01 August 2024
### Internal Audit System and CARO Applicability
#### **1. Applicability of Internal Audit System:**
Under the Companies Act, 2013, the requirement for maintaining an internal audit system in a private company is influenced by the provisions of the Companies (Auditor's Report) Order, 2020 (CARO 2020), and the Companies (Accounts) Rules, 2014.
**Internal Audit Mandate:** - **Internal Audit System** is mandatory for a private company if it meets any of the following conditions: - **Paid-up Share Capital:** The company's paid-up share capital is ₹50 crore or more. - **Turnover:** The company’s turnover is ₹200 crore or more. - **Borrowings:** The company’s borrowings from banks or financial institutions are ₹100 crore or more. - **Listed Companies:** All listed companies are required to have an internal audit system, regardless of the size or turnover.
If a private company falls under these conditions, it is required to have an internal audit system in place to ensure that its operations are efficient and comply with laws and regulations.
#### **2. Consequences of Non-Compliance:**
If a company that falls under the CARO 2020 criteria does not have an internal audit system, the following consequences may arise:
1. **Non-Compliance with CARO:** - **Audit Report:** The statutory auditor's report may include a qualification or adverse remark regarding the lack of an internal audit system, which could impact the credibility of the company's financial statements. - **Regulatory Scrutiny:** The company may face increased scrutiny from regulatory authorities such as the Ministry of Corporate Affairs (MCA).
2. **Legal and Penalty Consequences:** - **Penalties:** Under Section 143(3)(i) of the Companies Act, 2013, the statutory auditor is required to report on the existence and adequacy of the internal audit system. Failure to maintain an internal audit system, if mandated, may lead to penalties. - **Compliance Issues:** Non-compliance with internal audit requirements could result in legal actions and penalties for the company as prescribed by the Companies Act, 2013.
3. **Operational Risks:** - **Operational Efficiency:** Without an internal audit system, the company may face inefficiencies, fraud, and operational issues that could adversely affect its performance and compliance. - **Risk Management:** Lack of internal controls may lead to inadequate risk management and oversight, exposing the company to various financial and operational risks.
4. **Impact on Stakeholders:** - **Investors and Creditors:** The absence of an internal audit system may affect the confidence of investors and creditors, potentially impacting the company’s ability to raise capital or secure credit.
### **Summary:**
For private companies falling under CARO 2020 criteria, having an internal audit system is mandatory. Failure to establish such a system can lead to regulatory, legal, and operational consequences. It is essential for companies to comply with these requirements to ensure proper governance and risk management.