Compliance Management, Audit and Due Diligence · Internal Audit and Performance Audit

Internal Audit under Section 138 of the Companies Act, 2013

Updated 11 October 2026 · Fact-checked

Section 138 requires prescribed classes of companies to appoint an internal auditor to audit their functions and activities. Rule 13 of the Companies (Accounts) Rules, 2014 sets the classes: all listed companies, and unlisted public and private companies that cross the stated size limits. The internal auditor is a chartered accountant, a cost accountant or another professional the Board chooses.

Understand Internal Audit under Companies Act 2013 (Section 138)

An internal audit is a check run from inside the company's own system. It tests whether controls work, whether processes are followed and whether risks are managed. It is different from the statutory audit, which gives an opinion on the financial statements to the members.

Section 138 makes internal audit compulsory for some companies. The Act does not apply it to every company. It applies to the prescribed class of companies, and the Companies (Accounts) Rules, 2014 (Rule 13) say which ones. The tests use the preceding financial year, except that borrowings and deposits are tested at any time during that year.

The Act also says who can be the internal auditor. It must be a chartered accountant or a cost accountant, whether in practice or not, or such other professional as the Board decides. The internal auditor may or may not be an employee of the company. So a company can use its own staff, an outside firm or a professional such as a company secretary, as long as the Board decides so.

The Board appoints the internal auditor. The Audit Committee, or the Board where there is no committee, works with the internal auditor to fix the scope, functioning, periodicity and methodology of the audit. Reports go to the Audit Committee or the Board. Exam answers usually turn on three things: is the company covered, who may be appointed, and who decides what.

Key rules to remember

Section 138(1): who must appoint: Prescribed class of companies → must appoint an internal auditor to conduct internal audit of its functions and activities; The class is set by Rule 13 of the Companies (Accounts) Rules, 2014.
Rule 13: listed companies: Every listed company → internal audit applies; No size test. Listing alone is enough.
Rule 13: unlisted public company (any ONE test): Paid-up share capital ≥ ₹50 crore, or turnover ≥ ₹200 crore, or loans/borrowings from banks or public financial institutions > ₹100 crore, or outstanding deposits ≥ ₹25 crore; Capital and turnover are tested for the preceding financial year. Borrowings and deposits are tested at any time during the preceding financial year. Meeting one test is enough.
Rule 13: private company (any ONE test): Turnover ≥ ₹200 crore, or loans/borrowings from banks or public financial institutions > ₹100 crore; Paid-up capital and deposit tests do not apply to private companies.
Who can be internal auditor: Chartered accountant or cost accountant (in practice or not), or other professional decided by the Board; May or may not be an employee of the company.
Role of Board and Audit Committee: Board appoints; Audit Committee (or Board) in consultation with the internal auditor formulates scope, functioning, periodicity and methodology; Reports are made to the Audit Committee or the Board.

How to solve Internal Audit under Companies Act 2013 (Section 138) questions

Use this order for any case question on Section 138. It follows the exam format: provision, facts, conclusion.

1State the provision: Section 138 requires the prescribed class of companies to appoint an internal auditor, and Rule 13 prescribes the class.
2Classify the company: listed, unlisted public or private. This decides which tests apply.
3Apply the tests to the facts, using the preceding financial year. Remember that any one test is enough, and that borrowings must exceed ₹100 crore, not merely equal it.
4Conclude on applicability in one clear sentence.
5If the question asks who may be appointed, check the person against the Act: chartered accountant, cost accountant or other professional decided by the Board. Also note that employee status does not matter.
6State who acts: the Board appoints, and the Audit Committee or Board with the internal auditor fixes scope, periodicity and methodology.
7Add practical points: Board resolution, engagement letter, periodic reports to the Audit Committee, and follow-up of observations. For the statutory auditor, add that the Act bars them from providing internal audit services to the company.

Quickest way: Three-question check

When to use it: Use this for short applicability questions where numbers are given and time is tight.

Is the company listed? If yes, it is covered. Stop.
If not, is it a public or a private company? Pick the right list of tests. Private companies have only two: turnover and borrowings.
Check each number against its limit and note which test is met. Then write the conclusion with the figure and the limit side by side.

Common mistakes in Internal Audit under Companies Act 2013 (Section 138)

Applying the paid-up capital and deposit tests to a private company.
Students memorise one list of four tests and use it for every unlisted company.
Fix: Keep two lists. Unlisted public: capital, turnover, borrowings, deposits. Private: turnover and borrowings only.
Requiring all the tests to be met together.
Students read the list as a combined condition.
Fix: The tests are alternatives. Meeting any one makes the company covered.
Treating borrowings of exactly ₹100 crore as covered.
Students treat every limit as 'at least'.
Fix: Borrowings must exceed ₹100 crore. Capital of ₹50 crore, turnover of ₹200 crore and deposits of ₹25 crore are 'or more'.
Saying only a chartered accountant can be the internal auditor, or that it cannot be an employee.
Students confuse the internal auditor with the statutory auditor.
Fix: A chartered accountant, a cost accountant or another professional chosen by the Board may act. The person may or may not be an employee.
Naming the statutory auditor as the internal auditor.
Students see both as 'auditors' and assume they can be the same person.
Fix: The Act bars the statutory auditor from providing internal audit services to the company. Appoint a separate person or firm.
Saying the internal auditor fixes the scope alone, or that the Audit Committee appoints.
Students mix up the roles of the Board, Audit Committee and auditor.
Fix: The Board appoints. The Audit Committee (or Board) fixes scope, periodicity and methodology in consultation with the internal auditor.

Worked examples

Example 1

Sundaram Textiles Ltd is an unlisted public company. In the preceding financial year its paid-up share capital was ₹40 crore and its turnover ₹150 crore. It had deposits of ₹10 crore, and outstanding bank borrowings reached ₹120 crore at one time during the year. The Managing Director says internal audit is not needed because capital and turnover are below the limits. Advise.

Show the solution

Provision: Section 138 requires a prescribed class of companies to appoint an internal auditor. Rule 13 of the Companies (Accounts) Rules, 2014 sets the class.
Classification: the company is unlisted public, so four tests apply: paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, borrowings above ₹100 crore, deposits of ₹25 crore or more.
Capital: ₹40 crore is below ₹50 crore, so not met. Turnover: ₹150 crore is below ₹200 crore, so not met. Deposits: ₹10 crore is below ₹25 crore, so not met.
Borrowings: ₹120 crore from banks exceeds ₹100 crore at one time in the preceding year, so the test is met. The tests are alternatives and one is enough.
Conclusion and practical point: the MD is wrong. The Board must appoint an internal auditor, who may be a chartered accountant, a cost accountant or another professional it decides on, and pass a Board resolution.

Answer: Sundaram Textiles Ltd must appoint an internal auditor under Section 138 read with Rule 13, because its bank borrowings exceeded ₹100 crore during the preceding financial year. Failing the other three tests does not matter.

Example 2

Kaveri Engineering Pvt Ltd is an unlisted private company. In the preceding financial year its paid-up capital was ₹60 crore, turnover ₹80 crore, deposits ₹30 crore, and bank borrowings never exceeded ₹90 crore. Is it required to appoint an internal auditor? If it appoints one, can its Finance Manager act?

Show the solution

Provision: Section 138 and Rule 13 apply to the prescribed class of companies.
Classification: the company is private, so only two tests apply: turnover of ₹200 crore or more, and borrowings from banks or public financial institutions above ₹100 crore.
Turnover: ₹80 crore is below ₹200 crore, so not met. Borrowings: ₹90 crore does not exceed ₹100 crore, so not met.
Paid-up capital of ₹60 crore and deposits of ₹30 crore are not tests for a private company, so they are ignored.
Conclusion on applicability: the company is not covered, so it is not required to appoint an internal auditor under Section 138.
On the second part: the Act allows the internal auditor to be an employee. But the person must be a chartered accountant, a cost accountant or another professional the Board decides on. Independence is a real concern, because the Finance Manager would audit their own function. The Board should choose someone independent of the area audited.

Answer: Kaveri Engineering Pvt Ltd is not required to appoint an internal auditor, since neither the turnover test nor the borrowings test is met. If it appoints one voluntarily, an employee may act under the Act, but a Finance Manager auditing their own function is unwise for independence reasons.

Exam tips

Write the company type first. Marks in applicability questions depend on using the correct list of tests.
Show each test with the company's figure beside the limit, then a one-line conclusion. Examiners reward this structure.
Watch the wording: 'exceeding ₹100 crore' for borrowings against 'or more' for the other limits. Check the figures given for traps near the limit.
For roles, write the sequence: the Board appoints, the Audit Committee or Board and the internal auditor fix scope and methodology, and reports go to the Audit Committee or Board.
Where a case involves using internal auditors' work in the statutory audit, link to SA 610 (Revised): the external auditor must not use an internal auditor for direct assistance where there are significant threats to objectivity or the person lacks sufficient competence (paragraph 28).

Practice questions from Internal Audit and Performance Audit

Internal Audit under Companies Act 2013 (Section 138) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit under Companies Act 2013 (Section 138): frequently asked questions

Which companies must appoint an internal auditor under Section 138?

Those in the class prescribed by Rule 13 of the Companies (Accounts) Rules, 2014. That means every listed company, unlisted public companies meeting a capital, turnover, borrowing or deposit limit, and private companies meeting the turnover or borrowing limit. Meeting any one test is enough.

Who can be appointed as the internal auditor of a company?

A chartered accountant or a cost accountant, whether in practice or not, or any other professional the Board decides on. The person may or may not be an employee of the company. The statutory auditor cannot provide internal audit services to the same company.

Is the internal audit period tested on the current or the previous year's figures?

The tests use the preceding financial year. Capital and turnover are taken for that year. Borrowings and deposits are tested at any time during that year, so a single peak is enough.

Who decides the scope of the internal audit?

The Audit Committee, or the Board where there is no Audit Committee, formulates the scope, functioning, periodicity and methodology in consultation with the internal auditor. The Board appoints the internal auditor.

Can a company secretary be the internal auditor?

The Act names chartered accountants and cost accountants and then allows such other professional as the Board decides. A company secretary can therefore be appointed if the Board so decides.