Statutory Audit Under Companies Act: Who Needs It and Who Does Not
Every company registered under the Companies Act 2013 needs a statutory audit every financial year, whatever its turnover or profit and even if it has not started trading. A Chartered Accountant appointed as statutory auditor examines the books and expresses an opinion on whether the financial statements give a true and fair view, and that report goes to the Registrar with the financial statements in Form AOC-4. What varies from company to company is the reporting around the audit (such as CARO and internal financial controls reporting), not whether the audit itself is required. It is separate from a tax audit and cannot be replaced by one. The questions below cover who is caught, who can act as auditor, and where companies most often go wrong; the full scope of the service is on the Statutory Audit Under Companies Act page.
Is a statutory audit under the Companies Act mandatory for every company, even a small one with low turnover?
Yes. Unlike a tax audit, which is triggered only above specified turnover thresholds under Section 44AB of the Income-tax Act, the Companies Act statutory audit under Section 139/143 applies to every company registered under the Act — Private Limited, Public Limited, One Person Company, Section 8 Company, and Producer Company — regardless of turnover, profit, or even whether the company has commenced business. There is no small-company or low-turnover exemption from the audit requirement itself, though the reporting format (such as CARO applicability) can differ by company size and class.
In practice: Founders may assume that a company with no revenue in Year 1 has no compliance obligation. It is one of the most common — and costly — misconceptions in the incorporation-to-compliance journey. We flag this explicitly at every incorporation engagement.
Who does not need this audit
The Companies Act audit does not reach an LLP, which has its own audit trigger under the LLP Act, or a sole proprietorship or unregistered partnership firm, which sit outside the Companies Act altogether (a tax audit can still apply to them on turnover). It is also not the same thing as an internal audit, which is a management-facing review that the Act requires only for prescribed classes of companies. Formal dormant status under Section 455 has to be applied for and granted; a company that merely has no activity is not dormant in the legal sense, and even a company that holds the status has its own filing requirements, so confirm them before relying on it.
What is the difference between a Companies Act statutory audit and an Income-tax audit?
They are governed by entirely different laws and serve different purposes. The statutory audit under the Companies Act examines whether the financial statements give a true and fair view and comply with applicable Accounting Standards, and the report is filed with the RoC alongside AOC-4. The tax audit under Section 44AB of the Income-tax Act 1961 applies up to FY 2025-26 and results in Form 3CA/3CB with Form 3CD; from tax year 2026-27 it falls under Section 63 of the Income-tax Act 2025 and is reported in the consolidated Form 26. In either case it examines whether the business's accounts comply with income-tax provisions, is triggered by turnover/receipt thresholds, and is filed with the Income-tax Department. A company above the tax-audit threshold needs both audits — they are not substitutes for each other, though PNPC often performs both for efficiency where we are engaged for both. For the tax side, see who needs a tax audit.
In practice: Some smaller companies below the tax-audit threshold assume they are exempt from any audit. They are still required to complete the Companies Act statutory audit — the exemption, if any, applies only to the separate tax audit requirement.
How the auditor is appointed, and when the audit is due
The first auditor is appointed by the Board within 30 days of incorporation and holds office until the first AGM. After that the shareholders appoint the auditor at the AGM for a term of five consecutive years, and the appointment is reported to the RoC in Form ADT-1 within 15 days of the AGM. The earlier requirement to ratify the appointment at every AGM was removed by the Companies (Amendment) Act 2017, so a validly appointed auditor holds the full term, subject to rotation where Section 139(2) applies. If the auditor resigns mid-term, the outgoing auditor files Form ADT-3 with the RoC within 30 days giving the reasons. The Board fills a casual vacancy within 30 days; where it arises from resignation, the appointment must also be approved at a general meeting within three months of the Board's recommendation. A vacancy from disqualification is also a casual vacancy under Section 141(4).
The audit has to be finished in time for the AGM. Under Section 96 the first AGM can be held up to nine months after the end of the first financial year, and later AGMs within six months of the year end (30 September for a 31 March year end), with AOC-4 due within 30 days of the AGM. Plan backwards from that date: a company that starts the audit close to the AGM leaves no room for reconciliation problems.
How a statutory audit runs, step by step
- Independence check and engagement letter. The auditor confirms there is no disqualifying relationship under Section 141 and agrees scope and responsibilities in writing.
- Planning and risk assessment. Materiality is set and the high-risk areas are identified, such as related-party transactions, revenue recognition, inventory and loan covenants.
- Understanding controls and reconciling the trial balance to the ledger, bank statements, GST returns and TDS returns, so mismatches surface early and not in a later tax notice.
- Substantive testing. Vouching of significant transactions, bank and party confirmations, and physical verification of fixed assets and inventory where material.
- Related-party and CARO work. The auditor tests approvals and disclosures for related-party transactions and works through each applicable clause of CARO 2020.
- IFC reporting, where it applies, and any fraud-reporting duty that arises.
- Draft observations, management representation letter and report. Management gets the chance to correct or explain before the report is signed with the auditor's membership number and UDIN.
- Board approval, AGM adoption and AOC-4. The statements are approved, adopted, and filed within 30 days of the AGM.
Who can be appointed as a statutory auditor of a company?
Only a Chartered Accountant holding a valid Certificate of Practice from the Institute of Chartered Accountants of India (ICAI), or a firm where the majority of partners are practising CAs, can be appointed as statutory auditor under Section 141 of the Companies Act. The appointee must not be disqualified under Section 141(3) — which includes being an officer or employee of the company, holding a business relationship with the company beyond what is permitted, being indebted to the company beyond prescribed limits, or providing certain prohibited non-audit services to the company under Section 144.
In practice: Section 144 restricts a statutory auditor from providing certain services — like internal audit, investment advisory, and book-keeping — to the same company they audit. Independence is a reason to keep the auditor and any accounting or advisory provider separate for the same company.
What is mandatory auditor rotation, and does it apply to my company?
Section 139(2) mandates rotation of the statutory auditor for listed companies and certain classes of unlisted public companies and private companies meeting specified paid-up capital or borrowing thresholds prescribed under the Companies (Audit and Auditors) Rules. Where it applies, an individual auditor cannot be reappointed for more than one term of five consecutive years, and an audit firm cannot be reappointed for more than two terms of five consecutive years each, with a mandatory cooling-off period thereafter. Most small and mid-sized private companies fall below the prescribed thresholds and are not subject to mandatory rotation, but this should be confirmed for your specific company, not assumed.
In practice: Whether mandatory rotation applies depends on paid-up share capital, and separately on aggregate borrowings from banks/financial institutions/public deposits, as prescribed under the Rules — thresholds that companies cross as they grow. We monitor this for growing clients so a rotation trigger doesn't arrive as a surprise close to an AGM.
What is Internal Financial Controls (IFC) reporting, and is it mandatory?
Under Section 143(3)(i), the statutory auditor must report on whether the company has adequate internal financial controls with reference to financial statements, and whether such controls are operating effectively. The Ministry of Corporate Affairs notification G.S.R. 583(E) of 13 June 2017 switches this reporting off for certain private companies: a One Person Company or small company, and a private company whose turnover and aggregate borrowings are both below the notified limits (as clarified by the MCA corrigendum of 13 July 2017), provided it has not defaulted in filing its financial statements or annual return. The limits are set in monetary terms; confirm the current notification before assuming the exemption. Where reporting does apply, the auditor has to test control design and operating effectiveness formally, not just express a general opinion. For the review itself, see who needs an IFC review.
In practice: IFC testing is one of the more resource-intensive parts of a statutory audit where it applies. We scope this carefully at the planning stage — over-scoping wastes client time and fees; under-scoping produces an unsupportable conclusion. We confirm applicability for your company before starting fieldwork.
What is Section 143(12) fraud reporting, and when does it apply?
Section 143(12) requires the statutory auditor, if during the audit they have reason to believe that an offence involving fraud has been or is being committed against the company by its officers or employees, to report the matter. Where the amount involved is at or above the threshold prescribed under the Rules, the auditor reports directly to the Central Government via Form ADT-4 within the prescribed timeline. Below that threshold, the matter is reported to the Audit Committee or Board, and disclosed in the Board's Report.
In practice: This is a serious, non-discretionary obligation for the auditor once the reason-to-believe threshold is met — it is not something we can be asked to overlook. We explain this obligation to every new audit client at the engagement stage so there is no surprise if it is ever triggered.
What is the difference between AS (Accounting Standards) and Ind AS, and which applies to my company?
Indian Accounting Standards (Ind AS), converged with IFRS, are mandatory for specified classes of companies based on net worth and listing status — broadly, listed companies and larger unlisted companies meeting prescribed net worth thresholds, along with their holding, subsidiary, joint venture, and associate companies. Companies not covered by the Ind AS roadmap continue to follow the older Accounting Standards (AS) notified under the Companies (Accounting Standards) Rules. Most small and mid-sized private companies currently follow AS rather than Ind AS, but this changes as the company's net worth grows or if it becomes part of a group where a holding/subsidiary company is Ind AS-applicable.
In practice: We check Ind AS applicability at the start of every audit engagement, not just once at incorporation — a company that crosses the net worth threshold, or becomes a subsidiary of an Ind AS-applicable company, moves into the Ind AS framework and needs to restate comparatives and adjust accounting policies accordingly. This transition needs to be planned for, not discovered mid-audit.
What is a limited review, and is it different from a statutory audit?
A limited review is a lower-assurance engagement — typically used for quarterly financial results of listed companies under SEBI's Listing Obligations and Disclosure Requirements (LODR) — involving inquiry and analytical procedures rather than the full substantive testing of a statutory audit. It provides negative assurance ("nothing has come to our attention...") rather than the positive opinion ("gives a true and fair view") of a full audit. Most private companies do not require limited reviews unless they have listed debt securities or other specific regulatory triggers.
In practice: We occasionally get asked whether a limited review can substitute for the annual statutory audit to save cost. It cannot — they serve entirely different purposes and neither the Companies Act nor the RoC will accept a limited review report in place of the Section 143 statutory audit report for AOC-4 filing.
Does a startup that has raised VC funding face additional statutory audit scrutiny?
Not additional statutory requirements beyond the standard Companies Act audit, but in practice, VC-funded companies typically have more related party transactions (with the founders, ESOP trusts, or affiliated entities), more complex share capital structures (CCPS, multiple funding rounds), and investor-nominee directors who scrutinise the financial statements closely — all of which naturally increase the audit's substantive testing focus in those specific areas, even though the underlying legal framework is the same as for any other company.
In practice: For funded startups, ESOP accounting (fair value expensing under Ind AS 102/AS), CCPS classification as equity versus liability, and related-party approvals for founder transactions deserve particular attention.
What happens if a company skips the audit
A company that has no auditor or no audited accounts cannot validly adopt its financial statements at the AGM and cannot file AOC-4, which needs the auditor's report. Late filing of AOC-4 and the annual return attracts a flat per-day additional fee under the Companies (Registration Offices and Fees) Rules, and for these two forms the rules do not set an upper cap, so the amount keeps growing until the form is filed. Repeated non-filing can also lead to director disqualification under Section 164(2) and strike-off action by the Registrar under Section 248.
Mistakes that come up again and again
- "No activity, no audit." A company with nil transactions still needs audited nil statements every year. Calling the company dormant without the formal Section 455 status from the MCA does not stop the filing obligation.
- Losing track of the five-year term. Continuing with the same auditor after the term ends, without a fresh shareholder resolution, is a technical non-compliance that shows up in due diligence.
- Same firm for bookkeeping and audit. Section 144 bars an auditor from prohibited services such as book-keeping for the same company, so plan independence when you choose advisers.
- Starting close to the AGM. Reconciling the trial balance to GST and TDS in the last week is where most delays begin.
- Applying for strike-off with audits pending. A strike-off application needs a CA-certified statement of accounts, and older statutory audits and filings generally need to be current first; see voluntary strike-off and dormant company status.
Where this sits in the wider engagement
Statutory Audit Under Companies Act rarely arrives on its own. The statutory basis and the current requirements are set out on the Statutory Audit Under Companies Act service page, and the related services are grouped under Audit Assurance. For the step-by-step version, read the process from start to finish, and for the yearly company calendar see annual compliance for private companies.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Statutory Audit Under Companies Act we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.