A whistleblower complaint doesn't reach the statutory auditor because the vigil mechanism required under the Companies Act and listing regulations is built to route a complaint to the audit committee or a designated vigilance/ethics officer — the statutory auditor isn't a party in that reporting chain at all, and the only way a complaint reaches them is if the audit committee, management, or the internal audit function specifically decides to share it, which requires a deliberate choice that nothing in the mechanism's design forces.
Why the gap persists even when the process works as intended
- The vigil mechanism's confidentiality protections, designed to protect the complainant, can be interpreted internally as a reason to limit circulation rather than a reason to share facts (stripped of identifying detail) with the auditor.
- A complaint gets resolved internally — disciplinary action taken, process changed — and is considered "closed" before anyone asks whether it has financial statement implications that the auditor should know about.
- The audit committee reviews complaint summaries periodically, but the standard CARO-related confirmation to the auditor is a point-in-time management representation, not a running feed of every complaint received.
- A complaint about a matter that seems operational on its face (a safety issue, a harassment complaint) is never flagged as having a financial reporting angle, even when it touches a control the auditor is relying on.
Asking management only whether any whistleblower complaints were received during the year, and accepting a yes/no answer, misses this entirely — the right question is whether any complaint received, regardless of how it was resolved internally, has any bearing on the financial statements or the controls being relied on for the audit.
Why this matters specifically for CARO
CARO's whistleblower clause requires reporting on whether complaints received during the year have been considered by the auditor — which is only possible if the auditor actually knows a complaint exists. A vigil mechanism that technically works exactly as designed can still leave the auditor with nothing to consider, simply because nobody along the chain treated sharing it with the auditor as part of the process.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCReviewing the whistleblower mechanism as part of the auditWhat a whistleblower mechanism review has to check beyond the policy existing on paper, how to test whether complaints were actually investigated and closed, and how it connects to the auditor's fraud-reporting conversation.
- CARO & Companies ActCARO whistleblower and fraud reporting clausesThe auditor's reporting responsibility on fraud noticed and whistle-blower complaints received, and how to document the enquiry behind it.
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.