Internal Audit explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
These are the obligations that arrive without warning.
Nothing about how the company operates changes. A number crosses a line in the audited financial statements, and a new appointment becomes mandatory for the following year. Nobody sends a notice.
This is the threshold table for a growing private company — internal audit, secretarial audit, a whole-time company secretary, and cost audit — plus one board agenda item that stops any of them surprising you.
Internal audit at ₹200 crore turnover or ₹100 crore bank borrowings. Secretarial audit at ₹100 crore bank borrowings — the capital and turnover limbs are public-company-only. Whole-time CS at ₹10 crore paid-up capital. Cost records at ₹35 crore turnover, if you're in a covered industry.
Internal audit — Section 138
For a private company, only two triggers apply:
- turnover of ₹200 crore or more in the preceding financial year; or
- outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year.
Paid-up capital and deposits are not triggers for a private company — those limbs apply to unlisted public companies.
Who can do it? A chartered accountant, a cost accountant, or another professional the Board decides on. They may or may not be an employee, and the CA or CMA may be in practice or not.
But not your statutory auditor. Section 144 prohibits the auditor from rendering internal audit services to the company. That's a real constraint if you were planning to keep it in one firm.
The Audit Committee or the Board, in consultation with the internal auditor, formulates the scope, functioning, periodicity and methodology.
Timeline: a company covered for the first time must comply within six months of the commencement of the financial year in which it becomes covered. Not at year end — six months in.
Secretarial audit — Section 204
Read the drafting carefully here, because it catches private companies:
- every public company with paid-up capital of ₹50 crore or more;
- every public company with turnover of ₹250 crore or more;
- every company with outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more.
The first two limbs say "public company". The third says "every company" — so a private company with ₹100 crore of bank or PFI borrowings is inside the secretarial audit net, regardless of its capital or turnover.
The report is in Form MR-3, given by a company secretary in practice, and annexed to the Board's Report. The Board must explain in full any qualification, observation or remark in it.
Penalty: ₹2,00,000 on the company, on every officer in default, and on the practising company secretary in default.
Whole-time company secretary — Rule 8A
Section 203 requires whole-time KMP — an MD or CEO or manager, a company secretary and a CFO — for listed companies and prescribed classes. Rule 8 prescribes public companies with ₹10 crore paid-up capital, so private companies are outside the full KMP requirement.
But Rule 8A applies separately: every private company with paid-up share capital of ₹10 crore or more must have a whole-time company secretary.
So at ₹10 crore of capital you need a full-time ICSI member on the payroll — even though you still don't need a managing director or a CFO as KMP.
Penalty under Section 203(5): ₹5,00,000 on the company, ₹50,000 on every director and KMP in default, plus ₹1,000 per day of continuing default, capped at ₹5,00,000.
Cost records and cost audit — Section 148
Two tables of industries:
- Table A — regulated: telecom, electricity, petroleum, drugs and pharmaceuticals, fertilisers, sugar.
- Table B — non-regulated: a long list including machinery, steel, cement, rubber, chemicals, construction, education services and healthcare services.
Cost records in Form CRA-1 are required for a covered company whose overall annual turnover from all products and services is ₹35 crore or more in the immediately preceding financial year.
Cost audit applies on top:
| Sector | Trigger |
|---|---|
| Regulated (Table A) | Overall turnover ₹50 crore+ and covered products/services turnover ₹25 crore+ |
| Non-regulated (Table B) | Overall turnover ₹100 crore+ and covered products/services turnover ₹35 crore+ |
Exempt: companies whose export revenue in foreign exchange exceeds 75% of total revenue, companies operating from an SEZ, and electricity generation for captive consumption.
Process: the Board appoints the cost auditor and intimates in CRA-2 within 180 days of the start of the financial year or 30 days of the Board meeting, whichever is earlier. The auditor gives CRA-3 to the Board within 180 days of year end, and the company files CRA-4 with the Central Government within 30 days of receipt.
The whole thing, in order of arrival
| Obligation | Trigger for a private company |
|---|---|
| Cash flow statement | Ceases to be a small company (capital > ₹4 cr or previous-year turnover > ₹40 cr) |
| MGT-7 instead of MGT-7A | Ceases to be a small company |
| Four Board meetings instead of two | Ceases to be a small company |
| Demat (Rule 9B) | Not a small company per audited FS for a FY ending on/after 31 Mar 2023 — comply in 18 months |
| MGT-8 certification | Capital ≥ ₹10 cr or turnover ≥ ₹50 cr |
| Whole-time company secretary | Capital ≥ ₹10 crore |
| Cost records | Covered industry and turnover ≥ ₹35 cr |
| CSR | Net worth ≥ ₹500 cr or turnover ≥ ₹1,000 cr or net profit ≥ ₹5 cr |
| Cost audit | Covered industry and the turnover tests above |
| Auditor rotation | Capital ≥ ₹50 cr or public borrowings/deposits ≥ ₹50 cr |
| Vigil mechanism | Accepts public deposits or bank/PFI borrowings > ₹50 cr |
| Internal audit | Turnover ≥ ₹200 cr or bank/PFI borrowings > ₹100 cr |
| Secretarial audit | Bank/PFI borrowings ≥ ₹100 crore |
| CSR impact assessment | Average CSR obligation ≥ ₹10 cr over three preceding FYs |
The order matters. For a typical growing company, small-company status goes first — at ₹4 crore capital or ₹40 crore turnover — dragging Rule 9B demat with it. Then the whole-time CS at ₹10 crore. Then auditor rotation and vigil mechanism at ₹50 crore. Then internal and secretarial audit at ₹100–200 crore.
CSR can arrive at any point, because the ₹5 crore net profit trigger is completely independent of size.
One agenda item that prevents all of this
Add this to the Board meeting that approves the audited financial statements:
Review of threshold-based obligations. Note the audited paid-up share capital, turnover, net worth, net profit under Section 198, and outstanding borrowings from banks and public financial institutions, both at year end and at any point during the year. Determine against the statutory thresholds which of the following apply for the following financial year: small-company status, cash flow statement, MGT-7/7A, Board meeting frequency, Rule 9B demat, whole-time company secretary, MGT-8, CSR, internal audit, secretarial audit, cost records and cost audit, auditor rotation and vigil mechanism. Record the determination in the minutes.
Ten minutes a year, and it eliminates the entire category of "we didn't know it applied to us" defaults — which is, in practice, most of them.
Key takeaways
- Internal audit for a private company: ₹200 crore turnover or ₹100 crore borrowings. Capital and deposits aren't triggers.
- Your statutory auditor cannot be your internal auditor.
- Secretarial audit catches private companies through the borrowings limb only.
- Whole-time CS at ₹10 crore capital — the earliest of the "hire someone" thresholds.
- Cost records start at ₹35 crore turnover, if you're in a listed industry.
- New internal audit coverage means complying within six months of the year starting.
- Test everything against the audited numbers, once a year, in minutes.
Read next
- Compliance Checklist for a Private Limited Company
- Small Company: Definition, Thresholds and Benefits
- Demat of Shares by Private Companies (Rule 9B)
- CSR under Section 135
- Statutory Auditor: Appointment, ADT-1 and Rotation
Disclaimer: Thresholds are amended periodically. Positions stated as on 4 September 2026 — verify the current Rules before concluding on applicability.