Internal Audit Applicability 2026: Section 138 Rules, Thresholds & the ₹3 Lakh Penalty

In August 2026 a Bengaluru private limited company learned an expensive lesson. Its turnover had crossed ₹200 crore two years earlier, but no internal auditor was ever appointed. When the Registrar picked it up, the adjudicating officer imposed a penalty of ₹3,00,000 on the company and its directors, and gave 90 days to fix the gap. The company never planned to break the law. It simply did not know that a single line in its own profit and loss account had switched on a fresh obligation. That is how internal audit applicability catches growing companies: quietly, on the back of good numbers.

Why internal audit applicability trips up profitable companies

Most founders and finance heads track the deadlines they can see: the annual return, the financial statements, the auditor at the AGM. Internal audit sits in a blind spot because nothing on the MCA portal reminds you about it. There is no due-date email, no e-form that turns red, no filing that bounces. The obligation is triggered by your own financials, and the first signal that you missed it is usually an adjudication notice.

Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, requires a defined set of companies to appoint an internal auditor to examine and report on their functions and activities. The section itself carries no separate punishment. That gap is filled by Section 450, the general penalty, and the money is collected through an adjudication order under Section 454. Because the penalty runs per day of default and applies to every officer, a two-year lapse in a company with four directors adds up fast. Published orders against private companies for this single default have landed between ₹2.5 lakh and ₹3 lakh.

Who is actually caught: a quick decision path

What Section 138 and Rule 13 actually say

Section 138(1) states that prescribed companies "shall be required to appoint an internal auditor", who may be an individual, a partnership firm or a body corporate, to conduct internal audit of the functions and activities of the company. The person may be a chartered accountant or a cost accountant, or any other professional the Board decides, and the explanation to the section confirms the chartered accountant may be one in practice or not. The internal auditor may or may not be an employee of the company.

Rule 13 fixes who "prescribed companies" are, and it works off the preceding financial year. The table below is the version every finance head should keep on file.

Two details cause most of the errors. First, borrowings are tested "at any point of time" during the year, not at the closing balance sheet date. A company that drew a ₹110 crore facility for two months and repaid it before March still crosses the line. Second, the test looks at the preceding year's figures, so the appointment belongs to the current year. If turnover touched ₹210 crore in FY 2025-26, the internal auditor must be in place for FY 2026-27, and the delay clock starts running from the beginning of that year.

What you must do now

If your last completed year touched any of the limits, treat this as a board-meeting item, not a year-end one. Here is the sequence a practising company secretary would follow.

1. Run the threshold test on audited figures. Pull turnover, paid-up capital, the highest borrowing outstanding on any day, and deposits for the preceding financial year. Confirm against the audited financial statements, not provisional numbers, so the finding holds up later.
2. Decide the appointee. Choose a chartered accountant, a cost accountant or another professional the Board is comfortable with. It can be an outside firm or an in-house team. For a company preparing for a fundraise or listing, an independent external firm reads far better in diligence than a related in-house arrangement.
3. Collect a written consent and engagement letter. Fix the scope, reporting lines, frequency and fee before the appointment so there is a clean paper trail.
4. Pass a Board resolution. The appointment is a Board power. Record the name of the internal auditor, the period, and the scope in the minutes. Keep the resolution ready to produce; there is no separate RoC e-form for an internal auditor, so the minutes are your proof.
5. Set the scope with the Audit Committee. Where an Audit Committee exists, it (otherwise the Board) should agree the scope, functioning, periodicity and methodology, as Rule 13 expects.
6. Fix the reporting rhythm. Quarterly internal audit reports to the Audit Committee or Board are the practical norm and give directors a defence that oversight was real, not on paper.
7. If you already missed a year, come clean early. Appoint now, minute the delay honestly, and if a notice arrives, respond on time. Adjudication penalties are lighter for companies that rectify than for those that ignore the notice.

Common mistakes that turn a technicality into a penalty

The default is rarely deliberate. It grows out of a handful of assumptions that look reasonable until an officer reads the order. The first is treating the statutory auditor as sufficient. The statutory audit under Section 139 tests whether the accounts are true and fair; internal audit tests whether the controls behind those accounts actually work. One does not cover the other, and a company can have a spotless statutory audit while sitting on a live Section 138 default.

The second mistake is measuring borrowing on the closing balance sheet. Finance teams look at 31 March, see borrowing back under ₹100 crore, and conclude the section does not apply. Rule 13 tests the highest outstanding amount on any day, so a peak in October counts even if the facility was repaid by March. The third is forgetting that the test runs on the previous year. Companies check the current year's numbers, find they are still building up, and miss that last year's figures already switched the obligation on.

The fourth is appointing late and never minuting it. If a company crosses a limit and appoints an internal auditor six months into the year, the delay is real and the honest record of it matters more than pretending the appointment was timely. The fifth is confusing internal audit with an in-house finance review. Rule 13 expects a defined internal audit function with an agreed scope, not an informal look by the same team that prepared the books. Each of these gaps is cheap to close before a notice and costly to explain after one.

The deeper implication for growth-stage companies

According to CS Sapna Malpani, the internal audit trigger is really a maturity test that the law applies without warning. "A company that has crossed ₹200 crore in turnover or ₹100 crore in bank borrowing is no longer a small business, and the Companies Act stops treating it like one," she notes. "The penalty is the smaller problem. The bigger one shows up in a due diligence room, where a missing internal auditor reads as weak governance and gives an investor or a merchant banker a reason to renegotiate."

For a company on the road to an IPO, an internal audit gap is a standard finding in the pre-listing review, and it has to be closed before the offer document goes out. The forward view is straightforward: as more mid-market companies raise institutional debt, the ₹100 crore borrowing test will pull in businesses that never thought of themselves as internal-audit companies. The safest posture is to run the threshold check every year at audit sign-off, so the obligation never arrives as a surprise.

How internal audit compares with the other audits you already know

Founders often assume the statutory auditor covers everything. Each audit under the Act answers a different question, uses a different professional, and has its own filing. The matrix below sets them side by side.

For the detail on each, see our guides on Form ADT-1 and statutory auditor appointment, secretarial audit under Section 204, and cost audit under Section 148. Directors should also read how these appointments flow into the Board's report disclosures.

Sources and references

• Section 138, Companies Act, 2013, Ministry of Corporate Affairs
• Rule 13, Companies (Accounts) Rules, 2014, Ministry of Corporate Affairs
• Section 450 (general penalty) and Section 454 (adjudication), Companies Act, 2013, India Code
• MCA adjudication order, ₹3,00,000 penalty for non-appointment of internal auditor, TaxGuru
• MCA adjudication order, ₹2.5 lakh penalty on company and director, Taxscan
• Companies (Adjudication of Penalties) Rules, 2014, Ministry of Corporate Affairs

Frequently asked questions

What is internal audit applicability under Section 138?

Internal audit applicability means the set of companies that must appoint an internal auditor under Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014. It covers every listed company, unlisted public companies that cross limits on paid-up capital, turnover, borrowing or deposits, and private companies that cross ₹200 crore in turnover or ₹100 crore in bank borrowing. The test uses the preceding financial year's figures, so the appointment belongs to the current year.

Does a private limited company need an internal auditor?

A private company needs an internal auditor only if, in the preceding financial year, its turnover was ₹200 crore or more, or its outstanding loans or borrowings from banks or public financial institutions crossed ₹100 crore at any point during the year. Below both limits, a private company is not required to appoint one, though many do so voluntarily to strengthen controls before a fundraise.

What is the penalty for not appointing an internal auditor?

Section 138 has no penalty of its own, so the general penalty in Section 450 applies. The company and every officer in default can be penalised ₹10,000, with a further ₹1,000 for each day the default continues, subject to a maximum of ₹2,00,000 for the company and ₹50,000 for each officer. Adjudication orders against private companies for this default have reached ₹2.5 lakh to ₹3 lakh once the daily amounts and multiple officers are added.

Who can be appointed as an internal auditor?

The internal auditor may be a chartered accountant, a cost accountant, or any other professional the Board decides. The chartered accountant need not be in practice. The appointee can be an individual, a firm or a body corporate, and may or may not be an employee of the company. For companies preparing for diligence, an independent external firm is usually the safer choice.

Is there an e-form to file for internal auditor appointment?

No. Unlike the statutory auditor, whose appointment is filed in Form ADT-1, there is no dedicated RoC e-form for an internal auditor. The appointment is made by a Board resolution, so the minutes and the resolution are the evidence you must keep and be ready to produce.

When must the internal auditor be appointed?

The obligation applies in the financial year that follows the year in which a threshold is crossed. If turnover or borrowing crossed a limit in FY 2025-26, the internal auditor must be in place for FY 2026-27, and the delay is counted from the start of that year. Appointing at the first board meeting of the new financial year is the clean approach.

Is borrowing tested at year-end or at any point in the year?

At any point in the year. The ₹100 crore borrowing test looks at the highest outstanding amount at any time during the preceding financial year, not the balance on the last day. A short-term facility that is drawn and repaid within the year can still trigger internal audit applicability, which is a common oversight.