A CARO 2020 internal audit checklist helps finance teams collect the documents, reconciliations and explanations a statutory auditor may ask for before reporting under the Companies (Auditor’s Report) Order, 2020. Under Section 143(11) of the Companies Act, 2013, the order covers 21 reporting matters, and each answer needs audit evidence behind it.
This guide shows what to keep ready clause by clause, how to test applicability after the December 2025 small-company change, and how to organise employee expense evidence that supports fraud-related reporting.
Who this is for: CFOs, finance managers, controllers, accounts teams, internal auditors, statutory auditors and company secretaries at Indian companies.
Key Takeaways
- CARO 2020 covers 21 matters. Each needs evidence from your records.
- Test applicability first. Small-company limits are now ₹10 crore capital and ₹100 crore turnover.
- Organise evidence by clause, so the auditor can locate each document without raising follow-up queries.
- Show action on internal audit reports. A closed-loop tracker supports clause (xiv).
- Test employee expense claims. Duplicate claims and weak approval controls can surface under fraud reporting.
- Know the fraud timelines. Rule 13 sets 2-day, 45-day and 15-day windows.
What Is a CARO 2020 Internal Audit Checklist?
It is a management-side readiness list. It maps every CARO clause to the records your team owns.
The statutory auditor still forms the conclusion. Your job is to make that conclusion easy to evidence.
CARO does not replace the audit opinion. Where an answer is unfavourable or qualified, the report states the basis for it.
CARO 2020 Internal Audit vs Statutory Reporting
Area | Who owns it | What it covers |
CARO reporting | Statutory auditor | 21 matters in the auditor’s report |
Internal auditor, Board or audit committee | Ongoing review of controls and processes | |
Readiness checklist | Finance team | Documents, schedules and explanations for both |
Note that Section 144 bars a statutory auditor from providing internal audit services to the same company.
Why CARO audit requirements are now evidence-led
Regulators look at the audit file, not just the report. In an NFRA order summarised by Taxmann, an auditor reported that it considered internal audit reports. The file contained only the reports, with no working papers showing how the auditor used them. NFRA treated that as inadequate.
NFRA issued 23 disciplinary orders against auditors of public interest entities in FY 2024-25. These cases cover listed and other large entities, but the evidence standard they describe is a useful benchmark for any audit file.
Does CARO 2020 Apply to Your Company in FY 2025-26 and FY 2026-27?
Applicability decides how much of this CARO 2020 compliance checklist you need.
Company type | CARO 2020 status | Evidence to keep |
Banking or insurance company | Not applicable | Licence or incorporation details |
Section 8 company | Not applicable | Section 8 licence |
One Person Company | Not applicable | Certificate of incorporation |
Small company (a private company with paid-up capital up to ₹10 crore and previous-year turnover up to ₹100 crore, other than a holding company, a subsidiary company or a company governed by any special Act) | Not applicable | Capital and previous-year turnover workings |
Private company, not a holding or subsidiary of a public company, with capital plus reserves up to ₹1 crore, borrowings up to ₹1 crore and revenue (including other income, as per Schedule III) up to ₹10 crore | Not applicable if all three tests are met | Year-end capital, peak borrowing and revenue workings |
All other companies, including foreign companies | Applicable | Full clause-wise evidence pack |
2026 update: The MCA raised the small-company limits from ₹4 crore and ₹40 crore to ₹10 crore and ₹100 crore with effect from 1 December 2025 (Notification G.S.R. 880(E)). Confirm your working papers use the revised limits.
What Are the Three Common Applicability Traps?
- Borrowings are tested at any time in the year. A temporary peak can remove the private-company exemption.
- Turnover for the small-company test uses the previous financial year.
- Holding and subsidiary companies are excluded from the small-company definition.
Record the conclusion in a one-page memo. The auditor can then close applicability in minutes.
Sample applicability memo
# | Item | Entry |
1 | Company name, CIN, financial year | |
2 | Company type (private / public / OPC / Section 8 / other) | |
3 | Holding or subsidiary company? | Yes / No |
4 | Paid-up capital (small-company limit: ₹10 crore) | ₹ ___ |
5 | Previous-year turnover (small-company limit: ₹100 crore) | ₹ ___ |
6 | Small company? | Qualifies / Does not qualify |
7 | If a private company: capital plus reserves, peak borrowing in the year, total revenue | ₹ ___ / ₹ ___ / ₹ ___ |
8 | Conditional clauses triggered: cost records / fund raising / Nidhi / NBFC-HFC-CIC / CSR | |
9 | Conclusion | CARO 2020 applicable / not applicable |
10 | Prepared by / approved by CFO / date |
Use this template to record your applicability conclusion each year.
Does CARO 2020 Apply Differently to Indian Subsidiaries of Foreign Parents?
Under Section 2(85) of the Companies Act, 2013, a subsidiary cannot qualify as a small company, whatever its size. A private company that is a holding or subsidiary company of a public company also cannot use the ₹1 crore private-company exemption. Record both conclusions in the applicability memo.
CARO 2020 Internal Audit Checklist: Clause-Wise Documents Auditors May Request
Use this CARO 2020 checklist as a working index. The clause structure follows the ICAI Guidance Note on CARO 2020, which also carries an illustrative checklist.
Clause | What the auditor reports | Documents to keep ready |
(i) | Fixed assets and intangibles | Asset register, physical verification report, title deeds, registered valuer report if revalued |
(ii) | Inventory and working capital | Stock count sheets, discrepancy analysis by class, and, where sanctioned working capital limits exceed ₹5 crore secured on current assets, quarterly returns or statements filed with banks reconciled to books |
(iii) and (iv) | Loans, investments, guarantees | Party-wise schedule, agreements, repayment terms, board approvals, Section 185 and 186 workings |
(v) | Deposits | Deposit register, Sections 73 to 76 compliance file |
(vii) | Statutory dues | GST, TDS, PF, ESI and income tax challans, returns, ageing beyond six months, disputed dues schedule |
(viii) | Unrecorded income | Survey, search or assessment details and income surrendered |
(ix) and (x) | Borrowings and funds raised | Sanction letters, lender statements, end-use trail, default schedule, allotment records |
(xi) | Fraud and whistle-blower complaints | Fraud register, vigil mechanism log, ADT-4 copies, committee minutes |
(xiii) | Related party transactions | Related party register, approvals under Sections 177 and 188, disclosure workings |
(xiv) | Internal audit system | Appointment letter, audit plan, reports, management responses, action tracker |
(xv) | Non-cash transactions with directors or connected persons | Board approvals, Section 192 workings, valuation support |
(xvii) to (xix) | Cash losses, auditor resignation, ability to meet liabilities | Cash flow projections, ageing, key ratios, outgoing auditor correspondence |
(xx) | CSR unspent amount | CSR policy, committee minutes, Section 135 workings, transfer challans |
(xxi) | Group qualifications | Subsidiary CARO reports and remarks |
When this does not apply: Clauses (vi), (x), (xii), (xvi) and (xx) are reported only where their trigger exists, such as cost records, fund raising, Nidhi status, NBFC/HFC/CIC activity or CSR applicability.
Consulting a professional can help you assess how the conditional clauses apply to your records.
What Does a CARO 2020 Internal Audit Checklist Need for Clause (xiv)?
Clause (xiv) asks two questions. Does the company have an internal audit system commensurate with its size and business? And did the statutory auditor consider the internal auditor’s reports?
When is internal audit mandatory?
Internal audit applicability is set by Section 138 of the Companies Act, 2013, read with Rule 13 of the Companies (Accounts) Rules, 2014.
Company type | Trigger (preceding financial year) |
Listed company | Always |
Unlisted public company | Paid-up capital ₹50 crore or more, turnover ₹200 crore or more, borrowings above ₹100 crore, or deposits ₹25 crore or more |
Private company | Turnover ₹200 crore or more, or borrowings above ₹100 crore |
Internal audit checklist: what to hand over
- Board or audit committee resolution appointing the internal auditor
- Approved annual internal audit plan and scope
- All reports for the year, with management responses
- Action-tracker showing closed and open observations
- Minutes where the board or audit committee discussed findings
MSNA view: Handing over reports is not enough. Show what changed because of them. A closed-loop tracker is a strong form of evidence that reports were considered.
How Do Employee Expense Claims Fit Into a CARO 2020 Internal Audit Checklist?
Employee expenses can influence how deep the auditor’s fraud and controls questions go. This section covers expense claims, travel expenses and duplicate claims.
Why employee expenses reach CARO conversations
- Clause (xi): Fraud noticed or reported during the year.
- Clauses (iv), (xiii) and (xv): Advances, reimbursements and benefits for directors and related parties.
- Clause (vii): TDS and GST treatment of reimbursements.
- Clause (xiv): Whether internal audit tested the expense cycle.
Fraud detection tests for expense claims
Red flag | Test to run | Supporting documents |
Duplicate claims | Match invoice number, amount and date across employees and months | Original bills, claim system export |
Travel expenses that do not fit records | Compare tickets and hotel stays with attendance, leave and client visit logs | Tickets, boarding passes, trip reports |
Claims just below approval limits | Review claim frequency near each threshold | Authority matrix, claim history |
Missing or invalid GST invoices | Check GSTIN and invoice validity | Tax invoices, GSTR-2B match |
Self-approval or out-of-matrix approval | Compare approver against the delegation of authority | Approval logs, delegation policy |
Director or KMP personal expenses | Tag as related party and check approvals | Reimbursement vouchers, board minutes |
Approval controls and expense policy checklist
- A written expense policy with category limits, travel grades and a claim deadline
- Pre-approval for travel expenses above a set value, with booking proof attached
- Documented approval controls, with no approval of one’s own claim
- Mandatory supporting documents attached before payment
- Quarterly duplicate claims analytics on employee expenses
- Fraud detection results reported to the audit committee
“Auditors rarely doubt a single bill. They doubt a process that cannot show who approved it, against which policy, and what was checked afterwards.”
— Naveen S N, CA, Founder, MSNA & Associates LLP
What Are the Fraud Reporting Timelines Under Section 143(12)?
Clause (xi) links to the auditor’s duties under Rule 13 of the Companies (Audit and Auditors) Rules, 2014.
Situation | Timeline |
Suspected fraud of ₹1 crore or more | Auditor informs the Board or audit committee within 2 days |
Board or audit committee response | Within 45 days |
Reporting to Central Government | Form ADT-4 within 15 days of receiving the reply, or within 15 days after the 45-day period ends if no reply arrives |
Fraud below ₹1 crore | Reported to the audit committee or Board within 2 days |
These timelines are summarised in KPMG’s note on fraud reporting and Alvarez and Marsal’s analysis.
NFRA’s circular of 26 June 2023, addressed to auditors of NFRA-regulated entities, states that an auditor must file ADT-4 even when someone else identified the fraud first, and that resignation does not remove the reporting duty.
What Happens If Evidence Is Missing?
If a document is missing, the auditor may raise follow-up queries, extend testing, or report an unfavourable or qualified remark under the relevant clause, depending on the facts. The report must state the basis for any such remark. A gap in one clause does not by itself mean an adverse opinion on the financial statements, because the effect depends on materiality and the auditor’s judgement. A clause-indexed evidence pack reduces the number of follow-ups.
Statutory Audit Preparation Checklist: A 60-Day-to-Audit-Week Plan
This statutory audit preparation checklist is our own working model, and it doubles as a CARO 2020 audit checklist timeline. Adjust it to your year-end.
Window | Finance team action | Output |
60 days before | Applicability memo, open litigation and default list | Signed-off applicability note |
45 days before | Reconcile loans, fixed assets, inventory and statutory dues | Tied-out schedules |
30 days before | Internal audit tracker update, expense claim analytics | Closed-loop evidence |
15 days before | Evidence index and draft management representations | Indexed evidence pack |
Audit week | One point of contact, daily open-items tracker | Single request log |
How Do You Build a Clause-Indexed Evidence Pack?
Number each folder by clause, such as 3(vii) Statutory Dues. Keep one summary sheet at the top. Many auditors work in clause order, so indexing by clause is practical.
This habit cuts repeat requests, because the auditor sees what exists and where.
What Mistakes Slow Down a CARO 2020 Audit?
A CARO 2020 compliance checklist works only if the underlying records are reliable. These gaps cause the most rework:
- Using outdated thresholds for small-company status
- Unreconciled sub-ledgers for loans, advances and statutory dues
- Internal audit reports without follow-up
- Expense bills and supporting documents scanned months after payment
- Ignoring clause (xxi) when subsidiaries report qualifications
- Last-minute applicability decisions for clauses such as CSR and fund raising
Final Audit Documents Checklist
Confirm each item below before handing over the file.
- Applicability memo signed by the CFO
- Clause-indexed evidence pack
- Reconciled schedules for loans, assets, inventory and dues
- Internal audit reports and action tracker
- Fraud register and vigil mechanism log
- Expense policy, approval logs and exception reports
- Related party register and approvals
- Draft management representation letter
Next Steps: CARO 2020 Audit Readiness and Internal Audit Compliance Review
Finance teams may find it useful to have an independent professional review the evidence pack before fieldwork begins. Under Section 144, a company’s statutory auditor cannot provide internal audit services to that same company, so the reviewer should be chosen with that in mind.
This article is for general information and is not professional advice. Applicability depends on each company’s facts.
Prepare for Your CARO 2020 Audit
FAQs On The CARO 2020 Internal Audit Checklist
What is CARO 2020?
It is the Companies (Auditor’s Report) Order, 2020, issued under Section 143(11) of the Companies Act, 2013. It applies to audits of financial years starting on or after 1 April 2021.
Is CARO 2020 applicable to private limited companies?
Often yes. Exemptions exist only for small companies and for private companies that meet all three prescribed limits.
How many clauses does CARO 2020 have?
It has 21 clauses in paragraph 3, against 16 in CARO 2016. Some report only when a trigger exists.
Does CARO 2020 apply to LLPs?
No. It applies to companies registered under the Companies Act, 2013.
Does CARO apply to consolidated financial statements?
Only clause (xxi) applies. It covers qualifications in the CARO reports of group companies.
Does CARO apply to branches?
Yes. ICAI’s Guidance Note says it also applies to branch audits, because a branch auditor has the same duties as the company’s auditor under Section 143(8).
Can the statutory auditor do the internal audit?
No. Section 144 bars a statutory auditor from providing internal audit services to the same company.
Discover more from MSNA & Associates LLP
Subscribe to get the latest posts sent to your email.
