A statutory auditor's POSH compliance check is narrow and factual: confirm the entity has constituted an Internal Committee as required under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 at each office location with ten or more employees, confirm the Internal Committee filed its annual report with the District Officer for the relevant calendar year, and confirm the directors' report for the financial year discloses the number of complaints received and disposed of during the year, as required under the Companies (Accounts) Rules. The auditor does not evaluate the merits of any complaint — that sits outside the audit's scope and competence.
Internal Committee constitution
- Confirm an Internal Committee has been constituted at every office or branch with ten or more employees — the threshold applies location by location, not to the entity as a whole, so a head office with eight employees and a branch with fifteen can have different obligations.
- Check the committee's composition matches the Act's requirements: a presiding officer who is a senior woman employee, at least two members from among employees committed to the cause of women or with relevant experience, and one external member from an NGO or association working on women's issues.
- Confirm the committee's constitution has been refreshed where a presiding officer or member has left the organisation during the year — a committee that has lost its presiding officer without replacement is, for practical purposes, not constituted.
Annual report and directors' report disclosure
| Filing | Where it goes | What the audit checks |
|---|---|---|
| Internal Committee annual report | District Officer, for the preceding calendar year | Report was actually filed, and the complaint count disclosed is consistent with the entity's own complaint register |
| Directors' report disclosure | Annual report to shareholders, under the Companies (Accounts) Rules | Number of complaints received and disposed of during the financial year is disclosed, even if the number is nil |
Regulatory requirement
The Internal Committee constitution threshold, composition, annual report timeline, and the directors' report disclosure requirement are set out in the POSH Act, 2013 and the Companies (Accounts) Rules respectively. Confirm the current text before concluding, since the Companies Act rules in particular are amended from time to time.
A nil-complaint disclosure in the directors' report is not, by itself, evidence of compliance or of a healthy workplace — it is only evidence that the required sentence is present. Where the audit separately becomes aware of a complaint through other work (an HR interview, a resignation pattern, correspondence seen during another procedure), that awareness should be evaluated against what was actually disclosed.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- CARO & Companies ActSecretarial compliance checklist for a statutory auditorBoard meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
- Internal audit & IFCReviewing the whistleblower mechanism as part of the auditWhat a whistleblower mechanism review has to check beyond the policy existing on paper, how to test whether complaints were actually investigated and closed, and how it connects to the auditor's fraud-reporting conversation.
- CARO & Companies ActCARO clause 3(xi): fraud reporting, and how it connects to Section 143(12)SA 240 is about how the audit is performed. This clause is about what gets specifically disclosed once a fraud is actually found — a reporting requirement, not a detection procedure.
- Payroll & employee costDirector remuneration audit under the Companies ActManagerial remuneration limits and approvals, financial statement disclosure, and testing payments against board and shareholder resolutions.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.