CARO clause 3(xiv) requires the statutory auditor to report, first, whether the company has an internal audit system commensurate with the size and nature of its business, and second, whether the reports of the internal auditors for the period under audit were considered by the statutory auditor; the first part is an evaluation of adequacy and coverage, and the second part is a specific confirmation that the statutory auditor actually read and factored in internal audit's findings during the engagement, and the exact wording and applicability thresholds should be confirmed against the current order.
The two separate findings this clause requires
It is easy to collapse this into a single yes-or-no on whether internal audit exists. The clause actually asks two things that need separate evidence: whether an internal audit function exists and is adequate for the business, and whether the statutory auditor personally considered the internal audit reports issued during the period. A company can have a well-staffed internal audit function and the statutory auditor can still fail this clause if the reports were never actually obtained and reviewed during the engagement.
Testing the adequacy of the internal audit system
- 01Confirm whether section 138 applicability was correctly assessedCheck whether the company meets the prescribed thresholds (by listing status, turnover, borrowings or deposits) that make internal audit mandatory under the Companies Act, and whether the company's own assessment of applicability is consistent with those criteria.
- 02Review the internal audit charter and annual planAssess whether the audit universe covers the material processes and locations of the business, is risk-based, and is resourced proportionate to the scale of operations, rather than a token coverage of low-risk areas only.
- 03Check the frequency and timeliness of internal audit reportingA plan that exists on paper but produces reports months after the period they cover, or skips planned cycles, does not meet the commensurate-with-size-and-nature test even if the charter reads well.
- 04Assess the reporting line and independence of the internal audit functionInternal audit reporting to the audit committee, rather than to an operating executive whose area it reviews, is relevant to whether the function can be relied upon as adequate.
Documenting that the reports were considered
- 01Obtain the full set of internal audit reports issued during the periodNot a summary or a management-prepared status update; the actual reports as issued by the internal audit function, for every cycle completed in the year under audit.
- 02Cross-reference internal audit findings to the statutory audit risk assessmentWhere internal audit flagged a control weakness or exception, confirm the statutory audit either tested that area further or documented why reliance was still appropriate; a finding that simply disappears between internal audit's report and the statutory file is a gap worth closing before sign-off.
- 03Record the consideration in the audit fileKeep a working paper that lists each internal audit report obtained, the period it covers, key findings, and how those findings were factored into statutory audit procedures, so the clause 3(xiv) response is supportable on its own evidence rather than a general statement.
Where section 138 applicability is borderline, do not default to reporting the clause as not applicable without documenting the applicability assessment itself; a company that crossed the threshold mid-year and never set up internal audit is a reportable gap, not a non-applicable clause.
Regulatory requirement
The section 138 applicability thresholds, the exact CARO clause wording, and what counts as commensurate coverage are set out in the Companies Act, its rules, and the Companies (Auditor's Report) Order as currently in force. Confirm all of these against current source material before drafting the report.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCInternal audit vs statutory audit: what actually differsWhere internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
- Internal audit & IFCInternal audit checklist for CA firms taking on the mandateHow to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
- Internal audit & IFCSA 610: using the work of internal auditors, and the two decisions it actually requiresSA 610 asks two separate questions, in a specific order. Skipping to the second without answering the first is the standard's most common misapplication.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.