Applicability of Internal Audit under Companies Act 2013
In Chapter IX of the Companies Act, 2013, Section 138 includes provisions relating to internal audit. In this blog, we walk you through the provisions concerning the internal audit of a company in compliance with Section 138 of the Companies Act, 2013 and the Companies (Accounts) Rules, 2014.
What is an internal audit?
An internal audit is a management tool that aims to verify the appropriateness of internal controls and checks in the company. It is either performed by the personnel of the organization or a professional firm engaged for this purpose.
Traits of internal audit
Some of the traits of internal audit are:
- It is a continuous and systematic process of examining the operations and business records of an entity.
- It is performed by the company’s employees or external agencies specially assigned for this purpose.
- It is, in essence, auditing for the management.
- It is a method of control dealing with the review and evaluation of other systems of control.
- The internal audit work includes facilitating the implementation of a risk management framework and ensuring that it meets key priorities, and also the subsequent review of the framework.
Scope of internal audit
Internal audit encompasses the following areas of operations:
- To review the reliability and integrity of financial and operating information
- To review the means used to identify, measure, classify and report financial and operating information
- To ensure that there is an economic and efficient use of resources available
- To ensure that there is compliance with policies, plans, procedures, laws, and regulations applicable to the company
- To ensure that the internal control system including the accounting control system in a company is effective
- To verify the existence of assets and to review the means of safeguarding assets
- To ensure that a system is in place which ensures that all major risks are appropriately identified and analyzed
Why is an internal audit system needed?
An independent and dedicated internal audit function enables both the management and the oversight body (e.g. the Board of Directors, audit committee) in meeting their obligations. It brings a systematic and disciplined approach to assessing the effectiveness of the design and execution of internal control systems and risk management processes. Such an assessment of internal control systems and risk management processes by the internal audit team gives the management and the oversight body an assurance that the organization’s risks have been appropriately mitigated.
Applicability of internal audit in India – Companies that are required to appoint an internal auditor
The appointment of internal auditor is compulsory for all listed companies and ‘producer companies’, irrespective of any criterion.
According to Rule 13 of the Companies (Accounts) Rules, 2014, the following classes of companies are mandated to appoint an internal auditor or a firm of internal auditors:
I. All listed companies
II. Unlisted public companies that meet either of the below criteria:
- Have a paid-up share capital of Rs. 50 crores or more during the immediately preceding financial year, or
- Have a turnover of Rs. 200 crores or more during the immediately preceding financial year; or
- Have outstanding loans or borrowings from banks or financial institutions with a balance exceeding Rs. 100 crores at any point of time during the immediately preceding financial year; or
- Have outstanding deposits of Rs. 25 crores or more at any point of time during the immediately preceding financial year
III. Private companies that meet either of the below criteria:
- Have a turnover of Rs. 200 crores or more during the immediately preceding financial year; or
- Have outstanding loans or borrowings from banks or financial institutions with a balance exceeding Rs. 100 crores at any point of time during the immediately preceding financial year
All the companies covered under any of the above conditions will need to comply with the requirements of section 138 and rules specified under the Companies (Accounts) Rules, 2014.
Conditions for applicability of internal audit
| Particulars | Applicability of internal audit to Listed companies | Applicability of internal audit to Unlisted public companies | Applicability of internal audit to private limited companies |
| Paid-up share capital | Always applicable | Rs. 50 crores or more | NA |
| Turnover | Always applicable | Rs. 200 crores or more | Rs. 200 crores or more |
| Outstanding loans or borrowings from banks or financial institutions | Always applicable | Exceeding Rs. 100 crores | Exceeding Rs. 100 crores |
| Outstanding deposits | Always applicable | Rs. 25 crores or more | NA |
Let us take some examples here. Suppose XYZ Pvt. Ltd. has Rs. 50 lacs paid-up capital, Rs. 9.70 crores reserves and turnover of last three consecutive financial years, immediately preceding the financial year under audit, is Rs. 69 crores, Rs. 158 crores and Rs. 281 crores, but it does not have any internal audit system.
In the instant case, XYZ Pvt. Ltd. is having a turnover of Rs. 281 crores during the preceding financial year which is more than Rs. 200 crore. Thus, the company has the statutory requirement to appoint an internal auditor.
Similarly, ABC Pvt. Ltd. has outstanding loans or borrowings from banks exceeding one hundred crore rupees. In the given case, ABC Pvt. Ltd. is under a compulsion to appoint an internal auditor as its loans or borrowings are falling under the prescribed limit.
Appointment of an internal auditor
The appointment of an internal auditor can be made only by a resolution passed at the meeting of the Board, as provided for in Rule 8 of the Companies (Meetings of Board and its Powers) Rules, 2014. The company is, therefore, also required to file Form MGT-14 with the Registrar within 30 days of the date of the Board’s resolution. However, such a requirement of filing resolutions with ROC does not apply to private limited companies.
Procedure for appointment of an internal auditor
Companies need to follow the below-mentioned procedure for the appointment of an internal auditor:
1. To be eligible for appointment as an internal auditor, obtain a written consent letter from the proposed new auditor.
2. Send a notice of the Board meeting to every director of the company, and call a Board Meeting for the appointment of the internal auditor.
3. File e-form MGT-14 with ROC for the appointment of the internal auditor of the company.
4. Send an intimation letter to the newly appointed internal auditor, expressing his appointment in the company.
Qualifications needed for the internal auditor
The internal auditor shall be either a chartered accountant, whether or not engaged in practice, or a cost accountant, or any other specialized professional as the Board may determine to perform an internal audit of the company’s operations and activities.
The internal auditor may or may not be an employee of the organization.
Further, a company’s statutory auditor appointed under Section 139 is not eligible to offer services as an internal auditor, whether rendered directly or indirectly to the company or its holding company or subsidiary company.
Role of the audit committee
The scope, functioning, periodicity, and methodology for performing the internal audit shall be formulated by the Audit Committee of the organization or the Board, in consultation with the Internal Auditor.
Internal audit report
The internal audit report must be sent to the company’s board of directors. It is the responsibility of the internal auditor to report risk management issues and internal control deficiencies identified. He/she must report directly to the audit committee/ Board of Directors and suggest recommendations for improving the operations of the company, in terms of both efficient and effective performance.
Note: The company’s internal auditor has the authority to inspect the Minutes of the Board and any Committee thereof, as well as the Minutes of General Meetings, as he deems essential for the fulfilment of his duties.
Penalty and punishment
Section 138 does not provide for any specific penal provisions. The penal provisions referred to in Section 450 would therefore be applicable in the event of any failure to comply with Section 138.
Accordingly, for contravention, a fine of up to Rs.10, 000 shall be imposed on the company and every officer of the company who is in default. If the contravention is a continuing one, a further fine of Rs.1, 000 every day shall also be imposed. Offenses under Section 138 are compoundable under section 441 of the Companies Act, 2013.
Concluding remarks
Since internal auditors are specialists in understanding organizational risks, they assist the management in understanding these topics and offer recommendations for improvements. That is why even if internal audit is not compulsory for all, businesses often get it done to evaluate the efficacy of internal control, soundness of the financial system, the efficiency of business processes, etc.
Hope the information provided in this blog proves helpful to you!
Also read: All about Cost Audit Applicability under Companies Act 2013
