Does Your Company Need an Internal Auditor? A Guide to Section 138

Every company in India knows about the statutory audit, the annual check required of all companies. Fewer know about a second requirement: internal audit under Section 138 of the Companies Act, 2013. Unlike statutory audits, this one doesn’t apply to everyone. It applies once a company crosses specific size or borrowing thresholds.

This is a plain breakdown of who needs one, who’s exempt, and what happens on non-compliance.

The Legal Basis

Section 138 requires certain classes of companies to appoint an internal auditor to review the company’s functions and activities. The exact classes are defined in Rule 13 of the Companies (Accounts) Rules, 2014. Together, these two provisions determine applicability.

Who Must Comply

1. Listed companies, always Any company listed on a stock exchange in India requires internal audit. No turnover or capital threshold applies; listing status alone triggers it.

2. Unlisted public companies An internal auditor is required if the company crossed any one of these thresholds in the preceding financial year:

• Paid-up share capital of ₹50 crore or more
• Turnover of ₹200 crore or more
• Outstanding loans/borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the year
• Outstanding deposits of ₹25 crore or more at any point during the year

3. Private companies The rules are lighter here since paid-up capital doesn’t apply. A private company is covered if either of these applies in the preceding financial year:

• Turnover of ₹200 crore or more
• Outstanding loans/borrowings from banks or public financial institutions exceeding ₹100 crore

Deposits aren’t a trigger for private companies; that criterion applies only to unlisted public companies.

Who’s Exempt

• Smaller private and unlisted public companies below all the above thresholds aren’t required to appoint an internal auditor, though many do so voluntarily for better governance.
• LLPs and partnership firms fall outside Section 138 entirely; it applies only to companies registered under the Companies Act, 2013.
• Section 8 (charitable) companies aren’t automatically exempt. If they meet the Rule 13 thresholds, they must comply like any other company.
• IFSC public/private companies are covered only if their articles of association provide for it.

A Simple Way to Remember the Numbers

The thresholds follow a rough pattern: turnover (₹200 crore) is roughly double the loan/borrowing limit (₹100 crore), and paid-up capital (₹50 crore) is roughly half of that again. This isn’t a strict rule, but it helps in recalling the figures.

One detail that often gets missed: for loans and deposits, the test is whether the threshold was crossed at any point during the year, not just at year-end. A company that took on a large loan mid-year and repaid it before March 31 still counts as having crossed the threshold.

Who Can Be the Internal Auditor

The internal auditor can be a Chartered Accountant, Cost Accountant, or any other professional the Board decides on, practising or not. They don’t need to be an employee; an external professional or firm can be appointed as easily as an in-house resource.

One restriction applies: the statutory auditor cannot also serve as the internal auditor. The two roles are meant to stay independent.

Timing for Newly Covered Companies

A company crossing a threshold for the first time isn’t expected to comply overnight. It gets six months from the date the criteria become applicable to appoint an internal auditor and set up the internal audit process.

What the Internal Audit Covers

The Act doesn’t prescribe a fixed scope for internal audit. Rule 13 leaves that to the Audit Committee (or the Board, if there’s no Audit Committee), which works with the internal auditor to decide scope, methodology, frequency, and reporting. This flexibility allows the internal audit to be tailored to the company’s actual risks rather than following a one-size-fits-all checklist.

Penalty for Non-Compliance

Section 138 doesn’t specify its own penalty. The general penalty provision under Section 450 applies instead, with a fine of up to ₹2 lakh for the company and ₹50,000 for officers in default, plus an additional daily fine for continuing default.

Bottom Line

Internal audit applicability isn’t only a “big company” problem. A fast-growing private company can cross the ₹200 crore turnover or ₹100 crore borrowing mark faster than expected, especially in a strong growth year. It’s worth checking these numbers against last year’s financials at each close, rather than assuming statutory audit compliance already covers this requirement.

This is a general overview and not a substitute for professional advice — always check current MCA rules or consult a company secretary or chartered accountant for your specific situation.