Mandatory internal audit for certain companies

Backdrop

• The Companies Act,1956 did not  cast a legal obligation on any company to have an internal audit.
• The MAOCARO,1988 and CARO,2003 orders issued by the Central Government under section 227(4A) of the said Act merely required statutory auditors of specified companies to comment in audit report whether company had an internal audit commensurate with the size and nature of its business. 
• The obligation was on the statutory auditor to report. If any specified company did not have an internal audit, it was not a violation of any statutory provision.
• The Companies Act,2013 brings a sea change in the position. Section 138 of the Companies Act,2013 titled 'Internal Audit' provides that such class or description of companies as may be prescribed  shall be required to appoint an internal auditor to conduct internal audit of the functions and activities of the company.

Companies or classes of companies which are required to appoint internal auditor

Rule 13(1) of the Companies (Accounts)Rules,2014 provides that  the following class of companies shall be required to appoint an internal auditor or a firm of internal auditors, namely:—
(a) every listed company;

(b) every unlisted public company having—

• (i) paid up share capital of fifty crore rupees or more during the preceding financial year; or
• (ii) turnover of two hundred crore rupees or more during the preceding financial year; or
• (iii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year; or
• (iv) outstanding deposits of twenty five crore rupees or more at any point of time during the preceding financial year; and

(c) every private company having—

• (i) turnover of two hundred crore rupees or more during the preceding financial year; or
• (ii) outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year:

An existing company covered under any of the above criteria shall comply with the requirements of section 138 and this rule within six months of commencement of such section.

Qualifications of internal auditor

 Internal auditor shall be

• a Chartered Accountant or 
• a Cost Accountant or 
• such other professional as may be decided by the Board.

 Explanation  to Rule 13(1) clarifies that —

• the internal auditor may or may not be an employee of the company;
• the term “Chartered Accountant” shall mean a Chartered Accountant whether engaged in practice or not.

Appointment of internal auditor shall be by Board resolution at a Board meeting
In view of section 179(3) of the Companies Act,2013 and Rule 8(4) of the Companies (Meetings of Board
and its Powers) Rules, 2014, the power of appointment of internal auditor shall be exercised by the Board of Directors by means of a resolution passed at a Board meeting . Appointment of internal auditor cannot be
made by means of a circular resolution. However, there is no bar in making the appointment at a Board meeting held through video conferencing or audio visual means

Scope, functioning, periodicity and methodology of internal audit
Rule 13(2) of the Companies (Accounts) Rules, 2014 provide that the Audit Committee of the company or the Board shall, in consultation with the Internal Auditor, formulate :
(i) the scope,
(ii) functioning,
(iii) periodicity, and
(iv) methodology
for conducting the internal audit.

Statutory auditor cant be internal auditor
A statutory auditor of a company cannot also be its internal auditor. Nor can he be the internal auditor of the company’s holding company or subsidiary company. [Section 144 of the 2013 Act].