CORAA University · Free tool

Internal audit applicability checker

Must this company appoint an internal auditor under Section 138? Test the Rule 13 limbs — every listed company, the ₹50 crore capital / ₹200 crore turnover / ₹100 crore borrowings / ₹25 crore deposits tests for unlisted public companies, and the two limbs that reach private companies — then see who may be appointed, why your statutory auditor cannot be, and what the Audit Committee has to record.

Explore all tools

Company profile — figures for the preceding financial year

Company category — this decides which limbs of Rule 13(1) can reach the company at all

Paid-up share capital — unlisted public companies only

Turnover

Outstanding loans/borrowings — banks or PFIs, peak during the year

Outstanding deposits — peak during the year — unlisted public companies only

Why this matters in audit

Internal audit and the ICFR opinion run on the same control evidence

CORAA builds the risk-and-control matrix once and reads it twice — as internal audit fieldwork, and as the control-level evidence behind the statutory auditor's Section 143(3)(i) opinion on internal financial controls. Two deliverables, one working file.

Keep going

Put checks like this inside your audit workflow

Run your first audit free Explore all tools

Also testing whether the same company needs a secretarial audit? Run the Section 204 checker next — different thresholds, and a point-in-time test rather than Rule 13’s “at any point during the preceding year”.

How internal audit applicability is determined

Section 138(1) of the Companies Act, 2013 requires such class or classes of companies as may be prescribed to appoint an internal auditor — who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board — to conduct internal audit of the functions and activities of the company. The prescribed classes sit in Rule 13(1) of the Companies (Accounts) Rules, 2014, which was substituted in its present form by the Companies (Accounts) Amendment Rules, 2016 (G.S.R. 742(E), dated 27 July 2016).

Rule 13(1) works in three tiers. Clause (a) covers every listed company outright, with no threshold test at all. Clause (b) covers an unlisted public company on any one of four limbs: paid-up share capital of ₹50 crore or more during the preceding financial year; turnover of ₹200 crore or more during the preceding financial year; outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the preceding financial year; or outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year. Clause (c) covers a private company on only two of those limbs — turnover of ₹200 crore or more, or outstanding bank/PFI borrowings exceeding ₹100 crore. A private company is never pulled in by its paid-up capital or by its deposits, however large.

Two details in the wording decide most borderline cases. First, the capital and turnover limbs are tested "during the preceding financial year", while the borrowings and deposits limbs are tested "at any point of time during the preceding financial year" — a peak test, not a balance-sheet-date test. A company whose bank borrowings touched ₹105 crore in August and were down to ₹60 crore by 31 March is still caught. Second, the borrowings limb reads "exceeding one hundred crore rupees", so exactly ₹100 crore does not trigger it, whereas the capital, turnover and deposits limbs read "or more" and are triggered at exactly the stated figure. Because every limb runs on the preceding financial year, the internal auditor for a year has to be in place on the strength of the year before — this is a forward-looking appointment, not a year-end assessment.

Worked example — a private company caught on the peak borrowings test

A private limited company had turnover of ₹140 crore and paid-up share capital of ₹60 crore in the preceding financial year. Its working-capital and term borrowings from banks peaked at ₹118 crore in the second quarter and closed the year at ₹74 crore.

Inputs

CategoryPrivate limited company

Paid-up share capital₹60 crore (≥ ₹50 Cr — but limb not available to a private company)

Turnover₹140 crore (below ₹200 Cr ✗)

Peak bank/PFI borrowings during the year₹118 crore (exceeds ₹100 Cr ✓)

Balance-sheet-date borrowings₹74 crore (irrelevant — the test is the peak)

Output

Internal audit required?Yes — Rule 13(1)(c)(ii)

Who may be appointedCA, cost accountant, or other professional decided by the Board

Who may notThe company’s own statutory auditor (Sec 144)

Board/Audit Committee actionFormulate scope, functioning, periodicity and methodology — Rule 13(2)

The ₹60 crore paid-up capital never comes into play: the capital limb is at Rule 13(1)(b)(i) and reaches unlisted public companies only. Turnover is below the ₹200 crore line. The company is caught solely because bank borrowings exceeded ₹100 crore at a point during the year — and closing the year at ₹74 crore does not undo that, because the limb is worded "at any point of time during the preceding financial year".

Common mistakes

Testing borrowings on the balance sheet date instead of the peak

The borrowings and deposits limbs are both worded "at any point of time during the preceding financial year". A company that drew down heavily mid-year and repaid before 31 March is still covered. Check the maximum outstanding through the year from the bank sanction and statement records, not the closing figure in the balance sheet.

Applying the paid-up capital or deposits limb to a private company

Rule 13(1)(c) gives a private company exactly two limbs — turnover of ₹200 crore or more, and bank/PFI borrowings exceeding ₹100 crore. The ₹50 crore capital limb and the ₹25 crore deposits limb sit in clause (b) and are worded for unlisted public companies. A private company with ₹300 crore of paid-up capital and ₹90 crore turnover is outside Section 138.

Reading "exceeding ₹100 crore" as "₹100 crore or more"

The borrowings limb alone uses "exceeding". Borrowings of exactly ₹100 crore do not trigger it. The capital (₹50 crore), turnover (₹200 crore) and deposits (₹25 crore) limbs all read "or more" and are triggered at exactly the figure. Getting this backwards changes the answer for companies sitting precisely on a round number.

Appointing the statutory auditor as internal auditor

Section 144 expressly bars the statutory auditor from rendering internal audit services to the company, its holding company or its subsidiary — directly or indirectly, including through the audit firm’s network entities. This is a recurring peer-review and disciplinary finding, and it is not cured by using a different partner of the same firm.

Appointing an internal auditor but never recording the scope

Rule 13(2) requires the Audit Committee — or the Board where there is no Audit Committee — to formulate the scope, functioning, periodicity and methodology of the internal audit in consultation with the internal auditor. An appointment resolution with no scope resolution behind it leaves the company technically non-compliant and leaves the internal auditor with no defensible plan.

Treating internal audit as a substitute for the ICFR opinion

Internal audit under Section 138 and the statutory auditor’s report on internal financial controls under Section 143(3)(i) are separate obligations with separate reporters. Internal audit work can inform and support the ICFR assessment — the same risk-and-control matrix serves both — but it does not discharge the statutory auditor’s duty to form and express its own opinion on the adequacy and operating effectiveness of those controls.

Frequently asked questions

Which companies must appoint an internal auditor under Section 138?+

Every listed company; every unlisted public company with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, during the preceding financial year, or outstanding bank/PFI borrowings exceeding ₹100 crore or outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year; and every private company with turnover of ₹200 crore or more during the preceding financial year, or outstanding bank/PFI borrowings exceeding ₹100 crore at any point of time during that year.

Is internal audit applicable to private limited companies?+

Yes, but on only two limbs. A private company is covered under Rule 13(1)(c) if its turnover in the preceding financial year was ₹200 crore or more, or if its outstanding loans or borrowings from banks or public financial institutions exceeded ₹100 crore at any point of time during that year. Paid-up share capital and outstanding deposits are not tests for a private company.

Who can be appointed as an internal auditor?+

A chartered accountant, a cost accountant, or such other professional as may be decided by the Board — Section 138(1). The requirement that the CA or cost accountant be "in practice" was removed by the Companies (Amendment) Act 2017, and the Explanation to Rule 13(1) states that the internal auditor may or may not be an employee of the company, so an in-house internal audit team is permitted.

Can the statutory auditor also be the internal auditor?+

No. Section 144 prohibits an auditor from rendering internal audit services to the company it audits, or to that company’s holding company or subsidiary, whether directly or indirectly and including through the firm’s network entities. Using a different partner of the same firm does not cure the breach.

Are the Rule 13 thresholds tested on the balance sheet date or during the year?+

It depends on the limb. Paid-up share capital and turnover are tested "during the preceding financial year". Outstanding loans or borrowings and outstanding deposits are tested "at any point of time during the preceding financial year" — a peak test, so a mid-year drawdown that was repaid before the year-end still triggers the rule.

Does borrowing of exactly ₹100 crore trigger internal audit?+

No. The borrowings limb is worded "exceeding one hundred crore rupees", so exactly ₹100 crore falls short of it. By contrast, the capital, turnover and deposits limbs read "or more" and are triggered at exactly ₹50 crore, ₹200 crore and ₹25 crore respectively.

Who decides the scope of the internal audit?+

Rule 13(2) requires the Audit Committee of the company — or the Board of Directors, where the company has no Audit Committee — to formulate the scope, functioning, periodicity and methodology for conducting the internal audit, in consultation with the internal auditor. This should be recorded in the minutes.

How does internal audit relate to the auditor’s report on internal financial controls?+

They are distinct. Section 138 places a duty on the company to have internal audit conducted; Section 143(3)(i) places a duty on the statutory auditor to state whether the company has adequate internal financial controls with reference to financial statements and the operating effectiveness of those controls. Internal audit evidence over the same controls can support the auditor’s assessment, but the statutory auditor must still form and express its own opinion.

What is the penalty for not appointing an internal auditor?+

Section 138 does not carry its own penalty clause, so a default falls under the residual penalty in Section 450 of the Companies Act 2013 for the company and every officer in default. The larger practical consequence is that non-compliance is a reportable governance failure and surfaces in the statutory auditor’s and secretarial auditor’s work.

Authoritative sources

MCA

Companies Act, 2013 — Section 138 — Requires prescribed classes of companies to appoint an internal auditor — a chartered accountant, a cost accountant, or such other professional as the Board decides. The words "in practice" were omitted by the Companies (Amendment) Act 2017.

MCA

Companies (Accounts) Rules, 2014 — Rule 13 — Prescribes the classes of companies covered — substituted in its present form by the Companies (Accounts) Amendment Rules, 2016 (G.S.R. 742(E), 27 July 2016). Rule 13(1) sets the listed / unlisted-public / private tiers and their thresholds; the Explanation confirms the internal auditor may or may not be an employee; Rule 13(2) requires the Audit Committee or Board to formulate scope, functioning, periodicity and methodology.

MCA

Companies Act, 2013 — Section 144 — Bars the statutory auditor from rendering internal audit services to the audited company, its holding company or its subsidiary, directly or indirectly.

ICAI

ICAI — Standards on Internal Audit (SIA) — The methodology framework once internal audit applies — planning, evidence, documentation, review, reporting and follow-up. The 2026 Compendium of Standards on Internal Audit renumbers the earlier series and is applicable from 1 April 2026; verify the current mandatory/recommendatory status on the ICAI site before relying on a specific standard number.

Always confirm against the latest version of the source. Regulations evolve and amendments are common.

Related calculators

Secretarial audit applicability checker →CARO 2020 applicability checker →Small company checker →Company audit ceiling checker →

Share this tool

Last reviewed: 2026-08-20 · For informational purposes only — not professional advice.