Internal Auditor Applicability explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 13 of the Companies (Accounts) Rules, 2014 lists the classes of company that must appoint an internal auditor under section 138 of the Act. The tests differ for listed companies, unlisted public companies and private companies. This article reads the rule as amended up to G.S.R. 357(E) dated 30 May 2025 (in force 14 July 2025) per the MCA e-book; that notification changes other rules of the same set, not rule 13. Later amendments should be checked. For help with internal audit design, see our compliance advisory service.
Every listed company must appoint an internal auditor. An unlisted public company must do so if, in the preceding financial year, it had paid-up share capital of fifty crore rupees or more, or turnover of two hundred crore rupees or more, or outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees, or outstanding deposits of twenty five crore rupees or more. A private company is covered by two of those tests: turnover or borrowings. The internal auditor may be an individual, a partnership firm or a body corporate (rule 13(1)).
The tests, class by class
| Class | Test (preceding financial year unless stated) |
|---|---|
| Every listed company | No size test |
| Unlisted public company | Paid-up share capital of fifty crore rupees or more; or turnover of two hundred crore rupees or more; or outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees at any point of time; or outstanding deposits of twenty five crore rupees or more at any point of time |
| Private company | Turnover of two hundred crore rupees or more; or outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees at any point of time |
Read the wording closely.
- The tests for unlisted public and private companies are alternatives, joined by "or". One test met is enough.
- Paid-up capital and turnover are looked at "during the preceding financial year". For borrowings and deposits the rule says "at any point of time during the preceding financial year", so a single day above the limit counts.
- The rule says "exceeding one hundred crore rupees or more" for loans and borrowings. The words are printed that way in the e-book; the test is read as printed.
- A private company is not tested on paid-up capital or on deposits under rule 13.
Who may be the internal auditor
Rule 13(1) as amended in 2016 says the internal auditor may be either an individual or a partnership firm or a body corporate. The Explanation adds two points: the internal auditor may or may not be an employee of the company, and the terms "Chartered Accountant" and "Cost Accountant" mean such a person whether engaged in practice or not. Read the rule together with section 138 of the Act. See Section 138: internal audit.
Existing companies: the proviso
An existing company covered by any of the criteria shall comply with section 138 and the rule within six months of the commencement of that section. That is a transitional proviso for the years after the section came into force. It tells you the period was six months and that it ran from commencement. For a company that crosses a threshold later, the rule prints no separate period; take advice on timing rather than assuming the six months restarts.
Scope and method: rule 13(2)
Rule 13(2) says the Audit Committee of the company, or the Board, shall, in consultation with the internal auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit. Two points follow. Where the company has an Audit Committee, the committee does this. Where it has none, the Board does. And the rule does not fix how often internal audit is done; that is left to the scope the committee or Board formulates. For the committee's role see Section 177: audit committee.
How internal audit connects to the other audit rules
The statutory auditor reports on internal audit under the Companies (Auditor's Report) Order; our article on CARO 2020 clauses xi to xvi explains the internal-audit clause. Reporting on internal financial controls is covered under the Audit Rules; see rules 10 and 10A. For the accounts side of the same Rules, see the Accounts Rules 1 to 3 on electronic books.
Example
Meridian Packaging Private Limited had turnover of one hundred and sixty crore rupees last year, and at one point in the year its bank borrowings stood at one hundred and ten crore rupees. Turnover does not meet the two hundred crore test, but the borrowings test is met on that one point of time, so rule 13(1)(c)(ii) applies and the company needs an internal auditor. Its Board, in consultation with the person appointed, formulates scope, periodicity and methodology under rule 13(2).
Common mistakes
- Testing a private company on paid-up capital, which rule 13 does not use for private companies.
- Using year-end borrowings, when the rule looks at any point of time in the preceding year.
- Applying the test to the current year rather than the preceding financial year.
- Assuming the internal auditor must be a chartered accountant in practice, or an employee. The Explanation says neither is required.
- Leaving scope and periodicity undefined. Rule 13(2) makes the Audit Committee or Board formulate them.
- Treating the six-month proviso as a standing grace period for any company that crosses a limit later.
Need help setting up internal audit?
Choosing the auditor, writing the scope and agreeing the reporting calendar are the practical steps after the applicability check. Our team can support the design and review, including the Board paper that records the scope.
Key takeaways
- Listed: always. Unlisted public: four alternative tests. Private: two alternative tests.
- Look at the preceding financial year; borrowings and deposits at any point of time.
- The internal auditor can be an individual, a firm or a body corporate, employee or not.
- The Audit Committee or Board sets scope, functioning, periodicity and methodology.
- Check later amendments before relying on the figures.
Read next
- Section 138: internal audit
- Section 177: audit committee
- Rules 10 and 10A: internal financial controls reporting
- CARO 2020 clauses xi to xvi
Disclaimer: This article is general information, not legal advice. It reads the rule as printed in the MCA consolidated text, as amended up to the notification named above; later amendments should be checked on the official MCA site before you file or act.