Internal Audit Applicability in India: Section 138 Thresholds, In-House vs Outsourced and What a First Internal Audit Covers

TL;DR: Section 138 of the Companies Act makes internal audit mandatory for every listed company and for unlisted public and private companies that cross the size tests set in the rules made under the Act. A CFO should test applicability against the preceding financial year’s audited figures, minute the board’s conclusion and re-test whenever the accounts are restated. The choice between an in-house, outsourced or co-sourced internal auditor turns on process maturity, the specialist skills the first cycle needs and how independent the function must look to the audit committee. A first internal audit should cover the core money cycles, statutory compliance and IT general controls. Any internal audit team drafting with generative AI must verify every output, because those tools can state a wrong answer in a confident tone.

Section 138 turns internal audit into a statutory duty for prescribed companies

Section 138 of the Companies Act requires prescribed classes of companies to appoint an internal auditor to audit the company’s functions and activities. Every listed company falls in scope. Unlisted public companies and private companies come in when they cross size tests in the rules made under the Act, and those tests look at measures such as turnover, outstanding borrowings, paid-up capital and, for public companies, deposits.

Internal audit

an independent review, reporting to the audit committee or the board, of whether a company’s controls, processes and compliance work the way management says they do.

The rupee thresholds are deliberately absent from this article. Astravise holds to one rule in published work: we do not publish numbers we cannot attribute, and the current notified text of the rules is the only safe place to read a statutory figure. Take the thresholds from the latest amended rules, ask the company secretary to confirm them, and keep that copy in the board file.

Section 138 also fixes who may hold the role. The internal auditor must be a chartered accountant, a cost accountant or another professional the board decides on, and that person may or may not be an employee of the company. Scope, functioning, periodicity and methodology are set by the audit committee (or the board, where there is no committee) in consultation with the internal auditor. First-time CFOs often underestimate that last point: the internal audit plan belongs to the committee, not to finance.

A four-step applicability test a CFO can run before the board meeting

Applicability is a test run on numbers, so the numbers have to be the right ones. Our experience suggests a short routine that takes an afternoon and prevents an argument with the statutory auditor later.

1. Confirm the company’s class. Listed status settles the question at once. For an unlisted public or private company, identify which set of size tests applies before pulling any figures, because the two classes are not tested on identical measures.

2. Read each test against the preceding year’s audited financial statements. Use the signed accounts, not management MIS or a provisional trial balance. Some tests, borrowings among them, look at a level reached at any point during the year, so ask treasury for the peak balance and not only the year-end figure.

3. Minute the outcome either way. Record the conclusion in board minutes with the figures relied on. A company that is out of scope this year will want that written record when the statutory auditor asks about it next year.

4. Re-test after any restatement. A restated year can move a company across a line in either direction. Treat every restatement as a trigger for a fresh applicability check.

Revision of first-cut figures is normal, even at national scale. Reuters reported in September 2026 that India’s January-March quarter growth was revised to 8.6% from an earlier 7.8%^[1], under a new GDP series with a 2022/23 base year in which historical data were also revised. If a country’s headline statistic can move that far after first publication, a company’s provisional numbers can move far enough to change the answer on a threshold.

In-house, outsourced or co-sourced: each model buys something different

Co-sourced internal audit

a model in which the company keeps a named internal audit lead on its own payroll and buys specialist reviews, such as IT or indirect tax, from an outside firm.

Section 138 allows all three models, because the internal auditor need not be an employee. The right choice depends less on fee than on what the first cycle has to prove to the audit committee.

Our experience suggests that most companies running a first internal audit are better served by an outsourced or co-sourced model for at least the first year. A first cycle is mostly discovery, and discovery needs people who have seen the same control gap in other businesses. The most common mistake is selecting a delivery model before clearly defining what the audit committee needs to know.

One conflict deserves a plain warning. A financial controller who doubles as internal auditor ends up testing processes they designed and run, and the audit committee will discount every clean finding that person reports.

What a first internal audit covers, in the order Astravise runs it

A first internal audit has two jobs: give the audit committee an honest baseline, and build a plan the second cycle can test against. The sequence below is the one we follow.

1. Risk assessment and audit universe. List every process, entity and location, then rank them by financial exposure and by how much judgement each involves. The ranking decides where fieldwork hours go, and it is the document the audit committee approves first.

2. Audit committee approval of scope and method. The committee signs off the plan, the periodicity and the reporting format before fieldwork starts. That approval is what makes the plan the committee’s rather than management’s.

3. Procure-to-pay. Test vendor master changes, purchase approvals against delegated authority and three-way matching of order, receipt and invoice. Duplicate vendors and payments released without a matched receipt are the findings this cycle most often produces.

4. Order-to-cash and payroll. Test credit limits, revenue cut-off and the ageing of receivables, then reconcile payroll to headcount and statutory deductions. Joiners and leavers processed outside the cycle are where payroll gaps usually sit.

5. Record-to-report and estimates. Review the close calendar, manual journals and how provisions and accruals are estimated and later trued up. India’s Statistics Secretary made the national version of this point in September 2026, saying quarterly revisions had moved in both directions over three years and should shrink as more timely data become available^[2]; a faster, better-evidenced close does the same for management estimates.

6. Statutory compliance. Check GST returns against the books, TDS deposits against due dates and labour filings against the payroll register. Each mismatch is a finding with a cost attached, which makes this section the one boards read most closely.

7. IT general controls. Review user access, segregation of duties inside the ERP, backups and the hardware and software estate. This area is covered in more detail below, because it is where first audits find gaps that nobody owns.

8. Reporting and action tracking. Every finding gets an owner, a date and a rating, and the tracker goes to the audit committee each quarter. A first internal audit that ends with a report and no tracker has done half its work.

IT general controls surface the findings that have no owner

The typical first-cycle IT finding is a fact everyone knows and nobody has acted on. Hardware lifecycle shows why.

Consider an asset register that still lists desktops running the Intel Core i3-8100. Intel’s specification page gives the processor a launch date of Q4’17, a marketing status of Discontinued and an End of Servicing Updates Date of Monday, June 30, 2025^[3]. PassMark, in its gaming assessment, calls it “a fairly old CPU that is no longer competitive with newer CPUs”^[4].

Intel’s page does not define what servicing updates cover, and it says nothing about security or operating-system support. An internal auditor should therefore not report that those machines are unsafe. The finding is narrower and more useful: IT has no documented view of what the status means for the estate, and finance has no replacement plan it can budget for. Ownership, not the processor, is the control gap.

Generative AI speeds up audit drafting and adds errors that look correct

An internal audit team that uses ChatGPT or a similar tool to draft process notes, summarise policies or suggest test steps has added a new source of error to its working papers. A 2024 peer-reviewed review in Data Intelligence concluded that ChatGPT brings “inevitable security risks and ethical issues”^[5] alongside its benefits, and names privacy violation among the consequences.

The accuracy problem is the one that reaches audit files. A short communication in the Brazilian Journal of Science, written about GPT-3.5, notes that ChatGPT’s apparently correct answers may be factually inaccurate^[6]. An undated SOCi knowledge article adds that ChatGPT can deliver incorrect information in a confident tone and rarely signals uncertainty^[7], which is exactly what makes an error hard for a reviewer to catch. No source in our research gives a published hallucination rate for these tools, so there is no figure an audit team can adopt as a tolerance.

Complexity makes the problem worse. In a June 2025 paper, Apple’s researchers found that reasoning models helped on medium-complexity tasks, lost to standard models on simple ones, and collapsed alongside them on high-complexity ones^[8] in controlled puzzle tests. The same paper notes that evaluations built on established benchmarks often suffer from data contamination, so a strong benchmark score says little about the tool’s reliability on a company’s own ledger.

Three working rules follow for any internal audit team using these tools:

• Verify every reference at its source. A section number, notification or circular suggested by an AI tool goes into a working paper only after a team member has read the original. The reviewer signs for the source, not for the tool’s summary of it.

• Keep client data out of public tools. Ledger extracts, payroll files and vendor lists stay inside systems the company controls. The privacy risk the Data Intelligence review describes applies directly to a payroll file pasted into a chat window.

• Record where AI was used. Each working paper notes which steps an AI tool drafted. The audit committee can then judge how much of the evidence rests on human testing.

FAQ