Who must appoint an internal auditor under Section 138, what IFC means under Sections 134(5)(e) and 143(3)(i), and how to build workable controls.
As private limited companies and unlisted public companies grow — whether in the industrial areas of Urla, Bhanpuri and Siltara in Raipur, the steel belt of Durg-Bhilai, or the agro-processing clusters of Kalahandi and Jayapatna — transaction volumes rise, purchasing spreads across locations, and inventory moves through more hands.
Without sound internal controls, that growth often fails to reach the bottom line. Unmonitored scrap, unverified weighbridge entries, unauthorised discounts, split purchase orders and ghost payroll entries quietly drain cash.
Many promoter-run businesses focus on tax compliance and treat internal controls as an afterthought. The Companies Act, 2013, however, places clear responsibility on directors and management for Internal Financial Controls (IFC). In addition, Section 138 makes internal audit mandatory for specified companies, and CARO 2020 Clause 3(xiv) requires the statutory auditor to comment on the internal audit system.
This guide explains the legal requirements, how to design controls, the common leakage points in regional industries, and a practical roadmap to put it all in place.
1. Mandatory Internal Audit Thresholds under Section 138
Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, requires specified companies to appoint an internal auditor. The internal auditor may be a Chartered Accountant or a Cost Accountant (whether or not in practice), or another professional decided by the Board, and may or may not be an employee of the company.
Applicability is tested on the figures of the preceding financial year. A company is covered if it meets any one of the conditions in its row:
| Type of company | Paid-up share capital | Turnover | Outstanding loans / borrowings from banks & public financial institutions | Outstanding deposits |
|---|---|---|---|---|
| Listed company | Always covered | Always covered | Always covered | Always covered |
| Unlisted public company | ₹50 crore or more | ₹200 crore or more | ₹100 crore or more (at any point during the year) | ₹25 crore or more (at any point during the year) |
| Private company | Not a test | ₹200 crore or more | ₹100 crore or more (at any point during the year) | Not a test |
Points to remember
- Preceding-year test: For FY 2026-27, applicability depends on the figures for FY 2025-26 (the year ended 31 March 2026).
- "At any point" for borrowings and deposits: If borrowings or deposits crossed the limit at any time during the preceding year, the company is covered — even if the balance was repaid before 31 March.
- Voluntary internal audit: Companies below these limits are not required to appoint an internal auditor, but a voluntary internal audit is often worthwhile. Mid-sized manufacturing units with informal control environments tend to be more exposed to leakages than larger companies running standardised ERP systems.
2. The Legal IFC Framework: Section 134(5)(e) vs. Section 143(3)(i)
The Companies Act, 2013 deals with Internal Financial Controls in two places — one is the directors' responsibility, the other is the auditor's reporting duty:
| Section 134(5)(e) — Directors' responsibility | Section 143(3)(i) — Auditor's reporting | |
|---|---|---|
| Who it applies to | Listed companies (good practice for large unlisted companies too) | All companies whose financial statements are audited, except the exempt private companies listed below |
| What is required | Directors state that adequate IFCs were laid down and were operating effectively | The auditor reports whether the company has adequate IFC over financial reporting and whether those controls were operating effectively |
| Scope | Broad — orderly conduct of business, safeguarding assets, fraud prevention, accuracy of records | Narrower — Internal Financial Controls over Financial Reporting (ICOFR) |
Directors' responsibility under Section 134(5)(e)
In a listed company, the Directors' Responsibility Statement must confirm that the directors "had laid down internal financial controls to be followed by the company and that such internal financial controls are adequate and were operating effectively." Lenders, investors and auditors increasingly expect the same discipline from large unlisted companies.
The Act explains that internal financial controls are the policies and procedures adopted for ensuring:
- the orderly and efficient conduct of business, including adherence to company policies;
- the safeguarding of assets;
- the prevention and detection of frauds and errors;
- the accuracy and completeness of accounting records; and
- the timely preparation of reliable financial information.
Auditor's reporting under Section 143(3)(i)
The statutory auditor must report whether the company has adequate internal financial controls over financial reporting and whether they were operating effectively.
Under the MCA exemption notification for private companies (G.S.R. 583(E) dated 13 June 2017, as clarified in July 2017), this reporting does not apply to a private company that is:
- a One Person Company or a small company; or
- a private company with turnover below ₹50 crore (as per its latest audited financial statements) and aggregate borrowings from banks, financial institutions or any body corporate below ₹25 crore at all times during the year.
The exemption is available only if the company has not defaulted in filing its financial statements (Section 137) or annual return (Section 92) with the ROC. A late AOC-4 or MGT-7 can therefore bring IFC reporting back into scope.
3. Designing Internal Controls: DOA Matrix & Segregation of Duties
An effective control environment rests on two pillars: a clear Delegation of Authority (DOA) matrix and strict Segregation of Duties (SoD).
A. Delegation of Authority (DOA) matrix
A DOA matrix sets out who can approve purchases, sign contracts, release payments and allow discounts — and up to what amount. Without one, junior staff make commitments they should not, or senior management gets stuck approving routine purchases.
Illustrative DOA matrix for a manufacturing unit
The limits below are only an example — each company should set its own based on size and risk.
| Transaction | Store / Department Manager | Plant Head / GM | CFO / VP Finance | Managing Director |
|---|---|---|---|---|
| Purchase requisition | Up to ₹50,000 | Up to ₹5,00,000 | Up to ₹25,00,000 | Above ₹25,00,000 |
| Purchase order approval | Up to ₹25,000 | Up to ₹2,00,000 | Up to ₹10,00,000 | Above ₹10,00,000 |
| Vendor payment approval | — | Up to ₹1,00,000 (budgeted) | Up to ₹10,00,000 | Above ₹10,00,000, or any non-budgeted payment |
| Scrap disposal | — | Up to ₹50,000 | Up to ₹5,00,000 | Above ₹5,00,000 |
| Customer credit period | Standard terms (30 days) | Up to 45 days | Up to 60 days | Above 60 days / special limits |
B. Segregation of Duties (SoD)
No single person should control every stage of a transaction. Four functions should be kept apart: authorisation, custody of assets, recording, and reconciliation.
| Area | What typically goes wrong | How to fix it |
|---|---|---|
| Purchasing | One manager selects the supplier, negotiates rates, raises the PO, checks goods at the gate and approves the invoice for payment. | Split purchasing, gate-entry verification and invoice accounting between different people, with maker-checker controls in Tally / SAP. |
| Cash & bank | The cashier collects cash, records it in the books and also prepares the bank reconciliation. | Give bank reconciliation to an accounts executive who does not handle cash or sign cheques. |
| Master data | Sales staff can change customer details, credit limits and bank details in the accounting system. | Restrict master-data editing to the central finance team, with written CFO approval for each change. |
4. Common Leakage Points in Regional Industries
Some leakages are specific to the industries common in Chhattisgarh and Odisha, and a routine financial audit may not pick them up:
| Industry (typical locations) | Main leakage risks | Key controls |
|---|---|---|
| Steel rerolling & sponge iron (Urla, Bhanpuri, Durg-Bhilai) | Burning-loss / yield variance hiding unbilled sales; scrap sold for cash; manual weighbridge overrides | Benchmark yield against technical norms monthly; ERP-integrated digital weighbridge with photo capture and no manual entry |
| Rice milling & agro-processing (Kalahandi, Jayapatna) | Out-turn ratio gaps; husk and bran sold for cash off the books; moisture-loss manipulation | Track out-turn against CMR norms; pre-numbered gate passes; weighbridge cross-check on every by-product sale |
| Civil & PWD contractors (Raipur, Bhilai, Korba) | Diesel diversion; material lost in transit; unverified site stores | Monthly reconciliation of material issued vs RA bill quantities; fuel drawn vs engine hours / GPS logs |
Steel rerolling and sponge iron plants
- Burning loss and yield variance: The yield from raw material (billets / ingots) to finished goods (TMT bars, structural steel) should be compared with technical norms every month. Losses above the normal burning-loss range can hide unbilled cash sales of finished goods or unrecorded scrap dispatches.
- Weighbridge manipulation: Incoming scrap and iron-ore trucks are weighed at the gate. Where the weighbridge software allows manual entry, tare or gross weight can be altered, leading to payment for weight that never arrived. A digital weighbridge linked directly to the ERP, with automatic photo capture and no manual entry, closes this gap.
Rice mills and agro-processing units
- Custom milling out-turn ratio: For custom-milled rice delivered to the government, the standard out-turn is 67% for raw rice and 68% for parboiled rice. A persistent gap between actual recovery and these norms can point to unrecorded commercial sales of rice, broken rice or bran.
- By-product sales: Rice husk and de-oiled rice bran are often sold for cash. Without pre-numbered gate passes and a weighbridge cross-check, these sales can go unrecorded.
Civil and infrastructure contractors
- Material consumption: Cement, steel, bitumen and diesel issued to sites should be reconciled every month against the quantities billed in running-account (RA) bills.
- Fuel diversion: Diesel drawn by excavators, tippers and loaders should be compared with engine-hour or GPS run-time logs to spot diversion at remote sites.
5. The Internal Audit Cycle, Step by Step
Internal audit is a continuous cycle, not a once-a-year exercise. A typical cycle runs through these eight stages:
| Stage | What happens | Output |
|---|---|---|
| 1. Risk assessment & annual plan | Identify key processes, regulatory requirements and gaps from past audits | Risk-based annual audit plan |
| 2. Scoping & process walkthrough | Document current procedures, map how transactions flow, review the DOA | Process notes and scope for each area |
| 3. Sample testing & data analytics | Test ledgers, run 3-way matching (PO–GRN–invoice), check for duplicates in the ERP | Exceptions list |
| 4. Fieldwork & physical verification | Surprise cash counts, inventory spot checks, weighbridge checks | Verification working papers |
| 5. Discussion with process owners | Share draft findings with department heads and record their responses | Agreed observations with management comments |
| 6. Final report & corrective action plan | Rate findings High / Medium / Low and set owners and deadlines | Internal audit report and Corrective Action Plan (CAP) |
| 7. Reporting to Audit Committee / Board | Present key control weaknesses and recommendations | Board / Audit Committee review |
| 8. Follow-up | Track open points by age and verify that corrective action has been taken | Quarterly follow-up report |
6. Checklist: Core Internal Audit Areas & Controls
An internal audit should cover controls across six core business functions:
| Audit area | Key risks | Controls to look for | How to verify |
|---|---|---|---|
| Procure-to-Pay (P2P) | Ghost vendors, inflated prices, split POs, duplicate payments | 3-way match (PO, GRN, tax invoice); vendor onboarding checks; price master locked in ERP | Test vendor payments against POs; run duplicate checks on GSTINs and bank accounts |
| Order-to-Cash (O2C) | Unauthorised credit, unbilled dispatches, bad debts, manual price overrides | System-enforced credit limits; dispatch only against an invoice; balance confirmations from customers | Reconcile the dispatch register with GSTR-1; review debtors over 180 days |
| Inventory & stores | Theft, scrap leakage, unrecorded wastage, false weighbridge entries | Perpetual inventory counts; weighbridge integrated with ERP; serially numbered gate passes | Surprise physical counts; compare raw-material yield with production records |
| Payroll (Hire-to-Retire) | Ghost employees, wrong overtime, PF / ESIC non-compliance | Biometric attendance linked to payroll; HR approval for new employees; monthly PF / ESIC reconciliation | Match salary payouts with bank lists and attendance logs; check ECR filings |
| Treasury & cash | Cash misappropriation, unauthorised transfers, delayed cheque deposits | Two-person authorisation for net banking; daily cash limits; independent monthly bank reconciliation | Physical cash counts; review long-pending items in bank reconciliations |
| Fixed assets & capex | Unrecorded disposals, idle machinery, wrong capitalisation | Fixed asset register with barcode / QR tagging; periodic physical verification; capex approvals under the DOA | Physically verify high-value machinery; match capex invoices with approvals |
7. CARO 2020 Reporting: Clause 3(xiv)
Under the Companies (Auditor's Report) Order, 2020, the statutory auditor must report on the company's internal audit system under Clause 3(xiv):
| Clause | What the auditor reports | What it means in practice |
|---|---|---|
| 3(xiv)(a) | Whether the company has an internal audit system commensurate with the size and nature of its business | Scope, coverage, competence of the audit team and frequency must match the scale of operations. Appointing an internal auditor only on paper — with no real fieldwork or reports — can lead to an adverse comment. |
| 3(xiv)(b) | Whether the internal audit reports for the period under audit were considered by the statutory auditor | The statutory auditor reviews the internal audit reports and assesses the impact of significant findings (inventory shortages, control failures, unrecovered advances) on the financial statements and IFC reporting. |
Like the rest of CARO 2020, this clause does not apply to certain companies — including small companies, One Person Companies, and private companies that meet the CARO exemption limits for capital, borrowings and revenue.
8. A 90-Day Implementation Roadmap
Building an IFC framework does not need to disrupt operations. A growing company can put the basics in place in about three months:
| Month | Focus | Key actions |
|---|---|---|
| Month 1 | Process mapping & risk identification | Map the core cycles (purchase, sales, inventory, payroll, finance); write standard operating procedures (SOPs); identify high-risk gaps and segregation-of-duties conflicts |
| Month 2 | Control design & ERP automation | Approve a formal DOA matrix; set up maker-checker controls in Tally / SAP / Busy; add digital controls such as weighbridge integration and biometric attendance |
| Month 3 | Internal audit & monitoring | Appoint the internal auditor (mandatory where Section 138 applies); start quarterly reporting to the Audit Committee or Board; maintain a CAP tracker for open audit points |
Frequently Asked Questions
Is internal audit mandatory for every private limited company? No. A private company needs an internal auditor only if, in the preceding financial year, its turnover was ₹200 crore or more, or its outstanding loans or borrowings from banks and public financial institutions reached ₹100 crore or more at any time.
Can the statutory auditor also act as the internal auditor? No. Section 144 of the Companies Act, 2013 bars the statutory auditor from providing internal audit services to the same company.
Does IFC reporting apply to small private companies? Generally not. The auditor's IFC reporting under Section 143(3)(i) does not apply to One Person Companies, small companies, or private companies with turnover below ₹50 crore and borrowings below ₹25 crore — provided they have not defaulted in filing their financial statements or annual return.
Thresholds and exemptions under the Companies Act and its rules are amended from time to time. Confirm the current position for your company before relying on the figures in this guide.
Related services
Need Direct CA Consultation in Raipur?
Connect with our partner-led practice at GF-28, Shyam Plaza, Pandri, Raipurfor GST advisory, Income Tax audit (Sec 44AB), Bank DPR & CMA Data, Company Registration, and Chhattisgarh Industrial Subsidies.
Authored by CA Rabi Agrawal & Practice Team
Rabi Agrawal & Associates, Chartered Accountants — Head Office Raipur (CG), Branch Office Jayapatna (Odisha).