CARO 2020 Internal Audit Clause, Checklist: What Auditors Need From Finance Teams
When a statutory audit is coming up, most finance teams prepare for the usual things: fixed assets, statutory dues, related-party transactions. The internal audit clause often gets ignored. That’s exactly why it causes trouble later.
This CARO 2020 internal audit checklist explains what clause 3(xiv) asks for, what your statutory auditor will want to see, and how to keep it ready before the audit starts.
This clause comes from Section 143(11) of the Companies Act, 2013. This section allows the government to ask auditors to report on extra matters. The Companies (Auditor’s Report) Order, 2020, known as CARO 2020, lists 21 such matters. Clause 3(xiv) is the one about internal audit. It looks short on paper. But in real audits, a quick “yes” without proper backup can create problems.
What Is CARO 2020?
CARO 2020 is an extra report that statutory auditors attach to their main audit report under the Companies Act, 2013. It covers things like fixed assets, inventory, fraud, going concern, and internal audit. It replaced an older order called CARO 2016 and applies to financial years starting on or after 1 April 2021. The number of matters to report on went up from 16 to 21.
CARO applies to companies audited under the Companies Act, including foreign companies. Some companies are left out, such as OPCs, small companies, banks, insurance companies, and Section 8 companies.
What Does CARO 2020 Clause 3 Internal Audit Ask For?
Clause 3(xiv) has two parts. Many teams only prepare for one of them.
Part (a): Is the internal audit system right for the size of the business?
Here, the auditor has to judge something simple to say but not simple to measure: does your internal audit match how big and complex your business is? There is no fixed formula for this. A small factory with one location and simple work does not need the same level of internal audit as a large group with many businesses, heavy use of technology, and approvals spread across departments. The auditor usually checks the internal audit plan, how often audits actually happen, who is doing the audits and how qualified they are, and who they report to.
Part (b): Did the statutory auditor look at the internal audit reports?
This part is more about paperwork, and it is easy to miss. The statutory auditor must clearly say whether they reviewed the internal audit reports for that year. For this to happen, those reports need to reach the statutory auditor. They also need to be complete, and they need to arrive early enough to actually be read, not dumped on the last day.
This is why a CARO 2020 internal audit checklist needs to cover two things. First, whether the internal audit system itself is good enough. Second, whether there is clear proof that the statutory auditor actually received and used those reports.
Do You Need to Already Have an Internal Auditor?
Clause 3(xiv) is about reporting. Whether you are required to have an internal auditor at all is a different question. That comes from Section 138 of the Companies Act, 2013, along with Rule 13 of the Companies (Accounts) Rules, 2014. People often mix up these two things. CARO tells the auditor to check your internal audit system. Section 138 tells you whether you needed one in the first place.
Company type | Internal audit is compulsory when |
Listed companies | Always, no matter the size |
Unlisted public companies | Turnover ₹200 crore or more, OR paid-up capital ₹50 crore or more, OR bank/PFI borrowings above ₹100 crore, OR deposits ₹25 crore or more, in the year before |
Private companies | Turnover ₹200 crore or more, OR bank/PFI borrowings above ₹100 crore, in the year before |
Private companies are only checked on two things: turnover and borrowings. Not paid-up capital, not deposits. Many finance teams get this wrong because they apply the unlisted-public-company rules to a private company out of habit. Check this every year. Do not just repeat last year’s answer. A new loan, a funding round, or simple business growth can change where your company stands.
Even if a company sets up internal audit on its own, below the Section 138 limits, clause 3(xiv) still applies. The auditor will still check if that internal audit is good enough for the business.
What If Your Company Is Fully Exempt From CARO 2020?
Before spending time on clause 3(xiv), it’s worth checking whether CARO applies to your company at all. A private company which is not a small company is exempt from CARO 2020 only if it meets all three of these at once: paid-up capital and reserves of ₹1 crore or less, borrowings of ₹1 crore or less at any point in the year, and revenue of ₹10 crore or less. It also can’t be a subsidiary or holding company of a public company. Miss even one of those, and CARO applies in full, internal audit clause included.
Small companies get a separate exemption, based on paid-up capital and turnover limits under Section 2(85) of the Companies Act. These limits change from time to time, so it’s worth confirming the current figures with your auditor. Banking companies, insurance companies, One Person Companies, and Section 8 companies are exempt outright, regardless of size.
If your company falls into one of these exempt categories, clause 3(xiv) simply doesn’t come up in your CARO report. If you’re not sure where you stand, that’s the first thing to settle with your statutory auditor, before worrying about internal audit documentation at all.
SGGK often gets asked to help run this exemption check first, precisely because getting it wrong in either direction wastes effort, either over-preparing for a clause that never applies or missing one that does.
The CARO 2020 Internal Audit Checklist: What Finance Teams Should Prepare
Most items on this list should already exist as outputs from your internal audit team. The real task is gathering them before the statutory auditor asks.
- Board or Audit Committee approval of the internal audit plan for the year, showing what areas will be covered and how often
- The risk assessment used to decide which areas got covered and which got left out
- Every internal audit report issued during the year, with dates, findings, and management’s response
- Proof that these reports reached the Audit Committee or Board, such as meeting minutes
- A tracker showing the status of each observation, what’s closed, what’s still open, and by when
- Details of the internal auditor, their qualifications and whether they are in-house or outsourced
- A record of exactly when internal audit reports were shared with the statutory auditor
What Statutory Auditors Check Under CARO 2020 Internal Audit?
Auditors are not just ticking a box that says “internal audit exists.” They want to know if the function is actually working.
1. Coverage and scope
Does the internal audit plan focus on what matters for this specific business? Or does it look like a generic template copied from somewhere else? A company with a lot of related-party deals, or complex IT systems, needs internal audit to spend extra time on those exact areas.
2. Frequency and follow-up
Did the team actually complete the planned audits, or did they fall behind partway through the year? Auditors want to see finished audits and closed observations, not points raised once and then forgotten.
3. Independence and reporting line
Does the internal auditor report to someone who can act on the findings without bias? Ideally, that means the Audit Committee or Board, not the same department being checked. A weak reporting line is one of the most common problems auditors notice, even when it doesn’t turn into a formal remark in the CARO report.
4. Proof that reports were actually reviewed
For part (b) of the clause, the statutory auditor needs some record showing they reviewed the internal audit reports. Just having the reports sit in a folder somewhere is not enough.
Common Internal Audit Problems Auditors Flag
Most of these come up more than once across different clients
What auditors often notice | Why it’s a problem | What finance teams should do |
Internal audit plan was never approved by the board | No clear mandate for what got covered that year | Get the yearly plan approved and recorded in minutes before the year starts |
Planned audits didn’t get finished | Shows the team may not have enough resources | Track planned versus actual work, and be ready to explain any gaps |
Points raised but never closed | Shows weak follow-up on controls | Keep a live tracker and review it every quarter |
Internal auditor reports to the CFO or the department being checked | Raises doubts about independence | Route reporting through the Audit Committee, where one exists |
Reports reach the statutory auditor too late | Auditor cannot say the reports were reviewed | Set a fixed date for handing over reports during year-end planning |
Where Is CARO 2020 Internal Audit Reporting Headed?
Audit checks in India have been getting stricter. NFRA data shows the regulator debarred 85 chartered accountants and fined 103 professionals between 2022 and 2025 for audit quality issues. That pressure trickles down to how closely auditors check every CARO clause, including this one. From what we see on the audit-support side, clause 3(xiv) is slowly moving away from a quick tick-mark answer and toward a proper documentation check. This is the same path clauses on statutory dues and related-party transactions have already taken. A simple “yes” now often needs real paperwork behind it, not just a verbal assurance from management.
For finance teams, this means the internal audit function is no longer just a nice-to-have for large companies. It becomes something that keeps the whole statutory audit on schedule. Teams that treat internal audit reporting as an ongoing, every-quarter habit, instead of something rushed together at year-end, usually walk into their audit with far fewer questions on this clause.
CARO 2020 Internal Audit Checklist: 6 Steps Before the Statutory Audit
Run through this before your statutory auditor starts checking clause 3(xiv):
- Check if Section 138 applies to your company this year, using this year’s numbers, not last year’s.
- Pull out the board-approved internal audit plan and compare it with what actually got done.
- Collect every internal audit report from the year, with dates.
- Make sure the observation tracker is up to date and shows what’s closed.
- Confirm the internal audit reports were formally shared with the statutory auditor, and note when.
- Look at the internal auditor’s reporting line yourself, before your auditor points out any gaps.