CARO stands for the Companies (Auditor’s Report) Order. It is not a separate audit. It is a set of additional reporting matters that the statutory auditor must address in the auditor’s report for covered companies. ICAI’s Guidance Note explains that these requirements are supplemental to section 143 reporting under the Companies Act, 2013, which is why CARO matters in day-to-day audit planning, documentation, and final reporting.
For readers who also need to separate company-law audit reporting from income-tax audit obligations, this comparison of tax audit and statutory audit is the most useful companion topic. CARO sits inside the statutory audit framework; it is not the same thing as a tax audit under section 44AB.
What CARO is meant to achieve
In substance, CARO pushes the auditor to comment on specific operational and compliance areas that often matter to lenders, investors, boards, and regulators. Instead of leaving these topics buried in working papers, the order requires direct reporting on matters such as fixed assets records, inventory verification, statutory dues, borrowings, fraud, related party compliance, internal audit, and certain going-concern style indicators around liability repayment.
That makes CARO important for two reasons. First, it changes the depth of audit procedures in several areas. Second, it changes how companies prepare schedules, reconciliations, and management representations because weak records often become a reporting issue rather than only an internal file note.
Applicability: when CARO applies
Based on the MCA order issued on February 25, 2020 and the ICAI announcement dated December 19, 2020 referring to the MCA extension order dated December 17, 2020, CARO 2020 applies for audits of financial years commencing on or after April 1, 2021. In practical terms, that means FY 2021-22 onward.
CARO applies broadly to companies, including foreign companies covered by the Companies Act audit framework. ICAI’s Guidance Note also explains that branch auditors of covered companies should report on CARO matters relevant to the company so the main auditor can complete the reporting properly.
Companies exempt from CARO
| Category | Position under CARO 2020 | What to watch |
|---|---|---|
| Banking company | Exempt | Exemption is category-based. |
| Insurance company | Exempt | Exemption is category-based. |
| Section 8 company | Exempt | Status should be checked for the relevant year. |
| One Person Company | Exempt | Classification matters. |
| Small company | Exempt | Whether a company qualifies depends on the Companies Act definition applicable for the year under audit. |
| Certain private limited companies | Exempt only if all stated conditions are satisfied together | The company must not be a subsidiary or holding company of a public company, and it must stay within the paid-up capital plus reserves and surplus, borrowing, and total revenue limits specified in the order. |
For the private company exemption, the order uses three numerical conditions together: paid-up capital and reserves and surplus not more than Rs 1 crore as on the balance sheet date, borrowings from any bank or financial institution not exceeding Rs 1 crore at any point during the financial year, and total revenue under Schedule III not exceeding Rs 10 crore during the financial year. If even one of these conditions is not met, the exemption fails.
Example: when a private company loses the exemption
Assumptions: ABC Private Limited is not a subsidiary or holding company of a public company. Its paid-up capital plus reserves and surplus are Rs 90 lakh at year-end. Its total revenue is Rs 8.4 crore. During the year, its working capital borrowing from a bank touched Rs 1.15 crore for two weeks.
Result: CARO applies. Even though two conditions are within the limit, the borrowing condition is breached because the test looks at any point during the financial year.
Example: small company status can change the answer
Assumptions: XYZ Private Limited appears close to the private-company exemption thresholds, but it separately qualifies as a small company under the Companies Act definition applicable for that year.
Result: ICAI’s Guidance Note indicates that where a company is covered by the definition of small company, it remains exempt from CARO even if it would otherwise be tested under the private-company criteria.
How CARO operates in practical audit work
CARO works as a reporting matrix. The auditor starts by deciding whether the company is covered. If yes, the audit team maps each CARO clause to records, controls, management explanations, third-party evidence, and final reporting language. This usually affects the audit file in at least five ways:
- Asset, inventory, loan, dues, and borrowing schedules need tighter reconciliation.
- Management representations need to be more clause-specific.
- Litigation, defaults, and fraud discussions with management become more structured.
- Schedule III disclosures and CARO reporting often need to be read together.
- Group and branch coordination becomes more important where multiple reporting units are involved.
Main reporting areas under CARO 2020
CARO 2020 contains 21 reporting areas in paragraph 3. Reading them as business themes is usually more useful than memorising the clause numbers.
| Theme | Typical CARO coverage | Why it matters in practice |
|---|---|---|
| Assets and inventory | Property, plant and equipment, intangible assets, title deeds, revaluation, benami proceedings, inventory verification, quarterly current asset statements filed with lenders | Tests whether core records and security-backed information are reliable. |
| Lending and use of funds | Loans, advances, guarantees, investments, compliance with sections 185 and 186, use of term loans, short-term funds used for long-term purposes, funds routed through intermediaries or ultimate beneficiaries | Focuses on substance of financing decisions and fund flow risk. |
| Basic legal compliance | Public deposits, cost records, statutory dues, disputed dues, previously unrecorded income surrendered in tax proceedings | Highlights recurring compliance failures and documentation gaps. |
| Borrowings and capital raising | Default in repayment, wilful defaulter status, application of IPO or further offer proceeds, preferential allotment or private placement compliance | Directly relevant to lenders, investors, and boards. |
| Fraud and governance | Fraud by or on the company, whistle-blower complaints, related party compliance, internal audit system, non-cash transactions with directors | Brings governance quality into the audit report more explicitly. |
| Special-status and resilience matters | Nidhi requirements, RBI Act registration where relevant, cash losses, auditor resignation issues, capability of meeting liabilities, CSR unspent amounts, consolidated reporting on adverse remarks in component CARO reports | Captures entity-specific risk signals that users of financial statements often care about most. |
Which clauses usually create the most work
In many real audits, the heavier clauses are inventory, statutory dues, borrowings, fraud, related parties, internal audit, utilisation of borrowed funds, and the clause on whether material uncertainty exists about meeting liabilities due within one year from the balance sheet date. These areas demand more than ledger checking. They usually require corroboration from agreements, board papers, bank statements, ageing data, and post-balance-sheet information.
CARO is not a guarantee of business health
A clean CARO report does not mean the company is risk-free. It means the auditor has reported on the matters specified in the order based on audit evidence obtained. CARO sharpens visibility, but it does not convert the audit report into a commercial due diligence report or a guarantee against future failure.
A practical checklist before concluding CARO applicability
- Confirm that the engagement is a company audit under the Companies Act framework.
- Check whether the reporting period begins on or after April 1, 2021.
- Test each exemption separately instead of assuming private companies are automatically outside CARO.
- For a private company, verify all exemption conditions together, including the borrowing test at any point during the year.
- Check whether the entity qualifies as a small company for that specific year before concluding.
- Where branches, foreign operations, project offices, or liaison offices are involved, make sure the principal auditor receives the reporting needed from the relevant auditors.
- Map each applicable CARO clause to audit procedures and file evidence before drafting the report.
Where readers usually go wrong
- Treating CARO as if it applies to every private company.
- Looking only at year-end borrowings instead of the peak at any point during the year for the private-company exemption test.
- Confusing CARO reporting with tax audit reporting.
- Ignoring the interaction between Schedule III disclosures and CARO clauses.
- Assuming exemption without checking current-year company classification under the Companies Act.
Bottom line
CARO is best understood as a mandatory expansion of the statutory auditor’s reporting responsibilities for covered companies. If applicability is established, the next question is not whether to report, but how robustly each clause has been evidenced. For CAs, finance teams, and businesses, that is the difference between treating CARO as a format issue and handling it as a substantive audit and compliance exercise.
