## CARO 2020 — Clause (xiv): Internal Audit
### What Must Be Reported
Under Clause (xiv) of Paragraph 3 of CARO 2020, the statutory auditor must report on two distinct points:
1. Whether the company has an internal audit system that is commensurate with the size and nature of its business.
2. Whether the reports of the internal auditors for the period under audit were considered by the statutory auditor.
---
### Key Concepts
Commensurate means the internal audit function should be proportionate — a large, complex company needs a more robust internal audit system than a small, simple one.
The statutory auditor is not just confirming existence of internal audit — they are evaluating adequacy relative to the company's scale and operations.
The second point reinforces that statutory and internal audit are complementary: the statutory auditor should leverage and review internal audit findings, not ignore them.
### Example 1
Q (MTP 1): DOX Limited — courier services, ₹300 Cr turnover, has an internal audit department headed by Mr. G. Discuss the statutory auditor's reporting responsibility under CARO 2020 in relation to internal audit for 2023-24.
Since CARO 2020 applies to DOX Limited (no exemption qualifies), the statutory auditor must report under Clause (xiv) of Paragraph 3:
(i) Whether DOX Limited has an internal audit system commensurate with its size (₹300 Cr pan-India and international courier business) and the nature of its business (service sector, widespread operations).
(ii) Whether the reports of Mr. G (internal auditor) for 2023-24 were considered by the statutory auditor during their audit.
Note: The question of whether Mr. G's appointment was valid under Companies Act 2013 (Section 138 requirements for mandatory internal audit) is a separate matter — the reporting obligation under CARO covers both existence/adequacy and whether the statutory auditor reviewed those reports.