Statutory audit in India: a guide for US parent companies and Indian management
A statutory audit is the independent examination of a company's annual financial statements that Indian company law requires. The auditor reports to the shareholders on whether the accounts give a true and fair view, and the report is filed publicly with the Registrar of Companies. For a US group, it is also the foundation for the Indian numbers in the consolidated accounts.
What a statutory audit covers
The statutory auditor examines the balance sheet, statement of profit and loss, cash flow statement, statement of changes in equity and notes, and reports on whether they give a true and fair view of the company's financial position and performance. The audit is carried out under the Standards on Auditing (SAs) issued by the Institute of Chartered Accountants of India, and the opinion follows the format in SA 700.
Beyond the opinion, section 143 of the Companies Act requires the auditor to report on a number of specific matters, including:
- Whether proper books of account have been kept and the accounts agree with them
- Whether the financial statements comply with the applicable accounting standards
- Whether any director is disqualified from being appointed
- The adequacy and operating effectiveness of internal financial controls over financial reporting, where this applies
- Pending litigation, foreseeable losses and transfers to the Investor Education and Protection Fund
- Whether the accounting software keeps an audit trail (edit log) that cannot be disabled, as required since April 1, 2023
Appointing the statutory auditor
Section 139 of the Companies Act sets out how auditors are appointed. The rules differ for the first auditor and for later years:
- First auditor: the board of directors appoints the first auditor within 30 days of incorporation. The first auditor holds office until the end of the first annual general meeting (AGM).
- Five-year term: at the first AGM, shareholders appoint an auditor to hold office from that meeting until the end of the sixth AGM, a term of five years.
- Filing: the company informs the Registrar of Companies of the appointment in Form ADT-1 within 15 days of the meeting.
- Rotation: listed companies and certain larger unlisted companies must rotate auditors. An individual can serve one term of five years and an audit firm two terms of five years, followed by a five-year cooling-off period.
A statutory auditor must be independent. Under section 144, the statutory auditor cannot also provide certain services to the company, including internal audit, accounting and bookkeeping, and management services.
CARO 2020: the additional auditor's report
The Companies (Auditor's Report) Order, 2020, known as CARO 2020, requires the auditor to report on a long list of additional matters in an annexure to the audit report. These include physical verification of fixed assets and inventory, loans given and guarantees, deposits, statutory dues such as GST, provident fund and income tax, defaults on borrowings, use of funds raised, fraud, related party transactions and whether the company has an adequate internal audit system.
CARO 2020 applies to most companies. It does not apply to banking companies, insurance companies, section 8 companies, one person companies and small companies. A private company is also exempt if it is not a holding or subsidiary of a public company, its paid-up capital and reserves are not more than ₹1 crore, its borrowings from banks and financial institutions did not exceed ₹1 crore at any time in the year, and its revenue is not more than ₹10 crore.
Reporting on internal financial controls
Section 143(3)(i) requires the auditor to report on whether the company has adequate internal financial controls over financial reporting and whether they are operating effectively. This report is based on the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting.
Private companies are exempt from this report if they are one person companies or small companies, or if their turnover in the latest audited accounts is below ₹50 crore and their borrowings from banks, financial institutions or any body corporate are below ₹25 crore at all times in the year. Both conditions must be met, and the company must not have defaulted in filing its financial statements or annual return.
Where the report applies, the company needs documented processes and controls. A risk control matrix is the usual way to record them, and it can be built to serve both Indian IFC reporting and a US SOX programme.
Audit trail (edit log) requirements
Since April 1, 2023, every company that keeps its books electronically must use accounting software that records an audit trail of each transaction, creates an edit log of every change, and cannot be disabled. The audit trail must be preserved for at least eight years. The statutory auditor reports on whether the software had this feature, whether it operated throughout the year for all relevant transactions and whether it was tampered with.
- Cloud and SaaS accounting tools may log changes in the application but not in the underlying database, which the auditor will need to consider
- Some ERP systems need the audit trail feature to be switched on and configured for each module
- Changes made directly to the database by administrators are a common gap
- Group ERPs hosted by the US parent need confirmation from the parent's IT team on how logging works
Audit trail is closely linked to IT general controls, which we document in a risk control matrix. Books kept electronically must also be backed up daily on servers physically located in India.
Fraud reporting by the auditor
If the auditor has reason to believe that an offence of fraud is being or has been committed against the company by its officers or employees, section 143(12) requires them to report it. For suspected fraud of ₹1 crore or more, the auditor reports to the Central Government in Form ADT-4 after first giving the board or audit committee a chance to respond. Smaller suspected frauds are reported to the board or audit committee and disclosed in the board's report.
Where a suspected fraud needs investigation, the company usually commissions a separate forensic audit to establish the facts.
Understanding the auditor's opinion
The audit report gives one of four types of opinion. Each has a different meaning for your US parent, lenders and investors:
| Opinion | What it means | What usually follows |
|---|---|---|
| Unmodified (clean) | The financial statements give a true and fair view | No action needed; any emphasis of matter paragraph should still be read |
| Qualified | True and fair except for a specific matter that is material but not pervasive | Lenders and group auditors will ask how the matter is being fixed |
| Adverse | The financial statements do not give a true and fair view | Serious concern for lenders, regulators and the US group |
| Disclaimer | The auditor could not obtain enough evidence to form an opinion | Usually points to missing records or restrictions on the audit |
For listed companies, the report also describes key audit matters under SA 701, the areas the auditor considered most significant. Most qualifications in subsidiaries come from issues that could have been fixed earlier, such as unreconciled intercompany balances, missing inventory records or unsupported provisions, which is why we raise them during the year through interim work and, where useful, internal audit.
Statutory audit timeline and filings
| Step | Timing | Notes |
|---|---|---|
| Year end | March 31 | Indian financial year runs April to March |
| Audit fieldwork | April to August | Earlier if the US parent needs signed accounts sooner |
| Board approval | Before the AGM notice | Board approves the financial statements and board's report |
| Annual general meeting | By September 30 | Within six months of year end; first AGM within nine months |
| AOC-4 | Within 30 days of the AGM | Audited financial statements filed with the Registrar |
| MGT-7 | Within 60 days of the AGM | Annual return filed with the Registrar |
We help you plan the audit so that the AGM and filings happen on time, and we coordinate with your company secretary on board meetings and ROC compliance.
Statutory audit and US group reporting
The Indian statutory audit and the US group audit look at the same company but for different purposes and periods. The Indian audit covers the year to March 31 under Indian standards. The US group audit usually covers the year to December 31 under US GAAP.
Indian statutory audit
- Year ending March 31
- Ind AS or Indian Accounting Standards
- Report to the company's shareholders
- Filed with the Registrar of Companies
US group reporting
- Year ending December 31 for most groups
- US GAAP reporting package
- Report to the group auditor
- Used in the US consolidated accounts
We plan both together: a December hard close and reporting package for the group, followed by a March statutory audit that builds on the December work. We also reconcile the two sets of numbers so differences can be explained quickly, and coordinate with transfer pricing and tax audit work, which uses the same accounts.
Issues that often come up in US-owned subsidiaries
- Cost-plus revenue: many Indian subsidiaries earn a mark-up on costs from the US parent. Year-end true-ups must match the transfer pricing policy and be invoiced on time.
- Intercompany balances: amounts owed to or by the US parent must agree on both sides, and long-outstanding balances raise FEMA questions.
- Share-based payments: when employees in India receive stock options or RSUs from the US parent, the Indian entity may need to recognise the cost and record any recharge. Our ESOP advisory team can help.
- Foreign currency: payables and receivables in US dollars must be restated at the closing rate, and differences recorded properly.
- Unbilled revenue and accruals: timing differences between the US and Indian year ends often leave cut-off issues.
- Deferred tax and tax provisions: these must match the tax audit and the income tax return position.
- Inventory: for manufacturing and distribution subsidiaries, physical counts and valuation, sometimes checked through a stock audit for the bank.
Choosing an Indian statutory auditor
When choosing an auditor for an Indian company, US parents usually check three things:
- Peer review: auditors of listed companies, larger unlisted public companies and certain other entities must hold a valid peer review certificate from ICAI.
- Independence: the auditor must not provide prohibited services such as internal audit or bookkeeping to the same company.
- Group reporting experience: the team should be able to work to US group audit instructions and US GAAP reporting packages.