Statutory Audit Requirements for Private Limited Companies

New founders often assume an audit is something that kicks in once a company crosses a certain revenue size, because that is how income tax audit works. Statutory audit under the Companies Act 2013 does not work that way. It is a corporate law requirement tied to the fact of being an incorporated company, not to how much the company earned in a given year, and skipping it because "the company barely did any business this year" is one of the more common and avoidable compliance failures among early-stage companies.

Every Company, Regardless of Turnover

Statutory audit under Sections 139 and 143 of the Companies Act 2013 is mandatory for every company registered under the Act, private limited, public limited, or One Person Company alike, irrespective of turnover, paid-up capital, or whether the company transacted any business at all during the financial year. A private limited company that had zero revenue and no operations still needs its financial statements audited and filed with the Registrar of Companies. This is a fundamentally different trigger from the income tax audit under Section 44AB (renumbered Section 63 under the Income Tax Act 2025), which is turnover- and gross-receipts-based and applies to a much wider set of taxpayers, including proprietorships and professionals, not only companies.

The distinction matters in practice: a company can be well below the tax audit turnover threshold and still be legally required to complete a full statutory audit of its books every single year from the year of incorporation onward, with no grace period for a dormant first year.

Auditor Appointment: Timelines That Matter

Getting the first auditor appointment right sets the clock for everything that follows:

• First auditor: The Board of Directors must appoint the company's first auditor within 30 days of incorporation. If the Board misses this window, the members must step in and appoint the first auditor within 90 days, at an extraordinary general meeting called for the purpose. The first auditor holds office until the conclusion of the first annual general meeting.
• Subsequent auditors: After the first AGM, an auditor is typically appointed for a term of five years at a time, subject to the conditions prescribed under the Act being met at each AGM. The earlier requirement to place the auditor's appointment before shareholders for ratification at every single AGM during that five-year term was removed by a later amendment to the Act, which simplified the ongoing compliance burden once the five-year appointment is made.

Missing the first-auditor appointment window, or letting an auditor's term lapse without a fresh appointment resolution, creates a compliance gap that can complicate everything from bank account operations to due diligence in a future fundraise. This is one of the checklist items worth locking down as part of a broader post-incorporation checklist.

Mandatory Auditor Rotation

Beyond the standard five-year appointment, Section 139(2) of the Companies Act imposes mandatory rotation for a defined set of companies, intended to prevent an auditor from becoming too familiar (and too comfortable) with a single client over decades. Rotation applies to:

• All listed companies.
• Unlisted public companies with paid-up share capital of Rs 10 crore or more.
• Private companies with paid-up share capital of Rs 50 crore or more.
• Any company, public or private, below those capital thresholds that nonetheless has public borrowings from banks, financial institutions, or public deposits of Rs 50 crore or more.

Where rotation applies, an individual appointed as auditor can serve only one term of five consecutive years at that company. An audit firm can serve a maximum of two consecutive five-year terms, a total of ten years, after which a mandatory five-year cooling-off period applies before the same firm can be reappointed at that company. Most small and mid-sized private limited companies fall below these thresholds and are not subject to mandatory rotation, but growth-stage companies approaching these capital or borrowing levels should plan for rotation well before it becomes mandatory, since transitioning statutory auditors mid-cycle takes real lead time.

CARO 2020: When the Extra Reporting Kicks In

The Companies (Auditor's Report) Order 2020 (CARO 2020) requires auditors to report on a detailed additional set of matters beyond the standard audit opinion, covering areas like fixed assets, inventory, related-party transactions, statutory dues, and loans and guarantees. CARO 2020 applies broadly across companies, but small companies and One Person Companies (OPCs) are exempt from CARO reporting, along with certain other specified categories such as banking, insurance, and Section 8 (not-for-profit) companies.

Because a company's "small company" classification depends on its paid-up capital and turnover, both of which can change year to year, whether CARO applies to a given company's audit report should be reassessed at the start of each audit cycle rather than assumed to carry over from the prior year. A company that grows past the small-company thresholds during the year can find CARO reporting applying for the first time without warning if this isn't checked proactively.

Getting Statutory Audit Right From Year One

The most common mistake is treating statutory audit as something to think about only once the company is generating meaningful revenue. Because the requirement attaches from incorporation, the practical discipline is to appoint the first auditor within the 30-day window, maintain proper books from day one so the first audit isn't a scramble, and build the audit timeline into the same annual compliance calendar as ROC filings like AOC-4 and MGT-7. Our guide to annual ROC filing covers how the audited financial statements feed directly into those filings.