Internal and Forensic Audit · Internal Audit: Introduction and Overview

Legal Framework: Section 138 and Internal Audit Rules

Updated 11 October 2026 · Fact-checked

Section 138 of the Companies Act, 2013 requires prescribed classes of companies to appoint an internal auditor, who may be a chartered accountant, cost accountant or other professional, or an employee. Rule 13 of the Companies (Accounts) Rules, 2014 sets the thresholds. The Audit Committee or Board decides scope, methodology and frequency, and the auditor reports to it.

Understand Legal Framework: Section 138 and Internal Audit Rules

Internal audit is a check carried out inside the company, for the management and the Board, on how well its operations, controls and risk processes work. Section 138 turns this from good practice into a legal duty for certain companies.

The Act does not make it compulsory for every company. It applies to the classes of companies prescribed in the rules. Rule 13 of the Companies (Accounts) Rules, 2014 prescribes them. It covers every listed company, and unlisted public companies and private companies that cross stated limits on paid-up capital, turnover, borrowings or deposits.

The internal auditor can be a chartered accountant or a cost accountant (whether or not in practice), or such other professional as the Board decides. It can also be an employee of the company. The Act does not bar an employee, but the Board must ensure real independence in practice. The statutory auditor of the company cannot do the internal audit, because the two roles must stay separate.

The Audit Committee, or the Board where there is no Audit Committee, consults the internal auditor and fixes the scope, functioning, periodicity and methodology. The internal auditor reports to the Audit Committee or Board. The Act gives the Board the power to appoint, so appointment is a Board decision, normally on the Audit Committee's recommendation.

SEBI LODR adds a layer for listed entities. The Audit Committee must review the adequacy of the internal audit function, its structure, reporting and coverage. The internal auditor may report directly to the Audit Committee. This is why listed companies treat the internal audit function as part of governance, not just finance.

Key rules to remember

Section 138(1) - who must appoint: Prescribed class of company → must appoint an internal auditor (CA, cost accountant, other professional, or employee); The classes are prescribed by Rule 13 of the Companies (Accounts) Rules, 2014.
Rule 13 - classes covered: Every listed company; unlisted public company meeting any prescribed limit; private company meeting any prescribed limit; Limits relate to paid-up share capital, turnover, outstanding loans or borrowings from banks and public financial institutions, and outstanding deposits. Check the exact figures in the official rule text before using them in an answer. The tests are applied to the immediately preceding financial year.
Who can be internal auditor: Chartered accountant | cost accountant | other professional decided by the Board | employee; The statutory auditor of the company cannot be appointed as its internal auditor.
Appointing authority: Board of Directors appoints (on Audit Committee recommendation where one exists); The Audit Committee or Board decides scope, functioning, periodicity and methodology in consultation with the internal auditor.
Reporting line: Internal auditor → Audit Committee / Board; Under SEBI LODR, the Audit Committee reviews adequacy, structure, coverage and frequency of internal audit, and the internal auditor may report directly to it.

How to solve Legal Framework: Section 138 and Internal Audit Rules questions

Section 138 questions are usually fact-based: a company is described and you must say whether it needs an internal auditor and who may be appointed. Use this order.

1Identify the type of company: listed, unlisted public, or private.
2If it is listed, state that the requirement applies without any financial test.
3If it is unlisted public or private, test each prescribed limit (paid-up capital, turnover, borrowings, deposits) using the preceding financial year's figures. Meeting any one limit is enough.
4State the conclusion on applicability in one line, citing Section 138 read with Rule 13.
5Say who can be appointed: CA, cost accountant, other professional or employee. Check the facts for a disqualifying link, such as the statutory auditor being proposed.
6State who appoints and who fixes scope and periodicity, then to whom the auditor reports.
7Add the SEBI LODR point if the company is listed, then close with a clear conclusion.

Quickest way: Three-question check

When to use it: Use when a short case asks 'is internal audit mandatory and who can do it?'

Q1: Is it listed? If yes, mandatory. Stop and move to who.
Q2: If not listed, does it meet any one Rule 13 limit in the preceding year? If yes, mandatory.
Q3: Is the proposed person the statutory auditor? If yes, not allowed. Otherwise a CA, cost accountant, other professional or employee is fine.
Write the reporting line: appointed by Board, scope set by Audit Committee or Board, report to them.

Common mistakes in Legal Framework: Section 138 and Internal Audit Rules

Saying every company must appoint an internal auditor.
Students read Section 138 without Rule 13.
Fix: Always write 'prescribed class of companies' and then list the Rule 13 classes.
Requiring all limits to be met for an unlisted company.
The limits are listed together and look cumulative.
Fix: Meeting any one prescribed limit triggers the requirement. Say so explicitly.
Using current-year figures to test applicability.
Students assume the latest numbers matter.
Fix: Rule 13 tests the immediately preceding financial year. Use that year's audited figures.
Saying an employee can never be internal auditor.
Mixing up with the independence expected of statutory auditors.
Fix: The Act permits an employee. The Board should still ensure objectivity. The statutory auditor is the one who cannot be appointed.
Saying the internal auditor reports to the statutory auditor or shareholders.
Confusing internal audit with external audit.
Fix: The internal auditor reports to the Audit Committee or Board. Shareholders receive the statutory auditor's report.
Quoting exact threshold figures from memory without checking them.
Figures look alike across different rules and get mixed up.
Fix: Learn the figures straight from the official Rule 13 text and quote them only when sure. Otherwise state the type of limit and apply the numbers given in the question.

Worked examples

Example 1

Sundaram Textiles Ltd is a listed company with a small turnover. Its Board proposes to appoint its statutory auditor, Mehra & Associates, to also conduct the internal audit. Advise the Board.

Show the solution

The company is listed, so it falls in a class covered by Rule 13 regardless of its size or turnover.
Section 138 therefore requires it to appoint an internal auditor.
The internal auditor may be a CA, cost accountant, other professional or an employee.
The statutory auditor of the company cannot be appointed as its internal auditor, so the proposal to use Mehra & Associates is not permitted.
The Board should appoint a different CA firm, cost accountant, professional or a suitable employee, preferably on the Audit Committee's recommendation.
As a listed company, the Audit Committee should also review the adequacy and coverage of the internal audit function under SEBI LODR.

Answer: Internal audit is mandatory because the company is listed. The proposal is not allowed, as the statutory auditor cannot act as internal auditor. The Board should appoint another eligible person.

Example 2

Kaveri Foods Pvt Ltd is an unlisted private company. In the preceding financial year it did not meet any of the limits prescribed in Rule 13. The directors ask whether they must appoint an internal auditor and whether they may do so voluntarily.

Show the solution

The company is private and unlisted, so the requirement applies only if it meets a prescribed limit.
Facts say no limit was met in the preceding financial year.
Section 138 read with Rule 13 therefore does not make the appointment compulsory for the present year.
The Act does not stop a company from appointing an internal auditor voluntarily. Doing so strengthens controls and can help the directors with their duty on internal financial controls.
If it appoints one, it can choose a CA, cost accountant, other professional or employee, and the Board or Audit Committee can set scope and reporting, with the auditor reporting to the Board.

Answer: Appointment is not compulsory, since no prescribed limit was met in the preceding year. The company may still appoint one voluntarily, and the same eligibility and reporting rules would sensibly apply.

Exam tips

Open every answer with 'Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014' to anchor the provision.
In case questions, work through listed or unlisted, then limits, then eligibility, then reporting. Examiners award marks for each stage.
Use the preceding financial year for all tests, and say you are doing so.
For listed companies, add one line on the SEBI LODR Audit Committee role. It earns extra marks.
Write exact figures only if you are certain. Otherwise name the limit and apply the numbers in the question.

Practice questions from Internal Audit: Introduction and Overview

Legal Framework: Section 138 and Internal Audit Rules in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Legal Framework: Section 138 and Internal Audit Rules: frequently asked questions

Is internal audit compulsory for every company under Section 138?

No. It applies only to the classes of companies prescribed in Rule 13 of the Companies (Accounts) Rules, 2014. These include every listed company and unlisted public and private companies that meet prescribed limits.

Who can be appointed as internal auditor of a company?

A chartered accountant, a cost accountant, or another professional the Board decides, whether or not in practice. An employee of the company can also be appointed. The statutory auditor cannot be the internal auditor.

Who appoints the internal auditor and who decides the scope?

The Board appoints the internal auditor. The Audit Committee, or the Board if there is no Audit Committee, decides the scope, periodicity and methodology in consultation with the internal auditor.

To whom does the internal auditor report?

The internal auditor reports to the Audit Committee or the Board. In listed entities, the SEBI LODR framework lets the internal auditor report directly to the Audit Committee, which reviews the function.