The Applicability Classes
Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 requires internal audit for: every listed company; every unlisted public company with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public deposits of ₹100 crore or more; and every private company with turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or financial institutions of ₹100 crore or more. The thresholds are tested against the financial statements of the preceding financial year.
The Appointment and Independence
The internal auditor may be an employee of the company or an external firm. The audit committee or the board must approve the appointment and the remuneration. The internal auditor should report functionally to the audit committee and administratively to the managing director or CEO. A reporting line that places the internal auditor under the CFO compromises independence.
The Risk-Based Plan
The internal audit plan should be derived from the company’s risk assessment, not from a standard checklist. The plan should identify: the auditable units; the risk rating of each unit; the audit frequency; the resource allocation; and the reporting timeline. The audit committee should approve the plan before the year begins and review the progress quarterly.
The Scope
The scope should cover: the effectiveness of internal controls; the reliability of financial reporting; the compliance with laws and regulations; the safeguarding of assets; and the efficiency of operations. For RPT-intensive groups, the internal audit should specifically test the RPT approval chain, the Section 184 disclosures, and the Section 186 headroom computations.
The Reporting and Remediation
The internal auditor should issue a report for each audit with findings, risk ratings, and management responses. The audit committee should track the remediation of high-risk findings and close them within the agreed timeline. A finding that is repeated across two audit cycles is a governance failure, not an audit finding.
Documentation for the Audit Committee
The committee should receive: the approved internal audit plan; the progress report; the summary of findings; the management response; the remediation tracker; and the follow-up report on previous findings. The committee’s minutes should record the specific findings discussed and the direction given.
Call to Action: For internal audit plan design, audit committee reporting, or Section 138 applicability review, contact office@anujdesaiassociates.com or 9619456656. Website: https://anujdesaiassociates.com. LinkedIn: linkedin.com/in/ca-anuj-desai-122547230.