What Is the Private Company Internal Audit Applicability Limit Under Section 138? (2026)

Last updated: 5 October 2026

Quick Answer: The private company internal audit applicability limit is turnover of ₹200 crore or more, or bank or public financial institution borrowings exceeding ₹100 crore. Either test is enough, both use the preceding financial year, and borrowings are measured at their peak, not at year-end. Paid-up capital and deposits are not tests for a private company.

Usually, promoters first hear about this limit from the statutory auditor, after the accounts for a good year have closed. By then the company may already be inside the rule for the current year.

The limits are brief. Interpreting them is more difficult because one of the tests is performed with the annual figure while the second uses a peak that is not represented in the balance sheet.

Which two rule 13 tests make internal audit mandatory?

A private company must appoint an internal auditor if it meets either of two limits in the preceding financial year. Section 138 of the Companies Act, 2013 requires prescribed classes of companies to have an internal auditor. Rule 13(1)(c) of the Companies (Accounts) Rules, 2014 prescribes the private-company class.

Both tests serve as alternatives. Turnover of ₹200 crore is enough with modest borrowings, and so is a bank borrowing peak exceeding ₹100 crore at ₹120 crore of turnover.

Which year's figures decide whether internal audit applies?

The prior financial year decides it. The numbers for the year ended 31 March 2026 will show whether an internal auditor is necessary for the 2026-27 financial year.

Turnover is a full-year figure

Turnover is read for the whole of the previous financial year. The limit is inclusive: turnover of exactly ₹200 crore meets it.

Borrowings are a peak, not a year-end balance

The borrowing test measures the amount outstanding "at any point of time" during the preceding year. For example, a cash credit limit drawn to ₹105 crore in December counts, even if the balance had fallen to ₹70 crore by 31 March. The wording of the rule, "exceeding one hundred crore rupees or more", is ambiguous at exactly ₹100 crore. A Board whose peak reaches ₹100 crore should treat the test as met or take advice before relying on the narrower reading.

Which lenders count?

Only borrowings from banks and public financial institutions (PFIs) count. Under section 2(72) of the Act, the term "public financial institution" covers bodies such as the Life Insurance Corporation of India and institutions notified by the Central Government. Loans from directors, promoters or group companies fall outside the words of the rule.

How do the limits work on real numbers?

The cases below are illustrative. Each applies rule 13(1)(c) to figures for the preceding financial year.

Case A reflects a common misreading: the ₹50 crore paid-up capital figure in rule 13 applies only to unlisted public companies.

What are the limits for public and listed companies?

Rule 13(1) sets three classes, and a company falls into exactly one of them.

When a private company is treated as public

The proviso to section 2(71) of the Act deems a subsidiary of a company that is not a private company to be a public company, even if its articles still call it private. A private subsidiary of a listed or unlisted public company should therefore test itself against the unlisted public company row, including the ₹50 crore paid-up capital and ₹25 crore deposit limits.

What happens once a private company crosses the limit?

For the year following the test year, the company is required to appoint an internal auditor, which has three consequences.

Appointment of the internal auditor and who can be appointed

Section 138 and rule 13 leave the Board three choices to make:

• Qualification: a chartered accountant, whether in practice or not, a cost accountant, or another professional decided by the Board.
• Form: an individual, a partnership firm or a body corporate.
• Status: an employee of the company or an outside appointee.

The Board must make the appointment by a resolution passed at a Board meeting, under rule 8(4) of the Companies (Meetings of Board and its Powers) Rules, 2014.

Under rule 13(2), the audit committee or the Board, in consultation with the internal auditor, formulates the scope, functioning, periodicity and methodology of the internal audit.

The statutory auditor reports on it

Where CARO 2020 applies, paragraph 3(xiv) requires the statutory auditor to report whether the company has an internal audit system commensurate with its size and nature. The ICAI Guidance Note on CARO 2020 gives the wording for a company that is required to have internal audit under section 138 but has not established it for the year.

Not appointing one attracts a penalty

Section 138 carries no penalty of its own, so the general penalty in section 450 applies: ₹10,000, plus ₹1,000 for each day after the first during which the default continues, up to ₹2 lakh for the company and ₹50,000 for each officer in default (as of 5 October 2026). In one adjudication order of February 2024, the Registrar of Companies at Pune imposed penalties under section 450 on a private company and its officers for not appointing an internal auditor.

Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, approaches newly covered companies through its internal, process and management audit practice, which follows a COSO-based method.

Which mistakes do companies make when reading the limit?

Four errors recur among growing manufacturers and retailers (illustrative):

1. Reading only the 31 March balance sheet. A spinning mill draws its cash credit hardest during the cotton buying season, and a jewellery retailer carries peak gold stock before the festival months. The peak can cross ₹100 crore while the year-end figure sits well below it.
2. Testing the current year instead of the preceding one. The obligation for 2026-27 turns on the 2025-26 accounts, not on the turnover forecast.
3. Missing the group position. A private company that became a subsidiary of a public company during a restructuring is now tested as a public company.
4. Treating the appointment as permanent or as never needed. The test is applied afresh every year, so a company near ₹200 crore should monitor it each quarter.

Peaks follow each sector's cash cycle, so the industries a company operates in shape the Board's review.

Does a company below the limit still need internal audit?

A Board does not have to appoint one, but it can choose to do so. If a company is close to either threshold, it can start a lighter internal audit a year early, so that the function and its first reports are in place before the rule applies.

Not sure whether your company has crossed the limit?

In case you find the turnover nearing ₹200 crore or if your working capital lines cross ₹100 crore, a short review of last year's numbers will settle the question. You can contact Astral Business Consulting to plan an internal audit that is ready before the rule applies.