Audit & Assurance Services – Delhi

Every company registered in India must undergo a statutory audit. No exceptions — not for startups, not for dormant companies, not for micro-businesses. This is not a threshold-based obligation. It is universal.

For many businesses, audit is something that happens to them once a year. For well-run companies, it is a tool — one that catches problems early, strengthens internal controls, gives banks and investors confidence in the numbers, and keeps the company clear of MCA penalties.

The audit environment in India changed significantly in FY 2025-26. MCA revised the Small Company definition effective December 1, 2025 — now paid-up capital ≤ ₹10 crore and turnover ≤ ₹100 crore — bringing thousands more companies under the lighter compliance regime. The Income Tax Act 2025 replaced the 1961 Act from April 2026, renumbering all sections in Form 3CD. ICAI’s 60-audit-per-partner limit took effect from April 2026. And the mandatory software audit trail is now actively verified by auditors, not just noted as a guideline.

Sapient Services provides statutory audit, internal audit (Section 138), secretarial audit (Section 204), tax audit (Section 44AB), GSTR-9C, and management audit services for companies, LLPs, trusts, and corporates in Delhi NCR and across India.

→ Free Consultation: +91 9540162888 | valuation@sapientservices.com

Statutory Audit — Mandatory for Every Company in India

A statutory audit is the annual independent examination of a company’s financial statements — balance sheet, profit & loss account, and cash flow statement — conducted by a practising Chartered Accountant appointed under Section 139 of the Companies Act, 2013.

Every company registered in India must undergo this audit every financial year. There is no minimum turnover, no size threshold, no exemption for newly incorporated companies. The auditor issues a report confirming whether the financial statements give a ‘true and fair view’ of the company’s financial position, and reports on compliance, fraud, and internal controls.

What a Statutory Audit Covers — FY 2025-26

• Financial statement verification — balance sheet, P&L, cash flow, notes to accounts, accounting policy disclosures.
• CARO 2020 reporting — detailed reporting on fixed assets, inventory, loans, statutory dues, fraud, and 16 other matters (see CARO section below for applicability).
• Internal Financial Controls (IFC) assessment — design and operating effectiveness; not required for small companies.
• Audit trail verification — mandatory for all companies; auditors must verify that accounting software maintains an immutable, timestamped audit trail; non-compliance is reportable.
• Income Tax Act 2025 alignment — all Form 3CD cross-references updated to new IT Act 2025 section numbers (effective AY 2026-27); auditors must work from updated templates.
• Employee benefit provisions — Code on Social Security 2020 wage definition impacts gratuity, PF, and leave encashment calculations; auditors verify provisions are correctly computed.
• Going concern assessment, related party disclosure verification, and fraud reporting obligations under Section 143(12).

Key Statutory Compliance Dates — FY 2025-26

Missing these deadlines has serious consequences. If audited financial statements are not filed on time, the company is marked ‘Active Non-Compliant’ on the MCA portal — restricting banking, fundraising, and regulatory approvals. The company and its officers are also exposed to penalties under Section 147 of the Companies Act, 2013.

Small Company Definition — December 2025 Update and Its Impact on Audit

MCA revised the definition of ‘small company’ under Section 2(85) of the Companies Act, 2013, with effect from 1 December 2025. This is one of the most significant recent changes affecting audit compliance for private companies.

What small company status means for audit:

• CARO 2020 does not apply to small companies — the detailed 16-clause reporting requirement is not mandatory.
• IFC (Internal Financial Controls) reporting is not required for small companies.
• Statutory audit itself is still mandatory — there is no size exemption from the core audit requirement.
• Simplified abridged financial statements (MGT-7A annual return format) are permissible.
• Reduced penalties under Section 446B — half the penalty that would apply to a non-small company.

Practical implication: A large number of private companies in Delhi NCR that previously did not qualify as small companies now do — with paid-up capital up to ₹10 crore and turnover up to ₹100 crore. If your company newly qualifies under these updated thresholds, your audit scope and cost should be reviewed with your auditor for FY 2025-26.

CARO 2020 — What It Is, Who It Applies To, and What Auditors Must Report

CARO 2020 (Companies (Auditor’s Report) Order 2020) is a mandatory supplementary reporting framework that requires statutory auditors to comment on 16 specific operational and compliance matters in their audit report. It is not a separate audit — it is additional reporting within the statutory audit.

CARO 2020 Applicability

CARO 2020 applies to all companies except:

• One Person Companies (OPCs).
• Small companies — private companies with paid-up capital ≤ ₹10 crore AND turnover ≤ ₹100 crore (updated December 2025 thresholds).
• Banking companies, insurance companies, and Section 8 (non-profit) companies.
• Certain private companies: those not a holding/subsidiary of a public company, with paid-up capital plus reserves ≤ ₹1 crore, borrowings ≤ ₹1 crore throughout the FY, and revenue ≤ ₹10 crore.

Key Matters CARO 2020 Requires Auditors to Report On

• Fixed assets — whether physical verification was conducted and discrepancies reported; whether title deeds of immovable properties are held in the company’s name.
• Inventory — whether physical verification was done at reasonable intervals; whether discrepancies of 10% or more in any material item were noticed.
• Loans, advances, and guarantees — details of loans given to related parties; whether terms are prejudicial to the company’s interest.
• Statutory dues — whether all statutory dues (TDS, PF, ESI, GST, customs) have been deposited regularly; details of disputed dues.
• Utilisation of borrowings — whether funds raised on short-term basis have been used for long-term purposes.
• Fraud reporting — whether any fraud by or on the company was noticed or reported during the year.
• Related party transactions — compliance with Sections 177 and 188.
• CSR compliance — whether mandated CSR amount was spent; reasons if unspent.
• Internal audit system — whether an adequate internal audit system exists commensurate with the company’s size.
• Nidhi companies, NBFC compliance, and other sector-specific reporting where applicable.

Internal Audit — Mandatory Under Section 138 (With Updated Small Company Thresholds)

Internal audit is an independent, ongoing review of a company’s internal controls, risk management, operational processes, and regulatory compliance. Unlike statutory audit which examines the final financial statements, internal audit works inside the year — identifying weaknesses before they become losses or penalties.

Under Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014, internal audit is mandatory for prescribed classes of companies:

Note: The updated Small Company thresholds (₹10 crore capital / ₹100 crore turnover, effective December 2025) mean that many companies previously subject to voluntary internal audit governance expectations now formally qualify as small companies — reducing their formal regulatory burden. However, companies seeking bank credit, investor funding, or pre-IPO readiness benefit from internal audit regardless of mandatory applicability.

Secretarial Audit — Mandatory Under Section 204 (Updated SEBI LODR Norms from April 2025)

Secretarial audit is an independent verification of a company’s compliance with all applicable laws — the Companies Act, SEBI regulations, FEMA, labour laws, and sector-specific legislation. It is conducted by a Practising Company Secretary (PCS) and results in Form MR-3, which is attached to the Board’s Report.

Who Must Get a Secretarial Audit

• All listed companies — mandatory.
• Unlisted public companies: paid-up capital ≥ ₹50 crore; OR turnover ≥ ₹250 crore; OR outstanding loans/borrowings from banks/FIs ≥ ₹100 crore.
• Private companies that are subsidiaries of public companies meeting the above thresholds.
• Voluntary: companies not covered above can opt for secretarial audit for governance assurance, bank/investor readiness, or pre-IPO compliance confidence.

SEBI LODR Changes for Listed Companies — Effective April 2025

SEBI’s (LODR) Third Amendment Regulations 2024, effective 1 April 2025, introduced significant changes to secretarial audit standards for listed entities:

• Only peer-reviewed Practising Company Secretaries — individual or firm — can be appointed as secretarial auditors for listed companies.
• Appointment and reappointment of secretarial auditors now require shareholder approval at the AGM — aligning with statutory auditor processes.
• 5-year cooling-off period before reappointment; the firm must not share partners with the previous secretarial auditor for 5 years.
• Annual Secretarial Compliance Report (ASCR) under Regulation 24A must be submitted to stock exchanges within 60 days of FY-end.

Penalty: Under Section 204(4), non-compliance attracts a penalty of ₹2 lakh each on the company and every officer in default. For listed companies, SEBI may impose additional penalties for non-submission of the ASCR under Regulation 24A. MCA has imposed penalties of up to ₹36 lakh in adjudication proceedings for failure to attach the secretarial audit report in Form MR-3.

Tax Audit Under Section 44AB — Thresholds and Form 3CD Changes (IT Act 2025)

A tax audit under Section 44AB of the Income Tax Act is mandatory for businesses and professionals above prescribed turnover thresholds. The tax auditor issues Form 3CA/3CB and Form 3CD — a 44-clause report covering income computation, TDS compliance, disallowances, loans, and related party transactions.

Income Tax Act 2025 — Impact on Tax Audit and Form 3CD

The Income Tax Act 2025 replaced the Income Tax Act, 1961, effective from 1 April 2026. All section numbers have changed. Section 44AB under the 1961 Act is renumbered in the 2025 Act — and every clause in Form 3CD that references IT Act sections now requires updated cross-references.

This is not a cosmetic change. Every CA firm conducting tax audits for AY 2026-27 must update their Form 3CD working papers, TDS section references, and penalty clause references to the new IT Act 2025 numbering. Companies should verify with their tax auditor that their team has updated templates and is not working from pre-April 2026 checklists.

ICAI 60-Audit-Per-Partner Limit — Effective April 2026

From April 2026, each partner in a CA firm can sign a maximum of 60 tax audits per year under Section 44AB. The cap cannot be redistributed among partners. Large firms that previously concentrated assignments with senior partners must restructure. For companies, the practical impact is: engage your tax auditor early in the financial year. Partners at established firms may hit capacity limits by August-September, creating timeline pressure for companies that delay.

GST Audit — GSTR-9C Reconciliation Statement

Under the GST framework, registered taxpayers with aggregate annual turnover above ₹5 crore must file GSTR-9C — a reconciliation statement between their audited financial statements and their GSTR-9 annual return, certified by a Chartered Accountant or Cost Accountant.

• GSTR-9C deadline: 31 December 2026 (for FY 2025-26).
• Most common issues: ITC mismatch between returns and books; turnover differences due to invoice timing recognition; exempt supply classification differences.
• Sapient Services conducts GST reconciliation reviews before the GSTR-9C filing date — identifying and resolving mismatches that would otherwise attract GST notices.
• GSTR-9C mismatches that remain unresolved attract scrutiny under Section 61 of the CGST Act — auto-generated notices from GSTN.

Which Audits Apply to Your Company — Quick Reference

Use this table to check which audits are mandatory for your company type. Thresholds reflect current law as of May 2026.

Source: Companies Act 2013 (as amended), MCA Notification G.S.R. 880(E) dated 1 Dec 2025 (small company thresholds), CARO 2020, SEBI LODR Third Amendment Regulations 2024, Income Tax Act 2025.

Mandatory Audit Trail Requirement — What Every Company Must Know

All companies are required to use accounting software that maintains a complete, immutable audit trail for every financial transaction. This means:

• Every transaction entry — creation, modification, or deletion — must be logged with date, time, and the user who made the change.
• The audit trail cannot be disabled at any level — not by the administrator, not by a user with override access.
• Auditors are required to verify the audit trail as part of every statutory audit from FY 2023-24 onwards.
• If the audit trail was disabled at any point during the year — even briefly — this must be reported in the audit report as a qualification or an adverse remark.
• A qualified audit report on this point is visible to MCA, banks, investors, and all stakeholders who review your financials.

What to check: Does your current accounting software (Tally, SAP, Zoho Books, QuickBooks, custom ERP) maintain an audit trail that cannot be switched off? Do you have admin-level users who can delete or modify entries without a log? If yes, this is a compliance gap that needs to be addressed before your FY 2025-26 audit fieldwork begins.

Audit & Assurance Services — What Sapient Services Provides

Why Companies in Delhi Choose Sapient Services for Audit

The difference between a good audit and a poor one is not always visible at the time of signing. It becomes visible when a bank asks questions about your CARO report, when an investor wants to understand your IFC findings, or when MCA sends a notice about something your auditor failed to report.

Sapient Services delivers audit reports that are built to withstand regulatory and investor scrutiny — with UDIN verification, current regulatory knowledge, and practical management recommendations alongside the compliance output.

Frequently Asked Questions — Audit & Assurance Services

Q1. Is statutory audit mandatory for small companies and startups?

Yes. Every company registered in India must undergo statutory audit every financial year under Section 139 of the Companies Act, 2013 — including small companies, startups, and dormant companies. There is no turnover, size, or age exemption from the audit requirement. Small company status (updated to ₹10 crore capital / ₹100 crore turnover effective December 2025) exempts companies from CARO 2020 reporting and IFC assessment — but not from the audit itself.

Q2. What is the updated Small Company definition as of 2026?

MCA revised the small company definition under Section 2(85) of the Companies Act, 2013, effective 1 December 2025 (Notification G.S.R. 880(E)). A company qualifies as a small company if: paid-up share capital does not exceed ₹10 crore AND turnover does not exceed ₹100 crore. Both conditions must be satisfied simultaneously. This replaced the previous thresholds of ₹4 crore capital and ₹40 crore turnover. Small companies benefit from exemptions from CARO 2020, IFC reporting, auditor rotation, and simplified annual returns — but statutory audit remains mandatory.

Q3. Who needs a CARO 2020 report in their audit?

CARO 2020 applies to all companies except: OPCs; small companies (≤₹10 crore capital AND ≤₹100 crore turnover under December 2025 revised thresholds); banking, insurance, and Section 8 companies; and certain private companies with paid-up capital plus reserves ≤ ₹1 crore, borrowings ≤ ₹1 crore throughout the FY, and revenue ≤ ₹10 crore. All other companies — including unlisted public companies and private companies above the small company thresholds — require CARO 2020 reporting as part of their statutory audit.

Q4. What is the threshold for mandatory internal audit under Section 138?

Internal audit is mandatory for all listed companies (no threshold). For unlisted public companies: turnover ≥ ₹200 crore, or paid-up capital ≥ ₹50 crore, or loans/borrowings > ₹100 crore, or deposits ≥ ₹25 crore. For private companies: turnover ≥ ₹200 crore in the preceding FY, or outstanding loans/borrowings from banks/FIs > ₹100 crore at any point in the preceding FY. These thresholds are checked against the preceding financial year’s figures. Appointment must happen within 6 months of crossing the threshold. Penalty for non-compliance: ₹10,000 + ₹1,000 per day for continuing default.

Q5. Who can be appointed as internal auditor — can the statutory auditor do it?

Under Section 138, the internal auditor can be a Chartered Accountant, Cost Accountant (CMA), or any other professional as the Board decides. However, the statutory auditor of the company cannot also serve as the internal auditor — the two roles require independence from each other. The internal auditor can be an employee of the company or an external engagement — the Companies Act does not mandate external appointment for internal audit, though governance best practice favours independence.

Q6. What is the mandatory audit trail requirement, and how does it affect my company?

All companies must use accounting software that records an audit trail for every transaction — logging every creation, modification, or deletion with date, time, and user identity. The trail must be immutable — it cannot be disabled by any user including administrators. Statutory auditors must verify this as part of every audit and must report non-compliance in the audit report. A qualification on this point is visible to MCA, banks, and investors. If your accounting software has a setting to turn off the audit trail, or if admin users can delete entries without a log, this is a reportable compliance gap.

Q7. What is secretarial audit, and which companies need it?

Secretarial audit is an independent review of a company’s compliance with all applicable laws — Companies Act, SEBI regulations, FEMA, labour laws, and sector-specific statutes. It is conducted by a Practising Company Secretary (PCS) and results in Form MR-3 attached to the Board’s Report. Mandatory for: all listed companies; unlisted public companies with paid-up capital ≥ ₹50 crore, turnover ≥ ₹250 crore, or loans/borrowings ≥ ₹100 crore; and certain private company subsidiaries of qualifying public companies. For listed companies, from 1 April 2025, only ICSI-peer-reviewed PCS firms can be appointed — shareholder approval at AGM is required.

Q8. How does the Income Tax Act 2025 affect tax audit and Form 3CD?

The Income Tax Act 2025, effective from 1 April 2026, replaced the Income Tax Act, 1961. All section numbers have changed. Form 3CD references — including the TDS sections, penalty sections, and compliance references — now use the IT Act 2025 numbering. Every CA firm must update their Form 3CD working paper templates for AY 2026-27 tax audit engagements. A Form 3CD filed with 1961 Act section references for AY 2026-27 would be technically incorrect. Companies should confirm with their tax auditors that updated templates are in use.

Q9. What is GSTR-9C and who must file it?

GSTR-9C is the annual GST reconciliation statement — a certificate by a Chartered Accountant or Cost Accountant reconciling the taxpayer’s audited financial statements with their GSTR-9 annual return. It is mandatory for registered taxpayers with aggregate annual turnover exceeding ₹5 crore. For FY 2025-26, GSTR-9C must be filed by 31 December 2026. The most common reconciliation differences: ITC claimed in returns vs books, turnover recognition timing differences, and classification of exempt and taxable supplies. Unresolved differences attract auto-generated scrutiny notices under Section 61 of the CGST Act.

Q10. What are the penalties for statutory audit non-compliance?

Under Section 147 of the Companies Act, 2013: if a company fails to comply with audit provisions, the company is liable to a fine of not less than ₹25,000 and not more than ₹5,00,000, and every officer in default is liable to imprisonment up to one year or a fine of not less than ₹10,000 and not more than ₹1,00,000, or both. Beyond direct penalties, an unfiled AOC-4 marks the company ‘Active Non-Compliant’ on the MCA portal — blocking bank account changes, fundraising, director DIN renewals, and regulatory clearances.

Q11. What is the difference between statutory audit and tax audit?

Statutory audit is mandated by the Companies Act, 2013 under Section 139 — it applies to every company regardless of turnover and examines whether financial statements give a true and fair view. Tax audit under Section 44AB of the Income Tax Act applies only to businesses and professionals above turnover thresholds — it examines income computation, TDS compliance, and specific disclosures required for income tax purposes. Both are distinct engagements with separate reports. Most companies above the turnover threshold require both — a statutory audit and a tax audit — for the same financial year.

Q12. Does Sapient Services handle audit for companies outside Delhi?

Yes. Sapient Services provides audit and assurance services pan-India from our Okhla Phase II, New Delhi office. We work with companies across Delhi NCR, Noida, Gurgaon, Faridabad, and other major states including Uttar Pradesh, Haryana, Rajasthan, Maharashtra, Gujarat, and Karnataka. For multi-entity group companies with entities across different states, we coordinate group-level audit planning, timelines, and consolidated reporting.

Book Your Audit with Sapient Services — Delhi’s Trusted Audit & Assurance Team

Audit compliance in India has more moving parts in 2026 than it has had in years. The Small Company threshold change, the IT Act 2025 renumbering, the audit trail verification requirement, ICAI’s capacity limits, and SEBI’s tightened secretarial audit rules have all landed in the same period. Companies that work with auditors who are current on these changes avoid surprises. Those that don’t, discover the issues when the report comes back with a qualification — or when a regulator asks a question the auditor didn’t flag.

Sapient Services keeps its regulatory knowledge current. Our statutory audit process covers audit trail verification, correct small company classification, CARO 2020 depth, IFC assessment, and UDIN-verified delivery. Our tax audit team works from updated IT Act 2025 templates. Our secretarial audit engagement is structured for the post-April 2025 SEBI LODR environment.

We work with private companies, public companies, listed entities, LLPs, trusts, and Section 8 organisations across manufacturing, trading, services, NBFC, healthcare, education, and real estate sectors.

→ Call +91 9540162888 | valuation@sapientservices.com | Free consultation within 24 hours.