Internal audit in India is not a single compliance requirement-it is a multi-authority framework where the MCA, CBDT, and GST Council each impose their own audit and review obligations with different thresholds, timelines, forms, and penalties. A company with Rs 250 crore turnover faces all three simultaneously: mandatory internal auditor under Section 138 (MCA), tax audit under Section 44AB (CBDT), and GSTR-9C reconciliation plus potential departmental audit under Section 65 (GST). Missing any one of these creates separate penalty exposure under separate laws.
This guide consolidates all three frameworks into a single reference, covers the 2026 changes (IT Rules form renumbering, ICAI 60-audit cap, GSTR-9C self-certification implications, IT Act 2025 transition), and provides a practical pre-audit health check workflow. For businesses managing professional accounting services (know more) that include audit coordination, understanding the interaction between these three audit streams is essential for comprehensive compliance.
Three Audit Authorities: The Master Comparison
| Parameter | MCA (Internal Audit) | CBDT (Tax Audit) | GST Council (Reconciliation/Audit) |
|---|---|---|---|
| Governing law | Section 138, Companies Act 2013 + Rule 13 | Section 44AB, Income Tax Act (Section 63 under IT Act 2025) | Section 44 CGST Act (GSTR-9C) + Section 65/66 (departmental/special audit) |
| Who must comply? | Listed companies; Pvt/public cos with turnover ≥ Rs 200 Cr OR loans ≥ Rs 100 Cr | Business turnover > Rs 1 Cr (Rs 10 Cr if 95%+ digital payments); Professionals gross receipts > Rs 50L | GSTR-9C: turnover > Rs 5 Cr. Section 65: any taxpayer (no threshold). Section 66: on Commissioner’s order |
| Who conducts? | CA / CMA / Board-approved professional. Statutory auditor CANNOT be internal auditor. | Chartered Accountant (practising). ICAI cap: 60 tax audits per CA from April 2026. | GSTR-9C: Self-certified by taxpayer (no CA needed since FY 2020-21). Section 65: Tax officers. Section 66: CA/CMA appointed by Commissioner. |
| Key forms | No prescribed form. Report to audit committee/board. ICAI SIAs apply. | Form 3CA/3CB + Form 3CD (renumbered under IT Rules 2026). Filed on IT portal. | Form GSTR-9C (reconciliation statement). Filed on GST portal by 31 December. |
| Due date | As per board/audit committee decision (typically quarterly). | 31 October of assessment year (31 October 2026 for TY 2026-27). | GSTR-9C: 31 December following the FY. Section 65: within 3 months of commencement. |
| Penalty | Rs 10,000 + Rs 1,000/day continuing default (Section 450). | 0.5% of turnover or Rs 1,50,000 whichever lower (Section 271B). | GSTR-9C: Rs 200/day (max 0.5% of state turnover) or Rs 25,000 general penalty. Section 65/66 findings: Section 73/74 demand + interest + penalty. |
MCA Guidelines: Internal Audit Under Section 138
Who Must Appoint an Internal Auditor?
| Company Type | Internal Audit Mandatory If... |
|---|---|
| Every listed company | Always mandatory (no threshold) |
| Unlisted public company | Turnover ≥ Rs 200 crore in preceding FY, OR outstanding loans/borrowings ≥ Rs 100 crore from banks/PFIs at any point in preceding FY |
| Private company | Turnover ≥ Rs 200 crore in preceding FY, OR outstanding loans/borrowings ≥ Rs 100 crore from banks/PFIs at any point in preceding FY |
Key rules:
- Appointment: Board of Directors appoints the internal auditor. Can be a CA, CMA, or any other professional the Board decides.
- Statutory auditor restriction: Under Section 144(b), the statutory auditor of the company cannot serve as internal auditor. This is a strict independence requirement.
- Scope: The audit committee (or Board, if no audit committee) determines the scope, methodology, periodicity, and coverage in consultation with the internal auditor.
- Reporting: Internal audit reports go to the audit committee (for listed/large companies) or the Board. The Board must review findings and take corrective action.
- ICAI Standards on Internal Audit (SIAs): While not legally mandated, ICAI’s SIA framework provides professional standards for planning, execution, documentation, and reporting of internal audits. Following SIAs strengthens the audit’s credibility and legal defensibility.
For companies registered through company registration (know more) that cross the Rs 200 crore turnover or Rs 100 crore loan thresholds, appointing an internal auditor is a first-year compliance obligation.
CBDT Guidelines: Tax Audit Under Section 44AB
Who Needs a Tax Audit?
| Category | Tax Audit Threshold |
|---|---|
| Business (cash/mixed receipts) | Total sales/turnover/gross receipts > Rs 1 crore in any previous year |
| Business (95%+ digital receipts & payments) | Total sales/turnover/gross receipts > Rs 10 crore in any previous year |
| Profession | Gross receipts > Rs 50 lakh in any previous year |
| Presumptive taxation (Section 44AD/44ADA) opt-out | If profits declared are lower than presumptive limit and income exceeds basic exemption limit |
2026 changes:
- ICAI 60-audit cap: From 1 April 2026, no CA can sign more than 60 tax audit reports in a financial year (aggregate across individual capacity and firm partnerships). This affects companies that must verify their CA has capacity before appointment.
- IT Rules 2026 form renumbering: Form 3CA/3CB and Form 3CD have been renumbered under the new IT Rules. Tax audit software must be updated before April 2026 to generate the correct form numbers.
- Tax Year concept: The IT Act, 2025 replaces “Assessment Year” with “Tax Year.” The tax audit report for TY 2026-27 is due by 31 October 2026.
For entities using tax audit services (know more), the 60-audit cap means early engagement with the auditor is critical-popular CAs may fill their capacity before the filing season.
GST Council Guidelines: GSTR-9C and Departmental Audit
GSTR-9C: Self-Certified Reconciliation Statement
Since FY 2020-21, the mandatory GST audit by CA/CMA has been replaced with a self-certified reconciliation statement (GSTR-9C) filed by the taxpayer. This applies to taxpayers with aggregate turnover exceeding Rs 5 crore.
- What it covers: Reconciliation of turnover, tax paid, and ITC claimed between GSTR-9 (annual return) and the audited financial statements. Discrepancies must be reported with reasons.
- Self-certification: The taxpayer (CFO/Finance Head/authorised person) self-certifies the statement. No CA certification required.
- Due date: 31 December following the end of the financial year.
- Penalty: Late filing: Rs 200/day (Rs 100 CGST + Rs 100 SGST), max 0.50% of state/UT turnover. General penalty: Rs 25,000 for non-filing.
Critical implication: With the removal of CA certification, the responsibility for accuracy rests entirely on the taxpayer. This has increased the frequency and rigour of departmental audits under Section 65.
Section 65: Departmental Audit by Tax Officers
Section 65 of the CGST Act empowers the Commissioner to authorise any officer to conduct a general audit of a registered person. Key features:
- No turnover threshold-any taxpayer can be selected
- Audit must be completed within 3 months from commencement (extendable by 6 months)
- Taxpayer must provide access to books, accounts, documents, and computer records
- Audit findings are communicated within 30 days of completion
- Discrepancies can trigger demand proceedings under Section 73 (normal) or Section 74 (fraud/wilful misstatement)
Section 66: Special Audit
If during scrutiny, investigation, or audit, the officer believes the accounts are complex or the taxpayer’s interest of revenue is at stake, the Commissioner may order a special audit by a CA or CMA nominated by the Commissioner. The auditor’s report is submitted within 90 days (extendable).
For businesses managing GST registration (know more) alongside annual compliance, the GSTR-9C reconciliation should be treated as an internal audit exercise-the pre-filing reconciliation catches discrepancies before the department does.
Pre-Audit Health Check: A Practical Workflow
Whether preparing for MCA internal audit, CBDT tax audit, or GST departmental audit, a structured pre-audit review prevents findings and penalties:
- Reconcile GSTR-3B, GSTR-1, and GSTR-2B for the entire period. Any mismatch between filed returns and books is the first thing auditors check. Resolve discrepancies before the audit starts.
- Verify all ITC claims. Check every major claim against valid tax invoices, proof of receipt, and the 180-day payment rule. Reverse blocked ITC proactively.
- Reconcile salary TDS (Form 24Q) with payroll records. Ensure Form 16 data matches Form 26AS/AIS. Check ESOP perquisite computation and new regime TDS calculations.
- Review internal financial controls. Document all controls over revenue recognition, expenditure authorisation, asset verification, and compliance monitoring. The statutory auditor reports on internal controls under Section 143(3)(i)-internal audit findings directly feed this assessment.
- Verify director remuneration compliance. Check Section 197 limits, board resolutions, and Schedule V compliance. CARO 2020 requires auditor reporting on director remuneration.
- Reconcile financial statements with IT return and GST returns. Revenue per books vs ITR vs GSTR-9 should match. Differences must be explainable and documented. For income tax return filing (know more), the reconciliation is a pre-filing audit step that prevents notices.
Common Mistakes to Avoid
Mistake 1: Treating internal audit as a checkbox exercise. Internal audit under Section 138 requires substantive review of controls, processes, and compliance. A perfunctory report that says “everything is fine” without evidence-based testing fails to serve its purpose and exposes the Board to liability.
Mistake 2: Using the statutory auditor as internal auditor. Section 144(b) explicitly prohibits this. The same firm or individual cannot perform both roles for the same company. Violation is a compliance breach and compromises audit independence.
Mistake 3: Not appointing the internal auditor at the start of the financial year. Section 138 requires appointment “before the commencement of the financial year.” Late appointment means the first quarter goes unaudited, creating gaps in the internal control assessment.
Mistake 4: Filing GSTR-9C without internal reconciliation. Self-certifying GSTR-9C without thoroughly reconciling GSTR-3B, GSTR-1, GSTR-2B, and books of accounts leads to discrepancies that the department’s Section 65 audit will catch. The self-certification shifts all liability to the taxpayer.
Mistake 5: Not verifying the CA’s capacity for tax audit under the 60-audit cap. From April 2026, a CA who has already signed 60 tax audit reports cannot sign yours. Verify available capacity before engagement to avoid last-minute scrambles.
Key Takeaways
Internal audit in India is a multi-authority compliance function: MCA mandates internal auditors under Section 138 (listed companies, turnover ≥ Rs 200 crore, loans ≥ Rs 100 crore), CBDT requires tax audit under Section 44AB (turnover > Rs 1 crore / Rs 10 crore), and GST Council requires GSTR-9C self-certified reconciliation (turnover > Rs 5 crore) with departmental audit powers under Sections 65 and 66.
The 2026 changes sharpen the compliance landscape: ICAI’s 60-tax-audit cap per CA, IT Rules 2026 form renumbering, the Tax Year concept, and the continued shift of GSTR-9C responsibility from CAs to taxpayers (self-certification). Companies facing all three audit streams need an integrated approach: internal audit that simultaneously covers Companies Act controls, income tax compliance, and GST reconciliation-reducing duplication and ensuring comprehensive coverage.
For growing companies, the internal audit is not just compliance-it is the single most effective tool for catching errors before three different regulators do. A robust internal audit function pays for itself by preventing penalties, interest, and demand proceedings across MCA, CBDT, and GST authorities.
Integrate Your Audit Compliance
Internal audit, tax audit, and GST reconciliation are three separate compliance obligations that converge on the same underlying data: your books of accounts. An integrated approach-where the internal audit simultaneously covers MCA controls, CBDT tax compliance, and GST reconciliation-eliminates duplication, catches cross-regulatory issues early, and provides a single, coherent compliance framework.
Explore our professional accounting services (know more) for internal audit under Section 138, tax audit under Section 44AB, GSTR-9C reconciliation, and pre-audit health checks that cover all three regulatory dimensions.
For queries, reach out at +91 945 945 6700 or WhatsApp us directly.
