Internal audit is an independent, ongoing check of a business's processes, controls and risks, carried out for the board and management rather than for the shareholders at large. It looks at how the business actually runs during the year, not only at whether the year-end accounts are fairly stated. Under section 138 of the Companies Act, 2013, certain companies must have one.
Facts checked: 9 October 2026. The thresholds below are taken from Rule 13 of the Companies (Accounts) Rules, 2014, as compiled in sources dated October 2025. Check the current text on the MCA website before you advise a client, in case of a later amendment.
Meaning, objective and scope
The objective is to give the board and the audit committee comfort that risks are identified, controls work and management's numbers can be relied on. Scope is decided by the board with the audit committee, and usually covers areas such as purchase to payment, sales to collection, payroll, inventory, fixed assets, IT controls, statutory compliance and fraud risk. Scope can be widened to operations, not just finance. For a deeper reading list, see the internal audit resource hub and the internal audit FAQ.
Who must have an internal audit
| Type of company | Trigger (preceding financial year) |
|---|---|
| Listed company | Always required |
| Unlisted public company | Paid-up capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding borrowings from banks or public financial institutions above ₹100 crore at any time, or outstanding deposits of ₹25 crore or more |
| Private company | Turnover of ₹200 crore or more, or outstanding borrowings from banks or public financial institutions above ₹100 crore at any time |
Any one limit is enough. The rule text for the borrowing limit has been read by commentators as "₹100 crore or more" in some places and "exceeding ₹100 crore" in others, so a client sitting exactly on the line needs a closer look. Use the internal audit applicability checker for a first pass. Sector regulators such as the RBI and SEBI can also require internal audit regardless of these limits.
Who can be the internal auditor
Section 138 allows a chartered accountant or cost accountant (whether or not in practice), or any other professional the board considers suitable. The person may or may not be an employee. The one firm bar is section 144: the statutory auditor cannot also provide internal audit services to the company.
The internal audit process
- Risk assessment. Understand the business, map key risks and decide where audit effort should go.
- Plan. Agree scope, frequency, locations and timelines with the audit committee.
- Fieldwork. Walk through processes, test transactions on a sample or full-population basis, and collect evidence.
- Reporting. Issue observations with risk rating, root cause, recommendation and management response. See the report format guide and the internal audit report template.
- Follow-up. Track action taken until each observation is closed or formally accepted as a risk.
ICAI's Standards on Internal Audit (SIA) set the expected approach for members performing the work. Our methodology map shows how the steps fit together, and the audit committee question list shows what boards usually ask.
Internal audit versus statutory audit
| Point | Internal audit | Statutory audit |
|---|---|---|
| Purpose | Improve controls and manage risk | Opine on whether financial statements give a true and fair view |
| Reports to | Board and audit committee | Shareholders |
| Appointed by | Board | Shareholders (members) |
| Scope | Set by the board | Fixed by law and auditing standards |
| Timing | Through the year | After year end |
The full comparison is in internal audit vs statutory audit vs tax audit. The statutory side is covered in what is statutory audit, and all the audit types are listed in types of audit in India.
A worked scenario
A private limited manufacturer had turnover of ₹140 crore and a peak bank borrowing of ₹112 crore in the last financial year. Turnover is below ₹200 crore, but borrowings went above ₹100 crore at one point, so the borrowing limit is met and an internal auditor is needed for the current year. The board appoints a CA firm that is not the company's statutory auditor, agrees a quarterly plan with the audit committee or board, and asks for reports within a fixed time after each cycle.
Frequently asked questions
Is internal audit mandatory for every company?
No. It is mandatory for listed companies and for unlisted public and private companies that cross the limits above. Smaller companies may still choose to have one.
Can the statutory auditor do the internal audit?
No. Section 144 bars the statutory auditor from providing internal audit services to the company.
Is internal audit the same as a concurrent audit?
No. Concurrent audit is a transaction-level check done close to the event, often for banks. Internal audit is wider and risk based.
Do the limits use current year or last year figures?
The rule refers to the preceding financial year.
If you are comparing audit types for a client, start with forensic audit as the next read.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error