What Your Auditor Must Check and Report: Section 143 and Fraud Reporting

An audit is not a signature exercise. Section 143 of the Companies Act, 2013 gives the statutory auditor a right of access to your books at all times, lists specific questions the auditor must look into, prescribes what the audit report must state, and requires the auditor to report suspected fraud. Directors who know what the auditor is obliged to do can prepare for it. Directors who obstruct it, or lean on the auditor to stay quiet, create exactly the situation the section penalises.

Legal basis: Companies Act, 2013, s.143(1)-(4) and (11)-(15); rule 13, Companies (Audit and Auditors) Rules, 2014 (as substituted by the Companies (Audit and Auditors) Amendment Rules, 2015, notified 14 December 2015).

---

Access at all times, and six specific inquiries

"Every auditor of a company shall have a right of access at all times to the books of account and vouchers of the company, whether kept at the registered office of the company or at any other place" and is entitled to require from officers "such information and explanation as he may consider necessary for the performance of his duties as auditor" (s.143(1), Companies Act 2013). The place does not matter: head office, factory, or an accounting system hosted elsewhere.

Alongside that access the auditor must "inquire into" six matters (s.143(1)(a)-(f)):

whether loans and advances made on the basis of security have been properly secured, and whether their terms are prejudicial to the company or its members;
whether transactions represented merely by book entries are prejudicial to the company's interests;
where the company is not an investment or banking company, whether shares, debentures and other securities were sold at a price less than the purchase price;
whether loans and advances have been shown as deposits;
whether personal expenses have been charged to revenue account;
where the books say shares were allotted for cash, whether cash was actually received, and if not, whether the position in the account books and balance sheet is "correct, regular and not misleading".

The auditor of a holding company also has a right of access to the records of its subsidiaries and associate companies, so far as it relates to consolidation of the financial statements (proviso to s.143(1)).

What the audit report must say

The report is addressed to the members, not to management. It is made "on the accounts examined by him and on every financial statements which are required by or under this Act to be laid before the company in general meeting", and states whether, to the best of the auditor's information and knowledge, the accounts give "a true and fair view" of the company's affairs at year-end and its profit or loss and cash flow for the year (s.143(2)).

The report "shall also state" the following (s.143(3)):

(a) whether the auditor sought and obtained all information and explanations necessary for the audit, and if not, the details and their effect on the financial statements;
(b) whether proper books of account have been kept, and proper returns received from branches not visited;
(c) how the auditor dealt with any branch auditor's report;
(d) whether the balance sheet and profit and loss account agree with the books and returns;
(e) whether the financial statements comply with the accounting standards;
(f) observations or comments on financial transactions or matters having an adverse effect on the functioning of the company;
(g) whether any director is disqualified from being appointed under s.164(2);
(h) any qualification, reservation or adverse remark on the maintenance of accounts;
(i) whether the company has adequate internal financial controls with reference to financial statements, and whether they operate effectively;
(j) such other matters as may be prescribed.

Where any of these matters is answered in the negative or with a qualification, "the report shall state the reasons therefor" (s.143(4)). The Central Government may also direct, for a class of companies, that the report include a statement on specified matters (s.143(11)). The auditor must comply with the auditing standards (s.143(9)).

Two items deserve board attention. Clause (g) means the auditor, not only the board, checks director disqualification, so the directors' declarations should be current before fieldwork begins. Clause (i) means the auditor reports on internal financial controls, so weak controls surface in a document the members read.

Fraud reporting: the ₹1 crore line

Section 143(12) says that if an auditor, while performing duties, "has reason to believe that an offence of fraud involving such amount or amounts as may be prescribed, is being or has been committed in the company by its officers or employees", the auditor must report the matter to the Central Government in the prescribed time and manner. The trigger is reason to believe, not proof, and it covers frauds that are ongoing as well as completed ones.

The prescribed amount and procedure are in rule 13, Companies (Audit and Auditors) Rules, 2014, as substituted in December 2015:

Fraud involving ₹1 crore or above (individually). Rule 13(1) applies where the fraud "involves or is expected to involve individually an amount of rupees one crore or above". The steps in rule 13(2) are:

the auditor reports to the Board or Audit Committee "immediately but not later than two days of his knowledge of the fraud", seeking their reply or observations within forty-five days;
on receiving the reply, the auditor forwards the report, the reply and his own comments to the Central Government within fifteen days of receipt;
if no reply arrives within the forty-five days, the auditor forwards the report to the Central Government with a note of what was sent to the Board or Audit Committee and that no reply was received;
the report goes to the Secretary, Ministry of Corporate Affairs, in a sealed cover by registered post with acknowledgement due or speed post, followed by an e-mail confirmation, on the auditor's letter-head, signed with seal and membership number, in the form of a statement as specified in Form ADT-4.

Fraud involving less than ₹1 crore. Rule 13(3) requires the auditor to report to the Audit Committee constituted under s.177, or to the Board, "immediately but not later than two days of his knowledge of the fraud", specifying the nature of the fraud with description, the approximate amount involved, and the parties involved.

Disclosure in the Board's report. Under the second proviso to s.143(12), a company whose auditor reported a fraud to the audit committee or Board but not to the Central Government must disclose the details in the Board's report. Rule 13(4) lists what is disclosed for each such fraud during the year: nature of the fraud with description, approximate amount involved, parties involved if remedial action has not been taken, and remedial actions taken.

Protection for reporting, penalty for silence

No duty to which an auditor is subject "shall be regarded as having been contravened by reason of his reporting the matter referred to in sub-section (12) if it is done in good faith" (s.143(13)). A confidentiality clause in the engagement terms or discomfort with management does not stand in the way of a good-faith report.

An auditor, cost accountant or company secretary in practice who does not comply with s.143(12) is liable to a penalty of five lakh rupees for a listed company and one lakh rupees for any other company (s.143(15)).

The duty is not limited to statutory auditors. Section 143 applies, with the necessary changes (mutatis mutandis), to the cost accountant conducting cost audit under s.148 and the company secretary in practice conducting secretarial audit under s.204 (s.143(14)), and rule 13(5) extends the rule 13 procedure to the cost auditor and secretarial auditor in the same way.

Branch audits and non-audit services

Where the company has a branch office, its accounts are audited either by the company's auditor or by another qualified person appointed under s.139, and the branch auditor sends a report to the company's auditor, who deals with it in his own report (s.143(8) and its proviso). Separately, s.144 bars an auditor from providing certain services to the company, including accounting and book-keeping, internal audit, actuarial, investment advisory and management services, other than services approved by the Board or audit committee and outside the prohibited list. Read s.144 in full before engaging your auditor for anything beyond the audit.

What to do now

Next step. Before the audit starts, give the auditor access to everything s.143(1) covers, and confirm director declarations on s.164(2) disqualification are current (s.143(3)(g)). Keep a short note of any suspected fraud and who has been told.
Deadline. If the auditor tells you of a suspected fraud, expect the reporting clock to be tight: rule 13(2)(a) and 13(3) allow the auditor not later than two days from knowledge to report it to the Board or Audit Committee. For frauds of ₹1 crore or above, the Board or Audit Committee reply is sought within forty-five days (rule 13(2)(a)), and the auditor's report to the Central Government follows within fifteen days of the reply (rule 13(2)(b)).
Consequence. An auditor who does not comply with s.143(12) faces a penalty of ₹5 lakh (listed) or ₹1 lakh (other companies) (s.143(15)), and a fraud reported only to the Board or Audit Committee must be disclosed in the Board's report (second proviso to s.143(12); rule 13(4)).

Have a CA review your facts before you act or file.

FAQ

Can the auditor look at records kept somewhere other than the registered office?
Yes. The right of access to books of account and vouchers applies "whether kept at the registered office of the company or at any other place" (s.143(1)).

Which fraud goes to the Central Government and which stays with the Board?
Under rule 13, a fraud involving ₹1 crore or above individually is reported by the auditor to the Central Government after the Board or Audit Committee has had forty-five days to reply. A fraud below that amount is reported to the Audit Committee or Board and disclosed in the Board's report (rule 13(1)-(4)).

How fast must the auditor first raise a suspected fraud?
Immediately, and not later than two days from knowledge, to the Board or Audit Committee (rule 13(2)(a) and 13(3)).

Is the auditor protected for reporting?
Yes, if done in good faith (s.143(13)). Non-compliance with s.143(12) carries a penalty of ₹5 lakh for a listed company or ₹1 lakh for any other company (s.143(15)).

Does this also apply to cost and secretarial auditors?
Yes. Section 143(14) applies the section, with the necessary changes, to cost audit under s.148 and secretarial audit under s.204, and rule 13(5) does the same for the reporting procedure.

---

Next steps on annual compliance

See what applies to your company, then check it with a free tool.

Run a free compliance check →Compliance Health Check