Internal Audit Applicability for Private Companies 2026: Turnover, Loan & Deposit Thresholds

Internal audit is mandatory for a private company if turnover reaches ₹200 crore or bank/PFI borrowings exceed ₹100 crore at any point in the preceding financial year – paid-up capital and deposits are not tested for private companies, only for unlisted public companies. The requirement is reassessed each year based on the prior year’s figures, so applicability can switch on or off.

Every year around this time we get the same call from a finance head. The company has had a good year, turnover has jumped, and someone at the bank or in the board meeting has asked whether an internal auditor now needs to be appointed. Nobody is quite sure. Somebody half-remembers a figure of two hundred crore, somebody else mentions deposits, and the discussion goes in circles.

So here is the position, set out plainly. Internal audit applicability is not complicated once you know which numbers to look at, and – just as importantly – which numbers do not apply to you at all. Once you’ve confirmed whether the requirement applies to you, it’s worth understanding what an internal audit engagement actually covers before you start evaluating auditors.

The Threshold Tests Under Rule 13 – And Why Private Companies Have Only Two

First, the source. The requirement comes from Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014. Not the Companies (Audit and Auditors) Rules – that set of rules deals with your statutory auditor, and mixing the two is where a lot of confusion starts.

Rule 13 sets out four possible tests: paid-up share capital, turnover, borrowings from banks or public financial institutions, and deposits. But they do not all apply to everybody.

• Listed companies are covered regardless of size. No test, no threshold, no argument.
• Unlisted public companies are tested against all four.
• Private companies are tested against only two – turnover and borrowings.

That last line is worth reading twice, because plenty of articles, including some published by people who should know better, tell private companies to check their deposits and their paid-up capital. Rule 13 does not ask a private company to do either. If you are a private limited company with a paid-up capital of Rs. 80 crore and a turnover of Rs. 50 crore, and you have no bank borrowings worth speaking of, Section 138 does not apply to you.

Turnover, Borrowings & Deposits – The Exact Current Limits

The figures below are what Rule 13 actually says, and they have not changed for years. Every one of them is measured against the preceding financial year.

For a private company (either test triggers it)

• Turnover of Rs. 200 crore or more during the preceding financial year, or
• Outstanding loans or borrowings from banks or public financial institutions exceeding Rs. 100 crore at any point of time during the preceding financial year.

For an unlisted public company (any one test triggers it)

•  Paid-up share capital of Rs. 50 crore or more during the preceding financial year, or
•  Turnover of Rs. 200 crore or more during the preceding financial year, or
•  Outstanding borrowings from banks or public financial institutions exceeding Rs. 100 crore at any point during the preceding financial year, or
•  Outstanding deposits of Rs. 25 crore or more at any point during the preceding financial year.

Two details that decide real cases. The borrowing test says “at any point of time”, not “at the year-end”. A company that took a short-term facility of Rs. 110 crore in June and repaid it by December has crossed the line, even though the balance sheet on 31 March shows nothing. And the borrowing must be from a bank or a public financial institution. An unsecured loan from a director, or a group company loan, does not count towards that Rs. 100 crore.

As for who can be the internal auditor: a chartered accountant, a cost accountant, or any other professional the Board decides on. He or she may be an employee of the company. What is not allowed is asking your statutory auditor to do it – Section 144 rules that out.

Does Applicability Reset Every Year or Stay Once Triggered?

This is the question people actually want answered, and the honest answer is that the rule tests you afresh each year.

Rule 13 asks whether you crossed a threshold “during the preceding financial year”. So the test for FY 2026-27 is your FY 2025-26 numbers. If turnover was Rs. 230 crore last year and Rs. 160 crore this year, with no large bank borrowings, then on a plain reading the requirement applied last year and does not apply next year. It is not a one-way door.

That said, dropping the internal auditor the moment you fall below the line is rarely a good idea, and here is why. Your statutory auditor still has to report, under CARO, whether the company has an internal audit system that suits its size and nature of business, and whether the internal audit reports were considered. Falling below Rs. 200 crore does not make that question go away. Neither do your lenders, who tend to notice when internal audit quietly disappears from a company that is close to the threshold and likely to cross it again.

Our practical advice to clients sitting near the line: keep the function, scale the scope. It costs less than switching it on and off.

What Happens If a Company Skips a Required Internal Audit

Section 138 does not carry its own penalty clause. That has led some people to assume there is no real consequence. There is.

• The general penalty applies. Where the Act prescribes no specific punishment, Section 450 kicks in: the company and every officer in default face a penalty of Rs. 10,000, and Rs. 1,000 for each day the default continues, subject to the caps in that section. It is compoundable, but it is still a penalty on the company and on named directors.
• It shows up in the audit report. CARO requires the statutory auditor to comment on whether an internal audit system exists and is commensurate with the business. A company that should have one and does not gets that written into a public document.
• It surfaces during diligence. Every buyer, private equity investor and lender runs a Companies Act compliance check. A missing internal auditor for a year in which the company clearly crossed Rs. 200 crore is an easy finding, and it invites the question of what else was missed.

The higher cost is usually not the fine. It is that a company doing Rs. 200 crore of turnover without any independent review of its processes is normally leaking money somewhere, and nobody has been looking. If you’ve just crossed the threshold and are weighing how to staff this, our comparison of in-house vs outsourced internal audit breaks down the real cost difference for a company your size.

LLP Audit Applicability – How the Rules Differ

A lot of people land on this topic looking for LLPs, so let us deal with it properly rather than in a footnote.

An LLP is not a company. It is governed by the Limited Liability Partnership Act, 2008, not the Companies Act, 2013. Section 138 does not apply to an LLP at all, which means there is no statutory internal audit requirement for an LLP, whatever its turnover.

What LLPs do have is a statutory audit requirement, and this is where the confusion usually begins. Under the LLP Act read with the LLP Rules, 2009, an LLP must get its accounts audited by a chartered accountant in practice if either:

• its turnover in a financial year exceeds Rs. 40 lakh, or
• its contribution exceeds Rs. 25 lakh.

Below both of those, an LLP is not required to have its accounts audited, though the partners must still maintain proper books and file the annual returns.

So the two things are quite different. For a company, internal audit is a governance obligation that switches on at large numbers. For an LLP, statutory audit is an accounts obligation that switches on at fairly small numbers, and internal audit is simply a management choice. Plenty of LLPs – professional firms, distribution businesses, family ventures – do run internal audits, because it makes sense for them, not because anyone made them.

A Quick Self-Check Table by Company Type

Find your row, look at the trigger, and check it against last year’s numbers.

Entity type	Internal audit needed?	What triggers it (preceding FY)	Where the rule sits
Listed company	Yes, always	No threshold. Listing alone is enough.	Sec. 138 + Rule 13
Unlisted public company	Yes, if any one test is crossed	Paid-up capital Rs. 50 cr or more; or turnover Rs. 200 cr or more; or bank / PFI borrowings above Rs. 100 cr; or deposits Rs. 25 cr or more	Sec. 138 + Rule 13
Private limited company	Yes, if either test is crossed	Turnover Rs. 200 cr or more; or bank / PFI borrowings above Rs. 100 cr. Capital and deposits are not tested.	Sec. 138 + Rule 13
LLP	No statutory internal audit at all	But statutory audit is needed if turnover is above Rs. 40 lakh or contribution is above Rs. 25 lakh.	LLP Act, 2008 + LLP Rules, 2009
Partnership firm/proprietorship	No internal audit under any statute	Tax audit and other laws may still apply separately.	Not covered by Sec. 138

One caution before you use this as the final word. Sector regulators can impose their own requirements – NBFCs and insurance intermediaries are the usual examples – and those sit on top of Section 138, not inside it. If you are in a regulated sector, check the regulator’s rules as well.

Frequently Asked Questions

When is internal audit mandatory for private companies?

For a private company, internal audit is mandatory if, in the previous financial year, turnover was ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions crossed ₹100 crore at any point. You only need to cross one of these to be covered. If you’re below both, internal audit isn’t legally required — though you can still choose to do one.

What is Section 138 of the Companies Act?

Section 138 of the Companies Act, 2013 is the provision that requires certain classes of company to appoint an internal auditor. The specific size thresholds are set out in Rule 13 of the Companies (Accounts) Rules, 2014, which works alongside Section 138. Together they decide which companies must have an internal audit and who can carry it out.

What is the penalty for not having internal audit?

Section 138 doesn’t prescribe a specific penalty. So the general penalty under Section 450 applies — the company and every officer in default can be fined up to ₹10,000, plus ₹1,000 for each day the default continues. On top of the fine, ongoing non-compliance can invite MCA scrutiny and, in serious or repeated cases, contribute to director disqualification under Section 164.

Can a CA firm conduct internal audit for a private company?

Yes. A CA firm is one of the most common choices for internal audit, and many private companies prefer an external firm for the independence and expertise it brings. The internal auditor can be a Chartered Accountant, a cost accountant, or another board-approved professional, and can be either in-house or external. The only firm that can’t do it is your existing statutory auditor – Section 144 keeps those two roles separate.

How PKC Can Help

PKC Management Consulting is a mid-tier firm with decades of combined experience running internal audits for private companies of every size — from large groups well over the thresholds to smaller businesses that simply want their controls checked before they scale. We’ll help you work out whether Section 138 actually applies to you, set the right scope and frequency, and turn the findings into practical fixes rather than a report that gathers dust. If you’re unsure where you stand, that’s exactly the kind of thing we sort out every day.

Your dream business is just a click away. Book a FREE 30-minute consultation.

Call us: +91 91761 00095

Disclaimer: This blog is for general information only and is not legal or financial advice. Thresholds and rules can change, and sector regulators may impose their own internal audit requirements. Please speak to a qualified professional about your specific situation.