Your auditor is about to sign one document that reads your company's compliance record back to you, line by line, in front of every bank, investor and future acquirer who will ever open your file. It is called the CARO report, and for the financial year that just ended on 31 March 2026 it carries 21 separate questions your auditor must answer in writing. Miss on any of them and the answer is not "no comment"; it is a recorded remark that a diligence team reads before it reads anything else. And the rules on who even receives this report changed on 1 December 2025, which means a lot of founders think they are exempt when they are not.
This is the guide to CARO 2020 applicability for FY 2025-26: who is covered after the new small company limits, what all 21 clauses actually test, what an adverse remark costs you in real terms, and the checklist to be CARO-ready before your audit report is signed.
TL;DR: CARO 2020, FY 2025-26
Deadline: The CARO report is attached to your statutory audit report, which feeds Form AOC-4, due within 30 days of your AGM (around 30 October 2026 for a 30 September AGM).
Who must comply: Every company under audit except banking, insurance, Section 8 and one person companies, "small companies", and a narrow band of small private companies. After 1 December 2025 a small company means paid-up capital up to Rs 10 crore and turnover up to Rs 100 crore, but holding and subsidiary companies never qualify.
The catch: Take institutional funding and become a subsidiary, or cross Rs 100 crore turnover, and CARO applies no matter how young you are.
Key action: Run the 21 clauses as a pre-audit checklist now, fix the fixable gaps, and brief your auditor before the report is drafted.
Time to act: Before your FY 2025-26 audit report is signed.
What CARO 2020 actually is, and why it bites harder than the balance sheet
The Companies (Auditor's Report) Order, 2020, known as CARO 2020, was issued by the Ministry of Corporate Affairs under Section 143(11) of the Companies Act, 2013 and has applied to audits from FY 2021-22 onward. It does not change your accounts. It adds a separate section to the audit report where the auditor has to state, clause by clause, whether your company did or did not do 21 specific things. Where the answer is unfavourable or qualified, the auditor must also give reasons.
That last part is what makes CARO different from an ordinary audit qualification. A qualification sits inside accounting language. A CARO remark is plain: "the company has not been regular in depositing undisputed statutory dues", or "the company has defaulted in repayment of borrowings", or "a fraud on the company has been noticed". These lines are the first thing a lender's credit team, an acquirer's diligence lawyer and a merchant banker preparing your DRHP will search for. A single adverse clause can reprice a loan, stall a term sheet, or turn into a diligence finding that you spend three months explaining.
The order carries no separate penalty on the company by itself. The cost lands in two other places. First, each thing CARO flags (an unregistered charge, an overdue statutory due, a loan to a director outside Section 185) already carries its own penalty under the Companies Act, and the CARO remark puts that default on the record for the Registrar and NFRA to notice. Second, the reputational cost with anyone deciding whether to lend to you, invest in you or buy you. For a company that plans to raise a round or list, that second cost is the larger one.
The Rs 100 crore line that changed on 1 December 2025
Here is the part most founders have not registered. CARO 2020 exempts a "small company", and the definition of a small company under Section 2(85) was revised with effect from 1 December 2025. A small company now means a company, other than a public company, whose paid-up share capital does not exceed Rs 10 crore and whose turnover does not exceed Rs 100 crore, as per the amendment to Rule 2(1)(t) of the Companies (Specification of Definition Details) Rules, 2014.
FY 2025-26 is the first full financial year audited under this higher line. On paper it pulls a large number of mid-sized standalone private companies out of CARO. But the exclusions inside the small company definition are exactly where founders get caught:
A small company can never be a holding company or a subsidiary company. The moment you raise a priced round and an investor entity, a fund vehicle or a foreign parent holds enough to make you its subsidiary, you lose small company status, and with it your CARO exemption, regardless of your revenue. A ten-person startup with Rs 6 crore of revenue that became a subsidiary after its Series A is squarely inside CARO 2020 for FY 2025-26. So is any company whose holding company is a public company. Turnover above Rs 100 crore, or paid-up capital above Rs 10 crore, does the same thing.
There is also a separate, tighter exemption for private companies that are not caught by the small company route. A private company that is not a subsidiary or holding of a public company is outside CARO only if all three of these hold together: paid-up capital plus reserves and surplus is Rs 1 crore or less on the balance sheet date; total borrowings from any bank or financial institution are Rs 1 crore or less at any point during the year; and total revenue is Rs 10 crore or less during the year. All three, at the same time. Breach one, say borrow Rs 1.2 crore for a single month or cross Rs 10 crore of revenue, and CARO applies in full.
The 21 clauses, and what each one exposes about you
CARO is not a formality your auditor ticks in an afternoon. Each clause maps to a live compliance obligation, and the honest answer to several of them lives in records the company controls, not the auditor. The table below groups the 21 clauses by the risk they surface and states, in plain terms, what a clean answer requires from you.
| Clause | What the auditor reports | What a clean answer needs from you |
|---|---|---|
| (i) | Property, plant, equipment and intangibles; title deeds in the company's name; benami proceedings | A fixed asset register and title deeds held in the company name |
| (ii) | Inventory verification; whether quarterly returns to banks agree with books (for Rs 5 crore-plus working capital limits) | Stock statements filed with the bank that reconcile to your accounts |
| (iii) | Investments, guarantees, security and loans given, including to related parties and overdue amounts | Board-approved, documented terms; nothing prejudicial to the company |
| (iv) | Compliance with Sections 185 and 186 on loans to directors and investments | No loans to directors outside Section 185; 186 limits respected |
| (v) | Deposits accepted under Sections 73 to 76 | DPT-3 filed; no undocumented money treated as a deposit |
| (vi) | Maintenance of cost records under Section 148(1) | Cost records where your sector requires them |
| (vii) | Statutory dues: GST, PF, ESI, income tax and others; arrears over six months; disputed dues | No undisputed statutory dues outstanding beyond six months |
| (viii) | Income surrendered or disclosed in income tax assessments and recorded in books | Nothing surrendered in an assessment that your books left out |
| (ix) | Default in repayment of loans or interest; wilful defaulter status; end-use of term loans; short-term funds used long-term | No repayment defaults; borrowings used for their stated purpose |
| (x) | End-use of IPO, further issue and private placement or preferential allotment money; Sections 42 and 62 | Fundraise proceeds used for the purpose stated to investors |
| (xi) | Fraud by or on the company; Form ADT-4 filed; whistle-blower complaints considered | A working vigil mechanism and clean fraud record |
| (xii) | Nidhi company ratios and deposits | Applies only to Nidhi companies |
| (xiii) | Related party transactions under Sections 177 and 188, and disclosure in financials | Board or audit committee approval and correct disclosure |
| (xiv) | Internal audit system under Section 138 | An internal audit function where the section applies |
| (xv) | Non-cash transactions with directors under Section 192 | Prior approval for any non-cash deal with a director |
| (xvi) | NBFC or CIC registration under Section 45-IA of the RBI Act | Registration if your activity needs it |
| (xvii) | Cash losses in the current and preceding year | Reported factually; a flag reviewers weigh |
| (xviii) | Resignation of statutory auditors during the year | Handovers documented; issues raised addressed |
| (xix) | Material uncertainty on meeting liabilities as they fall due; going concern | A funded runway and serviceable liabilities |
| (xx) | Unspent CSR transferred to the right fund under Section 135(5) and (6) | Unspent CSR moved to the correct account on time |
| (xxi) | Qualifications in the CARO reports of group components in consolidated accounts | Clean CARO at each subsidiary you consolidate |
CARO 2020, by the numbers
What you must do now, before the report is signed
CARO is one of the few compliance items where the company can still change the answer after the year has closed, but only until the audit report is drafted. Once your auditor signs, the remarks are fixed. Use the window between now and signing.
1. Settle the applicability question in writing. Confirm whether you are a small company after 1 December 2025, whether any shareholder makes you a subsidiary, and whether the three-part private company test is met. Keep the working. Do not assume last year's position carries over. The threshold moved and your cap table may have too.
2. Clear undisputed statutory dues over six months old. Clause (vii) is the most common adverse remark for growing companies. Pull a GST, TDS, PF and ESI ageing today and clear anything sitting beyond six months before the balance sheet cut-off review closes.
3. Reconcile your bank stock statements to your books. If you have working capital limits of Rs 5 crore or more, clause (ii) checks that the quarterly statements you filed with your bank agree with your accounts. Differences here read as either sloppy controls or inflated drawing power. Reconcile now.
4. Register every charge and fix the register. Clause (iii) and clause (ix) surface borrowings and defaults. An unregistered charge under Section 77 is both a separate default and a CARO trigger. Confirm each loan has a filed CHG-1 and that repayments are current.
5. Re-check director loans and related party approvals. Clause (iv) tests Sections 185 and 186; clause (xiii) tests Sections 177 and 188. Any advance to a director or a related entity that skipped board approval or crossed a limit becomes a written remark. Regularise what you can and paper what you must.
6. Verify fundraise end-use. If you raised on a private placement or preferential allotment, clause (x) checks that the money went where you told investors it would. Match the utilisation to the offer letter and the PAS-3 filing.
7. Move unspent CSR and check going concern. Clause (xx) needs unspent CSR in the correct account on time. Clause (xix) asks whether you can meet liabilities as they fall due. If your runway is short, have the funding position documented before the auditor forms a view.
8. Brief your auditor early. Walk your auditor through the fixes before the report is drafted, not after. An auditor who sees a resolved position reports it as resolved. An auditor who discovers an open gap at signing has to write it up.
The deeper implication
CARO has quietly become a compliance scorecard that outsiders trust more than a management deck. According to CS Sapna Malpani, the clauses that used to feel like auditor housekeeping, such as statutory dues, charges, related party approvals and fundraise end-use, are now the exact points a diligence team, a lender and a merchant banker test first, because the auditor has already done the checking and put the answer on paper. A company that treats CARO as a year-end formality is handing every counterparty a pre-audited list of its weak spots.
The forward view: the Corporate Laws (Amendment) Bill, 2026 proposes lifting the statutory ceiling for the small company definition to Rs 20 crore of capital and Rs 200 crore of turnover, which would let the government raise the small company limits further through rules. If that passes, more standalone private companies will drop out of CARO in later years. The subsidiary trap will not move. A funded company is a subsidiary the day its investor crosses the control line, and no size threshold rescues it. For anyone raising a round this year, CARO readiness is not an audit task. It is part of being fundable.
CARO 2020 versus the provisions people confuse it with
CARO is often mixed up with two neighbouring duties, and the difference matters. Section 143(11) and CARO are the auditor's standing report on 21 governance and compliance matters, made every year the order applies. That is separate from fraud reporting under Section 143(12), where an auditor who suspects an offence involving a threshold amount reports it to the Central Government in Form ADT-4, a specific trigger rather than an annual clause, though CARO clause (xi) asks whether such reporting happened. It is also separate from the small company definition itself under Section 2(85), which decides your exemption but is a status, not a report. Read together, the sequence is simple: your status under Section 2(85) decides whether CARO applies, CARO decides what your auditor reports across 21 clauses, and Section 143(12) sits inside one of those clauses for the narrow case of suspected fraud.
Key takeaways
- CARO 2020 runs under Section 143(11) and requires your auditor to answer 21 clauses in writing for FY 2025-26.
- The small company line moved to Rs 10 crore capital and Rs 100 crore turnover on 1 December 2025, and FY 2025-26 is the first full year audited under it.
- Holding and subsidiary companies never qualify as small companies, so a funding round that makes you a subsidiary pulls you into CARO whatever your size.
- The private company exemption needs all three conditions together: capital plus reserves up to Rs 1 crore, bank borrowings up to Rs 1 crore, and revenue up to Rs 10 crore. Breach one and CARO applies.
- Clause (vii) on statutory dues over six months old is the single most common adverse remark for growing companies.
- CARO carries no separate penalty, but each flagged default has its own penalty and the remark is a permanent diligence red flag.
- You can still fix most gaps, but only until the audit report is signed, which is tied to your AOC-4 filing around 30 October 2026.
Sources and references
- Ministry of Corporate Affairs, Companies (Auditor's Report) Order, 2020, under Section 143(11), Companies Act, 2013: mca.gov.in
- Companies (Specification of Definition Details) Amendment Rules, 2025, revising small company thresholds effective 1 December 2025: MCA notification summary
- ICAI Guidance Note on CARO 2020 (clause-wise reporting requirements): icai.org
- Section 143, Companies Act, 2013, on the powers and duties of auditors: India Code
- Taxmann: CARO 2020 case studies and FAQs: taxmann.com
- Corporate Laws (Amendment) Bill, 2026, proposing a small company ceiling of Rs 20 crore / Rs 200 crore.
Get CARO-ready before your FY 2025-26 audit is signed
CS Sapna Malpani, a practising Company Secretary in Bangalore, helps private companies, funded startups and IPO-bound companies close CARO gaps before the report is drafted: statutory dues, charges, related party approvals and fundraise end-use.
Run your position on the Annual Compliance Checker, review filing exposure with ROC Compliance Filing and MCA Penalty Handling, or message the office directly on WhatsApp.
Frequently asked questions
What is CARO 2020 applicability for FY 2025-26?
CARO 2020 applies to the audit report of every company for FY 2025-26 except banking, insurance, Section 8 and one person companies, small companies, and a narrow band of small private companies. A small company after 1 December 2025 means paid-up capital up to Rs 10 crore and turnover up to Rs 100 crore, but holding and subsidiary companies are excluded from small company status and remain covered by CARO. Where CARO applies, the auditor must report on all 21 clauses.
Which private companies are exempt from CARO 2020?
A private company that is not a subsidiary or holding company of a public company is exempt only if three conditions hold together: paid-up capital plus reserves and surplus of Rs 1 crore or less on the balance sheet date, total borrowings from banks or financial institutions of Rs 1 crore or less at any time in the year, and total revenue of Rs 10 crore or less during the year. If even one condition is breached, CARO 2020 applies in full. Separately, a company that qualifies as a small company under Section 2(85) is also exempt.
Does raising funding change my CARO 2020 applicability?
Yes. If an investor entity, fund or parent acquires enough to make your company its subsidiary, you stop being a small company under Section 2(85) regardless of turnover, and you lose the small company exemption from CARO. A funded startup that became a subsidiary after its round is covered by CARO 2020 for FY 2025-26 even if its revenue is small. This is one of the most common ways founders discover CARO applies to them.
What happens if CARO 2020 reporting is adverse?
CARO 2020 itself carries no separate penalty on the company. The consequences come from two places. Each matter CARO flags (an unregistered charge, statutory dues in arrears, a loan to a director outside Section 185) already carries its own penalty under the Companies Act, and the CARO remark records that default for the Registrar and NFRA. The remark also acts as a red flag that lenders, investors and acquirers read during due diligence, which can reprice or stall a transaction.
When is the CARO 2020 report due?
The CARO report is part of the statutory audit report, so it is finalised when your audit is signed and filed with the financial statements in Form AOC-4. For a company holding its AGM by 30 September 2026, AOC-4 is due within 30 days, around 30 October 2026. The practical deadline to fix any CARO gaps is earlier, before the auditor drafts and signs the report.
Which CARO 2020 clause causes the most problems?
For growing companies, clause (vii) on undisputed statutory dues outstanding for more than six months is the most frequent adverse remark, followed by clause (ii) where bank stock statements do not reconcile to the books and clause (iii) or (ix) on loans, guarantees and repayment defaults. These are also the clauses a company can most often fix before the audit report is signed, which is why an early internal review of the 21 clauses is worth the effort.
Need help with this in practice?
CS Sapna Malpani is a Practising Company Secretary in Bengaluru advising companies and startups on ROC and FEMA compliance, secretarial audit, incorporation and corporate governance. Book a consultation to discuss your specific requirement.