When a company grows bigger, its financial activities also become more complex. Money flows in and out, departments expand, and decisions affect many people — investors, lenders, and employees. Because of this, Indian company law requires certain companies to conduct something called an internal audit.
In simple terms, internal audit is a system that checks whether the company’s financial and operational processes are working properly and following the rules. Let’s understand which companies must appoint an internal auditor in India, who can become one, and how the internal audit process actually works.
What Internal Audit Means in a Company
Imagine a company that has factories in several cities, large bank loans, and hundreds of employees handling purchases, payments, and inventory. If no one regularly checks whether systems are working properly, mistakes or irregularities may go unnoticed.
This is where internal audit comes in.
Internal audit is a regular internal check of the company’s activities, records, and financial systems. The goal is to see whether the company’s operations are:
- working efficiently
- following company policies
- complying with legal requirements
Unlike the statutory audit, which mainly verifies financial statements for external reporting, internal audit focuses more on improving the company’s internal processes and controls. In practice, internal audit often looks at areas like:
- purchase processes
- inventory management
- payment approvals
- risk controls
- compliance procedures
For large companies, this internal check becomes very important.
Companies That Must Appoint an Internal Auditor
Indian company law requires certain companies to appoint an internal auditor based on their size and financial activity. Let’s understand this category by category.
1. Listed Companies
Any company whose shares are listed on a stock exchange must appoint an internal auditor. Listed companies handle public money from thousands of investors. Because of this, stronger internal monitoring is necessary. So, if a company is listed on the stock market, internal audit becomes compulsory regardless of its size.
2. Unlisted Public Companies (Large Companies)
Some unlisted public companies must also appoint an internal auditor if they cross certain financial levels. A company falls into this category if any one of the following situations existed during the previous financial year.
Paid-up Share Capital
If the company had paid-up share capital of ₹50 crore or more, it must appoint an internal auditor. Paid-up share capital simply means the amount of money shareholders have invested in the company through shares.
Turnover
If the company’s annual sales cross ₹200 crore, internal audit becomes mandatory. For example, if a manufacturing company sold goods worth ₹230 crore in the previous year, it must appoint an internal auditor.
Bank Loans or Borrowings
If the company had loans from banks or public financial institutions exceeding ₹100 crore at any point during the year, it must conduct an internal audit. Notice an important point here. The rule looks at any moment during the year, not just the year-end balance. For instance, a company may have taken a ₹110 crore loan temporarily during the year and later repaid part of it. Even in that case, internal audit requirements can apply.
Public Deposits
If the company had public deposits of ₹25 crore or more at any time during the year, internal audit becomes compulsory. Public deposits refer to money accepted from the public under deposit schemes allowed by company law.
3. Private Companies (Very Large Ones)
Most small private companies do not require internal audits. But once a private company becomes very large, internal audits become necessary. This happens when either of these conditions existed during the previous financial year.
High Turnover
If the company’s annual turnover reached ₹200 crore or more, it must appoint an internal auditor. For example, a fast-growing technology company generating ₹240 crore in revenue would fall into this category.
Large Bank Borrowings
If the company’s loans from banks or financial institutions exceed ₹100 crore at any point during the year, internal audit becomes mandatory. Again, the rule looks at the highest loan level during the year, not just the closing balance.
Time Limit for Existing Companies
Sometimes a company grows and crosses these limits later. For example, a private company’s turnover may increase beyond ₹200 crore this year.
In such situations, the company does not need to appoint the internal auditor immediately on the same day. Instead, the company is expected to comply with the internal audit requirement within six months from the time the rule becomes applicable.
Who Can Be Appointed as Internal Auditor
Now a common question beginners ask is:
Does the internal auditor have to be a Chartered Accountant?
Not necessarily.
The law allows three broad possibilities.
An internal auditor can be:
- a Chartered Accountant (CA)
- a Cost Accountant (CMA)
- another professional chosen by the company’s Board who is capable of conducting internal audit
An important detail many people miss:
A Chartered Accountant or Cost Accountant does not have to be in practice. Even someone working in a professional role can be appointed. Also, the internal auditor may or may not be an employee of the company. So companies generally choose between two models:
- External firm (for example, a CA firm)
- In-house internal audit team
Both are acceptable as long as the audit is conducted properly.
How Internal Audit Is Conducted
Internal audit does not follow exactly the same fixed format in every company. Instead, the law allows flexibility. Usually, the Audit Committee or the Board of Directors, together with the internal auditor, decides:
- what areas will be checked
- how frequently the audit will happen
- what processes will be reviewed
- how findings will be reported to management
For example, a manufacturing company may focus more on:
- inventory systems
- factory cost controls
- supplier payments
Whereas a technology company might focus more on:
- project expenses
- revenue recognition
- internal approval processes.
The idea is to design an audit system that suits the size and nature of the company.
Example
Let’s look at a simple situation.
XYZ Steel and Aluminium Ltd is a listed company that manufactures steel and operates across India. For the financial year ending 31 March 2023, the company hired an external Chartered Accountant firm, MNP & Co. LLP, as its internal auditor.
Now the company plans to build a strong in-house internal audit team for the next year.
Can it stop using the CA firm?
Yes, it can.
If the company creates an internal audit system that is appropriate for its size and operations, it is allowed to discontinue the external chartered accountant and rely on its internal team. The law only requires that internal audit exists, not that it must always be outsourced.
Why Internal Audit Matters for Large Companies
From practical experience, internal audit is not just a legal requirement. Many companies discover small operational problems through internal audits that would otherwise remain hidden. Common issues identified include:
- duplicate vendor payments
- inventory mismatches
- weak approval systems
- inefficient processes
Fixing these early often saves companies significant money and trouble later. That’s why large companies treat internal audits not only as compliance, but also as a management improvement tool.
Conclusion
Internal audit is a system that helps companies regularly examine their internal operations, financial processes, and controls. Under Indian company law, internal audit becomes mandatory mainly for:
- all listed companies
- large unlisted public companies
- very large private companies
The internal auditor may be a Chartered Accountant, Cost Accountant, or another professional, and the role may be performed either by an external firm or an internal team. For growing companies, internal audit plays an important role in ensuring that systems remain strong as the business expands.
Understanding this concept early helps beginners see how corporate governance and financial oversight work inside Indian companies.
