Who qualifies
Section 138 names chartered accountants and cost accountants (practising or not) and then adds “such other professional as may be decided by the Board” — so a company secretary, a finance professional, even an internal team can hold the role. Independence from management, not a particular certificate, is what gives the function value. The statutory auditor is expressly disqualified: section 144 bars them from rendering internal-audit services to the same company — auditing one’s own work is the conflict the law refuses.
When internal audit is mandatory
Rule 13 of the Companies (Accounts) Rules, 2014 — tested on the preceding financial year:
- Every listed company — always;
- Unlisted public companies — paid-up capital ₹50 crore+, or turnover ₹200 crore+, or outstanding bank/PFI borrowings ₹100 crore+ at any time, or deposits ₹25 crore+;
- Private companies — turnover ₹200 crore+ or outstanding bank/PFI borrowings ₹100 crore+ at any time.
Making it worth the fee
A compliance-checklist internal audit is a cost; a risk-based one is an instrument — revenue leakage, procurement controls, GST credit hygiene, related-party discipline. The scope is set by the audit committee or board, which is where the real design decision sits. Our internal audit & governance practice builds that scope around how the business actually runs.