Section 138 of the Companies Act, 2013 does not make internal audit compulsory for every company. It requires prescribed classes of companies to appoint an internal auditor, and those classes are set out in Rule 13 of the Companies (Accounts) Rules, 2014. For finance teams, company secretaries and auditors, the practical question is therefore not simply “Does the company need internal audit?” but “Which Rule 13 test applies to this company, and which financial-year numbers must be checked?”
The legal starting point is Section 138 of the Companies Act, 2013 in the ICSI e-book. The detailed class-wise tests appear in Rule 13 of the Companies (Accounts) Rules, 2014.
Which companies are required to appoint an internal auditor?
1. Every listed company
Every listed company is covered by Rule 13. There is no separate turnover, capital, borrowing or deposit threshold to cross before the rule applies.
2. Unlisted public companies
An unlisted public company is covered if it satisfies any one of the following tests during the preceding financial year:
- paid-up share capital of ₹50 crore or more;
- turnover of ₹200 crore or more;
- outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the preceding financial year; or
- outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year.
3. Private companies
A private company is covered if it satisfies either of these tests during the preceding financial year:
- turnover of ₹200 crore or more; or
- outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the preceding financial year.
A useful distinction is that Rule 13 does not use paid-up share capital or outstanding deposits as standalone internal-audit triggers for a private company. Those tests appear in the unlisted-public-company limb of the rule.
Do not test borrowings only at year-end
One of the easiest compliance mistakes is to look only at the closing balance on 31 March. The borrowing test for both unlisted public companies and private companies is based on the amount outstanding at any point of time during the preceding financial year. The deposit test for an unlisted public company is framed the same way.
For example, assume a private company had bank borrowings of ₹108 crore in October but repaid part of the facility and closed the year at ₹92 crore. Looking only at the year-end balance could lead the company to the wrong conclusion. Because the Rule 13 borrowing test looks at the peak outstanding amount during the preceding financial year, the October balance is relevant.
Which numbers should the finance team collect?
A practical Rule 13 review should be performed soon after year-end using a short evidence pack:
- company status: listed, unlisted public or private;
- paid-up share capital for the preceding financial year, where the public-company test is relevant;
- turnover for the preceding financial year;
- month-end and, where needed, daily or transaction-level schedules for bank and public-financial-institution borrowings so that the peak outstanding amount can be established;
- deposit schedules showing the highest amount outstanding during the year for an unlisted public company; and
- Board or Audit Committee records documenting the applicability conclusion and appointment process.
The key is to preserve evidence for the maximum borrowing or deposit exposure during the year, not merely the closing balance appearing in the financial statements.
Who can be appointed as internal auditor?
Section 138 states that the internal auditor may be a chartered accountant, a cost accountant, or another professional decided by the Board. Rule 13 further provides that the internal auditor may be an individual, partnership firm or body corporate. The rule also says the internal auditor may or may not be an employee of the company.
That flexibility does not mean the statutory auditor can simply take the internal-audit assignment. Section 144 of the Companies Act, 2013 lists internal audit among the services that an auditor appointed under the Act cannot provide, directly or indirectly, to the company or the covered holding or subsidiary relationships described in that section.
What must the Board or Audit Committee decide?
Appointment is only the first step. Rule 13(2) requires the Audit Committee, where applicable, or the Board to formulate the scope, functioning, periodicity and methodology of internal audit in consultation with the internal auditor. A one-line appointment without a defined audit mandate is therefore not a good compliance process.
In practice, the governance note should address the audit universe, risk priorities, locations or processes to be covered, reporting frequency, escalation of significant findings, responsibility for management responses and follow-up of open observations.
Practical decision framework
- Identify the company type. Determine whether it is listed, unlisted public or private before looking at thresholds.
- Use the preceding financial year. Apply the capital and turnover tests to that period.
- Calculate peak exposure. For relevant borrowing and deposit tests, identify the highest amount outstanding at any point during the preceding financial year.
- Document the conclusion. Keep schedules supporting each threshold test, including the reason a test does or does not apply.
- Check independence restrictions. Ensure the proposed internal-audit arrangement does not conflict with Section 144 or other applicable professional requirements.
- Approve scope and methodology. Have the Board or Audit Committee, as applicable, formulate the internal-audit framework in consultation with the internal auditor.
- Use current professional guidance. For execution quality, ICAI maintains the Compendium of Standards on Internal Audit; the February 2026 compendium is stated by ICAI to be applicable from 1 April 2026.
Two common mistakes to avoid
- Assuming every large private company is covered because of paid-up capital. Rule 13 uses turnover and specified borrowings as the private-company tests; the paid-up-capital test is stated for unlisted public companies.
- Using only the 31 March loan balance. A company can cross the borrowing threshold earlier in the year and fall below it before year-end. The rule asks whether the specified borrowing level was exceeded at any point during the preceding financial year.
Special cases need a separate check
The Section 138 e-book page records notification-based modifications for specified IFSC public and private companies. Companies operating under a special statutory or regulatory status should therefore check the applicable notification or modification rather than mechanically applying the general matrix above.
Practical takeaway
For most companies, Section 138 applicability can be resolved with a disciplined three-part test: identify the company type, apply the correct Rule 13 thresholds to the preceding financial year, and calculate peak borrowings or deposits where the rule uses an “at any point of time” test. Once covered, the company should treat internal audit as a governed function with a properly appointed auditor, documented scope, reporting cadence and follow-up process—not as a year-end formality.
