Compliance Management, Audit and Due Diligence · Concepts of Various Audits

Internal Audit under Section 138 of the Companies Act, 2013

Updated 11 October 2026 · Fact-checked

Internal audit is an independent review of a company's functions, activities and controls, done by an internal auditor. Under Section 138 and Rule 13, listed companies and larger unlisted public and private companies must appoint one. The Board or Audit Committee fixes the scope with the auditor's input. It is continuous and management-focused, unlike the annual statutory audit.

Understand Internal Audit

Internal audit is a check that a company runs on itself. An internal auditor looks at how the business actually operates: whether processes work, whether controls hold, whether laws and policies are followed, and where money or information leaks. The result goes to management so that problems are fixed early.

Think of it as a regular health check during the year. The statutory audit is the annual certificate that the financial statements give a true and fair view. Internal audit is wider. It can cover purchases, inventory, payroll, IT systems, compliance, fraud risk and efficiency, not only the accounts.

Section 138 makes internal audit mandatory for prescribed classes of companies. The internal auditor must be a chartered accountant or a cost accountant (whether in practice or not), or any other professional the Board decides. The internal auditor may be an employee of the company or an outsider. The Board appoints the auditor, usually on the Audit Committee's recommendation where the company has one.

The Audit Committee, or the Board if there is no committee, formulates the scope, functioning, periodicity and methodology of the audit in consultation with the internal auditor. The auditor reports to the Audit Committee or the Board, and not to the department being audited. This keeps the auditor independent of the people whose work is reviewed.

For exam purposes, remember three layers: who must appoint (Rule 13 thresholds), who can be appointed (Section 138), and how the audit is run and how it differs from the statutory audit.

Key rules to remember

Who may be internal auditor (Section 138): Chartered accountant OR cost accountant (in practice or not) OR other professional decided by the Board; The internal auditor can be an employee or an outsider. Say this explicitly in answers.
Listed companies (Rule 13, Companies (Accounts) Rules, 2014): Every listed company must appoint an internal auditor; No size test applies to listed companies.
Unlisted public companies (Rule 13): Any ONE of: paid-up share capital ≥ ₹50 crore; turnover ≥ ₹200 crore; outstanding bank/PFI borrowings > ₹100 crore; outstanding deposits ≥ ₹25 crore; Paid-up capital and turnover are tested for the preceding financial year. Borrowings and deposits are tested at any point during the preceding financial year. Note the symbols: ≥ for capital, turnover and deposits, but > for borrowings.
Private companies (Rule 13): Any ONE of: turnover ≥ ₹200 crore; outstanding bank/PFI borrowings > ₹100 crore; Paid-up capital and deposits are not tests for private companies.
Scope and manner: Audit Committee or Board, in consultation with the internal auditor, formulates scope, functioning, periodicity and methodology; The auditor does not set these alone, and neither does management alone.
Internal audit vs statutory audit: Internal: management's tool, appointed by Board, wide scope, continuous. Statutory: members' protection, appointed by members, opinion on financial statements, annual; Learn this as a comparison on appointment, purpose, scope, reporting and independence.

How to solve Internal Audit questions

Most questions on this topic fall into three types: applicability, appointment and scope, or comparison. This method works for all three.

1Read the question and mark which type it is: applicability of Section 138, qualifications and appointment, or internal vs statutory audit.
2State the provision first: Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014.
3For applicability, identify the company type (listed, unlisted public, private) and test only the thresholds that apply to that type.
4Use the preceding financial year figures, and check the exact symbols: ≥ or >.
5Apply the facts: name the test that is met or not met, and say who can be appointed and who frames the scope.
6For comparison questions, write a point-wise contrast on appointment, objective, scope, reporting, independence and frequency.
7End with a clear conclusion in one line: the company must or need not appoint, or the key difference in a sentence.

Quickest way: Three-test shortcut for applicability

When to use it: Use this when a case gives several figures and asks whether the company must appoint an internal auditor.

Listed? If yes, appointment is required. Stop.
If unlisted public, check the four tests: capital ≥ ₹50 crore, turnover ≥ ₹200 crore, borrowings > ₹100 crore, deposits ≥ ₹25 crore. One is enough.
If private, check only two tests: turnover ≥ ₹200 crore, borrowings > ₹100 crore. One is enough.
Ignore figures that are not a test for that company type, and write one line on why you ignored them.

Common mistakes in Internal Audit

Applying the paid-up capital and deposit tests to private companies.
Students merge the unlisted public and private company lists into one.
Fix: Remember that private companies have only two tests: turnover and borrowings. Learn public companies as four tests and private as two.
Saying the internal auditor must be an employee, or must not be one.
Students confuse it with the statutory auditor, who is always independent of the company.
Fix: Write that the internal auditor may or may not be an employee, and must be a CA, a cost accountant or another professional decided by the Board.
Writing that only a chartered accountant can be internal auditor.
Students assume the audit profession is limited to CAs.
Fix: Include cost accountants and 'such other professional as the Board may decide'. A company secretary can qualify only through this Board-decided route.
Testing turnover or capital on current-year figures.
The question gives many figures and students use the latest ones.
Fix: The tests refer to the preceding financial year. Check the wording in the case before choosing the figure.
Treating internal audit as a substitute for statutory audit.
Both involve checking records, so they look similar.
Fix: State that Section 138 adds to the statutory audit and does not replace it. They differ in appointer, purpose, scope and the recipient of the report.
Saying the internal auditor alone decides the scope of the audit.
Students think independence means total control over scope.
Fix: Write that the Audit Committee or Board formulates scope, functioning, periodicity and methodology in consultation with the internal auditor.

Worked examples

Example 1

Examine whether the following companies must appoint an internal auditor under Section 138 read with Rule 13. (a) Sunrise Foods Ltd, an unlisted public company: paid-up capital ₹30 crore, turnover ₹150 crore, bank borrowings ₹120 crore outstanding during the preceding year, deposits ₹10 crore. (b) Kaveri Traders Pvt Ltd: paid-up capital ₹60 crore, turnover ₹180 crore, bank borrowings ₹90 crore. (c) Mehta Textiles Ltd, a listed company with turnover of ₹40 crore.

Show the solution

Provision: Section 138 requires prescribed classes of companies to appoint an internal auditor, and Rule 13 prescribes the classes.
(a) Sunrise Foods is an unlisted public company. Test capital: ₹30 crore is below ₹50 crore, so not met. Turnover: ₹150 crore is below ₹200 crore, so not met. Deposits: ₹10 crore is below ₹25 crore, so not met. Borrowings: ₹120 crore exceeds ₹100 crore, so met.
One test is enough, so Sunrise Foods must appoint an internal auditor.
(b) Kaveri Traders is a private company, so only turnover and borrowings are tested. Turnover ₹180 crore is below ₹200 crore, and borrowings ₹90 crore are not above ₹100 crore. Neither test is met. The paid-up capital of ₹60 crore is irrelevant for a private company.
(c) Mehta Textiles is listed, and Rule 13 covers every listed company with no size test. Its small turnover does not matter.

Answer: Sunrise Foods Ltd and Mehta Textiles Ltd must appoint an internal auditor. Kaveri Traders Pvt Ltd is not required to, on the given figures.

Example 2

Distinguish between internal audit and statutory audit, and explain who may be appointed as internal auditor of a company under Section 138.

Show the solution

Provision: Section 138 of the Companies Act, 2013 deals with internal audit. Statutory audit is governed by Sections 139 to 148, mainly Sections 139 and 143.
Appointment: the internal auditor is appointed by the Board, and may be an employee or an outsider. The statutory auditor is appointed by the members at the general meeting and must be an independent chartered accountant or firm.
Purpose: internal audit helps management improve controls, efficiency and compliance. Statutory audit gives an independent opinion on whether the financial statements give a true and fair view, for the benefit of members and other users.
Scope: the Audit Committee or Board decides internal audit scope, which can cover operations, compliance, risk and IT. Statutory audit scope is fixed by law and auditing standards and centres on the financial statements and the matters in Section 143.
Reporting: the internal auditor reports to the Audit Committee or the Board. The statutory auditor reports to the members.
Frequency: internal audit is continuous or periodic through the year. Statutory audit is annual.
Eligibility for internal auditor: a chartered accountant, a cost accountant (whether in practice or not), or another professional decided by the Board.

Answer: Internal audit is a management tool, appointed by the Board, wide in scope and ongoing. Statutory audit is a legal requirement for members, appointed by members, focused on the financial statements and annual. Under Section 138 the internal auditor may be a CA, a cost accountant or another professional chosen by the Board, and may or may not be an employee.

Exam tips

Quote both Section 138 and Rule 13 of the Companies (Accounts) Rules, 2014 in applicability answers. It shows you know where the thresholds sit.
Always separate the three company types. A neat three-line layout for listed, unlisted public and private companies earns clear marks.
For comparison questions, use at least five points: appointment, purpose, scope, reporting, frequency. Add independence if you have time.
In a case question, say which test is met, not only the final conclusion. The analysis is where marks are given.
Link internal audit to the Audit Committee and to internal financial controls where relevant. This shows understanding beyond the bare section.

Practice questions from Concepts of Various Audits

Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit: frequently asked questions

Which companies must appoint an internal auditor under Section 138?

Section 138 covers prescribed classes of companies, and Rule 13 of the Companies (Accounts) Rules, 2014 sets them out. These are every listed company, unlisted public companies and private companies that cross the specified turnover, borrowing, capital or deposit limits. Check the limits for each company type separately.

Can a company secretary be an internal auditor?

Section 138 names chartered accountants and cost accountants, and also allows any other professional the Board decides. So a company secretary can be appointed only if the Board decides so. Say this clearly in your answer.

Is the internal auditor an employee of the company?

The internal auditor may or may not be an employee. The law leaves this choice to the company. Many companies use an outside firm for added independence.

What is the main difference between internal audit and external (statutory) audit?

Internal audit serves management and is appointed by the Board, with a scope the company decides. Statutory audit serves members, is appointed by them, and gives an opinion on the financial statements. The two exist side by side and one does not replace the other.