A company covered by Section 138 of the Companies Act, 2013 appoints its internal auditor by a resolution of the Board, and the person appointed can be a chartered accountant, a cost accountant or any other professional the Board decides on, whether an employee or an outside firm. The company's own statutory auditor cannot take the role, and the Audit Committee or the Board must settle the scope, functioning, periodicity and methodology of the audit in consultation with the internal auditor.
September 2026 saw a run of market-news items about listed companies appointing or re-appointing internal auditors for FY 2026-27. If your Board has not yet passed the resolution for the year, this guide covers who must appoint, who can be appointed, what the resolution should say and the order in which to do things.
Start here if you want the working file first:
| Need | Use this |
|---|---|
| The resolution, scope annexure and consent letter in Word | Board resolution for appointment of internal auditor |
| Check whether the company is covered | Internal Audit Applicability Checker |
| Draft the scope of work | Internal Audit SOW Generator |
| The charter that sits behind the appointment | Internal audit charter and mandate |
| The standards the internal auditor works to | Standards on Internal Audit |
Which companies must appoint an internal auditor in 2026
Section 138(1) says that prescribed classes of companies must appoint an internal auditor. The classes are in Rule 13 of the Companies (Accounts) Rules, 2014. A company is covered if it meets any one test for its type, measured on the preceding financial year.
| Type of company | Covered if, in the preceding financial year |
|---|---|
| Listed company | Always. There is no threshold test. |
| Unlisted public company | Paid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the year; or outstanding deposits of ₹25 crore or more at any point of time during the year |
| Private company | Turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the year |
Three details decide most borderline cases.
- A private company is tested on two limbs only. Paid-up capital and deposits are tests for unlisted public companies, not for private companies.
- Borrowings and deposits are peak tests. "At any point of time during the preceding financial year" means the highest balance in the year counts, even if it was repaid before 31 March.
- For FY 2026-27, look at FY 2025-26. The tests run on the preceding financial year, so the figures in the accounts for the year ended 31 March 2026 decide whether an internal auditor is needed for the year now running.
Regulated entities such as banks, NBFCs and market intermediaries carry their own internal audit requirements from their regulators on top of the Companies Act. Do not assume Section 138 is the whole answer for them.
The applicability checker runs these tests and produces a one-page result you can place before the Board.
Who can be appointed as internal auditor
Section 138(1) allows three kinds of appointee:
- a chartered accountant;
- a cost accountant; or
- such other professional as may be decided by the Board.
Rule 13 adds two clarifications in its Explanation. The internal auditor may or may not be an employee of the company. And "Chartered Accountant" means a chartered accountant whether engaged in practice or not. The rule also speaks of "an internal auditor or a firm of internal auditors".
In practice the Board chooses between an outside firm, an employee who is a chartered accountant or cost accountant, an in-house head supported by an outside firm for fieldwork, or another professional whose suitability is recorded in the minutes. Where the appointee is an employee, the reporting line should reach the Audit Committee and not stop at the CFO.
Section 138 has no rule on term, rotation or cooling-off for the internal auditor, unlike the rules for the statutory auditor. Independence is protected through the Audit Committee's oversight and the internal auditor's own professional standards.
Who cannot be appointed: the Section 144 bar
Section 144 lists services a statutory auditor must not provide to the company it audits, and internal audit is on the list. The bar applies whether the service is rendered directly or indirectly, and it extends to the company's holding company and subsidiary companies. "Indirectly" reaches the auditor's partners and network firms.
So the statutory audit firm cannot be the internal auditor, a different partner of the same firm does not solve it, and neither does an affiliate trading under the same name. Before the Board meeting, ask the proposed internal auditor for a written confirmation on this point. The consent letter in our template carries the wording.
What the Audit Committee or Board must settle: Rule 13(2)
Rule 13(2) says that the Audit Committee of the company or the Board shall, in consultation with the internal auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit. This is the part most often skipped. A fee quotation with a one-line scope does not meet it.
| Head | What to record |
|---|---|
| Scope | Entities, locations and processes covered, the period, and what is excluded |
| Functioning | Who the internal auditor reports to, access to records and people, the management contact |
| Periodicity | Monthly, quarterly or half-yearly fieldwork; when reports reach the Audit Committee |
| Methodology | Risk-based plan, testing approach (sample or every transaction), report format, rating scale, follow-up of open actions |
For listed companies, the SEBI Listing Regulations give the Audit Committee a role that reaches the appointment itself: Schedule II, Part C includes reviewing the adequacy of the internal audit function, including its structure, staffing and the seniority of the person heading it, and reviewing the appointment, removal and terms of remuneration of the chief internal auditor. It also says the internal auditor may report directly to the Audit Committee.
The SOW generator produces a scope document under these heads, and the charter and mandate page covers the standing document behind it.
The board resolution
A sound resolution contains:
- The provision and the reason. Section 138 read with Rule 13, and which limb brings the company in.
- The Audit Committee's recommendation, with its meeting date, where the company has one.
- The appointee. Name, professional qualification, firm registration or membership number.
- The period. FY 2026-27, or a longer term if the Board prefers.
- Scope, functioning, periodicity and methodology, approved by reference to an annexure.
- Remuneration, or for an employee, a statement that the terms of employment continue.
- Authority for a named officer to issue the letter, obtain acceptance and complete any filing.
The template gives the certified true copy with variants for a firm and for an employee, the annexure, and the consent and acceptance letter.
Meeting or circulation?
The Companies (Meetings of Board and its Powers) Rules, 2014 list, at Rule 8, powers that the Board exercises only by resolution passed at a meeting, in addition to those in Section 179(3). On the rule text as we read it on a bare-act mirror on 1 October 2026, the list includes "to appoint internal auditors and secretarial auditor". Pass the resolution at a Board meeting.
Does it need Form MGT-14?
The reference material we rely on for internal audit law does not settle this, so treat what follows as the commonly applied reasoning and confirm it with your company secretary. Resolutions passed under Section 179(3) are filed with the Registrar in Form MGT-14 within thirty days, and private companies are exempt from that filing clause. Since the appointment of internal auditors is listed in Rule 8 as Board-meeting business, company secretaries commonly file MGT-14 for a public company and not for a private company. There is no separate appointment form for an internal auditor comparable to the one used for a statutory auditor.
What a listed company discloses
Two things are clear from the material we rely on. A listed company must always have an internal auditor, and its Audit Committee reviews the function and the terms of the chief internal auditor under Schedule II, Part C of the Listing Regulations.
On stock exchange intimation, we have not read the regulation text for this guide, so we will not cite a regulation number. What we can say is that through late August and September 2026 the market-news site ScanX carried a steady series of headlines about listed companies appointing or re-appointing internal auditors for FY 2026-27, some for one year and some for longer terms. We saw the headlines, not the filings. A listed company should ask its company secretary which disclosure the Listing Regulations require for the appointment, what details it must carry and within what time, and build that into the authority clause of the resolution.
Steps and timing
Rule 13 does not state a date in the year by which the appointment must be made. The rule text we read carries a proviso giving existing companies six months from the commencement of the section to comply; that was a one-time transition when the law began in 2014, and it should not be read as a standing grace period for a company that newly crosses a threshold. Because the tests run on the preceding year, a covered company should have its internal auditor in place early in the financial year, so that the whole year is covered.
| Step | What happens | Sensible timing |
|---|---|---|
| 1 | Test applicability on the audited figures of the preceding year | As soon as the accounts are final |
| 2 | Shortlist; obtain profile, proposed scope and fee | Before the first Audit Committee meeting of the year |
| 3 | Obtain written consent and the Section 144 confirmation | Before the Board meeting |
| 4 | Audit Committee considers and recommends; formulates scope, functioning, periodicity and methodology with the proposed auditor | First quarter |
| 5 | Board passes the resolution at a meeting | Same day or the next Board meeting |
| 6 | Issue appointment letter; receive signed acceptance | Within a few days |
| 7 | Complete any Registrar filing and, for a listed company, the exchange intimation | Within the time your company secretary confirms |
| 8 | Internal auditor presents the annual plan to the Audit Committee | Before fieldwork begins |
| 9 | Tell the statutory auditor who has been appointed | With the plan |
Step 9 is a courtesy with a purpose. The statutory auditor reports under CARO 2020 on whether the company has an internal audit system commensurate with its size and business, and on whether the internal auditor's reports for the period were considered.
Worked example
The figures are illustrative.
A private company (unnamed, for illustration) had turnover of ₹164 crore in FY 2025-26 and paid-up capital of ₹55 crore. Its bank borrowings stood at ₹82 crore on 31 March 2026 but had reached ₹109 crore in October 2025.
| Test | Figure | Result |
|---|---|---|
| Turnover ₹200 crore or more | ₹164 crore | Not met |
| Bank or PFI borrowings exceeding ₹100 crore at any point | Peak ₹109 crore | Met |
| Paid-up capital ₹50 crore or more | ₹55 crore | Not a test for a private company |
The company is covered for FY 2026-27 on the borrowings limb. It has no Audit Committee, so the Board itself formulates the scope with the proposed internal auditor. The statutory auditors' affiliate offers to do the work; the Board declines because of Section 144 and appoints an unconnected firm of chartered accountants, quarterly reporting, with the scope annexed to the resolution. The company secretary confirms the filing position for a private company before closing the file.
After the appointment
The quality of the year then depends on the plan and on how findings are closed. Some companies pair the periodic audit with checks that run across every transaction each month; CORAA's internal audit product is one way to do that.
Internal auditor appointment FAQ
Who can be appointed as internal auditor under Section 138?
A chartered accountant, a cost accountant, or such other professional as the Board may decide. The person may be an employee or an outsider, and a chartered accountant need not be in practice.
Is a board resolution required for appointment of internal auditor for FY 2026-27?
Yes. The appointment is made by the Board, and on the rule text we read, the appointment of internal auditors is business to be passed at a Board meeting. Where there is an Audit Committee, its recommendation should come first.
Can the statutory auditor be the internal auditor of the same company?
No. Section 144 bars the statutory auditor from rendering internal audit services, directly or indirectly, to the company or to its holding or subsidiary company.
Is internal audit applicable to a private limited company?
Yes, if in the preceding financial year its turnover was ₹200 crore or more, or its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point of time. Paid-up capital and deposits are not tests for a private company.
Is Form MGT-14 required for appointment of internal auditor?
Confirm with your company secretary. The common reasoning is that a public company files MGT-14 because the appointment is Board-meeting business, and a private company is exempt from that filing clause.
Who decides the scope of internal audit?
The Audit Committee or the Board, in consultation with the internal auditor, under Rule 13(2). They formulate the scope, functioning, periodicity and methodology.
Related CORAA resources
- Board resolution for appointment of internal auditor (Word)
- Internal Audit Applicability Checker
- Internal Audit SOW Generator
- Internal audit charter and mandate
- Standards on Internal Audit
- Audit committee questions to ask internal audit
- Internal audit for newly listed companies: India and the NYSE proposal
Sources
- Companies Act, 2013 and related rules, Ministry of Corporate Affairs
- Rule 13, Companies (Accounts) Rules, 2014, text read on 1 October 2026 at https://ca2013.com/rule-13-companies-accounts-rules2014/
- Rule 8, Companies (Meetings of Board and its Powers) Rules, 2014, text read on 1 October 2026 at https://ca2013.com/rule-8-companies-meetings-of-board-and-its-powers-rules2014/
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit
- Google News listing of ScanX (scanx.trade) headlines on internal auditor appointments, late August to September 2026, viewed 1 October 2026 (headlines only)