Most private limited companies in India have compliance gaps. Not because the founders are negligent - but because the compliance landscape is vast (10+ different regulatory bodies, 20+ annual filings, 4+ separate portals) and the cross-references between them are invisible until a problem surfaces.
The problem surfaces when: a bank asks for compliance records during a loan application, an investor requests a due diligence report, the ROC issues a notice for late filing, a director’s DIN is deactivated blocking all MCA filings, or the company receives an income tax notice because GST turnover does not match ITR turnover.
A compliance audit identifies these gaps before they create real damage. This blog describes our 10-point compliance audit framework, the most common gaps we find, and how we help Pvt Ltd companies regularise and prevent them.
What Is a Compliance Audit for a Pvt Ltd Company?
A compliance audit is a systematic examination of a company’s adherence to all applicable statutory and regulatory requirements. For a Pvt Ltd company in India, this covers:
- MCA/ROC compliance: filings under the Companies Act, 2013 (AOC-4, MGT-7, DIR-3 KYC, ADT-1, board meetings, statutory registers)
- Income tax compliance: ITR-6, tax audit, advance tax, TDS, transfer pricing (if applicable)
- GST compliance: GSTR-1, GSTR-3B, GSTR-9, GSTR-9C, e-invoicing
- Labour law compliance: PF, ESI, professional tax, gratuity, minimum wages
- Other compliance: FSSAI (food businesses), FEMA/FLA (if FDI/ODI), MSME-1 (if MSME vendor payments pending)
The audit produces: (a) a gap report listing every identified non-compliance, (b) a risk assessment (severity of each gap), and (c) a remediation plan (priority, timeline, cost). Businesses using ROC compliance services (know more) get compliance audit as the first step in the engagement.
Key Terms You Should Know
AOC-4 - Financial Statements: Filed within 30 days of AGM. Contains audited balance sheet, P&L, cash flow, and auditor’s report.
MGT-7 / MGT-7A - Annual Return: Filed within 60 days of AGM. MGT-7 for regular companies; MGT-7A for OPCs and small companies. Contains shareholder details, director details, and company structure.
DIR-3 KYC - Director KYC: Annual KYC for every DIN holder. Due 30 September. MCA notification (March 2026): now required once every 3 financial years instead of annually.
ADT-1 - Auditor Appointment: Filed within 15 days of AGM where auditor is appointed. Intimation to ROC about auditor’s name and tenure.
DPT-3 - Return of Deposits: Filed annually by 30 June. Reports details of deposits and exempt deposits received by the company.
MSME-1 - Outstanding Payments: Half-yearly filing reporting outstanding payments to MSME vendors beyond 45 days.
INC-20A - Commencement of Business: One-time filing within 180 days of incorporation (for companies incorporated after 2019).
Striking Off: ROC can strike off a company’s name from the register if it fails to file annual returns for 2+ consecutive years. Directors are disqualified from holding directorship in any company for 5 years.
Who Needs a Compliance Audit?
- Newly incorporated companies (to establish baseline compliance from Day 1)
- Companies seeking funding (investors and banks require clean compliance records)
- Companies changing CA/CS firms (new advisors need a compliance health check)
- Companies that received MCA notices or penalties (need gap identification and regularisation)
- Companies planning conversion (Pvt Ltd to LLP or vice versa - all pending compliances must be cleared first)
- Companies with dormant/inactive status (even dormant companies have compliance obligations)
- Any company that has not conducted a compliance review in the last 2+ years
Our 10-Point Compliance Audit Framework
✅ Point 1: MCA Status Check
We check: company status on MCA portal (Active/Default/Struck Off), DIN status of all directors (Active/Deactivated), GSTIN status, and any pending MCA notices or show cause orders.
Common gap found: 35% of new clients have at least one director with deactivated DIN (DIR-3 KYC not filed).
✅ Point 2: ROC Filing Review (All Years)
We download the MCA filing history and verify: AOC-4 filed for every year since incorporation, MGT-7 filed for every year, ADT-1 filed at auditor appointment/reappointment, DPT-3 filed annually (if deposits received), INC-20A filed (if incorporated after 2019).
Common gap found: 40% of companies we audit have at least one year of AOC-4 or MGT-7 not filed or filed significantly late.
✅ Point 3: Board Governance Review
We verify: minimum 4 board meetings held per year (gap between consecutive meetings ≤ 120 days), AGM held within 6 months of FY end (by 30 September), board meeting minutes maintained in bound form, statutory registers maintained (register of members, register of directors, register of charges). For statutory audit (know more) that feeds into compliance audit, we handle both.
Common gap found: 60%+ of startups and small Pvt Ltd companies do not maintain proper board meeting minutes.
✅ Point 4: Statutory Audit Status
We verify: auditor appointed at first AGM (within 30 days of incorporation), ADT-1 filed, audit completed before AGM, auditor’s report issued without qualifications (or qualifications documented and disclosed). For statutory audit 2026 analysis (know more), see how audit requirements have evolved.
Common gap found: 20% of companies have not appointed an auditor or have not renewed the auditor’s appointment at the required interval.
✅ Point 5: Income Tax Compliance Review
We verify: ITR-6 filed for every year, tax audit report filed (Form 3CA/3CB + 3CD) if applicable, advance tax payments made on time (15 Jun, 15 Sep, 15 Dec, 15 Mar), TDS deducted and deposited on time, TDS returns filed quarterly (Form 24Q/26Q/27Q), and any outstanding IT demands or notices.
Common gap found: 30% of companies have TDS returns filed late (triggering Section 234E late fee + Section 271H penalty).
✅ Point 6: GST Compliance Review
We verify: GSTR-1 and GSTR-3B filed for every month/quarter, GSTR-9 (annual return) filed, GSTR-9C (reconciliation) filed if turnover > Rs 5 crore, ITC reconciliation (GSTR-2B vs purchase register), e-invoicing compliance (if turnover > Rs 5 crore), and any GST notices or demands. For GST return filing (know more) services covering the complete GST compliance cycle, we handle the integrated calendar.
Common gap found: 25% of companies have GSTR-1 vs GSTR-3B turnover mismatches. 15% have not filed GSTR-9 for prior years.
✅ Point 7: TDS Compliance Review
We verify: TDS deducted on all applicable payments (salary, rent, professional fees, contractor payments, interest), TDS deposited by the 7th of the following month, TDS returns filed by due dates, Form 16/16A issued to deductees, and any TRACES notices.
Common gap found: 45% of companies miss TDS on professional fee payments (Section 194J) or rent payments (Section 194I).
✅ Point 8: Labour Law Compliance Review
We verify: PF registration and monthly contributions (if 20+ employees), ESI registration and contributions (if applicable), professional tax registration and payment (state-specific), gratuity provision (if 10+ employees), and minimum wages compliance.
Common gap found: 30% of growing companies cross the PF/ESI threshold without registering.
✅ Point 9: Cross-Verification (MCA-IT-GST Turnover)
We cross-check: turnover in AOC-4 (financial statements) vs turnover in ITR-6 vs turnover in GSTR-9 vs turnover in GST returns. Any mismatch between these four sources triggers regulatory notices.
Common gap found: 20% of companies have turnover mismatches between MCA, IT, and GST filings - usually due to timing differences, credit notes, or incorrect GST classification.
✅ Point 10: Remediation Plan
Based on Points 1-9, we create: a prioritised gap list (sorted by severity: high/medium/low), a remediation timeline (immediate: DIN reactivation, pending filings; 30 days: regularise MCA filings; 60 days: clear IT/GST gaps), and a cost estimate (filing fees, penalties, professional fees). For our comprehensive ROC filing penalties guide (know more) covering the full penalty framework, we provide this as part of the remediation plan.
The Complete Pvt Ltd Annual Compliance Checklist
| # | Compliance | Due Date | Filed With | Penalty for Delay |
|---|---|---|---|---|
| 1 | Board Meetings (min 4/year) | Within 120-day gap | Internal (minutes maintained) | Rs 25,000 per meeting missed |
| 2 | Annual General Meeting (AGM) | 30 September 2026 | Internal (minutes filed with ROC if needed) | Rs 1,00,000 on company + Rs 5,000/day on directors |
| 3 | Statutory Audit | Before AGM | Auditor issues report | No specific penalty for late audit; but AOC-4 cannot be filed without it |
| 4 | AOC-4 (Financial Statements) | 30 October 2026 (30 days after AGM) | MCA (ROC) | Rs 100/day. No cap. |
| 5 | MGT-7 (Annual Return) | 29 November 2026 (60 days after AGM) | MCA (ROC) | Rs 100/day. No cap. |
| 6 | DIR-3 KYC (Director KYC) | 30 September 2026 (now once per 3 FYs per MCA notification March 2026) | MCA | DIN deactivation + Rs 5,000 reactivation |
| 7 | ADT-1 (Auditor Appointment) | 15 days after AGM | MCA (ROC) | Rs 100/day |
| 8 | DPT-3 (Return of Deposits) | 30 June 2026 | MCA (ROC) | Up to Rs 10 crore or 2x deposits |
| 9 | MSME-1 (Outstanding Payments) | Half-yearly (31 Oct, 30 Apr) | MCA (ROC) | Rs 20,000 on company + daily fine on directors |
| 10 | ITR-6 (Income Tax Return) | 31 October 2026 | IT Department | Rs 5,000/10,000 + interest under 234A |
| 11 | Tax Audit (if applicable) | 30 September 2026 | IT Department | 0.5% of turnover or Rs 1,50,000 |
| 12 | GST Returns (GSTR-1/3B) | Monthly (11th/20th) | GST Portal | Rs 50-200/day + 18% interest |
| 13 | TDS Returns (24Q/26Q/27Q) | Quarterly (31 Jul/Oct/Jan/May) | TRACES | Rs 200/day (Section 234E) + penalty Section 271H |
| 14 | Advance Tax | 15 Jun/Sep/Dec/Mar | IT Department (challan) | Interest under 234B/234C |
| 15 | PF/ESI Returns | Monthly (15th of following month) | EPFO/ESIC | 12% interest + penalty up to 100% of contribution |
The 10 Most Common Compliance Gaps We Find
| # | Gap | Why It Happens | How We Fix It |
|---|---|---|---|
| 1 | DIR-3 KYC not filed (DIN deactivated) | Directors forget annual KYC. No reminder from MCA. DIN silently deactivated in October. | File DIR-3 KYC with Rs 5,000 fee. DIN reactivated within 24-48 hours. Then file all blocked forms. |
| 2 | AOC-4/MGT-7 not filed for 1+ years | Company started filing ‘next year’ and kept delaying. Penalty accumulated unnoticed. | File all pending returns sequentially (oldest first). Pay accumulated penalty. Total cost calculated upfront. |
| 3 | Board meetings not held (or minutes not maintained) | Startup founders conduct informal discussions but no formal board meetings with documented minutes. | Conduct retrospective board meetings (where possible). Prepare minutes for all past meetings. Establish quarterly meeting calendar. |
| 4 | Statutory registers not maintained | Companies maintain digital records but not the statutory registers required under the Companies Act (register of members, charges, directors). | Prepare and update all statutory registers from incorporation to current date. Maintain in bound form. |
| 5 | INC-20A not filed (commencement of business) | Companies incorporated after 2019 must file INC-20A within 180 days. Many miss this one-time filing. | File INC-20A with late fee. If not filed: company cannot commence business until filed. |
| 6 | GST-ITR-MCA turnover mismatch | Different data sources, timing differences, credit notes, exempt supplies reported differently across portals. | Reconcile all three sources. Document differences. Amend returns where possible. Prepare mismatch explanation for audit. |
| 7 | TDS not deducted on applicable payments | Company makes professional fee payments, rent payments, or contractor payments without deducting TDS. | Calculate TDS liability for all prior periods. Deposit TDS with interest (Section 201). File revised TDS returns. |
| 8 | Auditor not appointed or ADT-1 not filed | First auditor appointed at incorporation but not ratified at AGM. No ADT-1 filed. | Appoint auditor at next board meeting/AGM. File ADT-1 within 15 days. If lapsed: file with penalty. |
| 9 | PF/ESI not registered despite crossing threshold | Company hired 20+ employees but did not register for PF. ESI threshold crossed without registration. | Register immediately. Calculate and deposit past contributions with interest. File returns for all pending months. |
| 10 | GSTR-9 annual return not filed for prior years | Companies filed monthly returns but forgot the annual return. GSTR-9C also missed for turnover > Rs 5 crore. | File pending GSTR-9/9C for all open years. 3-year restriction: file immediately before the window closes. |
Documents Required for a Compliance Audit
- MCA filing history (download from MCA portal)
- Certificate of Incorporation, MOA, AOA
- LLP Agreement / Shareholders Agreement (if applicable)
- Board meeting minutes for all years
- AGM minutes for all years
- Statutory registers (members, directors, charges)
- Audited financial statements for all years
- Auditor’s appointment letter and ADT-1 receipts
- ITR-6 filed returns with computation for all years
- Tax audit reports (if applicable)
- GST returns (GSTR-1, 3B, 9, 9C) for all years
- TDS returns (24Q, 26Q, 27Q) for all quarters
- PF/ESI registration and return filing records
- Bank statements for all company accounts
- DIR-3 KYC acknowledgements for all directors
- Any MCA/IT/GST notices received
Step-by-Step: How to Conduct a Pvt Ltd Compliance Audit
Step 1: Download MCA master data (Day 1). Pull the company’s filing history from MCA V3 portal. Check: Active/Default status, all forms filed (with dates), DIN status of each director.
Step 2: Prepare compliance matrix (Day 1-2). List every required filing for every year from incorporation to current: AOC-4, MGT-7, ADT-1, DPT-3, DIR-3 KYC, INC-20A. Mark: filed/not filed/filed late.
Step 3: Review board governance (Day 2-3). Check board meeting records: 4 meetings per year held? Minutes documented? Statutory registers maintained?
Step 4: Review IT compliance (Day 3-4). ITR-6 filed for each year? Tax audit done? TDS deducted and deposited? Advance tax paid? Any outstanding notices?
Step 5: Review GST compliance (Day 4-5). GSTR-1/3B filed for every period? GSTR-9/9C filed? ITC reconciled? E-invoicing compliant? For our LLP compliance guide (know more), the same framework applies to LLP audits.
Step 6: Review labour law compliance (Day 5-6). PF registered? ESI registered? Professional tax paid? Gratuity provision maintained?
Step 7: Cross-verify turnover (Day 6-7). MCA (AOC-4) turnover vs ITR-6 turnover vs GSTR-9 turnover. Document mismatches.
Step 8: Prepare gap report and remediation plan (Day 7-10). Prioritise: Critical (DIN deactivation, pending filing blocking other forms) > High (AOC-4/MGT-7 delay accumulating penalty) > Medium (TDS deposit delay, PF registration) > Low (statutory register updates). Timeline each remediation step.
Penalties for Non-Compliance: The Cost of Gaps
| Non-Compliance | Penalty / Consequence | Escalation Risk |
|---|---|---|
| AOC-4 / MGT-7 late filing | Rs 100/day per form. No cap. 1 year delay = Rs 36,500/form. 2 forms × 2 years = Rs 1,46,000. | ROC notice. 2+ years: striking off proceedings. Director disqualification (5 years). |
| DIR-3 KYC not filed | DIN deactivated. Rs 5,000 reactivation fee. All MCA filings blocked until DIN is active. | Cascading delay: blocked filings accumulate penalty on other forms. |
| AGM not held | Company: Rs 1,00,000. Every director in default: Rs 5,000/day until AGM is held. | ROC prosecution. Director disqualification. |
| ITR-6 late filing | Rs 5,000 (before 31 Dec) or Rs 10,000 (after). Interest under 234A/234B/234C. | IT scrutiny selection. Loss of carry-forward of losses. |
| GST returns late | Rs 50-200/day + 18% interest on unpaid tax. GSTR-1 vs 3B mismatch notices. | ITC blocked for buyers. 3-year filing window closure. |
| TDS not deducted/deposited | Interest 1-1.5%/month (Section 201). Late fee Rs 200/day (234E). Penalty up to Rs 1 lakh (271H). | Disallowance of expense in ITR (Section 40(a)(ia)). TDS default report on TRACES. |
| PF/ESI not registered | 12% interest on delayed contributions. Penalty up to 100% of contribution amount. | Criminal prosecution for repeated default. Employee complaints to labour commissioner. |
2026 Context: What’s New for Pvt Ltd Compliance
| 2026 Change | Impact | What to Do |
|---|---|---|
| DIR-3 KYC now once per 3 FYs (MCA notification March 2026) | Directors no longer need to file KYC every year. Filing once per 3 financial years. Reduces annual compliance burden. | Check when last DIR-3 KYC was filed. If within 3 FYs: no action needed this year. If not: file by 30 September 2026. |
| MCA-IT-GST cross-verification intensified | MCA, IT Department, and GST authorities share data. Turnover mismatches are flagged automatically. Companies receive notices from all three authorities simultaneously. | Reconcile MCA-IT-GST turnover quarterly (not annually). Maintain a single reconciliation register. |
| MCA V3 portal improvements | Better pre-filling, real-time validation, and faster processing. Some form fields changed. Filing experience improved. | Familiarise with updated form formats before filing. Test submissions in sandbox if available. |
| 3-year filing restriction (GST) | GST returns older than 3 years cannot be filed. GSTR-9 for older years may be blocked. | File all pending GST annual returns immediately. Window closing fast for FY 2021-22 and earlier. |
| Income Tax Act 2025 (from April 2026) | Tax Year replaces AY/FY. ITR-6 form may change. Section numbers renumbered. TDS provisions restructured. | For current FY: old Act. From April 2026: familiarise with new form and section numbers. |
Common Mistakes Companies Make With Compliance
Mistake 1: Assuming dormant/zero-turnover companies have no obligations. Every Pvt Ltd company must file AOC-4, MGT-7, ITR-6, conduct AGM, and maintain statutory registers - regardless of turnover or activity.
Mistake 2: Filing ROC returns without actually holding AGM. Filing MGT-7 without conducting an AGM is a serious violation. The AGM minutes must support the MGT-7 data. MCA cross-checks AGM dates against filing timelines.
Mistake 3: Not linking auditor reappointment with AGM. Auditor’s tenure is 5 years. Reappointment must be done at AGM. ADT-1 must be filed within 15 days. Missing this creates a cascade: no auditor → no audit → no AOC-4.
Mistake 4: Treating ITR-6 like an individual return. Company ITR-6 requires: statutory audit, tax audit (if applicable), detailed computation of income, transfer pricing (if applicable), and advance tax reconciliation. It is far more complex than individual ITR filing.
Mistake 5: Ignoring MSME-1 and DPT-3. These are frequently missed filings. MSME-1: if you have outstanding payments to MSME vendors beyond 45 days - you must report half-yearly. DPT-3: if you have received any deposits or exempt deposits. Penalty for DPT-3 non-filing can be up to Rs 10 crore. For tax planning services (know more) that integrate all compliance streams, we handle the complete lifecycle.
How Our Compliance Audit Differs From a Standard Checklist
Standard compliance checklist: Lists forms and deadlines. Tells you what to file. Does not tell you whether you have actually filed, whether the data is correct, or whether cross-portal data is consistent.
Our compliance audit: Reviews actual filing status (not just what should have been filed). Cross-verifies data between MCA, IT, and GST portals. Identifies specific gaps with financial impact quantified. Produces a prioritised remediation plan with timeline and cost. Includes ongoing monitoring - we do not just audit once and walk away.
The difference: A checklist tells you the rules. An audit tells you where you’re breaking them - and how to fix it.
Key Takeaways
A compliance audit for Pvt Ltd companies covers 10 areas: MCA status, ROC filings, board governance, statutory audit, IT compliance, GST compliance, TDS compliance, labour law, cross-verification, and remediation planning.
The five most common gaps: DIR-3 KYC (DIN deactivated), AOC-4/MGT-7 (not filed or late), board meetings (not held or minutes not maintained), TDS (not deducted on applicable payments), and GST-ITR-MCA turnover mismatch.
Penalties are severe and compounding: Rs 100/day for MCA forms (no cap), DIN deactivation, director disqualification, company striking off, and cross-platform notices from IT, GST, and MCA simultaneously.
The 2026 context: DIR-3 KYC now once per 3 FYs. MCA-IT-GST cross-verification intensified. 3-year GST filing restriction. IT Act 2025 transition. MCA V3 portal improvements.
A compliance audit is not a one-time exercise - it should be the starting point for an ongoing compliance management system. Identify gaps, fix them, and build systems to prevent recurrence.
Need a Compliance Audit for Your Pvt Ltd Company?
Whether you need a first-time compliance health check, gap identification for investor due diligence, or complete regularisation of pending compliances - our team handles the entire 10-point audit and remediation.
Explore our ROC compliance services (know more) and statutory audit (know more) for Pvt Ltd compliance across Pune, Mumbai, Delhi, and all-India.
For queries, reach out at +91 945 945 6700 or WhatsApp us directly.
