Internal audit applicability as per Companies Act 2013

Internal audit plays a vital role in the day to day operations and functioning of the company. Companies Act, 2013 and its rule thereof have prescribed many companies who are mandatorily required to adopt internal audit system.

Some of the main objectives of internal audit are highlighted hereunder –

• To evaluate the company’s internal controls;
• To ensure complete compliance with laws, rules and regulations;
• To evaluate the risk management system;
• To establish better procedures and policies;
• To ensure adequate compliance of the law;
• To protect the interest of the shareholders;
• To ensure integrity and accountability; etc.

The present article provides a complete briefing on the applicability of internal audit; scope of internal audit; qualification of the internal auditor; appointment of the internal auditor; types of internal audit; penalty for non-compliance with the internal audit and relevant FAQs.

Applicability of Internal audit under the Companies Act, 2013

Provisions of section 138 of the Companies Act, 2013 read with rule 13 of the Companies (Accounts) Rules, 2014 prescribes the internal audit in specified companies. Accordingly, the following companies are required to undertake internal audit –

Scope of internal audit –

Notably, the scope of internal audit is not prescribed under the Companies Act, 2013 or rules made thereunder.

However, as per rule 13(2) of the Companies (Accounts) Rules, 2014, the audit committee of the company/ board together with the internal auditor will formulate the scope, periodicity, functioning and methodology for conducting the internal audit of the company.

Qualification of internal auditor –

According to section 138(1) of the Companies Act, 2013, the companies who are required to carry out the internal audit needs to appoint an internal auditor. Qualification of the internal auditor shall be either –

• Chartered Accountant (whether engaged in the practice or not); or
• Cost Accountant (whether engaged in the practice or not); or
• Other professional as may be decided by the Board.

It is important to note here that, as per provisions specified under section 144(b) of the Companies Act, 2013, the ‘statutory auditor’ of the company cannot be appointed as the ‘internal auditor’ of the company. In nut-shell, statutory auditor and internal auditor cannot be same.

Further, as per the explanation to rule 13 of the Companies (Accounts) Rules, 2014, an employee of the company can also be appointed as an internal auditor.

Appointment of internal auditor

The procedure for the appointment of an internal auditor are highlighted hereunder –

1. Obtain a written consent and a certificate from the proposed internal auditor stating his eligibility for appointment as an internal auditor as per the provisions of the Companies Act, 2013;

2. Issue a notice for calling a board meeting for the appointment of the internal auditor and also fixing the remuneration thereof of the internal auditor;

3. Hold the meeting of the board of directors;

4. Authorize the company secretary/ any director to sign and file the relevant form with the Registrar of the Companies (ROC);

5. Prepare the draft minutes and circulate the same within 15 days of the completion of the Board Meeting to all the directors for their comments;

6. File a certified copy of the Board’s resolution relating to the approval of the appointment of an internal auditor. Such copy is to be filed with the Registrar of the company in Form MGT 14 under section 117 of the Companies Act, 2013 along with the prescribed fee (applicable only to a public company). It is to be filed within 30 days from the date of passing of the Board’s resolution;

7. Issue an appointment letter to the appointed internal auditor.

Types of internal audit

Some types of internal audit are highlighted and briefed hereunder –

• Compliance audit –

Evaluation of timely and adequate compliance of the company with applicable rules and regulations is verified.

• Financial audit –

Financial segment of the company is analyzed and verified here.

• Environmental audit –

Environmental audit is basically carried out to analyze the impact of the company’s operations on the environment. Further, assessment of due compliance with applicable environmental law and regulations is also verified.

• Technology or IT audit –

Technology or IT audit comprises of assessment and evaluation of the technological infrastructure of the company.

• Operational audit –

Operational audit verifies the effectiveness and efficiency of a particular department of the company. It includes analysis of organizational structure, management as well as security of staff, accuracy of data, etc.

• Performance audit –

Performance audit evaluates the performance of specific team, employee, department, etc.

• Management audit;

Management structure and working of the company is examined and analyzed.

• Investigation audit –

Investigation audit are aimed at investigation of targeted specific area. The main purpose is timely detection of suspected errors/ frauds.

Penalty for non-compliance with internal audit provisions 

Companies Act doesn’t provide a specific penalty for non-compliance with the provisions relating to internal audit. Accordingly, the general penalty prescribed under section 450 of the Companies Act, 2013 will be levied as under –

• Company and every officer of the company or such other person in default shall be liable to a penalty of INR 10,000;
• In case of continuing contravention, an additional penalty of INR 1,000 per day subject to a maximum of INR 2 Lakhs in case of company and INR 50,000 in case of officer/ any other person in default.

FAQ relating to internal audit under the Companies Act, 2013

Some of the FAQs relating to internal audit as per the Companies Act, 2013 and rules made thereunder are summarized hereunder –

1. Is internal audit mandatory as per Companies Act, 2013?

Internal audit is mandatory for the following specified companies –

• Every listed company;
• Every unlisted public company satisfying any of the following condition;
  • Paid up share capital of INR 50 Crore or more during the preceding Financial Year; or
  • Turnover of INR 200 Crore or more during the preceding Financial Year; or
  • Outstanding loans/ borrowings from banks/ public financial institutions exceeding INR 100 Crores or more at any point of time during the preceding Financial Year; or
  • Outstanding deposits of INR 25 Crores or more at any point of time during the preceding Financial Year.
• Every private company satisfying any of the following condition;
  • Turnover of INR 200 Crore or more during the preceding Financial Year; or
  • Outstanding loans/ borrowings from banks/ public financial institutions exceeding INR 100 Crores or more at any point of time during the preceding Financial Year.

2. What is internal audit as per the Companies Act, 2013?

Internal audit of the company is basically the process to evaluate and analyze the internal controls, processes, methods and practices of the company. It enables to check the effectiveness of the operational standards framed and practiced by the company.

3. What is an internal audit and its advantages?

An internal audit is basically the evaluation of all the aspects of the organization. It covers all the internal aspects of the organizations like accounting, compliance, operations, internal controls, financial, etc.

The major advantage of internal audit is that statutory audit happens only once at the end of the year, whereas, internal audit can be conducted at any specific interval i.e. weekly, monthly, quarterly, etc.

4. Who can be internal auditor Companies Act, 2013?

As per section 138(1) of the Companies Act, 2013, an internal auditor can be either a Chartered Accountant or a Cost Accountant or such other professional as decided by the Board.

5. Is internal audit mandatory for companies?

Internal audit is mandatory for the companies as specified under rule 13(1) of the Companies (Accounts) Rules, 2014.

6. Do small companies need internal audit?

Internal audit is mandatory for the companies who satisfies the conditions prescribed under rule 13(1) of the Companies (Accounts) Rules, 2014. Hence, if the small companies doesn’t satisfy the conditions, then they are not required to carry out the internal audit.

7. What are 3 types of internal audits?

Important types of internal audits are compliance audit; financial audit; information technology audit; operational audit; etc.

8. Can anyone be an internal auditor?

Any Chartered Accountant or a Cost Accountant or such other professional as decided by the Board can be an internal auditor.

9. Who is required to have internal auditor?

All the specified companies [rule 13(1) of the Companies (Accounts) Rules, 2014] are required to have internal auditor for carrying out the internal audit.

10. What are duties of internal auditor?

Notably, the Companies Act, 2013 doesn’t prescribe the duties of internal auditor. It may be governed by the mutually decided terms between the company and the internal auditor. However, some of the duties of internal auditor are highlighted hereunder –

• Analyze the risk of the company and bring them into the notice of the management;
• Gathering and analyzing all the relevant datas;
• Evaluate and analyze the policies of the organizations and make necessary changes;
• Check and analyze the compliances undertaken by the company;
• Checking and verifying the accuracy of financial data and financial report; etc. 

11. Who appoints internal auditors of a company?

The internal auditor of the company is appointed by the Board of Directors of the company via board meeting.

12. Can company secretary do internal audit?

Yes, as per the provisions of section 138 of the Companies Act, 2013, even company secretary can be appointed as internal auditor to carry out internal audit of the company.

13. What will happen if there is no internal audit?

Firstly, if the company is mandatory required to carry out the internal audit and the same is not done. Then, the company will be liable to pay penalty as per provisions of section 450 of the Companies Act. Further, if the internal audit is not happened, then such company may lack effectiveness of their risk management, internal control and governance processes.