Section 177 of the Companies Act, 2013 creates the statutory framework for an Audit Committee and, separately, for a vigil mechanism. The two are related but they are not the same compliance test. A company may be required to establish a vigil mechanism even where it is not required to constitute an Audit Committee, so finance and secretarial teams should test both requirements independently.
The primary statutory text is the ICSI e-book page for Section 177 of the Companies Act, 2013. The prescribed company classes are linked through Rule 6 of the Companies (Meetings of Board and its Powers) Rules, 2014 and Rule 4 of the Companies (Appointment and Qualification of Directors) Rules, 2014.
Which companies must constitute an Audit Committee?
Section 177(1) requires every listed public company and other prescribed classes to constitute an Audit Committee. Rule 6 currently links the prescribed class to public companies covered by Rule 4 of the independent-director rules. In practical terms, an unlisted public company is generally brought into this framework when it meets any one of the following Rule 4 tests based on the latest audited financial statements:
- paid-up share capital of ₹10 crore or more;
- turnover of ₹100 crore or more; or
- aggregate outstanding loans, debentures and deposits exceeding ₹50 crore.
Rule 4 also excludes certain unlisted public companies from that rule: a joint venture, a wholly owned subsidiary and a dormant company. Because Rule 6 refers to companies covered under Rule 4, those exclusions matter when applying the prescribed-class limb. Special statutory modifications can also apply to particular company categories, so a company with a special status should check the relevant notification before relying only on the general matrix.
Audit Committee composition under Section 177
The Audit Committee must have at least three directors, with independent directors forming a majority. Section 177 also requires a majority of committee members, including the Chairperson, to be persons able to read and understand financial statements.
This composition rule should be checked whenever the Board changes. An appointment or resignation that looks harmless at Board level can make the committee non-compliant if it breaks the independent-director majority or reduces the committee below three members.
What does the Audit Committee actually do?
Section 177 requires the Board to specify the committee's terms of reference in writing. The statutory responsibilities are broad and directly relevant to audit, reporting and finance functions. They include:
- recommending the appointment, remuneration and terms of appointment of auditors;
- reviewing auditor independence, performance and effectiveness of the audit process;
- examining financial statements and the auditor's report;
- approving or subsequently modifying related-party transactions, subject to the statutory framework for omnibus approvals and specified exceptions;
- scrutinising inter-corporate loans and investments;
- considering valuation of undertakings or assets where necessary;
- evaluating internal financial controls and risk-management systems; and
- monitoring the end use of funds raised through public offers and related matters.
The committee is therefore not simply a meeting held before the Board approves financial statements. Its statutory role reaches auditor oversight, related-party governance, financing transactions, internal controls and risk.
Powers of the Audit Committee
Section 177 gives the committee meaningful information-gathering powers. It may call for auditor comments on internal-control systems, audit scope and audit observations, and may discuss relevant matters with internal auditors, statutory auditors and management. It may investigate matters within its remit, obtain professional advice from external sources and access company records.
When the committee considers the auditor's report, the company's auditors and key managerial personnel have a right to be heard, although they do not have a right to vote. The Board's report must disclose the composition of the Audit Committee and, where the Board does not accept a recommendation of the committee, disclose that fact together with the reasons.
Vigil mechanism: a separate applicability test
The vigil-mechanism requirement should not be assumed to follow the Audit Committee threshold automatically. Section 177(9) and Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 require a vigil mechanism for every listed company and also for companies that:
- accept deposits from the public; or
- have borrowed money from banks and public financial institutions in excess of ₹50 crore.
Where a company is required to constitute an Audit Committee, that committee oversees the vigil mechanism. If another company is required to have a vigil mechanism but does not have an Audit Committee, Rule 7 requires the Board to nominate a director to perform that oversight role.
The mechanism must provide safeguards against victimisation and direct access to the Audit Committee Chairperson, or the nominated director as applicable, in exceptional cases. Section 177 also requires details of the mechanism to be disclosed on the company's website, if any, and in the Board's report.
Worked example: when the two tests produce different answers
Assume an unlisted private company has borrowed ₹60 crore from banks and public financial institutions. It is not a listed public company and is not brought into the Audit Committee requirement through Rule 6 because that rule's prescribed class is tied to the public-company framework under Rule 4. However, the company crosses the Rule 7 borrowing test for a vigil mechanism because its relevant bank and public-financial-institution borrowings exceed ₹50 crore.
On those assumptions, the company may have no Companies Act requirement to constitute an Audit Committee under the general Section 177 and Rule 6 matrix, yet it must establish a vigil mechanism. Its Board should nominate a director to perform the oversight role described in Rule 7.
Practical compliance checklist
- Identify whether the company is listed public, unlisted public or private before applying thresholds.
- For an unlisted public company, test the Rule 4 capital, turnover and outstanding-finance conditions using the latest audited financial statements.
- Check whether any Rule 4 exclusion or special notification changes the general result.
- If an Audit Committee is required, verify at least three directors, an independent-director majority and financial-statement literacy of the required majority including the Chairperson.
- Keep the Board-approved written terms of reference aligned with Section 177 responsibilities.
- Map related-party approvals, auditor oversight, financial-statement review, inter-corporate loans and investments, internal controls and risk matters to committee agendas and minutes.
- Run the vigil-mechanism test separately for listed status, public deposits and the ₹50 crore borrowing condition.
- Where no Audit Committee exists but Rule 7 applies, record the Board's nomination of the director responsible for oversight.
- Check website and Board's report disclosures for the vigil mechanism and Board-report disclosures relating to the Audit Committee.
- Reperform the applicability and composition review whenever audited thresholds or Board composition changes.
Common mistakes to avoid
- assuming every company with a vigil mechanism must also have an Audit Committee;
- testing only year-end committee membership without considering resignations or vacancies during governance changes;
- treating the Audit Committee as only a financial-statement approval formality;
- overlooking the Rule 4 exclusions when applying the prescribed-class test for unlisted public companies; and
- having a whistle-blower policy but missing the statutory oversight, anti-victimisation or disclosure requirements.
Practical takeaway
Section 177 compliance is easiest to manage as two linked but separate decisions. First, test whether the company must constitute an Audit Committee and, if so, verify composition, written terms of reference and the committee's statutory responsibilities. Second, run the vigil-mechanism test independently. A company can fail compliance by assuming one test automatically answers the other. A short annual matrix covering company type, audited thresholds, committee composition, oversight responsibilities and disclosures is the most reliable control.
