Corporate Accounting and Auditing · Audit Report and Reporting under CARO

Reporting on Internal Financial Controls and CARO 2020 vs CARO 2016

Updated 10 October 2026 · Fact-checked

Under Section 143(3)(i), the auditor reports whether the company has adequate internal financial controls over financial reporting and whether they operate effectively. This is given in a separate annexure to the audit report. CARO 2020 replaced CARO 2016 under Section 143(11), with a wider set of reporting clauses, including new ones such as clause 3(xxi) for group companies.

Understand Reporting on Internal Financial Controls and Key Differences from CARO 2016

An audit report has two parts. The first part gives the opinion on the financial statements under the Standards on Auditing. The second part is the Report on Other Legal and Regulatory Requirements. SA 700 (Revised) recognises this: the auditor may have additional responsibilities that are supplementary to those under the SAs.

One such duty comes from Section 143(3). In the SA 700 illustration, clause (g) says that for the adequacy of the internal financial controls over financial reporting of the company and the operating effectiveness of such controls, you refer to a separate report in "Annexure A". So the IFC report is not buried in the main opinion. It sits in its own annexure, and the main report points to it. The Section 143(3) reference is clause (i) in the law; the SA 700 illustration shows it as an item in the list.

The auditor looks at two things: whether controls are adequate (properly designed and in place) and whether they operate effectively (work in practice). Both parts of the opinion on IFC matter.

CARO is a different report. The Companies (Auditor's Report) Order, 2020 was made by the Ministry of Corporate Affairs under sub-section (11) of section 143 of the Companies Act, 2013 (Order S.O. 849(E), 25 February 2020). It superseded CARO 2016. It is a statement on specified matters, given as an Annexure, to the extent applicable. The SA 700 illustration still shows the older wording, "As required by the Companies (Auditor's Report) Order, 2016". In current reports, the reference is to the 2020 Order.

CARO 2020 has more reporting clauses than CARO 2016. One clearly new clause is 3(xxi). It asks whether there have been any qualifications or adverse remarks by the respective auditors in the CARO reports of companies included in the consolidated financial statements. If yes, the auditor gives the company details and the paragraph numbers of the CARO report with the qualifications or adverse remarks. Study the other new clauses from the Order's full text in your study material.

Key rules to remember

Source of CARO: CARO 2020 = Order made under Section 143(11) of the Companies Act, 2013 (S.O. 849(E), 25 February 2020); It supersedes CARO 2016, except for things done or omitted before supersession.
IFC reporting location: Main report, Section 143(3) matters: IFC clause refers to separate "Annexure A"; The SA 700 illustration places this under the Report on Other Legal and Regulatory Requirements.
What the IFC report covers: IFC report = adequacy of IFC over financial reporting + operating effectiveness of such controls; Both limbs must be addressed.
CARO clause 3(xxi): Consolidated FS: report whether any qualifications or adverse remarks exist in the CARO reports of included companies; if yes, give company names and paragraph numbers; Reported by the auditor of the consolidated financial statements.
Where CARO appears: CARO statement = Annexure to the audit report, on matters in the Order, to the extent applicable; Do not mix it with the IFC Annexure A.

How to solve Reporting on Internal Financial Controls and Key Differences from CARO 2016 questions

Use this method for any question on IFC reporting or CARO 2020 versus CARO 2016.

1Read the question and decide whether it is about the IFC report, CARO, or both.
2If it is IFC, state the legal source: Section 143(3) requires reporting on adequacy of IFC over financial reporting and their operating effectiveness.
3State the location: a separate annexure, referred to in the main report under Other Legal and Regulatory Requirements.
4If it is CARO, state that it is an Order under Section 143(11), CARO 2020 superseded CARO 2016, and it is reported in an Annexure to the extent applicable.
5For differences, list the clear change first, such as clause 3(xxi) on qualifications in CARO reports of group companies, then add other changes from your study material.
6Check the type of entity: consolidated financial statements bring in clause 3(xxi).
7Close with a one-line conclusion tying the point to the auditor's duty.

Quickest way: Two-box method: IFC box and CARO box

When to use it: Use it for short theory answers and MCQs where the two reports may be confused.

Draw two boxes. IFC box: Section 143(3), adequacy plus operating effectiveness, separate Annexure A.
CARO box: Section 143(11), Order of the Central Government, Annexure on specified matters, CARO 2020 replaced CARO 2016.
Place each option or point in one box only.
For new clauses, remember clause 3(xxi) as the group CARO qualification clause.
Write the answer in the order: source, content, location.

Common mistakes in Reporting on Internal Financial Controls and Key Differences from CARO 2016

Treating the IFC report and the CARO report as the same annexure.
Both are annexures to the audit report and both are statutory.
Fix: Remember they have different sources. IFC comes from Section 143(3). CARO comes from the Order under Section 143(11). They are separate annexures.
Reporting only on adequacy of IFC and ignoring operating effectiveness.
Students think a design review is enough.
Fix: Always say both: adequacy of IFC over financial reporting and operating effectiveness of such controls.
Writing CARO 2016 as the current Order.
Older illustrations still use the 2016 wording.
Fix: CARO 2020 superseded CARO 2016. Use CARO 2020 in current answers.
Saying CARO 2020 is made under the Income-tax or SEBI law.
Confusion between regulators.
Fix: State that it is made by the Central Government under sub-section (11) of section 143 of the Companies Act, 2013, after consulting NFRA.
Applying clause 3(xxi) to standalone statements.
Students remember the clause but not its condition.
Fix: It concerns consolidated financial statements and the CARO reports of included companies.

Worked examples

Example 1

State where and how the auditor reports on internal financial controls over financial reporting, and what the report covers.

Show the solution

Source: the duty arises under Section 143(3) of the Companies Act, 2013, as part of other legal and regulatory reporting.
Location: the main audit report has a clause saying that for adequacy of IFC over financial reporting and operating effectiveness of such controls, see the separate report in Annexure A.
Content: the auditor reports on the adequacy of the company's IFC over financial reporting and on whether such controls operate effectively.
Conclusion: the IFC report is separate from the CARO annexure.

Answer: The auditor reports under Section 143(3) in a separate Annexure A, covering both adequacy of IFC over financial reporting and their operating effectiveness. The main report only cross-refers to it.

Example 2

The auditor of a holding company is reporting under CARO 2020. Explain the new reporting under clause 3(xxi) and how CARO 2020 relates to CARO 2016.

Show the solution

Relation: CARO 2020 was issued under sub-section (11) of section 143 and supersedes CARO 2016, except for things done or omitted before supersession.
Clause 3(xxi) applies to consolidated financial statements.
The auditor reports whether there were any qualifications or adverse remarks by the respective auditors in the CARO reports of the companies included.
If yes, the auditor gives the details of those companies and the paragraph numbers of the CARO report containing them.

Answer: CARO 2020 replaced CARO 2016. Under clause 3(xxi), the auditor of consolidated financial statements states whether any included company's CARO report has qualifications or adverse remarks, and if so gives the company details and paragraph numbers.

Exam tips

Write the section number with the report: Section 143(3) for IFC and Section 143(11) for CARO.
In theory answers, mention both adequacy and operating effectiveness for IFC.
For differences, state the clause number when you remember it. Clause 3(xxi) is a safe example.
In MCQs, watch for options that swap the IFC annexure with CARO.
Keep answers in a short structure: source, content, location.

Practice questions from Audit Report and Reporting under CARO

Reporting on Internal Financial Controls and Key Differences from CARO 2016 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Reporting on Internal Financial Controls and Key Differences from CARO 2016: frequently asked questions

Where does the auditor report on internal financial controls?

In a separate annexure, called Annexure A in the SA 700 illustration. The main report refers to it under Other Legal and Regulatory Requirements. The report covers adequacy and operating effectiveness of IFC over financial reporting.

Which law gives the CARO power?

CARO 2020 is made by the Central Government under sub-section (11) of section 143 of the Companies Act, 2013. It was made after consulting NFRA.

Did CARO 2020 replace CARO 2016?

Yes. The Order says it supersedes CARO 2016, except for things done or omitted before supersession.

What is clause 3(xxi) of CARO 2020?

It applies to consolidated financial statements. The auditor reports whether any qualifications or adverse remarks exist in the CARO reports of included companies. If yes, details of the companies and paragraph numbers are given.