Appointment of Internal Auditor Under Companies Act

Appointment of Internal Auditor Under Companies Act, 2013

Table of Contents:-

The appointment of an internal auditor is mandatory for specified classes of companies under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014.

Internal audit provides an independent review of an organisation’s risk management, internal controls, governance and operational processes. For companies meeting the prescribed criteria, understanding the applicability, eligibility and procedure for appointing an internal auditor is therefore an important corporate compliance requirement.

Companies requiring professional support may also refer to our Internal Audit Services in India.

Who is an Internal Auditor?

An internal auditor is a professional appointed to independently evaluate and review an organisation’s processes, internal controls, risk management systems and governance framework.

The internal auditor helps management and the Board identify weaknesses in processes and controls and recommends measures for improvement.

For a broader understanding of the function, see our guide on What Is Internal Audit?.

What Does an Internal Auditor Examine?

Depending upon the scope of engagement, an internal auditor may review:

internal financial and operational controls;
risk management processes;
statutory and regulatory compliance;
procurement and vendor management;
inventory controls;
revenue and receivables;
expenditure and payments;
payroll;
fixed assets;
information technology controls;
fraud-risk areas;
management reporting; and
adherence to company policies.

The precise scope depends upon the nature, size and risk profile of the organisation.

Legal Provision for Appointment of Internal Auditor

The principal provision governing internal audit under the Companies Act is Section 138 of the Companies Act, 2013.

Section 138 of the Companies Act, 2013

Section 138 requires prescribed classes of companies to appoint an internal auditor to conduct internal audit of the company’s functions and activities.

The detailed applicability criteria are prescribed under Rule 13 of the Companies (Accounts) Rules, 2014.

For current statutory provisions and amendments, companies should refer to the Ministry of Corporate Affairs.

Which Companies Are Required to Appoint an Internal Auditor?

Rule 13 specifies the classes of companies required to appoint an internal auditor.

Every Listed Company

Every listed company is required to appoint an internal auditor.

Unlisted Public Companies

An unlisted public company is covered where it meets any of the prescribed criteria during the relevant preceding financial year, including the applicable thresholds relating to:

paid-up share capital;
turnover;
outstanding loans or borrowings from banks or public financial institutions; or
outstanding deposits.

Private Companies

Specified private companies are also required to appoint an internal auditor where prescribed thresholds relating to turnover or outstanding loans/borrowings are met.

Important Applicability Point

Internal audit applicability should be examined based on the company’s legal status and the applicable financial thresholds for the relevant period.

Companies should therefore review applicability every year rather than assuming that internal audit is permanently applicable or permanently non-applicable.

Internal Audit Applicability Thresholds

Broadly, Rule 13 prescribes the following criteria.

Unlisted Public Company

Internal audit is applicable where the prescribed criteria include:

paid-up share capital of ₹50 crore or more during the preceding financial year;
turnover of ₹200 crore or more during the preceding financial year;
outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year; or
outstanding deposits of ₹25 crore or more at any point during the preceding financial year.

Private Company

Internal audit is applicable where the prescribed criteria include:

turnover of ₹200 crore or more during the preceding financial year; or
outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point during the preceding financial year.

Because corporate law provisions may be amended, the latest Act, Rules and notifications should always be verified before determining applicability.

Who Can Be Appointed as an Internal Auditor?

Section 138 provides flexibility regarding who may conduct internal audit.

Chartered Accountant

A Chartered Accountant may be appointed as internal auditor.

Cost Accountant

A Cost Accountant may also be appointed.

Other Professional

The Board may appoint another professional considered appropriate for conducting the internal audit, subject to the applicable legal requirements and the nature of the engagement.

Individual, Firm or Body Corporate

Rule 13 permits the internal auditor to be an individual, partnership firm or body corporate, subject to applicable requirements.

Can an Employee Be an Internal Auditor?

The Rules provide that the internal auditor may or may not be an employee of the company.

However, appropriate independence, objectivity and professional competence remain fundamental to an effective internal audit function.

Can the Statutory Auditor Act as Internal Auditor?

The statutory auditor of a company should not undertake internal audit services where prohibited under the Companies Act, including the restrictions applicable to services rendered by statutory auditors.

Accordingly, statutory audit and internal audit responsibilities need to be evaluated separately before appointment.

This distinction is also why our page on Appointment of Auditor in Company addresses a different subject from the present guide.

Role of the Board and Audit Committee

Internal auditor appointment should not be viewed merely as appointment of a professional. The governance framework surrounding the internal audit function is equally important.

Determining Scope and Methodology

Under the applicable Rules, the Audit Committee or Board, in consultation with the internal auditor, formulates the:

scope;
functioning;
periodicity; and
methodology

for conducting internal audit.

This helps ensure that internal audit focuses on areas relevant to the organisation’s risks and operations.

Process for Appointment of Internal Auditor

The exact corporate procedure should be determined considering the company’s circumstances and applicable provisions. Broadly, the following steps may be involved.

Determine Internal Audit Applicability

The company should first establish whether Section 138 and Rule 13 apply based on its status and financial thresholds.

Identify a Suitable Internal Auditor

Management or the Board should identify a professional having appropriate experience and competence considering the company’s:

industry;
size;
business processes;
risk profile;
technology environment; and
regulatory requirements.

Obtain Consent and Engagement Terms

The proposed internal auditor’s willingness to act should be obtained and the commercial and professional terms of engagement finalised.

The engagement should clearly identify matters such as:

scope;
responsibilities;
reporting structure;
timelines;
confidentiality;
access to information; and
professional fees.

Convene Board Meeting

The proposed appointment should be placed before the Board in accordance with the applicable corporate procedures.

The Board should consider and approve the appointment and relevant terms.

Pass the Necessary Board Resolution

The Board resolution should appropriately record the appointment of the internal auditor and other relevant matters.

Evaluate Applicable ROC Filing Requirements

The company should separately determine whether any ROC filing, including Form MGT-14 where applicable, is required considering the relevant provisions, exemptions and the company’s legal status.

This is preferable to treating MGT-14 as automatically applicable in every internal auditor appointment.

Issue Appointment / Engagement Letter

After approval, an appropriate appointment or engagement letter should be issued to the internal auditor.

Finalise Internal Audit Scope and Plan

Following appointment, the Board/Audit Committee and internal auditor should establish the scope, periodicity and methodology of the audit.

Our guide on Internal Audit Planning explains this stage in detail.

Documents Generally Required for Appointment

Depending upon the circumstances, documentation may include:

proposed internal auditor’s consent;
profile or credentials of the internal auditor;
Board meeting notice and agenda;
Board resolution;
appointment/engagement letter;
agreed scope of internal audit;
audit plan; and
applicable ROC documentation, if any.

Maintaining proper documentation is important for establishing both statutory compliance and appropriate governance.

Appointment of Internal Auditor vs Statutory Auditor

These two appointments should not be confused.

Internal Auditor

An internal auditor primarily reviews internal controls, processes, risk management and operational effectiveness.

Statutory Auditor

A statutory auditor conducts the statutory audit of financial statements and expresses an independent audit opinion in accordance with applicable law and auditing standards.

Therefore, the two roles have different objectives, statutory frameworks and responsibilities.

Internal Auditor Appointment for Foreign-Owned Companies in India

Indian subsidiaries of foreign groups should also evaluate their internal audit requirements under Indian law.

Even where statutory thresholds do not make internal audit mandatory, a foreign parent may require internal audit as part of its global governance or risk-management framework.

Areas Often Relevant for Foreign-Owned Companies

Internal audit may cover:

intercompany transactions;
transfer pricing processes;
FEMA compliance;
related-party transactions;
procurement controls;
payroll;
GST and TDS compliance;
group reporting;
information security;
delegation of authority; and
reconciliation between local and group financial reporting.

Accordingly, voluntary internal audit can also provide significant governance value.

Mandatory vs Voluntary Internal Audit

Internal audit is not useful only when legally mandatory.

Mandatory Internal Audit

Companies satisfying the prescribed criteria under Section 138 and Rule 13 are required to comply with the statutory internal audit requirements.

Voluntary Internal Audit

Other organisations may voluntarily establish an internal audit function to:

strengthen controls;
identify operational inefficiencies;
manage risks;
detect control gaps;
improve compliance;
prepare for expansion; and
strengthen corporate governance.

How EzyBiz India Can Assist

EzyBiz India Consulting LLP assists Indian companies, subsidiaries of foreign companies and other businesses with risk-focused internal audit assignments.

Our internal audit approach can cover planning, risk assessment, review of processes and controls, compliance testing, identification of observations and practical recommendations to management.

For professional support, visit our Internal Audit Services in India.

Frequently Asked Questions

Is appointment of an internal auditor mandatory for every company?

No. Internal audit is mandatory for prescribed classes of companies meeting the conditions under Section 138 and Rule 13. Other companies may undertake internal audit voluntarily.

Can a Chartered Accountant be appointed as internal auditor?

Yes. Section 138 recognises a Chartered Accountant, Cost Accountant or such other professional as may be decided by the Board, subject to the applicable provisions.

Can an employee of the company act as internal auditor?

The applicable Rules provide that an internal auditor may or may not be an employee of the company.

Can a firm be appointed as internal auditor?

Rule 13 provides for appointment of an internal auditor who may be an individual, partnership firm or body corporate, subject to the applicable requirements.

Who decides the scope of internal audit?

The Audit Committee or Board, in consultation with the internal auditor, formulates the scope, functioning, periodicity and methodology of internal audit.

Is MGT-14 mandatory for appointment of an internal auditor?

The ROC filing requirement should be evaluated based on the applicable provisions, exemptions and legal status of the company rather than assuming that MGT-14 is required in every case.

Is internal audit compulsory for a private limited company?

It can be. A private company meeting the prescribed turnover or borrowing criteria under Rule 13 is required to appoint an internal auditor.

Can a company appoint an internal auditor voluntarily?

Yes. Companies outside the mandatory applicability criteria may establish an internal audit function voluntarily as part of their risk-management and governance framework.

Related Services & Guides

Prepared By
Anil Agrawal, Chartered Accountant
EzyBiz India Consulting LLP, New Delhi

Last Updated
29 August 2026

Disclaimer
This article is intended for general informational purposes only. Applicability and procedural requirements should be verified with the latest provisions of the Companies Act, 2013, applicable Rules, notifications and MCA requirements before taking any action.

Appointment of Internal Auditor