Imagine this: Your company is crushing it. Sales are up, you’re expanding, and the future looks bright. Then, a notice arrives. It’s from the Registrar of Companies. Suddenly, you’re scrambling, facing potential penalties and a fire drill of compliance you never saw coming. Why? You crossed a financial threshold you weren’t even tracking, and a mandatory internal audit was triggered months ago.
This isn’t a scare tactic. I’ve seen this exact scenario play out with fast-growing businesses. They’re so focused on growth they miss the guardrails. The question of internal audit applicability isn’t just boring legal jargon—it’s a critical checkpoint for every ambitious company in India.
Forget the idea of audit as a punishment. In this article, we’ll reframe it as a strategic asset. You’ll learn the exact, up-to-date 2026 rules under the Companies Act, 2013. More importantly, you’ll discover how to use an audit function—whether mandatory or not—to build a stronger, more resilient, and more valuable business. Let’s get into it.
What Is Internal Audit, Really? (Hint: It’s Not Just About Catching Crooks)
First, let’s clear up a common misconception. An internal audit is not the same as the statutory (external) audit your company does every year. Think of it like this: a statutory auditor is like a home inspector checking the foundation before a sale. They’re focused on one thing: are the financial statements accurate for outsiders (investors, banks)?
An internal auditor, on the other hand, is like a master engineer living in the house. They’re constantly checking the plumbing, the electrical, the security systems, and the workflow of the household. Their job is to help the homeowners—the board and management—run the house better, safer, and more efficiently.
In technical terms, an internal audit is an independent, objective assurance and consulting activity. Its goals are much broader than just finance:
- Risk Radar: Are there hidden operational, financial, or reputational risks that could sink the ship?
- Process Optimizer: Where are the bottlenecks in your operations? How can you do more with less?
- Control Check: Are the systems you have in place to prevent errors and fraud actually working?
- Compliance Guardian: Are you following all the relevant laws, regulations, and internal policies?
In our experience, companies that embrace this broader view of internal audit don’t just survive; they thrive. They make smarter decisions, waste less money, and sleep better at night.
The Rules of the Game: Internal Audit Applicability in 2026
Okay, let’s get down to the brass tacks. In India, Section 138 of the Companies Act, 2013, along with Rule 13 of the Companies (Accounts) Rules, 2014, lays down the law. An internal audit is mandatory if your company falls into one of the following categories. The key is that these thresholds are based on your company’s financials from the preceding financial year.
⚠️ Watch Out
The “preceding financial year” clause is a common tripwire. You don’t wait until you cross a threshold to act. If your 2025-26 financials cross a limit, the requirement applies for the 2026-27 financial year. You need to be proactive, not reactive.
Here’s a clear breakdown of the criteria:
| Company Type | Mandatory Internal Audit Trigger |
|---|---|
| Every Listed Company | Always mandatory. No exceptions. If your shares are on a stock exchange, you must have an internal audit. Period. |
| Unlisted Public Company | Applicable if ANY ONE of these thresholds was met in the preceding financial year:
|
| Private Company | Applicable if ANY ONE of these (higher) thresholds was met in the preceding financial year:
(Note: Share capital and deposit thresholds do not apply to private companies.) |
🎯 Key Takeaway
Internal audit isn’t just a legal hurdle; it’s a strategic tool for risk management and operational excellence. The legal thresholds are the bare minimum, not the best practice for a growing, ambitious company.
Beyond the Law: Why Smart Companies Audit Voluntarily
So, your company doesn’t meet any of the criteria. You’re off the hook, right? Legally, yes. Strategically? You might be missing a huge opportunity.
Look, the law is a lagging indicator. It sets the absolute minimum standard. But in a competitive market, minimum standards don’t win. Based on hands-on testing with dozens of mid-sized firms, we’ve seen that voluntarily adopting an internal audit function can be a massive catalyst for growth.
Why? Because it builds a foundation of trust and control.
- You Become “Due Diligence Ready”: Thinking of raising capital or selling your business one day? Investors and buyers love companies with clean, well-documented processes and controls. A history of internal audits makes you instantly more attractive and can even increase your valuation.
- You Plug “Profit Leaks”: An internal audit isn’t just about risk; it’s about efficiency. We’ve seen audits uncover everything from wasteful spending in marketing to inefficient inventory management, putting real money back onto the bottom line.
- You Empower Your Board: It gives your Board of Directors and Audit Committee an independent line of sight into the business. This isn’t about micromanagement; it’s about providing them with the assurance they need to govern effectively.
- You Build a Moat Against Fraud: The simple presence of an active audit function is one of the most powerful deterrents to internal fraud. It sends a clear message: “We are watching.”
“An audit is not an end in itself, but a means of providing insight. It’s a flashlight in the dark corners of your organization.”
The Big Decision: In-House vs. Outsourced Internal Audit
Once you’ve decided to implement an internal audit, the next big question is: do you build a team or hire a firm? There’s no single right answer—it depends entirely on your company’s scale, complexity, and budget. From our experience, most companies benefit from a hybrid “co-sourced” model over time, but let’s break down the two primary options. GST Input Tax Credit: Top 10 Common Mistakes to Avoid
| Factor | In-House Team | Outsourced/Co-Sourced Firm |
|---|---|---|
| Cost Structure | High fixed cost (salaries, benefits, training). Can be expensive for smaller companies. | Variable cost (pay for what you use). More cost-effective, especially for targeted or less frequent audits. |
| Objectivity | Can be a challenge. Auditors may become too familiar with people and processes, or face internal pressure. | High. An external firm’s reputation depends on its independence and objectivity. This is their core strength. |
| Business Knowledge | Deep, continuous understanding of the company culture and specific operational nuances. | Steeper initial learning curve, but they bring broad industry knowledge and best practices from other companies. |
| Specialized Skills | May be limited. It’s hard for a small team to have experts in cybersecurity, forensic accounting, and supply chain. | Access to a deep bench of specialists on demand. Need a cybersecurity audit? They have a team for that. |
| Best For | Large, complex organizations with mature governance structures and a constant need for audit activities. | SMEs, high-growth companies, or large firms needing specialized skills or an independent perspective. |
💡 Pro Tip
When choosing an outsourced partner, don’t just look at the price. Ask for case studies specific to your industry. Speak with their references. The best firms act as strategic partners, not just checklist auditors. Ensure they have experience with companies of your size and complexity. Tax Audit Due Date for AY 2023-24: A Comprehensive Guide
The Internal Audit Process: A Step-by-Step Guide
A well-run internal audit isn’t a random inspection; it’s a structured, cyclical process. According to global standards from leading bodies like The Institute of Internal Auditors (IIA), the process is risk-based, ensuring that time and effort are focused where they matter most.
- Step 1: Risk-Based Planning. This is the most critical step. The audit team, in consultation with the board and senior management, identifies the biggest risks to the business. Is it supply chain disruption? Cybersecurity threats? Regulatory changes? This assessment creates a roadmap—the annual audit plan—that prioritizes audits for the year.
- Step 2: Fieldwork & Analysis. This is the “doing” phase. Auditors gather evidence by interviewing staff, observing processes, analyzing data, and testing controls. It’s not about finding fault; it’s about understanding reality. A good auditor is curious and analytical, not accusatory.
- Step 3: Reporting & Communication. Findings are useless if they’re buried in a 100-page report nobody reads. Modern audit reports are concise and visual. They clearly state the issue, the risk (the “so what?”), and a practical recommendation. Crucially, these findings are first discussed with the process owners to ensure accuracy and buy-in.
- Step 4: Follow-Up & Closure. An audit’s value is only realized when its recommendations are implemented. The audit function is responsible for tracking the progress of management’s action plans. This closes the loop and drives continuous improvement. Without this step, the entire exercise is a waste of time.
💡 Pro Tip
Prepare your team before the auditors arrive. Frame the audit as a collaborative effort to improve the business, not a “gotcha” exercise. When your team sees auditors as allies rather than adversaries, the process becomes infinitely more productive and insightful.
⚠️ Watch Out
Avoid the “report and run” trap. The biggest failure we see in internal audit functions is a lack of rigorous follow-up. An audit finding isn’t “closed” when the report is issued; it’s closed when the underlying risk has been verifiably fixed. Insist on a formal tracking system for all recommendations.
❓ Frequently Asked Questions
Who can be an internal auditor in India?
The Companies Act is quite flexible. You can appoint a Chartered Accountant (CA), a Cost Accountant, or any other professional the Board deems competent (like a Company Secretary or an MBA with relevant experience). They can be an employee of the company, an external firm, or an individual consultant.
So, internal audit isn’t mandatory for most private companies?
Correct. For a private limited company, it only becomes mandatory if your turnover hits ₹200 crore or your outstanding loans/borrowings from banks exceed ₹100 crore in the previous financial year. Many successful, medium-sized private companies fall below this threshold.
What are the penalties for not complying?
Non-compliance with Section 138 is taken seriously. The company and every officer in default can face penalties. According to the Companies Act, 2013, this can involve fines for both the company and its officers. It’s not just a financial risk; it’s a significant governance and reputational black mark.
Can our CFO also be the internal auditor?
While technically the Board can appoint an employee, this is a terrible idea from a governance perspective. The internal auditor must be independent of the functions they audit. Having a CFO audit their own department’s financial controls completely defeats the purpose of objectivity. Best practice demands a clear separation of duties.
How often should internal audits happen?
The law doesn’t specify a frequency. It’s determined by the Audit Committee or Board. A common approach is to have an annual audit plan that outlines several audits throughout the year (e.g., one major process audit per quarter). The frequency should be driven by the level of risk in different areas of the business.
Conclusion: From Compliance Burden to Strategic Advantage
We’ve covered a lot of ground. The rules for internal audit applicability are clear, but they only tell part of the story. Compliance is the floor, not the ceiling.
The most successful companies I’ve worked with don’t ask, “Do we have to do this?” They ask, “How can this make us better?” They view internal audit not as a cost center, but as an investment in resilience, efficiency, and trust.
So, here’s your next step. Don’t wait for a notice to land on your desk.
- Check Your Numbers: Pull up your financials from the last completed financial year. Compare your turnover and borrowings against the thresholds in the table above. Know where you stand.
- Look Ahead: Based on your growth projections, will you cross a threshold next year? If so, the time to start planning is now, not then.
- Start the Conversation: Whether you’re legally required to or not, bring this topic up with your leadership team or board. Ask the strategic question: “What don’t we know about our own business, and how can we find out?”
Answering that question honestly is the first step toward transforming your business from one that simply follows the rules to one that leads its industry.
