of rule 7 before putting it into a policy.

The vigil mechanism and the auditor's duty to report fraud under section 143(12) are different channels. One is for insiders raising concerns; the other is a statutory duty of the auditor. A company can have both running at once.

A worked example

A company in the prescribed class has a managing director whose family firm bids for a facility-management contract.

The proposal is a related party transaction, so it goes to the committee for approval before the Board acts on it. Where the company expects repeat low-value dealings with the same party, the committee may grant omnibus approval, within the conditions the rules prescribe.
If the transaction falls outside section 188 and the committee declines to approve it, the committee's remedy is a recommendation to the Board. The Board may still go ahead, but s.177(8) then requires the Board's report to say that the recommendation was not accepted and why.
If a director signs a transaction of up to ₹1 crore without committee approval and the committee has not ratified it within three months, the committee may avoid it. Where the other party is related to a director, or another director authorised the deal, the director concerned must indemnify the company for any loss.

The practical lesson is to route a transaction to the committee before it is signed. A late route turns an ordinary recommendation into a voidance question.

Consequence of getting it wrong

Section 178(8) covers contravention of section 177 as well as section 178. The company is punishable with a fine of not less than one lakh rupees, which may extend to five lakh rupees, and every officer in default is also liable to a penalty under that sub-section. This guide does not state the officer's amount, because sources conflict on it; read the current text of s.178(8) before quoting one.

What to do now

Next step: Check whether the company is a listed public company or falls in a class prescribed by rule 6 of the Companies (Meetings of Board and its Powers) Rules, 2014 (s.177(1)). Separately check whether it falls in the class prescribed by rule 7 for the vigil mechanism (s.177(9)).
Deadline: The Act sets no calendar date for constituting the committee; apply the test to the figures in the last audited financial statements and act when the company comes within the class. The committee's composition and any rejected recommendation are disclosed in each year's Board's report (s.177(8)).
Consequence: A company in default faces a fine of ₹1 lakh to ₹5 lakh, and officers in default face a penalty (s.178(8)).

Have a CA review your facts before you act or file.

FAQ

Which companies need an audit committee?
Every listed public company, and such other classes of companies as are prescribed (s.177(1)). The prescribed classes are in rule 6 of the Companies (Meetings of Board and its Powers) Rules, 2014; check the current text before deciding.

Who sits on the committee?
At least three directors, with independent directors forming a majority. A majority of the members, including the Chairperson, must be able to read and understand a financial statement (s.177(2)).

Can the committee take outside advice and see company records?
Yes. It has power to obtain professional advice from external sources and full access to the information in the company's records (s.177(6)).

Do the auditors vote at committee meetings?
No. The auditors and key managerial personnel have a right to be heard when the committee considers the auditor's report, but no right to vote (s.177(7)).

What must the company publish?
The committee's composition and any committee recommendation the Board did not accept, with reasons, in the Board's report (s.177(8)). Details of the vigil mechanism go on the company's website, if it has one, and in the Board's report (s.177(10)).

Does every company need a vigil mechanism?
Every listed company does. Others do only if they fall in the class prescribed under s.177(9); see rule 7 of the 2014 Rules and check its current text.

---

Next steps on annual compliance

See what applies to your company, then check it with a free tool.

Run a free compliance check →Compliance Health Check