Appointment of Internal Auditor: Eligibility and Process
By SCORE Editorial Team · Prepared by SCORE’s audit, tax and advisory practice · Law stated as on 5 August 2026
Quick answer: The appointment of internal auditor is made by the Board, by resolution at a Board meeting, under Section 138. The auditor may be a chartered accountant, cost accountant or other professional the Board chooses, employee or firm. It cannot be the statutory auditor. Public companies file MGT-14 within 30 days; private companies are exempt.
Which companies must appoint an internal auditor?
Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 set the classes. The tests apply to the preceding financial year.
| Company type | Appoint an internal auditor if, in the preceding FY, it had any of these |
|---|---|
| Listed company | Always required |
| Unlisted public company | Paid-up capital ₹50 crore or more; turnover ₹200 crore or more; bank or PFI loans above ₹100 crore at any time; or deposits ₹25 crore or more at any time |
| Private company | Turnover ₹200 crore or more; or bank or PFI loans above ₹100 crore at any time |
Other companies may still appoint one voluntarily. Many do, once lenders or investors ask for it.
Who can be appointed as internal auditor?
Section 138 allows a chartered accountant, a cost accountant or any other professional the Board decides on. Rule 13 clarifies two points. The auditor may or may not be an employee. And a CA or cost accountant may or may not be in practice.
| Candidate | Eligible? |
|---|---|
| Chartered accountant or CA firm | Yes |
| Cost accountant or cost accountant firm | Yes |
| Other professional chosen by the Board | Yes |
| Employee of the company, such as a head of internal audit | Yes |
| Statutory auditor of the company | No, barred by Section 144 |
Section 144 bars the statutory auditor from providing internal audit services. The bar covers services to the company, its holding company and its subsidiary. It also applies to services given indirectly, such as through the auditor’s relatives, partners or associated entities.
Can a company secretary do it? The “other professional” route allows it if the Board so decides.
Who appoints the internal auditor?
The Board of Directors appoints the internal auditor. The resolution must be passed at a Board meeting, not by circulation. Section 179(3) read with Rule 8 of the Companies (Meetings of Board and its Powers) Rules, 2014 reserves this power for meetings.
Where an audit committee exists, it should recommend the appointment first. Under Rule 13, the audit committee or Board, with the internal auditor, also sets the scope, functioning, periodicity and methodology.
Listed companies have one more step. Under SEBI LODR, the audit committee reviews the appointment, removal and pay of the chief internal auditor.
How do you appoint an internal auditor? Step by step
- Confirm applicability. Test last year’s audited figures against Rule 13.
- Choose the model. In-house, outsourced or co-sourced (in-house team plus specialist firm).
- Check independence. Confirm the candidate is not your statutory auditor or linked to it. Get a written declaration of independence and conflicts.
- Audit committee recommendation. The committee reviews the proposal, scope and fees.
- Board resolution at a meeting. Approve the appointment, scope, period and fees.
- File MGT-14 if you are a public company. File within 30 days of the resolution.
- Sign the engagement letter. Record scope, access, reporting and fees.
- Approve the audit plan. The audit committee or Board approves a risk-based plan for the year.
Is MGT-14 required for appointment of internal auditor?
It depends on the company type.
| Company type | MGT-14 needed? | Basis |
|---|---|---|
| Listed or unlisted public company | Yes, within 30 days | Section 117(3)(g) read with Section 179(3) |
| Private company | No | MCA exemption notification of 5 June 2015 |
Late MGT-14 filing attracts additional fees and possible penalty under Section 117(2). Check the fee schedule on the MCA V3 portal before filing late.
Sample Board resolution for appointment of internal auditor
Adapt this to your facts and the audit committee’s recommendation.
RESOLVED THAT pursuant to Section 138 and other applicable provisions of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, and on the recommendation of the Audit Committee, [name / firm, with ICAI or ICMAI registration number] be and is hereby appointed as the Internal Auditor of the Company for the financial year [2027-28], on the scope, periodicity, methodology and fees placed before the Board.
RESOLVED FURTHER THAT [director / company secretary] be and is hereby authorised to sign the engagement letter, file the required forms with the Registrar of Companies, and do all acts needed to give effect to this resolution.
Private companies can drop the reference to filing with the Registrar.
What should the internal audit engagement letter cover?
The law does not prescribe an engagement letter. It is still the best way to protect scope and independence.
- ☐ Scope: processes, locations, entities and period
- ☐ Methodology: risk-based plan, sampling and data analytics
- ☐ Periodicity: quarterly, half-yearly or continuous
- ☐ Reporting line: functionally to the audit committee; administratively to management
- ☐ Access: unrestricted access to records, systems, people and sites
- ☐ Deliverables: report format, timelines and follow-up reviews
- ☐ Confidentiality and data protection
- ☐ Fees, term and termination
- ☐ Independence: no role in designing or running the controls being tested
How do you keep the internal audit function independent?
Have internal audit report findings to the audit committee directly. Do not route them through the managers being audited.
Do not ask the internal auditor to design or operate the controls it tests. Let the audit committee, not the CFO alone, review the auditor’s performance and fees.
Frequently asked questions
Who appoints the internal auditor of a company?
The Board of Directors, by resolution at a Board meeting under Section 138. Where there is an audit committee, it should recommend the appointment and help set the scope.
Can an employee be appointed as internal auditor?
Yes. Rule 13 states that the internal auditor may or may not be an employee. Many large companies have an in-house head of internal audit.
Can the statutory auditor be the internal auditor?
No. Section 144 bars the statutory auditor from providing internal audit services to the company, its holding company or subsidiary. The bar also covers indirect services through related persons or entities.
Is MGT-14 required for appointment of internal auditor?
Yes for public companies, within 30 days of the Board resolution. Private companies are exempt under the MCA notification of 5 June 2015.
Can the Board appoint the internal auditor by circular resolution?
No. Section 179(3) and Rule 8 require this power to be exercised at a Board meeting. A meeting through video conferencing is allowed.
What is the term of an internal auditor’s appointment?
The law sets no fixed term. Most companies appoint for one financial year and review performance before renewing.
How SCORE helps
SCORE acts as outsourced internal auditor, reporting directly to the audit committee. We also co-source specialist areas for companies with in-house teams. For a logistics client, our internal audit covered 120+ controls.
Planning your internal audit for FY 2027-28? Request an internal audit proposal from SCORE and ask for our Engagement Letter Checklist.
Sources
- Opinion of the Council on eligibility of cost accountants as internal auditors (ICMAI)
- Companies Act, 2013 and rules (India Code)
- Standards on Internal Audit (ICAI Internal Audit Standards Board)
This article is general information, not professional advice.
Disclaimer: This article is for general information only and does not constitute legal, financial or tax advice. Laws, rates and due dates change, and their application depends on your facts. Please consult a qualified professional before acting on it.