Statutory Audit in India: Applicability, Auditor Appointment and ROC Filing Requirements

A company incorporated in October with no revenue, twelve employees, and a product still in development has a statutory audit obligation by March 31. Most foreign founders learn this in year one, usually when their CA informs them that audited accounts are needed before the ROC filing deadline.

Statutory audit India applies to every company registered under the Companies Act 2013. No turnover floor. No revenue threshold. No exemption for the first year of operations. The financial statements from the first partial financial year must be audited, placed before shareholders at the AGM, and then filed with the ROC through Form AOC-4. None of this is optional.

What foreign-owned companies miss is that the audit is not just a compliance checkbox. The FLA return filed with RBI references audited balance sheet figures. The valuation certificate uses audited financials as a reference point. The income tax return is prepared from audited accounts. If the audit is not done, or done late, the gap ripples across every regulatory framework simultaneously.

What Is Statutory Audit in India and Does It Apply to All Companies?

Under Section 139 of the Companies Act, 2013, Statutory Audit in India requires every company to have its financial statements audited annually by an independent Chartered Accountant. The obligation applies to all companies, including those with no revenue or business activity. The audited accounts form the foundation for every downstream regulatory filing the company must make.

The Companies Act does not qualify this obligation. Section 139 says every company shall appoint an auditor. Not every company above a certain size. Not every company that has commenced business. Every company irrespective of capital and turnover need to appoint Auditor.

There is a specific exemption worth noting for private limited companies under CARO 2020 — which is the reporting order attached to the audit, not the audit itself. A private limited company that is not a subsidiary or holding of a public company and simultaneously meets three conditions (paid-up capital plus reserves not exceeding Rs. 1 crore, total borrowings not exceeding Rs. 1 crore, and total revenue not exceeding Rs. 10 crore) is exempt from CARO applicability. The statutory audit for private limited company still happens. The CARO reporting obligations within that audit do not.

Most operating foreign-owned subsidiaries fail all three CARO exemption tests within the first two years of operations. Assume CARO applies.

Who Can Be Appointed to Conduct Statutory Audit India?

Only a Chartered Accountant holding a Certificate of Practice, or a firm in which the majority of partners hold Certificates of Practice, can conduct Statutory Audit in India. Section 141 also requires the auditor to remain independent. An auditor cannot provide bookkeeping or accounting services to the same company, serve as its director, officer, or employee, or hold securities in the company or its group entities.

The independence disqualification that catches most small foreign-owned subsidiaries: a CA firm engaged to prepare the accounts cannot simultaneously be appointed as the statutory auditor. Many newly incorporated companies appoint the same firm for both services without realising the two mandates cannot sit together. When the appointment is eventually reviewed during due diligence or a regulatory inquiry, it creates a Section 141 violation that must be remediated.

Other independent  conditions:

• Cannot be a relative of a director or key managerial personnel
• Cannot be convicted of fraud or money laundering
• Cannot have a material business relationship with the company, its holding company, subsidiary company, associate company, or subsidiary of such holding company beyond the audit engagement
• Cannot be indebted to the company, its holding company, subsidiary company, associate company, or subsidiary of such holding company in any material amount

Where a disqualifying condition arises after an auditor’s appointment, the auditor must step down within thirty days and the board must appoint a replacement. The process differs from a resignation because the vacancy is created by a statutory disqualification.

How Is the Statutory Auditor Appointed and What Is the ADT-1 Filing?

The first auditor must be appointed by the Board of Directors within 30 days of incorporation. If the board does not act within 30 days, the members must appoint within 90 days at an EGM. Every subsequent appointment after the tenure ends, is made at the AGM. Form ADT-1 must be filed with the ROC within 15 days of appointment, confirming the auditor’s consent and eligibility.

The 30-day clock for the first appointment runs from the date on the Certificate of Incorporation. Not from the date the company opens a bank account. Not from the first hireRather from the CoI date. This is the deadline foreign founders most commonly miss because they are focused on the operational setup and treat the auditor appointment as something to handle later.

The appointment process generates two documents before ADT-1 can be filed:

• Written consent from the proposed auditor confirming they are not disqualified under Section 141
• A certificate from the auditor that the appointment, if made, shall be in accordance with conditions specified under Section 141 and that they are not ineligible

Both documents must exist before the board resolution is passed, not collected afterward as an afterthought.

ADT-1 late filing attracts additional fees at 2 times of normal fees upto 30 days of delay and so on . More importantly, an auditor who has not been formally appointed through ADT-1 is not legally the company’s auditor in the eyes of the ROC, which creates a gap in the company’s statutory audit India compliance record.

What Are the Auditor Rotation Rules Under Statutory Audit India?

Mandatory rotation under Section 139(2) applies to listed companies, unlisted public companies having paid up share capital of Rs. 10 cr or more, and private limited companies with paid-up share capital of Rs. 50 crore or more. For these companies, an individual auditor cannot hold office for more than one consecutive term of five years, and an audit firm cannot hold office for more than two consecutive terms of five years. A five-year cooling-off period applies after rotation.

For most foreign-owned subsidiaries entering India at initial scale, mandatory rotation does not trigger until the paid-up capital crosses Rs. 50 crore. In practice, foreign parent companies with group-level Big Four relationships often appoint the Indian network firm of the same audit group to maintain consolidated reporting consistency. That is a governance decision, not a statutory requirement for smaller entities.

One thing that is statutory: a cooling-off period of five years after the maximum rotation term before the same auditor or firm can be reappointed. An auditor who completed two terms with a company in 2024 cannot be reappointed until 2029.

What ROC Filings Follow the Statutory Audit for Private Limited Company?

Following Statutory Audit for Private Limited Company, the approved financial statements and annual return must be filed with the ROC through Form AOC-4 and Form MGT-7 or MGT-7A respectively. These filings are due within 30 days and 60 days of the AGM, which is generally required to be held within six months of the financial year-end.

The Rs. 100 per day penalty on AOC-4 and MGT 7/ 7A has no statutory cap. A company that files financial statements 365 days late owes Rs. 36,500 in additional filing fees before professional service costs. That figure sounds small. What is not small is the Section 164(2) consequence: if financial statements or annual returns are not filed for three consecutive years, every director of the company is automatically disqualified from holding directorships across all Indian companies for five years. The disqualification is automatic, with no court order required.

The audit timeline determines whether ROC deadlines are met. A company that delivers draft accounts to the auditor in June and concludes the audit in July holds its AGM in August and files by September. A company that starts the audit process in August is almost certain to miss the September 30 AGM deadline and pay additional fees on every subsequent filing.

What Does the Statutory Auditor Report On Under CARO 2020?

The statutory audit India report covers the audit opinion on financial statements, CARO 2020 observations for applicable companies, internal financial controls reporting under Section 143(3)(i) for prescribed companies, and fraud reporting under Section 143(12). A qualified or adverse opinion must be disclosed in all downstream regulatory filings and surfaces during investor due diligence.

CARO 2020 requires auditors to report on twenty-one specific matters. Two of them are directly relevant to foreign-owned companies in a way that domestic audits rarely flag:

First, compliance with FDI regulations. If the auditor finds that FC-GPR was not filed on time, that FDI was received in a sector requiring Government Route approval under the Automatic Route, or that pricing norms under the NDI Rules 2019 were not followed, this appears in the CARO report. That report is filed with the ROC as part of AOC-4 and becomes a public document.

Second, related party transactions. Every intercompany payment to the foreign parent, every management fee, every royalty, and every technical service fee is a related party transaction that CARO requires the auditor to comment on. If the auditor finds that these were not at arm’s length or were not disclosed correctly under Section 188 of the Companies Act, that too appears in the audit report.

A CARO observation on either FDI compliance or related party transactions is not a minor note. It feeds into income tax assessments, FEMA compliance reviews, and CCI regulatory scrutiny if the company is involved in any M&A activity.

Conclusion

Statutory audit India is the annual compliance anchor that everything else is built around. The audit produces the financial statements that are filed with the ROC, used to prepare the income tax return, referenced in FEMA filings, and presented to investors during due diligence. A company whose audit is consistently done late, or whose audit report carries recurring CARO observations, is building a compliance record that creates real problems at the worst possible moment.

The auditor appointment within 30 days of incorporation. ADT-1 within 15 days of that. Draft accounts to the auditor by June. AGM by September. AOC-4 and MGT-7 before the October deadlines. That is the cycle. It is not complicated. It just has to be managed.

Corporate Legit Consulting LLP manages statutory audit coordination, auditor appointment compliance, ADT-1 filing, AOC-4 and MGT-7 submissions, and full annual compliance calendars for foreign-owned Private Limited Companies. Reach out to Corporate Legit to ensure your statutory audit India cycle is built into the compliance calendar from the start of each financial year.