A 48-person SaaS company in Bengaluru closed FY 2025-26 with ₹64 crore in revenue. The CFO signed off the statutory audit in September, filed AOC-4 on time, and considered the audit function closed for the year. In January, during a Series B diligence, the investor's counsel asked for the internal audit reports for the last two financial years. There were none — and there was no board resolution appointing an internal auditor either. The company had crossed the Section 138 turnover threshold two years earlier and had never noticed.
This is one of the most commonly missed obligations in the Companies Act 2013, because founders assume "audit" means the statutory audit under Section 139. It does not. Internal audit is a separate, mandatory function for companies above defined thresholds, with its own appointment procedure, its own MCA filing, and its own penalty.
What the law actually requires
Section 138 of the Companies Act 2013 states that "such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company."
The classes are prescribed in Rule 13 of the Companies (Accounts) Rules, 2014. For a private limited company, internal audit is mandatory if, during the preceding financial year, either of the following is true:
- Turnover of ₹200 crore or more, or
- Outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year.
For unlisted public companies, the thresholds are wider and any one triggers the requirement: paid-up share capital of ₹50 crore or more; turnover of ₹200 crore or more; outstanding loans or borrowings from banks or PFIs exceeding ₹100 crore at any point during the preceding financial year; or outstanding deposits of ₹25 crore or more at any point during the preceding financial year.
For every listed company, internal audit is mandatory with no threshold at all.
Three things founders routinely get wrong about these thresholds:
First, "at any point during the preceding financial year" is not a year-end test. A company that drew ₹110 crore on a working capital facility in August and brought it down to ₹40 crore by 31 March has crossed the borrowing threshold. The balance sheet on 31 March will not show it. The sanction letters and bank statements will.
Second, the trigger looks at the preceding financial year, and the obligation applies in the current one. If FY 2025-26 turnover was ₹210 crore, the internal auditor must be appointed for FY 2026-27 — not retrospectively for the year that crossed the line.
Third, borrowings from banks and public financial institutions are counted; venture debt from an NBFC that is not a notified PFI, or a convertible instrument from an investor, is not. Read the lender's classification before you conclude either way.
Rule 13(2) allows the Audit Committee — or the Board, where no Audit Committee exists — to determine the scope, functioning, periodicity and methodology for conducting the internal audit. This is deliberately open. The Act does not prescribe an audit programme; it makes the Board responsible for designing one.
Rule 13(1) proviso clarifies that the internal auditor may be an individual, a partnership firm, or a body corporate, and may or may not be an employee of the company. Critically, the same proviso confirms that a person other than a CA or cost accountant may be appointed — but this is a Board decision that should be minuted with reasons.
One prohibition matters more than the rest: under Section 144(b), the statutory auditor cannot render internal audit services to the same company. Appointing your statutory audit firm to also perform internal audit is a direct violation, and it is one of the first things a diligence team checks.
Practical implications: what happens when this is ignored
The penalty under Section 450. Section 138 has no dedicated penalty clause, so the residual penalty in Section 450 applies: the company and every officer in default are liable to a penalty of ₹10,000, with a further ₹1,000 per day for continuing default, subject to a maximum of ₹2,00,000 for the company and ₹50,000 for an officer in default. Two years of non-appointment reaches the company ceiling comfortably.
The audit report qualification. This is the more expensive consequence. Under Rule 11 of the Companies (Audit and Auditors) Rules, 2014 and Clause 3(xiv) of CARO 2020, the statutory auditor must report whether the company has an internal audit system commensurate with the size and nature of its business, and whether the reports of the internal auditor were considered by the statutory auditor. A company that should have appointed an internal auditor and did not will carry an adverse CARO remark in its filed AOC-4 — a permanent, publicly visible record.
MCA21 v3 consequences. AOC-4 on MCA21 v3 is a structured web form, not a PDF attachment. The CARO annexure fields are captured as discrete data points, which means an adverse Clause 3(xiv) response is machine-readable and sits in the company's risk profile rather than buried in a scanned annexure. Companies with recurring adverse CARO remarks are visible candidates for adjudication proceedings under Section 454.
The diligence and lending consequence. Banks reviewing a working capital renewal, and investors running financial due diligence, both treat a missing internal audit function in a company above the threshold as a governance failure rather than a paperwork gap. It typically results in a condition precedent, not a waiver.
A related deadline worth noting this week. The Companies Compliance Facilitation Scheme (CCFS-2026), notified by MCA General Circular 01/2026 and extended by General Circular 03/2026 dated 8 July 2026, closes on 31 August 2026. It allows companies with pending annual filings to regularise them at 10% of the accumulated additional fees — a 90% waiver under Section 460 read with Section 403. If your AOC-4 or MGT-7A for any prior year is still unfiled, that window closes in three days, and post-deadline the ROC has indicated it will proceed with adjudication notices and strike-off action.
Step-by-step: what to do
- Run the threshold test for the preceding financial year. Pull audited turnover for FY 2025-26 and the maximum outstanding bank/PFI borrowing at any point during that year — not the closing balance. Use sanction letters and monthly statements, not the balance sheet.
- If either threshold is crossed, pass a Board resolution appointing the internal auditor for the current financial year. The resolution must name the auditor, state the term, confirm the auditor is not the statutory auditor, and record the scope and periodicity determined under Rule 13(2).
- File Form MGT-14 within 30 days of the Board resolution. Under Section 179(3) read with Rule 8(4) of the Companies (Meetings of Board and its Powers) Rules, 2014, the appointment of an internal auditor is a Board power exercisable only at a meeting, and the resolution requires MGT-14 filing. Late filing attracts additional fees under Section 403.
- Obtain a written consent and independence confirmation from the internal auditor, confirming no conflict under Section 144 and no relationship that compromises independence.
- Approve a written internal audit plan and calendar. For a 50-person, single-product startup, a workable quarterly cycle is: Q1 — revenue recognition, customer contracts, and receivables ageing; Q2 — procurement, vendor onboarding, and payables including RCM exposure; Q3 — payroll, PF/ESI/TDS reconciliation, and reimbursement controls; Q4 — statutory compliance calendar, IT access controls, and follow-up on prior observations. Each quarter should test a sample, not the whole population, and each report should carry a management response column with an owner and a due date.
- Table every internal audit report before the Board (or Audit Committee) and minute the discussion. An internal audit report that never reaches the Board does not discharge Section 138 — Rule 13(2) makes the Board the owner of the function.
- Hand the internal audit reports to the statutory auditor before the audit begins. CARO Clause 3(xiv)(b) specifically asks whether the statutory auditor considered them. If they were never shared, the answer is no.
- Re-run the threshold test every year. The obligation is not permanent — a company that falls below both thresholds in a subsequent year is not required to continue, though most boards choose to.
FAQ
Our turnover is ₹40 crore. Do we need an internal auditor?
No. A private limited company is only covered if preceding-year turnover is ₹200 crore or more, or bank/PFI borrowings exceeded ₹100 crore at any point in that year. Below both, Section 138 does not apply — though CARO Clause 3(xiv) still requires the statutory auditor to comment on whether your internal control system is commensurate with your size.
Can our statutory auditor also do the internal audit?
No. Section 144(b) expressly prohibits the statutory auditor from rendering internal audit services to the same company. Appoint a different firm.
Can an internal employee be the internal auditor?
Yes. The proviso to Rule 13(1) allows the internal auditor to be an employee, and allows the Board to appoint a professional other than a CA or cost accountant. Record the reasoning in the Board minutes and ensure the person does not report to the function being audited.
What form do we file, and by when?
Form MGT-14 within 30 days of the Board resolution appointing the internal auditor, under Section 179(3) read with Rule 8(4). There is no separate internal-auditor appointment form equivalent to ADT-1.
---
For a compliance audit of your company, visit pvtltd.co
Ready to incorporate or sort your compliance?
Our team handles every filing. You focus on building.