Audit — Statutory, Tax & Internal Audit

Most business owners believe a forensic audit is simply a statutory audit done more carefully, over a longer period, by someone more suspicious. That belief is wrong on every count. The trigger is different, the standard of proof is different, the output is different, and the liability the Chartered Accountant carries is different. A statutory auditor forms an opinion on whether financial statements give a true and fair view; a forensic auditor builds a case file intended to survive cross-examination. This piece sets out the four separate legal regimes that actually mandate forensic audits in India — Sections 210, 212, 213 and 143(12) of the Companies Act 2013, the RBI Red Flagged Account framework, SEBI LODR disclosure obligations, and transaction audits under IBC 2016 — and then explains the part practitioners most often get wrong: what makes forensic evidence admissible. Since 1 July 2024 the Bharatiya Sakshya Adhiniyam 2023 governs electronic records, and Section 63 certification is not optional. Includes a nine-step engagement checklist and the three distinct heads of personal liability a signing CA carries.

Ask most promoters of an unlisted public company whether secretarial audit applies and you will hear a confident no — the reasoning is always that secretarial audit is a SEBI matter for listed companies. That belief has cost boards a flat Rs.2,00,000 penalty under Section 204(4) of the Companies Act 2013, and more often a qualified MR-3 report discovered days before an AGM. Section 204 does not turn on listing status alone. Rule 9 of the Companies (Appointment and Remuneration of Managerial Personnel) Rules 2014 sets four independent triggers, and three of them have nothing to do with the stock exchange — including one that catches private limited companies. This article sets out exactly who is covered, how the paid-up capital, turnover and Rs.100 crore borrowing tests are measured, what a company secretary in practice actually examines in Form MR-3, the appointment and tenure rules that changed for listed entities from FY 2025-26, and the working calendar to follow so the audit is not compressed into six weeks.

Bank branch audit is widely described, even inside the profession, as a week of voucher-ticking in April. That description is wrong in a way that creates real professional risk. A branch statutory audit is a regulatory certification in which the auditor independently forms a view on asset classification under RBI's IRACP Master Circular, and where a wrong call on a single large advance can understate provisioning by crores. This article sets out what Section 143 of the Companies Act 2013 and the RBI prudential norms actually require: the 90-day NPA trigger running from the day after the due date, the borrower-wise classification cascade, the out-of-order test for cash credit accounts, the Substandard to Doubtful to Loss progression with provisioning rates, and the twenty-odd heads of the Long Form Audit Report. It then walks through where branch audits go wrong in practice, most often on drawing power recomputation, manual overrides of system-flagged NPAs, restructured account provisioning, and stale security valuations, followed by a step-by-step engagement checklist and the Memorandum of Changes discipline that turns findings into actual provisioning.

Most promoters of private limited companies believe the statutory audit is a signature the CA provides so the company can file with the ROC, and that a company with no turnover does not need one at all. Both beliefs are wrong, and the second is expensive. The audit obligation under Section 139 of the Companies Act, 2013 attaches to the company itself, not to its revenue — there is no turnover threshold, unlike the tax audit. Section 143 imposes six specific enquiries the auditor must make, a defined list of matters the auditor must state an opinion on including internal financial controls and director disqualification, and a fraud-reporting duty that runs to the Central Government over the Board's head for amounts of Rs.1 crore or above. CARO 2020, notified under Section 143(11), adds 21 clauses covering title deeds, bank stock statement reconciliation, statutory dues, cash losses and more. This article sets out what the law actually requires, what surprises company owners in practice, and the seven things to fix before your FY 2025-26 audit begins.

Section 138 of the Companies Act 2013 mandates internal audit for certain companies based on turnover and paid-up capital thresholds. This post clarifies who must comply, what the audit scope covers, and the statutory obligations for audit committees.

A forensic audit is not a routine compliance exercise--it is a specialized investigation triggered by suspicion of fraud, misappropriation, or financial crime. Courts, lenders, and regulators deploy forensic auditors when standard audit procedures fail to uncover the truth. Understand when one is mandated, what evidence holds up in law, and what liability your CA faces.

Bank branch audits are a statutory necessity under RBI guidelines, governed by the long-form audit report (LFAR) framework and IRACP norms for asset classification. Understanding the technical requirements, NPA thresholds, and compliance obligations is critical for auditors and bank management.

Section 143 of the Companies Act 2013 mandates statutory audit for all companies above threshold limits. CARO 2020 (Companies Auditor's Report Order) prescribes 49 specific matters auditors must examine and report on. This post breaks down the core verification requirements every CA must follow.

Banks, NBFCs, and regulators frequently demand net worth certificates from CAs. This post clarifies when they're mandatory, which balance-sheet figures to include under Schedule III, and the professional and legal liability you face as the certifying accountant.