Internal audit is mandatory under Section 138 of the Companies Act, 2013 only for the classes of company listed in Rule 13 of the Companies (Accounts) Rules, 2014. Every listed company is covered. Unlisted public companies and private companies are covered only if they cross specified size tests in the preceding financial year. Many companies that are not covered still choose to have it.
Last reviewed: 17 October 2026. Facts checked. We could not open the Act or the rules on India Code (blocked, 403). The thresholds below come from a taxguru.in article quoting Rule 13 and a web search summarising several secondary sources. The rule text on ca2013.com, which we also opened, lists the same tests, with no deposits limb for private companies. For borrowings, the text quoted in secondary sources reads "exceeding one hundred crore rupees or more", which is ambiguous at exactly ₹100 crore. We flag it. Check the rule text on the MCA or India Code site before you decide for a real company. All company facts in the cases are invented.
For the appointment steps and board resolution, see our post on appointing an internal auditor. This post is only about whether the requirement applies.
The tests, as the sources we read state them
| Type | Covered if, in the preceding financial year |
|---|---|
| Listed company | Always |
| Unlisted public company | Paid-up share capital ₹50 crore or more; or turnover ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more at any time in the year; or outstanding deposits of ₹25 crore or more at any time in the year |
| Private company | Turnover ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more at any time in the year |
Points to hold on to:
- Any one test is enough. The tests are alternatives.
- Preceding financial year. Look at last year's numbers, not this year's.
- Borrowings at any time. The test looks at the outstanding amount at any point in the year, not only on the balance sheet date.
- Boundary wording. The borrowings limb is quoted as "exceeding one hundred crore rupees or more", which does not settle a company at exactly ₹100 crore. Take advice for that case.
- Deposit test. The deposits limb (₹25 crore or more) is for unlisted public companies only. The rule text has no such limb for private companies.
Case 1: the listed company
Facts (invented): Northgate Foods Ltd is listed. Turnover is ₹80 crore and borrowings are small.
Answer: Covered. Listing alone triggers it. Size does not matter.
Case 2: the large private company, close on turnover
Facts: Harbour Textiles Pvt Ltd had turnover of ₹212 crore last year and no bank borrowings.
Answer: Covered on turnover. It applies to the current year because the test looks at the preceding year. The company should appoint an internal auditor for the current year.
Case 3: the private company that borrowed in the middle of the year
Facts: Silverline Components Pvt Ltd had turnover of ₹90 crore. Its outstanding bank loans were ₹60 crore at year end, but peaked at ₹120 crore in December before being partly repaid.
Answer: Covered, on the reading that the test looks at any time during the year. The year-end balance alone would have missed it. Check the company's loan statements for the peak, not only the balance sheet.
Case 4: the unlisted public company with large capital but small sales
Facts: Summit Holdings Ltd is an unlisted public company with paid-up share capital of ₹55 crore, turnover of ₹20 crore and no borrowings.
Answer: Covered on paid-up capital. The capital test applies to unlisted public companies but not to private companies. If Summit were private, with the same numbers, it would not be covered on this basis.
Case 5: the borderline company
Facts: Greenfield Pharma Pvt Ltd had turnover of ₹185 crore and borrowings that touched exactly ₹100 crore for one week.
Answer: Not clearly covered. Turnover is below ₹200 crore. The borrowings limb is worded "exceeding one hundred crore rupees or more", so exactly ₹100 crore is unclear. Check the rule text, and meanwhile take a cautious route: appoint an internal auditor, or record the legal reading you relied on.
Four quick checks if your company is near a line
- Confirm the legal form: listed, unlisted public or private.
- Use audited numbers for the preceding year, not management estimates.
- Look up the highest outstanding loan or deposit balance during the year.
- Check for group structures. Our sources do not say how group or holding company numbers are treated, so confirm the test is applied company by company on its own financials.
If it is not mandatory
A company outside the classes does not have to appoint an internal auditor under section 138, but may do so voluntarily. Lenders, investors or a parent company often ask for it, and the board may want an independent look at controls. Other rules can also point to internal audit, such as sector regulation. Our guide to what internal audit is and who needs it covers those reasons.
What covered companies must do next
Section 138 requires the appointment, and the Audit Committee or Board must settle scope, functioning, periodicity and methodology in consultation with the internal auditor. The appointed person may be a chartered accountant, a cost accountant or another professional the board decides on. The statutory auditor cannot be appointed. For the order of steps and the resolution, use the appointment guide. For the shape of the work in year one, see types of internal audit.
Frequently asked questions
Is internal audit mandatory for a private company?
Only if it meets a size test in Rule 13: turnover of ₹200 crore or more, or the borrowings test. Check the rule text for boundary wording.
Is internal audit mandatory for every listed company?
Yes, according to the sources we read. Every listed company is covered.
Which year's numbers do I use?
The preceding financial year.
What if I miss one year?
We did not open the penalty provisions for this post. Take advice and check section 138 and the applicable penalty provisions.
Does a small company need an internal auditor?
Not under section 138 unless it falls in a covered class. It can still appoint one.
Last reviewed: 17 October 2026. Facts checked. Opened: Rule 13 on ca2013.com; taxguru.in article quoting Rule 13; web search results from several secondary sources; our own site posts. Could not open: the Act, Rule 13 and the penalty provisions on India Code or the MCA site.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error