Internal Audit Applicability Under the Companies Act in 2026
Last updated: 26 October 2026
Quick Answer: Internal audit is mandatory for listed companies and companies crossing a rule 13 limit in the preceding year. Private companies qualify at ₹200 crore turnover or bank or institution borrowings above ₹100 crore; unlisted public companies add ₹50 crore paid-up capital or ₹25 crore deposits. The internal auditor may be an employee or an outside firm such as HSAG Consulting.
Internal audit applicability as per Companies Act, 2013 is the test of whether a company must appoint an internal auditor under section 138 of the Companies Act, 2013, notified with effect from 1 April 2014. The classes are set out in rule 13 of the Companies (Accounts) Rules, 2014, and a company that meets any one condition for its class must appoint.
| Class or bar | Conditions (any one is enough) | When the figure is tested |
|---|---|---|
| Listed company | None: listing alone brings it in (rule 13(1)(a)) | Not applicable |
| Unlisted public company | Paid-up share capital of ₹50 crore or more; turnover of ₹200 crore or more; outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore; outstanding deposits of ₹25 crore or more (rule 13(1)(b)) | Capital and turnover during the preceding financial year; borrowings and deposits at any point of time during that year |
| Private company | Turnover of ₹200 crore or more; outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore (rule 13(1)(c)) | Turnover during the preceding financial year; borrowings at any point of time during that year |
| Barred from the role | The company's statutory auditor, directly or indirectly (section 144(b) of the Companies Act, 2013) | Every year |
What are the three classes of company under rule 13?
Rule 13(1) prescribes three classes: listed companies, unlisted public companies and private companies. Section 138(1) of the Companies Act, 2013 requires each prescribed class to appoint an internal auditor to conduct internal audit of the functions and activities of the company. The conditions within each class are alternatives, not cumulative, so meeting one is enough.
Do listed companies need an internal audit?
Yes. Rule 13(1)(a) covers every listed company, with no capital, turnover, borrowing or deposit test to meet. Listing alone brings the company into the class, so a listed company with turnover far below ₹200 crore must still appoint an internal auditor.
What are the limits for unlisted public companies?
An unlisted public company must appoint an internal auditor if it meets any one of four conditions under rule 13(1)(b) of the Companies (Accounts) Rules, 2014:
- Paid-up share capital of ₹50 crore or more during the preceding financial year.
- Turnover of ₹200 crore or more during the preceding financial year.
- Outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during the preceding financial year.
- Outstanding deposits of ₹25 crore or more at any point of time during the preceding financial year.
Two conditions are worded differently: the borrowing and deposit tests read "at any point of time", so a balance crossed even briefly counts, even if it falls back by the year end.
What are the internal audit applicability limits for a private company?
A private company must appoint an internal auditor if it meets either of two conditions under rule 13(1)(c). One is turnover of ₹200 crore or more during the preceding financial year. The other is outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point of time during that year. There is no paid-up capital test and no deposit test for a private company.
In short, internal audit applicability for private company accounts rests on two numbers. A private company with turnover between ₹1 crore and ₹50 crore sits far below the ₹200 crore turnover limb. It is covered only if its borrowings from banks or public financial institutions exceed ₹100 crore at some point in the preceding financial year. A private company below both conditions has no duty under rule 13, though it may still choose to run an internal audit.
Which year's figures decide whether the rule applies?
Every limb in rule 13 looks back to the preceding financial year. A company's figures for 2025-26 therefore decide whether it must have an internal auditor for 2026-27, and its figures for 2026-27 decide 2027-28.
Capital and turnover are read for the year as a whole; borrowings and deposits are read at any point of time during it. A bank loan above ₹100 crore held even for part of 2025-26 brings a private company into the class for 2026-27. A company that falls below every condition in a later year leaves the class for the following year, and should keep a note of the test it applied.
Which professionals can hold the internal auditor role?
Section 138(1) of the Companies Act, 2013 requires the internal auditor to be a chartered accountant, a cost accountant, or such other professional as the Board decides. Under the Explanation to rule 13, a salaried employee of the company may hold the role, and a chartered accountant or cost accountant counts whether or not engaged in practice.
Rule 13(1), as amended by the Companies (Accounts) Amendment Rules, 2016 dated 27 July 2016, allows the internal auditor to be an individual, a partnership firm or a body corporate; the earlier text spoke of "a firm of internal auditors".
One bar is absolute. Section 144(b) of the Companies Act, 2013 prohibits an auditor appointed under the Act from providing internal audit services, directly or indirectly, to the company, its holding company or its subsidiary company. In practice, the statutory auditor cannot also be the internal auditor.
What happens if an applicable company does not comply?
Section 138 has no penalty clause of its own, so a default falls under the general penalty in section 450 of the Companies Act, 2013. The company and every officer of the company who is in default are each liable to a penalty of ₹10,000, with a further ₹1,000 for each day after the first while the contravention continues. Penalties are capped at ₹2,00,000 for the company and ₹50,000 for an officer in default or any other person.
How is internal audit different from tax audit?
Internal audit is a company law duty under section 138 of the Companies Act, 2013 and rule 13; a tax audit is a separate duty under the income-tax law. For FY 2025-26 and earlier, section 44AB of the Income-tax Act, 1961 names the taxpayers who must have their accounts audited by a chartered accountant, who reports in Form No. 3CA or 3CB together with Form No. 3CD.
From tax year 2026-27, section 63 of the Income-tax Act, 2025 carries the same audit, and the chartered accountant reports in Form No. 26 under rule 47 of the Income-tax Rules, 2026.
Both duties can apply to one company in one year, and neither replaces the other. The tax audit limits are covered in the guide to tax audit applicability under section 44AB, and one case is worked through in tax audit applicability for ₹8 crore turnover.
Common Mistakes in Testing Internal Audit Applicability
Getting the class or the year wrong is what turns a routine compliance check into a penalty. These are the points to check before concluding that rule 13 does not apply.
- Testing the current year's figures. Rule 13 looks at the preceding financial year, so turnover of ₹200 crore or more in 2025-26 brings a company into the class for 2026-27.
- Applying the public company limbs to a private company. The ₹50 crore capital and ₹25 crore deposit limbs apply only to unlisted public companies; internal audit applicability to private companies rests on turnover and borrowings alone.
- Checking borrowings only at the year end. The borrowing and deposit tests apply at any point of time during the preceding financial year, so a temporary peak above the limit counts.
- Counting one lender only. The borrowing limb covers outstanding loans or borrowings from banks or public financial institutions, which can sit across several lenders and facilities.
- Appointing the statutory auditor. Section 144(b) of the Companies Act, 2013 bars the statutory auditor from internal audit of the company, its holding company or its subsidiary, directly or indirectly.
- Leaving the scope undefined. Rule 13(2) requires the Audit Committee or the Board, in consultation with the internal auditor, to formulate the scope, functioning, periodicity and methodology.
- Treating the appointment as optional once triggered. The section 450 penalty is ₹10,000 plus ₹1,000 a day, capped at ₹2,00,000 for the company and ₹50,000 for each officer in default.
Consider a hypothetical private company that runs a chain of diagnostic laboratories (illustrative figures). Its turnover was ₹180 crore in 2025-26, and its equipment and working capital loans from two banks touched a combined outstanding balance of ₹110 crore for three months of that year. It does not meet the turnover limb, but its borrowings exceeded ₹100 crore at a point of time during the year, so it must appoint an internal auditor for 2026-27.
How does a company put the internal audit in place?
Once applicability is settled, the Audit Committee or the Board fixes the scope with the internal auditor under rule 13(2). From then on, the audit covers the functions and activities of the company under section 138(1), and section 138(2) provides for it to be reported to the Board. HSAG Consulting lists internal and management audits among its assurance services, covering internal controls, processes and risk areas.
The guide on why every growing business needs an internal audit strategy sets out an action plan for findings, and the statutory audit checklist covers the separate annual audit.
Discuss Your Internal Audit Requirement
To discuss whether rule 13 applies to your company and how the internal audit should be scoped, leave your details on the contact page and the team will contact you.
