Section 138 of Companies Act, 2013 read with Rule 13 of Companies (Accounts) Rules, 2014 & ICAI Standards on Internal Audit (SIAs 110–390)

Internal Audit & IFC

Risk-based internal audit, Internal Financial Controls (IFC/IFCoFR) design and operating effectiveness testing, and corporate governance reviews conducted under Section 138 of the Companies Act 2013 and ICAI Standards on Internal Audit (SIAs).

CA Due Diligence

Official Portal Filing

State Stamp Advisory

Statutory Filing

MCA & Tax Practice

Relevant RegulatorMinistry of Corporate Affairs & ICAI, Government of India

MCA V3 Official Portal & ICAI Portal

The official Government of India portal for filing Board Resolutions appointing internal auditors in Form MGT-14, tracking corporate governance filings, and accessing ICAI Internal Audit Standards.

Visit Official Website

STATUTORY OVERVIEW

Risk-Based Internal Auditing & Internal Financial Controls (IFC) Assurance

An effective Internal Audit function serves as an essential strategic governance pillar, providing the Board of Directors, Audit Committee, and executive leadership with independent, objective assurance on the robustness of internal control systems, operational workflows, and enterprise risk management frameworks. Mandated under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 for qualifying corporate entities, our internal audit practice operates in strict alignment with the Standards on Internal Audit (SIAs) issued by the Institute of Chartered Accountants of India (ICAI). We design and execute Risk-Based Internal Audits (RBIA) that identify operational leakages, strengthen segregation of duties (SoD), and protect enterprise assets.

Statutory & Practice Summary • At-A-Glance

ICAI UDIN Authentication Mandate

Governing Framework

Section 138 of Companies Act, 2013 read with Rule 13 of Companies (Accounts) Rules, 2014 & ICAI Standards on Internal Audit (SIAs 110–390)

Regulatory Authority

Ministry of Corporate Affairs (MCA) & The Institute of Chartered Accountants of India (ICAI) - Internal Audit Standards Board (IASB)

Professional Assurance

Chartered Accountants Attestation under ICAI Standards & Code of Ethics

DOCUMENTATION MATRIX

Mandatory Documents Checklist

Self-attested scanned copies required

1. Promoters / Partners / Directors KYC

✓Board Resolution appointing the Internal Auditor under Section 138 of the Companies Act, 2013
✓Form MGT-14 filing acknowledgment from the MCA portal
✓Internal Audit Charter approved by the Audit Committee / Board of Directors

2. Registered Office & Premises Proof

✓Registered Office and branch manufacturing plant operational location records
✓Delegation of Authority (DoA) matrix and signing powers authorized by the Board

3. Specific Statutory Declarations & Enclosures

•Standard Operating Procedures (SOPs) and process flowcharts for core operational cycles
•Comprehensive Risk Control Matrices (RCM) mapping risks against preventive and detective controls
•ERP system user access lists (SAP, Oracle, Microsoft Dynamics) for Segregation of Duties (SoD) conflict testing
•Procure-to-Pay (P2P) purchase orders, vendor evaluation files, and payment release approvals
•Order-to-Cash (O2C) credit limit approvals, discount matrices, and customer aging ledgers
•Previous internal audit reports, statutory audit management letters, and open issue tracking sheets

PROCEDURAL ROADMAP

Step-by-Step Filing & Approval Process

Structured execution roadmap managed by our Chartered Accountants from pre-filing due diligence to certificate allotment.

01Month 1

Audit Universe & Risk-Based Planning

Defining the corporate audit universe, conducting risk assessments across operating entities, and securing Audit Committee approval for the annual internal audit plan.

02Month 2

Process Walkthroughs & RCM Evaluation

Performing walkthroughs across operational cycles, evaluating internal control design against the COSO framework, and identifying key control deficiencies.

03Quarterly Cycle

Fieldwork & Operating Effectiveness Testing

Executing substantive sample testing, testing automated ERP controls and manual approval workflows, and identifying operational leakages and fraud risks.

04Quarterly Review

Audit Committee Dashboards & Remediation

Presenting findings to the Audit Committee with root-cause analysis, quantifying financial exposures, and monitoring agreed management action plans.

Risk Control Matrix (RCM) Development & Process Audits

Practice Scope & Statutory Guidance

We construct and evaluate end-to-end Risk Control Matrices (RCM) across core operational cycles: Procure-to-Pay (P2P), Order-to-Cash (O2C), Record-to-Report (R2R), Hire-to-Retire (H2R), Inventory & Logistics, and Treasury Management. Our audits identify single points of failure, authorization bypasses, duplicate vendor master files, and inventory pilferage risks, providing practical recommendations that streamline corporate workflows.

Internal Financial Controls (IFCoFR) Testing & Design Gap Analysis

Practice Scope & Statutory Guidance

Under Section 134(5)(e) and Section 143(3)(i) of the Companies Act, 2013, corporate boards and statutory auditors must certify the adequacy and operating effectiveness of Internal Financial Controls over Financial Reporting (IFCoFR). Our team performs detailed Design Gap Assessments (DGA) and Operating Effectiveness Testing (OET) to substantiate financial control integrity, evaluating financial close processes, journal entry controls, and automated ERP validation rules.

Management Reporting, Root Cause Analysis & Remediation Tracking

Practice Scope & Statutory Guidance

Our internal audit deliverables go beyond finding identification. We provide executive-level dashboards categorizing risks by severity (High, Medium, Low), detailed root-cause analyses, quantitative exposure assessments, and actionable remediation roadmaps. We participate in Audit Committee presentations and facilitate periodic tracking to ensure timely closure of agreed management actions in accordance with ICAI SIA 310 (Planning the Internal Audit Activity).

STATUTORY MATRIX

Statutory Provisions & Regulatory Comparative Matrix

Comparative analysis of governing sections under the new framework alongside legacy statutory references.

Company Category / Structure	Governing Statute & Rule	Mandatory Internal Audit Threshold
Every Listed Company	Section 138(1) read with Rule 13	Mandatory for all listed companies regardless of turnover or capital size.
Unlisted Public Companies (Capital / Turnover)	Section 138(1) read with Rule 13(1)(a)	Paid-up share capital of ₹50 Crores or more; OR Turnover of ₹200 Crores or more during preceding FY.
Unlisted Public Companies (Loans / Deposits)	Section 138(1) read with Rule 13(1)(a)	Outstanding loans/borrowings from banks exceeding ₹100 Crores; OR Outstanding deposits exceeding ₹25 Crores.
Private Limited Companies	Section 138(1) read with Rule 13(1)(b)	Turnover of ₹200 Crores or more during preceding FY; OR Outstanding loans/borrowings from banks > ₹100 Crores.
Internal Financial Controls (IFCoFR)	Section 134(5)(e) of Companies Act, 2013	Mandatory for listed companies to confirm in Board's Report that adequate IFC are operating effectively.

ONGOING GOVERNANCE

Mandatory Post-Registration Compliances

Failing to complete statutory post-incorporation actions carries steep daily penalties. Our CA firm manages continuous compliance:

Form MGT-14 on MCA V3Within 30 days of Board Resolution

Filing Form MGT-14 with ROC

Mandatory filing of the Board Resolution appointing the internal auditor for public companies under Section 117.

Internal Audit Executive ReportAt every quarterly Board/Audit Committee meeting

Quarterly Audit Committee Reporting

Submitting structured quarterly internal audit reports with risk heat maps and status of previous open audit observations.

Section 134(5)(e) Board AttestationPrior to Board's Report finalization

Annual IFCoFR Effectiveness Attestation

Testing and validating internal financial controls over financial reporting to support directors' responsibility statements.

ICAI SIA 230 StandardsMinimum 7 Years

SIA Working Paper Documentation

Maintaining internal audit working papers, interview minutes, test sampling worksheets, and remediation proofs.

FREQUENTLY ASKED QUESTIONS

Statutory FAQs & Practical Guidance

Frequently asked questions and procedural guidance regarding Internal Audit & IFC.

Can the Statutory Auditor also act as the Internal Auditor of the same company?

No. Under Section 144 of the Companies Act, 2013, a statutory auditor is expressly prohibited from providing internal audit services to the same company, its holding company, or its subsidiary company. The internal audit must be conducted by an independent practicing Chartered Accountant, Cost Accountant, or a firm possessing specialized internal audit expertise.

Who is required to approve the Internal Audit Plan?

Under Section 177 of the Companies Act, 2013 and ICAI SIA 310, the Internal Audit Plan and the scope of internal audit activities must be reviewed and formally approved by the Audit Committee of the Board of Directors (or by the Board of Directors where no Audit Committee is required).

What is the difference between Internal Controls and Internal Financial Controls (IFC)?

Internal Controls encompass all operational, compliance, and strategic procedures across the entire enterprise. Internal Financial Controls (IFC), defined under Section 134(5)(e), specifically focus on the policies and procedures adopted by the company for ensuring orderly and efficient conduct of its business, safeguarding of assets, prevention and detection of frauds, accuracy and completeness of accounting records, and timely preparation of reliable financial information.

What is the penalty for failing to appoint an Internal Auditor under Section 138?

If a qualifying company fails to appoint an internal auditor, the company and every officer who is in default is liable to a penalty under Section 450 of the Companies Act, 2013 (₹10,000 one-time fine, plus ₹1,000 per day for continuing default, subject to a maximum of ₹2 Lakhs for the company and ₹50,000 for each officer).

STATUTORY ADVISORY DESK • PRACTICE INQUIRIES

Statutory Inquiries & Practice Advisory

Information on Internal Audit & IFC is provided for general reference. Office addresses and contact details are listed on the Contact page.

Contact Practice Office +91 99140-14949