Internal audit is a continuous, independent appraisal of a company's operations and controls. Section 138 of the Companies Act, 2013 makes it mandatory for certain classes of companies, so that management has independent assurance on the reliability of its books and processes — separate from the statutory (external) audit under Section 139.
## 2. Companies Required to Appoint an Internal Auditor
The rule applies based on the type of company and certain financial thresholds measured in the Preceding Financial Year (P.F.Y.).
### (a) Every Listed Company
A listed company must appoint an internal auditor — no thresholds; mere listing is enough.
### (b) Unlisted Public Company
Mandatory if any one of the following is met in the P.F.Y.:
Parameter
Threshold
Paid-up share capital
≥ ₹50 crore
Turnover
≥ ₹200 crore
Outstanding loans / borrowings from banks or Public Financial Institutions (PFI)
> ₹100 crore at any point of time
Outstanding deposits
≥ ₹25 crore at any point of time
### (c) Private Company
Mandatory if any one of the following is met in the P.F.Y.:
Parameter
Threshold
Turnover
≥ ₹200 crore
Outstanding loans / borrowings from banks or PFI
> ₹100 crore at any point of time
> Tip for memory: A private company has only two triggers (turnover + borrowings). Unlisted public companies have four triggers. Paid-up capital and deposits are not triggers for private companies.
## 3. Who Sets the Scope?
The Audit Committee (if one exists) or the Board of Directors, in consultation with the internal auditor, formulates the:
Scope of work
Functioning
Periodicity
Methodology of conducting the internal audit
## 4. Transitional Provision
An existing company that becomes covered under any of the above criteria must comply with Section 138 within 6 months from the date of commencement of the section (or from the date it first becomes covered).
## 5. Who Can Be Appointed as Internal Auditor?
Any of the following may be appointed:
A Chartered Accountant (whether or not in practice)
A Cost Accountant (whether or not in practice)
Any other professional as decided by the Board
Status of the auditor: The internal auditor may or may not be an employee of the company. This is a key flexibility — it permits both in-house and outsourced internal audit.
## 6. Decision Flow
1. Identify type of company → listed / unlisted public / private.
2. Check the relevant thresholds for the immediately preceding financial year.
3. If covered → appoint within 6 months (for new coverage) or before the FY begins for ongoing compliance.
4. Decide whether to appoint an employee, an in-house team, or an external firm.
5. Board / Audit Committee, with the internal auditor, sets scope, periodicity and methodology.
Worked example
### Example 1
Example 1 — Private Company Trigger
ABC Pvt. Ltd. had during FY 2024-25: Paid-up capital ₹60 crore, Turnover ₹150 crore, Outstanding bank loans ₹120 crore, Deposits ₹40 crore.
Analysis: Private companies are tested only on turnover (≥₹200 cr) and outstanding loans (>₹100 cr). Turnover is below threshold, but outstanding loans of ₹120 cr exceed ₹100 cr. Paid-up capital and deposits are irrelevant for a private company.
Conclusion: ABC Pvt. Ltd. must appoint an internal auditor for FY 2025-26.
### Example 2
Example 2 — Unlisted Public Company
XYZ Ltd. (unlisted public) had Paid-up capital ₹30 cr, Turnover ₹180 cr, Borrowings from banks ₹50 cr, Deposits ₹30 cr in P.F.Y.
Conclusion: Deposits criterion is met. Internal audit is mandatory.
### Example 3
Example 3 — Newly Covered Company
PQR Ltd. (unlisted public) crossed the turnover threshold for the first time on 31-March-2025. When must it appoint an internal auditor?
Answer: Within 6 months from becoming covered — i.e., by 30-September-2025.
⚠️ Common exam mistakes
Applying paid-up capital or deposit thresholds to private companies — these triggers apply only to unlisted public companies.
Forgetting that a listed company has no threshold — listing alone triggers Section 138.
Treating the thresholds as current-year figures. They must be measured for the immediately preceding financial year.
Assuming the internal auditor must be an employee. He/she may be in-house OR an external professional.
Assuming only a Chartered Accountant can be appointed — Cost Accountants and other professionals are also eligible.
Confusing the 6-month transitional period (for newly covered companies) with the timelines of statutory audit appointment.
Bare-Act text Section 138 and Rule 13 · Companies Act, 2013 read with Companies (Accounts) Rules, 2014 · click to expand
Section 138 — Internal Audit:
(1) Such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company.
(2) The Central Government may, by rules, prescribe the manner and the intervals in which the internal audit shall be conducted and reported to the Board.
Rule 13 of the Companies (Accounts) Rules, 2014 — Companies required to appoint internal auditor:
(1) The following class of companies shall be required to appoint an internal auditor or a firm of internal auditors, namely:—
(a) every listed company;
(b) every unlisted public company having— (i) paid up share capital of fifty crore rupees or more during the preceding financial year; or (ii) turnover of two hundred crore rupees or more during the preceding financial year; or (iii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year; or (iv) outstanding deposits of twenty five crore rupees or more at any point of time during the preceding financial year; and
(c) every private company having— (i) turnover of two hundred crore rupees or more during the preceding financial year; or (ii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year:
Provided that an existing company covered under any of the above criteria shall comply with the requirements of section 138 and this rule within six months of commencement of such section.
Explanation.— For the purposes of this rule— (i) the internal auditor may or may not be an employee of the company; (ii) the term 'Chartered Accountant' or 'Cost Accountant' shall mean a 'Chartered Accountant' or a 'Cost Accountant', as the case may be, whether engaged in practice or not.
(2) The Audit Committee of the company or the Board shall, in consultation with the Internal Auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit.