Advanced Auditing, Assurance and Professional Ethics · Internal Audit

Internal Audit under Section 138 of the Companies Act, 2013

Updated 5 October 2026 · Fact-checked

Section 138 requires prescribed companies to appoint an internal auditor. Rule 13 of the Companies (Accounts) Rules, 2014 prescribes them: all listed companies, and unlisted public and private companies crossing set limits on paid-up capital, turnover, borrowings or deposits in the preceding financial year. To solve a question, test each limit, then check eligibility and reporting.

Understand Internal Audit under Section 138 of Companies Act

An internal audit is a check on the company's own functions and activities, done for management. It is different from the statutory audit. The statutory auditor gives an opinion on the financial statements for members. The internal auditor tests processes, controls and risks for the Board.

Section 138 does not make internal audit compulsory for every company. It applies only to a prescribed class of companies. Rule 13 of the Companies (Accounts) Rules, 2014 lists that class. Larger companies and listed companies must have an internal auditor. Small unlisted companies need not.

On who can be appointed: the internal auditor must be a chartered accountant or a cost accountant, whether in practice or not. The Board may also choose such other professional. The internal auditor may or may not be an employee of the company. The Act separately bars the statutory auditor from rendering internal audit services, so the two roles stay apart.

On reporting: the Audit Committee, or the Board where there is no Audit Committee, consults the internal auditor and formulates the scope, functioning, periodicity and methodology of the internal audit. The internal auditor reports on the findings to that body. Exam questions usually give you a company's facts and ask whether Section 138 applies, and then who may be appointed and to whom the auditor reports.

Key rules to remember

Section 138 basic rule: Prescribed class of company → must appoint an internal auditor; The internal auditor audits the functions and activities of the company. The Board appoints.
Listed company: Every listed company → internal audit applies; No size test. Listing alone is enough.
Unlisted public company (any one test): Paid-up capital ≥ ₹50 crore OR turnover ≥ ₹200 crore OR loans/borrowings from banks/public financial institutions > ₹100 crore OR outstanding deposits ≥ ₹25 crore; Use the preceding financial year. For borrowings, the test is any point of time during that year, and the amount must exceed ₹100 crore. The same any-point-of-time test applies to deposits.
Private company (any one test): Turnover ≥ ₹200 crore OR loans/borrowings from banks/public financial institutions > ₹100 crore; Paid-up capital and deposits are not tests for private companies.
Who can be appointed: Chartered accountant OR cost accountant (in practice or not) OR other professional decided by the Board; May or may not be an employee. The statutory auditor cannot be appointed for this service.
Scope and reporting: Audit Committee/Board, in consultation with internal auditor → scope, functioning, periodicity, methodology; The internal auditor reports to the Audit Committee or the Board.

How to solve Internal Audit under Section 138 of Companies Act questions

Use this order for any application question on Section 138 and Rule 13. Write the provision, the facts and the conclusion in that order.

1Identify the type of company: listed, unlisted public, or private. If listed, conclude that internal audit applies and move on.
2Pick the year to test. Use the preceding financial year, not the current one.
3Apply only the tests that fit the company type. Unlisted public: four tests. Private: two tests.
4Check each limit with exact wording: 'or more' for paid-up capital, turnover and deposits, 'exceeding' for borrowings. One test met is enough.
5Conclude clearly: applicable or not applicable, naming the test that decided it.
6If asked who can be appointed, state CA, cost accountant or other professional decided by the Board. Add that an employee or an outsider is allowed, and that the statutory auditor cannot do it.
7If asked about reporting, state that the Audit Committee or the Board formulates the scope, functioning, periodicity and methodology in consultation with the internal auditor, and the internal auditor reports to it.

Quickest way: Three-question screen

When to use it: Use this in a 2-3 mark MCQ or a short case where you must decide applicability fast.

Q1: Is it listed? If yes, applicable. Stop.
Q2: If unlisted public, check four numbers: 50 crore capital, 200 crore turnover, 100 crore borrowings, 25 crore deposits. If private, check only 200 crore turnover and 100 crore borrowings.
Q3: Confirm all numbers belong to the preceding financial year. Any one hit means applicable.

Common mistakes in Internal Audit under Section 138 of Companies Act

Applying paid-up capital and deposit limits to a private company.
Students memorise the unlisted public list and use it for all unlisted companies.
Fix: Remember the private company has only two tests: turnover and borrowings. Write the two lists separately in your notes.
Testing the current year's figures.
The case gives several years of data and students pick the latest.
Fix: The rule looks at the preceding financial year. Identify that year first and ignore the others.
Saying only a chartered accountant can be internal auditor.
Students link all audit roles with chartered accountants.
Fix: State CA or cost accountant, in practice or not, or other professional decided by the Board.
Saying the internal auditor must be an outsider, or must be an employee.
Students assume independence needs an outsider, or that internal means staff.
Fix: The law allows both. The internal auditor may or may not be an employee.
Allowing the statutory auditor to also do the internal audit.
Students think one firm doing both saves cost and is acceptable.
Fix: The Act bars the statutory auditor from internal audit services. Say so in any case on appointment of the same firm.
Ignoring exact wording of limits, such as treating borrowings of exactly ₹100 crore as covered.
Students read all limits as 'or more'.
Fix: Borrowings must exceed ₹100 crore, while the other limits are 'or more'. Check the boundary in numerical cases.

Worked examples

Example 1

Alpha Foods Ltd is an unlisted public company. In the preceding financial year its paid-up share capital was ₹40 crore, turnover ₹180 crore and outstanding deposits ₹10 crore. Its borrowings from banks reached ₹112 crore at one point during that year. The Board says no internal auditor is needed because turnover is below ₹200 crore. Advise.

Show the solution

Provision: Section 138 read with Rule 13 covers an unlisted public company if any one of four tests is met in the preceding financial year.
Test 1: paid-up capital ₹40 crore is below ₹50 crore, so not met.
Test 2: turnover ₹180 crore is below ₹200 crore, so not met.
Test 3: borrowings from banks were ₹112 crore at one point, which exceeds ₹100 crore, so met.
Test 4: deposits ₹10 crore are below ₹25 crore, so not met.
Conclusion: one test is enough, so the Board's view is wrong.

Answer: Section 138 applies to Alpha Foods Ltd because its bank borrowings exceeded ₹100 crore at a point of time during the preceding financial year. It must appoint an internal auditor even though its turnover is below ₹200 crore.

Example 2

Beta Traders Pvt Ltd is an unlisted private company. In the preceding financial year its turnover was ₹150 crore, paid-up capital ₹60 crore, outstanding deposits ₹30 crore, and maximum bank borrowings ₹90 crore. The Board proposes to appoint its statutory auditor as internal auditor in case it is required. Is internal audit compulsory, and is the proposal valid?

Show the solution

Provision: for a private company, Rule 13 uses only two tests: turnover of ₹200 crore or more, or borrowings from banks or public financial institutions exceeding ₹100 crore.
Turnover ₹150 crore is below ₹200 crore, so not met.
Borrowings ₹90 crore do not exceed ₹100 crore, so not met.
Paid-up capital of ₹60 crore and deposits of ₹30 crore are not tests for a private company, so they do not matter.
Conclusion: Section 138 does not apply, so internal audit is not compulsory under it.
On the proposal: the Act bars the statutory auditor from rendering internal audit services, so the proposal is not valid even if the company chooses to have an internal audit voluntarily.

Answer: Internal audit is not compulsory for Beta Traders Pvt Ltd under Section 138, as neither the turnover nor the borrowing test is met. The statutory auditor still cannot be appointed as internal auditor.

Exam tips

In case MCQs, first label the company type, then apply only its tests. Most wrong options come from using the wrong list.
Always find the preceding financial year in the facts before you compare any figure.
Write one line on who can be appointed (CA, cost accountant, other professional decided by the Board, employee or not) in every theory answer. It earns easy marks.
For reporting questions, name the Audit Committee or Board and list the four items: scope, functioning, periodicity and methodology.
Link to the statutory auditor bar and to SA 610 in answers on coordination. It shows you see the whole picture.

Practice questions from Internal Audit

Internal Audit under Section 138 of Companies Act in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit under Section 138 of Companies Act: frequently asked questions

Which companies must appoint an internal auditor under Section 138?

Every listed company must. Unlisted public companies must if they meet any one of the four Rule 13 limits on capital, turnover, borrowings or deposits. Private companies must if turnover is ₹200 crore or more or borrowings exceed ₹100 crore.

Who can be appointed as internal auditor of a company?

A chartered accountant or a cost accountant, whether in practice or not, or any other professional the Board decides. The person may or may not be an employee of the company. The statutory auditor cannot render internal audit services.

Which year's figures are used for the Rule 13 limits?

The preceding financial year. For borrowings and deposits, the test is whether the amount reached the limit at any point of time during that year.

To whom does the internal auditor report?

The Audit Committee, or the Board where there is no Audit Committee, formulates the scope, functioning, periodicity and methodology in consultation with the internal auditor. The internal auditor reports on the audit to that body.