Critical Analysis of Internal Audit Provisions in Companies Act 2013

CS Bilu Balakrishnan

This write-up is all about the Internal Audit provisions of Companies Act 2013, read with relevant rules notified by the Govt. of India (erstwhile Ministry of Corporate Affairs). An attempt to critically interpret the provisions in the Rules Vs. Act is made. At the conclusion, few suggestions to improve the effectiveness of the provisions are also added.

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

The scope of internal auditing within an organization is broad and may involve topics such as an organization’s governance, risk management and management controls over: efficiency/effectiveness of operations (including safeguarding of assets), the reliability of financial and management reporting, and compliance with laws and regulations.

Internal auditing may also involve conducting proactive fraud audits to identify potentially fraudulent acts; participating in fraud investigations under the direction of fraud investigation professionals, and conducting post investigation fraud audits to identify control breakdowns and establish financial loss.

The concept of internal audit was not expressly provided in the 1956 Act, but, was parked in Companies (Auditor’s Report) Order, 2003 (CARO). But the 2013 Act has an express provision about internal audit recognizing the utility of such an audit in terms of better internal control and corporate governance.

Internal Audit provisions in Companies Act 2013 – Section 138:

As per Section 138 of the 2013 Act, such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company.

Further, it is also stated that the Central Government may, by rules, prescribe the manner and the intervals in which the internal audit shall be conducted and reported to the Board.

Thus, we were keenly waiting for the details of “such class or classes of companies as may be prescribed”; and “manner and the intervals” of the internal audit, in the Rules.

Internal Audit provisions in Companies (Accounts) Rules 2014 – Rule 13:

Applicability (Rule 13(1)):

The following class of companies shall be required to appoint an internal auditor or a firm of internal auditors, namely:-

(a) every listed company;

(b) every unlisted public company having-

(i) paid up share capital of fifty crore rupees or more during the preceding financial year; or

(ii) turnover of two hundred crore rupees or more during the preceding financial year; or

(iii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year; or

(iv) outstanding deposits of twenty five crore rupees or more at any point of time during the preceding financial year; and

(c) every private company having-

(i) turnover of two hundred crore rupees or more during the preceding financial year; or

(ii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year.

For an existing company covered under any of the above criteria shall, it shall then comply with the requirements of section 138 and this rule within six months of 1^st April, 2014.

Interesting Explanation in the Rule 13 of Companies (Accounts) Rules, 2014:

We can notice few interesting explanation under the Rule 13, which are detailed below:

Internal auditor can even be an Employee of the company:

The Rule states that “the internal auditor may or may not be an employee of the company”. Thus, w.e.f 1^st April, 2014 / FY 2014-15, companies which have to conduct internal audit, as per the provisions of Companies Act 2013, can do it even through an employee of the company. One side the new law speaks about the “independency” of auditors, and as the readers may know that internal audit is a more important tool, than statutory audit, can the Internal Auditor be an employee of the company ?, then what is the relevance of “concept of independency” ?. The internal auditor has to look into the internal control aspects and of course detection of fraud. Does the “Employee Internal Auditor” will be empowered to look into such aspects ?.

This new provision may provoke companies to appoint their own employees as Internal Auditors, even though they are professionals.

the term “Chartered Accountant” shall mean a Chartered Accountant whether engaged in practice or not:

Another explanation given under Rule 13 is about the term “Chartered Accountant”. But, I am doubted as how such an explanation came into picture in Rule 13, because, there is no mentioning about the term “Chartered Accountant” anywhere in Rule 13. I feel there is some drafting error.

Any way, we may proceed to interpret. For the purpose of internal auditing, a CA need not be a PCA (Practicing Chartered Accountant). Thus, even a CA who is in service / employment can hereafter be appointed as the Internal Auditor of the company. The question is whether a CA in employment & CA in practice can be treated as equally as far as the audit experience gained is considered.

I invite readers’ attention to Section 138 (1) which states that the internal audit can be conducted by a chartered accountant or a cost accountant, or such other professional as may be decided by the Board. Thus if the internal auditor is a CA, then he/she can be either a CA in employment & CA in practice, but, if the internal auditor is a Cost Accountant, then he/she shall be Cost Accountant in practice, and not in employment. Thus there is lack of co-ordination between Section 138 and Rule 13.

Further the expression “such other professional as may be decided by the Board”, used in Section 138 is very open. Even though other professionals like Company Secretaries can utilize the internal audit as a professional opportunity as an area of practice, the Companies Act 2013 lacks the definition of the term “professional”. Thus, if the Board of a company feels that the company’s internal audit is to be done by a Doctor / Engineer, will it satisfy the law ?.

The Audit Committee of the company or the Board shall, in consultation with the Internal Auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit:

Section 138 states that “the Central Government may, by rules, prescribe the manner and the intervals in which the internal audit shall be conducted and reported to the Board.” When it came to the rule, explanation to Rule 13 runs as “the Audit Committee of the company or the Board shall, in consultation with the Internal Auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit.” Thus, neither the Act nor the Rules is specifically saying about the manner or periodicity of internal audit.

Let me conclude, by placing few suggestions, in order to make the internal audit function more effective:

1. The applicability limit set is very high, and it should be brought down;
2. The Internal Auditor (who is not in the employment of the company) shall be a Practising Chartered Accountant or a Practising Cost Accountant or Practising Company Secretary (Provided that in the case of a Cost Accountant or Company Secretary, they should have been in three years of practice).
3. The periodicity of audit shall be on a quarterly basis (The Board may prescribe for a lesser period).
4. The Internal Auditor shall submit his report to the Chairman of Audit Committee, and when there is no such committee to the Board of Directors. The copy of the report shall also be provided to the Statutory Auditor of the company.
5. The Internal Auditor or a senior representative of the firm of Internal Auditor shall attend the Audit Committee meetings, and if invited to the AGM also.
6. The Board shall on the recommendation of the audit committee give written terms of reference to the Internal Auditor.
7. The Internal Auditors shall comply with the auditing standards of the respective Professional Institute they belong to and adhere to their code of conduct.

click here to read more about internal audit applicability