Cost and Management Audit · Operational Audit and Internal Audit under Companies Act, 2013

Internal Audit under Section 138 of the Companies Act, 2013

Updated 11 October 2026 · Fact-checked

Section 138 requires prescribed classes of companies to appoint an internal auditor. The auditor must be a chartered accountant, a cost accountant, or another professional the Board decides. Rule 13 of the Companies (Accounts) Rules, 2014 sets the classes by listing status, capital, turnover, borrowings and deposits. To solve questions, test the company type, then each threshold.

Understand Internal Audit under Section 138 of Companies Act 2013

An internal audit is an independent check of a company's functions and activities, done for the Board and management. It is different from the statutory audit. The statutory auditor reports to members on the financial statements. The internal auditor looks at how the business runs and how well controls work.

Section 138(1) does not make internal audit compulsory for every company. It applies to such class or classes of companies as may be prescribed. The classes are prescribed in Rule 13 of the Companies (Accounts) Rules, 2014. So an exam answer needs both the Act and the Rule.

The Act also says who can be the internal auditor. The person must be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board. The Rule adds that the person may or may not be an employee of the company. A CA or cost accountant may be in practice or not.

Section 138(2) lets the Central Government prescribe, by rules, the manner and intervals of the internal audit and its reporting to the Board. Under Rule 13, the Audit Committee, or the Board where there is no Audit Committee, formulates the scope, functioning, periodicity and methodology of the audit, in consultation with the internal auditor.

The thresholds and compliance periods below are from Rule 13 as generally taught. Check the latest amended text before the exam, because the amounts are tested exactly.

Key rules to remember

Section 138(1): who must appoint: Such class or classes of companies as may be prescribed must appoint an internal auditor; The Act only sets the principle. The classes come from Rule 13.
Who can be appointed (Section 138(1)): Chartered accountant OR cost accountant OR such other professional as the Board decides; The Rule allows the person to be an employee or an outsider. A CA or CMA need not be in practice.
Rule 13: every listed company: Listed company → internal auditor required; No size test applies. Listing alone is enough.
Rule 13: unlisted public company (any one test, preceding financial year): Paid-up share capital ≥ ₹50 crore, OR turnover ≥ ₹200 crore, OR bank/PFI loans and borrowings > ₹100 crore at any time, OR outstanding deposits ≥ ₹25 crore at any time; Meeting any one test is enough. Note ≥ for capital, turnover and deposits, but > for borrowings.
Rule 13: private company (any one test, preceding financial year): Turnover ≥ ₹200 crore, OR bank/PFI loans and borrowings > ₹100 crore at any time; Paid-up capital and deposits tests do not apply to private companies.
Scope and reporting (Section 138(2) and Rule 13): Audit Committee/Board, in consultation with the internal auditor, fixes scope, functioning, periodicity and methodology; report goes to the Board; The Board or Audit Committee decides these, not the management whose functions are audited.

How to solve Internal Audit under Section 138 of Companies Act 2013 questions

Use this order for any question on Section 138, whether it is a case study, a short note or an applicability problem.

1State the principle: Section 138(1) applies only to prescribed classes of companies, and Rule 13 of the Companies (Accounts) Rules, 2014 prescribes them.
2Classify the company: listed, unlisted public or private. This decides which tests apply.
3If it is listed, conclude that an internal auditor is required. Otherwise apply the tests for its type, using figures of the preceding financial year.
4Check each threshold exactly: ≥ or >, and whether the test uses the year-end figure or the figure at any time during the year.
5Check the appointee: a CA, a cost accountant, or another professional decided by the Board. Check the person is not disqualified by the Board's own independence needs.
6State who fixes scope, periodicity and methodology (Audit Committee or Board, in consultation with the internal auditor) and that the report goes to the Board.
7Write a one-line conclusion with the reason, for example 'Covered, because borrowings exceed ₹100 crore'.

Quickest way: Three-box applicability check

When to use it: MCQs and short case scenarios that give a company's type and figures and ask whether Section 138 applies.

Box 1: Listed? If yes, answer 'required' and stop.
Box 2: Unlisted public? Check capital ₹50 crore, turnover ₹200 crore, borrowings above ₹100 crore, deposits ₹25 crore. One hit means required.
Box 3: Private? Check only turnover ₹200 crore and borrowings above ₹100 crore. Ignore capital and deposits.
Watch the 'preceding financial year' wording and the exact boundary, such as borrowings of exactly ₹100 crore.

Common mistakes in Internal Audit under Section 138 of Companies Act 2013

Saying every company must appoint an internal auditor
Students confuse internal audit with the statutory audit, which applies to all companies.
Fix: Remember that Section 138(1) covers only prescribed classes. Always check Rule 13 before answering.
Applying the paid-up capital or deposits test to a private company
The tests for public and private companies are learnt as one list.
Fix: Keep two lists. Private company: turnover and borrowings only. Unlisted public company: capital, turnover, borrowings and deposits.
Treating the borrowing test as 'at least ₹100 crore'
Students assume all tests use ≥.
Fix: Borrowings must exceed ₹100 crore. Borrowings of exactly ₹100 crore do not trigger the test by themselves.
Saying only a chartered accountant can be the internal auditor
Students link audit with CAs.
Fix: Section 138(1) allows a chartered accountant, a cost accountant or another professional decided by the Board. The person may or may not be an employee.
Using current-year figures instead of the preceding financial year
Students skip the time reference in the Rule.
Fix: Use the preceding financial year's figures, and for borrowings and deposits use the position at any point in that year.
Saying the internal auditor decides the scope alone or reports to the CEO only
Students mix up Section 138 with general internal audit practice.
Fix: The Audit Committee or Board formulates scope, periodicity and methodology in consultation with the internal auditor. Reporting is to the Board under Section 138(2) and the Rule.

Worked examples

Example 1

Sundaram Textiles Ltd is an unlisted public company. In the preceding financial year its paid-up share capital was ₹30 crore, turnover ₹150 crore, and deposits outstanding were ₹10 crore. Its borrowings from banks stood at ₹120 crore on 31 December. Is it required to appoint an internal auditor under Section 138?

Show the solution

The company is an unlisted public company, so the four tests for such companies apply. Meeting any one is enough.
Paid-up capital ₹30 crore is below ₹50 crore. Not met.
Turnover ₹150 crore is below ₹200 crore. Not met.
Deposits ₹10 crore are below ₹25 crore. Not met.
Bank borrowings of ₹120 crore at a point in the year exceed ₹100 crore. Met.

Answer: Yes. Sundaram Textiles Ltd is covered under Rule 13 because its borrowings from banks exceeded ₹100 crore at a point in the preceding financial year. It must appoint a chartered accountant, a cost accountant or another professional decided by the Board.

Example 2

Kaveri Components Pvt Ltd is a private company. In the preceding financial year its turnover was ₹180 crore, its paid-up capital was ₹60 crore, its deposits outstanding were ₹30 crore, and its highest borrowing from banks was ₹90 crore. Is internal audit under Section 138 compulsory? Who fixes the scope if it appoints an internal auditor voluntarily?

Show the solution

The company is a private company. Only the turnover test and the borrowings test apply.
Turnover ₹180 crore is below ₹200 crore. Not met.
Highest bank borrowing ₹90 crore does not exceed ₹100 crore. Not met.
Capital of ₹60 crore and deposits of ₹30 crore are irrelevant for a private company, so they cannot create the obligation.
If the Board appoints an internal auditor voluntarily, it can decide the scope and the reporting. If the company were covered, the Audit Committee or Board would do so in consultation with the internal auditor.

Answer: No. Kaveri Components Pvt Ltd is not covered by Section 138 and Rule 13 on these facts, because neither the turnover test nor the borrowings test is met. The paid-up capital and deposits figures do not apply to a private company.

Exam tips

MCQs usually give figures and test the exact boundary. Underline ≥ versus > before choosing an option.
Always name both Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 in written answers. Marks go to both.
For applicability questions, write the company type first, then each test with a tick or cross, then the conclusion.
In case scenarios, check whether the appointee is a CA, a cost accountant or another professional decided by the Board, and note that being an employee is not a bar.
Link the topic to related areas in the same answer: Audit Committee role, internal audit scope and reporting, and internal financial controls under Section 143(3)(i).

Practice questions from Operational Audit and Internal Audit under Companies Act, 2013

Internal Audit under Section 138 of Companies Act 2013 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit under Section 138 of Companies Act 2013: frequently asked questions

Which companies must appoint an internal auditor under Section 138?

Section 138(1) applies to the classes of companies prescribed by rules. Under Rule 13 of the Companies (Accounts) Rules, 2014 these are listed companies, certain unlisted public companies and certain private companies, based on paid-up capital, turnover, borrowings and deposits of the preceding financial year.

Who can be appointed as internal auditor of a company?

Section 138(1) says the internal auditor shall be a chartered accountant or a cost accountant, or such other professional as the Board decides. Under the Rule, the person may or may not be an employee of the company.

Who decides the scope and frequency of the internal audit?

Section 138(2) lets the Central Government prescribe the manner and intervals of the audit and its reporting to the Board. Under Rule 13, the Audit Committee, or the Board if there is no Audit Committee, formulates the scope, functioning, periodicity and methodology in consultation with the internal auditor.

Is the internal auditor the same as the statutory auditor?

No. The statutory auditor reports to members on the financial statements under Section 143. The internal auditor reviews the company's functions and activities and reports to the Board or Audit Committee.