Internal audit is a process through which a company checks whether it’s financial, operational, and business activities are being carried out properly. It helps the company identify errors, fraud, risks, and weaknesses in its internal control system. It also helps management to improve the overall efficiency and performance of the business.
Internal audit is not only applicable to listed companies. Certain Private Companies are also required to conduct internal audits if they meet the conditions prescribed under the Companies Act, 2013 and the relevant rules.
A Private Company may have a profitable business, experienced management and a competent finance team, yet still lose money through gaps that remain invisible in day-to-day operations. A vendor may be overbilling, inventory may be lying unused, customer collections may be delayed, employees may have excessive system access, or purchases may be made without adequate commercial evaluation. The internal auditor examines the company’s records, transactions, systems, and controls and reports the findings to the appropriate management or Board.
Even when internal audit is not compulsory by law, a Private Company may voluntarily establish an internal audit function. This can be useful for companies that have large operations, several branches, significant financial transactions, or complex business processes.
Triggering Factors for Private Limited Companies
1. Statutory Threshold Limits
Unlike listed and unlisted public companies, which are evaluated across four financial metrics including paid-up capital, turnover, borrowings, and outstanding deposits, Private Limited Companies under the Companies Act, 2013 are evaluated on only two primary parameters.
An internal audit becomes legally mandatory for a Private Limited Company if it satisfies either of two conditions during the immediately preceding financial year:
- the company’s aggregate annual turnover reaches or exceeds Rs. 200 Crores or;
- the company’s aggregate outstanding loans or borrowings from banks or Public Financial Institutions exceed Rs. 100 Crores at any point during that financial year.
It is important to note that statutory applicability for the current financial year is always evaluated based on the audited or financial figures of the immediately preceding financial year.
Shareholders’ & Investment Agreements (SHA/SSA)
In practice, internal audit appointments in Private Companies are frequently driven by investor requirements rather than legal mandates. Venture capital, private equity, and institutional investors typically mandate an independent internal audit function through specific clauses in the Shareholders’ Agreement (SHA) or Investment Agreement. In these scenarios, internal audit serves as an essential governance mechanism, providing incoming investors and founder-managers with independent visibility over capital allocation, resource utilization, and internal risk management.
Articles of Association (AOA)
A Private Company can voluntarily incorporate internal audit mandates directly into its Articles of Association (AOA). This is common among professionally managed private enterprises operating across multiple plant locations, branches, or business lines. As administrative complexity grows, senior management cannot personally monitor every departmental transaction; incorporating internal audit clauses in the AOA bakes structural oversight into the company’s corporate governance framework.
NOTE:
- In case of Specified IFSC Private Company, the internal audit shall apply only if the Articles of Association of the Company provides for the same
- The applicability of internal audit is required to be assessed afresh for each financial year based on the prescribed thresholds applicable to the immediately preceding financial year. Accordingly, crossing the threshold in one financial year does not, by itself, make the requirement permanently applicable; the prescribed criteria must be evaluated for each subsequent financial year to determine continuing applicability.
Qualification and Eligibility of an Internal Auditor
When an internal audit is applicable, the appointment must align with the provisions of Section 138 of the Companies Act, 2013. The internal auditor may be
- a Chartered Accountant (in practice or employment);
- a Cost Accountant, or;
- any other professional as determined by the Board.
An internal auditor may be an internal employee of the company or an external professional firm. Regardless of the engagement model, the appointed auditor must possess the necessary technical competence, operational insight, and objectivity required to deliver reliable assurance.
Why Statutory and Internal Audit Roles are Separate
Under Section 144 of the Companies Act, 2013, a company’s Statutory Auditor is explicitly barred from providing internal audit services to the same entity. This prohibition preserves auditor independence by eliminating self-review threats.
For example, if a statutory auditor conducts the internal audit and designs or recommends a new control over revenue recognition, they would later be required during the statutory audit—to objectively audit and express an opinion on that exact same control. Evaluating one’s own work creates an inherent conflict of interest. By enforcing strict separation between internal assurance and external statutory reporting, the law ensures that external financial statements receive truly independent evaluation.
Practical Case Example: Procurement Oversight
Consider a Private Company with annual procurement spending of Rs. 50 Crores Management relies on system-driven controls, assuming that because every purchase invoice receives routine approval and flows through the ERP system, the procurement department is operating effectively.
During an internal audit, the auditor performs data analytics on vendor transactions and spots an anomaly: a single supplier receives an unusually high share of purchase orders. Further review reveals that individual purchase orders are consistently issued just below the spending threshold that triggers mandatory multi-vendor bidding. While every single purchase order appears compliant on a standalone basis, an overarching analysis reveals a clear pattern of bid-splitting to bypass approval matrices. The internal audit highlights this systemic exposure to management, recommending enhanced controls around vendor onboarding, aggregate spend monitoring, and revised authorization thresholds.
Conclusion
For a private enterprise, an internal audit should be evaluated through the lens of business complexity, operating footprint, and risk exposure, rather than purely as a statutory compliance box to check. As operations expand, a well-structured internal audit function serves as a proactive strategic shield: identifying hidden leaks, protecting profit margins, and strengthening long-term enterprise governance.
CLICK HERE DOWNLOAD PDF
Disclaimer: This article provides general information existing at the time of preparation and we take no responsibility to update it with the subsequent changes in the law. The article is intended as a news update and Affluence Advisory neither assumes nor accepts any responsibility for any loss arising to any person acting or refraining from acting as a result of any material contained in this article. It is recommended that professional advice be taken based on specific facts and circumstances. This article does not substitute the need to refer to the original pronouncement.
