Assurance · Section 138 Companies Act
Internal Audit
Services India.
Risk-based internal audit aligned to ICAI standards — IFC testing, fraud risk assessment, process efficiency review, and audit committee reporting for companies under the Section 138 mandate and beyond.
Risk
Based Approach
ICAI
Standards Aligned
IFC
Controls Testing
Sec 138
Mandate Covered
What We Audit
Internal Audit Services.
Risk-Based Internal Audit
Annual audit plan built on risk assessment — prioritising high-risk processes (procurement, revenue, payroll, treasury) and tailored to the company's sector, regulatory environment, and control maturity.
IFC Testing (Sec 143)
Design and operating effectiveness testing of Internal Financial Controls — documented Test of Controls (ToC) workpapers, control deficiency classification, and management action plan tracking.
Fraud Risk Assessment
Systematic fraud risk identification using ACFE methodology — assessing incentive, opportunity, and rationalisation factors, and designing controls to mitigate identified fraud schemes in Indian business contexts.
Process Audit
End-to-end process walkthroughs for procure-to-pay, order-to-cash, HR/payroll, and fixed assets — with control gap identification, efficiency recommendations, and implementation support.
Concurrent Audit
Real-time concurrent audit for banks, NBFCs, and high-transaction-volume businesses — monitoring daily transactions, branch operations, and KYC compliance on an ongoing basis.
Audit Committee Reporting
Structured quarterly audit committee presentations — executive summary, risk heat-map, management responses, and action tracker — formatted for board-level consumption and MCA requirements.
Applicability
Which Companies Need Internal Audit.
Section 138 of Companies Act 2013 mandates internal audit for specified classes of companies. Rule 13 of Companies (Accounts) Rules 2014 defines the thresholds — based on the previous financial year's figures.
Listed Companies
All listed companies — regardless of turnover or paid-up capital — are mandated to have an internal auditor under Section 138. The internal auditor must report to the audit committee and the board.
Unlisted Public Companies
- — Paid-up share capital ≥ ₹50 crore, OR
- — Turnover ≥ ₹200 crore, OR
- — Outstanding loans/borrowings ≥ ₹100 crore, OR
- — Outstanding deposits ≥ ₹25 crore
Private Companies
Turnover
Turnover ≥ ₹200 crore in preceding financial year
Borrowings
Outstanding loans/borrowings from banks or public financial institutions ≥ ₹100 crore
Recommendation
Companies approaching these thresholds should set up internal audit early — it signals governance maturity to investors and lenders.
Common Questions
Internal Audit FAQ.
Yes. Section 138(1) of Companies Act 2013 allows the internal auditor to be a Chartered Accountant, Cost Accountant, or any other professional — whether an employee of the company or an external firm. Most companies prefer to appoint an external CA firm as internal auditor to ensure independence. The internal auditor must not be the same firm as the statutory auditor for listed and certain other companies, due to independence requirements.
A statutory audit is a legal requirement under Companies Act 2013 — it verifies that financial statements show a true and fair view. Internal audit is an ongoing, risk-based review of business processes, controls, and governance. Statutory audit is mandatory for all companies; internal audit is mandatory only for certain larger companies under Section 138. Both serve different purposes and can be performed by different firms — in fact, for listed companies, independence standards typically require different auditors for each function.
Build your internal audit function today.
Hyderabad HQ: +91 94922 01497