Internal Audit Under Section 138: Who Appoints
Internal audit under section 138 of the Companies Act, 2013 is two sub-sections long and leaves almost everything to the rules. What the section does fix is worth knowing precisely: who may hold the role, who decides on a non-accountant candidate, and that the findings go to the Board rather than to the members. The bar on the statutory auditor taking the job comes from a different section entirely.
Definition
Internal audit under section 138
is the requirement that a prescribed class of companies appoint an internal auditor, who shall be a chartered accountant or a cost accountant or another professional the Board decides on, to conduct internal audit of the functions and activities of the company. Source: Companies Act, 2013, section 138.
What does internal audit under section 138 require?
Sub-section (1) is the whole obligation: Such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company.
Read slowly, it settles four things and defers one.
- Who is covered is deferred. The section says such class or classes of companies as may be prescribed, and fixes no turnover, capital or listing test of its own.
- The appointment is mandatory once a company is in a prescribed class. The words are shall be required to appoint.
- Two professions qualify by name: a chartered accountant, or a cost accountant. Neither is described as being in practice in this sub-section.
- A third route exists through such other professional as may be decided by the Board, which puts the choice of a non-accountant internal auditor with the Board rather than with management.
- The scope of the work is the functions and activities of the company, which is wider than the financial statements a statutory audit addresses.
Two sub-sections
The whole of section 138 of the Companies Act, 2013: sub-section (1) requires a prescribed class of companies to appoint an internal auditor, and sub-section (2) leaves the manner and intervals of the audit to rules made by the Central Government
Source: Companies Act, 2013, section 138
Who sets the frequency and the reporting line?
The Central Government, by rules. Sub-section (2) provides that it may, by rules, prescribe the manner and the intervals in which the internal audit shall be conducted and reported to the Board.
Two features of that sentence matter. The reporting line is fixed in the Act itself: internal audit is reported to the Board, not to the members and not to the statutory auditor. The manner and the intervals are not fixed in the Act, so a company's internal audit calendar is a rule and charter question rather than a statutory one. In a listed company the committee that receives and reviews the work in practice is the audit committee, described in audit committee section 177.
Who cannot be the internal auditor?
The company's own statutory auditor. That bar does not appear in section 138. It sits in section 144, which lists the services an auditor appointed under the Act may not provide to the company, its holding company or its subsidiary company, directly or indirectly. internal audit is clause (b) of that list. The full set of nine heads and the reach of the directly or indirectly Explanation are covered in services an auditor cannot render.
A second route out of the role is enforcement rather than conflict. Where the National Financial Reporting Authority proves professional or other misconduct, section 132(4)(c) lets it debar a member or firm from being appointed as an auditor or internal auditor for a minimum of six months and up to ten years. The internal audit role is named there alongside the statutory one, which is set out in NFRA and the National Financial Reporting Authority.
How does this differ for a producer company?
A producer company answers all three of the questions in the table below differently. Two of them section 138 leaves to rules, and the third, who may be appointed, section 138 answers itself and answers more widely. Section 378ZF provides that Every Producer Company shall have internal audit of its accounts carried out, at such interval and in such manner as may be specified in articles, by a chartered accountant as defined in clause (b) of sub-section (1) of section 2 of the Chartered Accountants Act, 1949.
| Section 138 | Section 378ZF | |
|---|---|---|
| Who is covered | Such class or classes of companies as may be prescribed | Every Producer Company |
| Who may be appointed | A chartered accountant, a cost accountant, or another professional the Board decides on | a chartered accountant, by the Chartered Accountants Act definition |
| Who sets the interval | The Central Government, by rules | The company, as may be specified in articles |
The accounts and audit regime for that company type is covered in producer company accounts and audit.
For anyone reading a company's governance disclosures, internal audit under section 138 is a fact about the control environment rather than about the numbers. The internal auditor's report is not a public document the way the statutory auditor's report is, so what reaches a reader is usually the appointment and the audit committee's account of the function, not the findings themselves. The statutory audit report that is public is governed by the duties in auditor fraud reporting section 143.
Flock reports the filings themselves, each stamped with its date and linked back to the exchange or regulator that published it. What any of it means for you is your call to make.
Frequently asked questions
Which companies must appoint an internal auditor?
Section 138(1) of the Companies Act, 2013 says such class or classes of companies as may be prescribed shall be required to appoint an internal auditor. The Act itself sets no threshold; the applicability is left entirely to the rules the Central Government prescribes. Source: Companies Act, 2013, section 138(1).
Who can be an internal auditor?
A chartered accountant or a cost accountant, or such other professional as may be decided by the Board, to conduct internal audit of the functions and activities of the company. Section 138(1) names the first two and leaves the third to the Board's decision. Source: Companies Act, 2013, section 138(1).
Can a company's statutory auditor also do its internal audit?
No. Internal audit is clause (b) of the list of services in section 144 of the Companies Act, 2013 that an auditor appointed under the Act may not render to the company, its holding company or its subsidiary company, directly or indirectly. Source: Companies Act, 2013, section 144(b).
Who decides how often internal audit is conducted?
The Central Government. Section 138(2) provides that it may, by rules, prescribe the manner and the intervals in which the internal audit shall be conducted and reported to the Board. The section fixes neither the frequency nor the reporting format itself. Source: Companies Act, 2013, section 138(2).
Flock tracks these filings, sourced, dated, and linked back to the original. See what smart-money entities disclosed, without the guesswork about what it means.
Disclosures shown are public regulatory filings. Data may be delayed or incomplete. Smart-money entities may no longer hold positions shown. Not investment advice.