Internal Audit Applicability: The One Rule Most Indian Firms Miss

TL;DR

The Fundraise That Broke Compliance Overnight

A Chennai auto components company closed a working capital facility last March. The founders celebrated. The CFO updated the board deck. Nobody noticed one detail. Total borrowings had crossed ₹100 crore for eleven days before a partial repayment brought the number back down.

Eleven days. That was enough. On April 1 the company owed the law an internal auditor, and not one person in the finance team knew it. The company found out eight months later, during due diligence for its next round, when an investor’s lawyer asked a one line question: who is your internal auditor under Section 138?

Here is the uncomfortable part. Internal audit applicability is not a judgement call. It is arithmetic. Five numbers from your last financial year decide it, and the rule that governs those numbers fits on a single page. Yet finance teams at well run companies miss it every year, because the rule hides one twist that trips almost everyone.

Read the next ten minutes and you will know your own answer. And if the answer surprises you, you will also know exactly what to do next.

The One Rule, In Plain English

Section 138 says who. Rule 13 says when.

Most articles online quote Section 138 of the Companies Act 2013 and stop there. That is the miss. Section 138 only says that certain classes of companies shall appoint an internal auditor. It never names the classes. The actual triggers live in Rule 13 of the Companies (Accounts) Rules, 2014. The two work as a pair, and reading one without the other is like reading a contract without the schedule.

So the structure is simple. Section 138 creates the duty. Rule 13 defines who needs internal audit through four financial thresholds and one listing test. The moment your previous financial year touches any single trigger, the duty attaches for the current year.

The threshold table

Check your last audited financials against this table. One yes is all it takes.

Why Smart Finance Teams Still Miss It

None of the misses come from carelessness. They come from four specific blind spots, and you will probably recognise at least one.

The previous financial year blind spot

Your team tracks current numbers. The law looks backward. Internal audit applicability for this year is decided entirely by last year’s figures, so a company checking its live dashboard will always test the wrong period. The Chennai company in our opening story made exactly this error. Its current borrowings sat comfortably below ₹100 crore. Its previous year’s peak did not.

The borrowings trap

Borrowings cause more applicability misses than any other trigger. Sanctioned working capital limits get drawn and repaid all year. A festival season stock build, a large customer paying late, a bridge facility before a raise. Any of these can push outstanding bank borrowings past ₹100 crore for a week and quietly make internal audit mandatory. Your balance sheet on March 31 will never show it. Your loan statements will.

The statutory auditor myth

Plenty of founders believe their statutory auditor has this covered. Different job. The statutory audit checks your financial statements after the year ends. Internal audit examines controls, processes, and risk through the year. The law treats them as separate duties, and Section 144 actually bars your statutory auditor from doing your internal audit. If you want the full picture of what an engagement covers, PKC India’s team wrote this guide to internal audit services in India that walks through scope in detail.

Growth outpaces compliance

Fast growing companies cross thresholds mid year with no tripwire in place. Revenue jumps from ₹140 crore to ₹230 crore, everyone celebrates the growth, and the compliance calendar still reflects the smaller company. By the time someone asks the Section 138 question, the appointment is overdue. Growth is the happiest way to become non compliant. It is still non compliance.

The 60 Second Applicability Self Check

Pull up your last audited financials and your loan statements for that year. Answer five questions. Any yes means internal audit is mandatory for you right now.

1. Is the company listed on any stock exchange? Yes means mandatory, stop here.
2. Did turnover in the previous financial year reach ₹200 crore or more?
3. Did outstanding borrowings from banks or public financial institutions touch ₹100 crore or more at any point during that year? Check peak utilisation, not the closing balance.
4. Public companies only: did paid up share capital stand at ₹50 crore or more?
5. Public companies only: did outstanding deposits touch ₹25 crore or more at any point during that year?

All five answers no? You sit outside the mandatory internal audit net for now, and the voluntary section below is written for you. Any answer yes, or any answer you are not sure about? Send PKC India your last balance sheet and loan statements. The team runs this exact check against your actual numbers at no cost and returns a written verdict in one working day.

Crossed a Threshold? Here Is What Happens Next

The appointment step

The board appoints the internal auditor through a board resolution. The law keeps the qualification flexible. A chartered accountant, a cost accountant, or any other professional the board considers fit can hold the role, and the appointee can be an individual, a partnership firm, or a body corporate. An employee of the company can also serve. What the board cannot do is skip the appointment. There is no specific penalty section for this default, so the general penalty under Section 450 applies: ₹10,000 on the company and every officer in default, plus ₹1,000 for each day the default continues.

What the auditor actually does in year one

A first year engagement done well follows a clear arc. PKC India starts with a risk mapping exercise across your revenue, procurement, inventory, payroll, and compliance processes, because a risk based internal audit puts effort where failure would hurt most. The team then agrees an audit plan with your board or audit committee, runs the field work in cycles through the year, and closes each cycle with a report your management can actually act on. Recommendations get tracked to completion rather than filed away. On a recent manufacturing engagement, that approach surfaced more than thirty process and control gaps across purchase, finance, inventory, and sales in the first cycle alone.

The cost question, answered honestly

Fees follow effort, and effort follows the size and mess of your processes. Most firms, PKC included, price on person days. As a realistic market range, a single location company near the threshold line typically invests ₹2 to ₹4 lakh a year for quarterly cycles. A mid size company with multiple departments lands between ₹4 and ₹10 lakh. Large multi location operations go higher. Set that against the Section 450 penalty clock, the cost of one undetected fraud, or one stalled funding round, and the mathematics stops being a debate.

Below the Thresholds? Why Voluntary Internal Audit Wins Funding Rounds

Escaping Rule 13 does not mean you should skip the function. It means you get to adopt it on your own terms, and that choice pays in three places.

• Due diligence speed. Investors and lenders in 2026 read governance quality before they read projections. A company with a working internal audit function walks into diligence with process documentation, control evidence, and clean reconciliations already on file. Term sheets move faster when the data room answers questions before lawyers ask them.
• Fraud caught early. Vendor collusion, inventory leakage, and payroll ghosts thrive in companies growing faster than their controls. A voluntary internal audit cycle catches these while the damage is still small.
• A smoother landing when the thresholds arrive. Companies growing toward ₹200 crore turnover will cross the line eventually. Building the function early means the mandatory year feels like any other year.

PKC Management Consulting’s audit and assurance practice runs scaled down voluntary programmes built for exactly this stage, with scope and frequency matched to your size rather than a big company template forced onto a growing business.

How PKC India Closes the Applicability Gap

PKC’s engagement model attacks the applicability problem at all three points where companies get hurt.

1. Applicability assessment. You share your last audited financials and loan statements. PKC tests every trigger, including peak borrowings that year end balance sheets hide, and gives you a written applicability verdict in one working day.
2. Scoped audit plan. If the duty applies, or you choose to adopt voluntarily, the team builds a risk based plan sized to your business, agrees it with your board, and starts the first cycle within weeks rather than quarters.
3. Ongoing threshold monitoring. PKC tracks your turnover and borrowing peaks through the year, so a mid year trigger never ambushes you again. You hear about applicability from your audit partner before your investor’s lawyer brings it up.

The team pairs boutique level partner attention with proprietary audit tools that automate data extraction, which leaves more engagement hours for analysis instead of spreadsheet wrangling. Explore the full scope on PKC India’s internal audit services page and book a consultation directly from there.

FAQ: Internal Audit Applicability

Is internal audit applicable to private limited companies in India?

Yes, when the previous financial year shows turnover of ₹200 crore or more, or outstanding borrowings from banks or public financial institutions of ₹100 crore or more at any point. Private companies face no paid up capital or deposit trigger under Rule 13.

What is the turnover limit for internal audit applicability?

₹200 crore in the preceding financial year, for both private companies and unlisted public companies. Turnover means gross revenue recognised in the profit and loss account from sale of goods or supply of services or both.

Who can be appointed as an internal auditor under Section 138?

A chartered accountant, a cost accountant, or any other professional the board decides. The appointee may be an individual, a partnership firm, or a body corporate, and may also be an employee of the company. The board makes the appointment by resolution.

Is internal audit mandatory for LLPs and startups?

Section 138 applies to companies, so LLPs sit outside the mandate. Startups registered as companies follow the same thresholds as everyone else. Cross a Rule 13 trigger in the previous financial year and the duty applies regardless of startup status.

What is the penalty for not appointing an internal auditor?

The Act prescribes no specific penalty, so Section 450 applies. The company and every officer in default face a penalty of ₹10,000, with a further ₹1,000 per day while the default continues, subject to the caps in that section.

Can the statutory auditor also act as the internal auditor?

No. Section 144 of the Companies Act 2013 bars the statutory auditor from providing internal audit services to the same company. The two roles must stay separate to protect independence.

Your Numbers Already Know the Answer

Back to that Chennai auto components company. One applicability check later, the board appointed an internal auditor, the first audit cycle closed before the funding round did, and the investor’s lawyer moved on to duller questions. The eleven day borrowing spike stopped being a landmine and became a line item.

That is the whole lesson. Internal audit applicability is one rule and five numbers, and your last financial year already contains the answer. The only real risk is not checking.

So check. Send PKC India your last balance sheet and loan statements today, and get your written applicability verdict within one working day. Your next board meeting deserves a compliance update, not a compliance surprise.