Audit Framework

Scope, independence, engagement acceptance, Companies Act linkages and audit-risk mindset.

Audit Hub · A01

Audit Framework

Scope, independence, engagement acceptance, Companies Act linkages and audit-risk mindset.

Section-wise decoding

1. Objective

Every statutory audit in India runs on two parallel tracks that must both be satisfied: the Companies Act, 2013 provisions governing who may be appointed, their independence, and what they must report (Sections 139-148), and the ICAI Standards on Auditing (SAs) governing how the audit itself is planned, evidenced and concluded.

2. Applicability

Every company (private or public) requires a statutory audit under Section 139, regardless of size — there is no small-company exemption from the audit requirement itself, only from certain reporting add-ons like CARO (see the CARO/NFRA/Quality module). LLPs require an audit only where contribution exceeds ₹25 lakh or turnover exceeds ₹40 lakh in a financial year.

3. Core Rules — the SA number tells you the audit stage

Block	Covers	Module
SA 200-299	General principles and responsibilities — objectives, engagement terms, quality control, documentation, fraud, laws/regulations, communication with governance	SA 200-299
SA 300-499	Risk assessment and response — planning, materiality, identifying risk, responding to assessed risk	SA 300-499
SA 500-599	Audit evidence — specific items, confirmations, sampling, estimates, related parties, going concern	SA 500-599
SA 600-699	Using the work of others — other auditors, internal audit, experts	SA 600-799
SA 700-799	Audit conclusions and reporting — forming an opinion, modifications, comparatives	SA 600-799

4. Practical Example

Before accepting an engagement, the incoming auditor must communicate with the outgoing auditor (a professional-ethics requirement, not just an SA 210 courtesy), confirm no disqualification under Section 141(3) applies (e.g. holding securities in the company, indebtedness above the prescribed limit, or providing a Section 144-restricted non-audit service), and record the engagement terms in a signed letter before starting substantive work.

5. Common Mistake

Treating "independence" as a one-time check at appointment. Section 141 disqualifications and SA 220 independence requirements apply throughout the engagement — a shareholding acquired mid-year, or a restricted non-audit service accepted mid-year, can compromise independence even if the auditor was clean at appointment.

Auditor appointment and reporting chain

Companies Act section	Subject
Section 139	Appointment of auditor (first auditor, subsequent appointment, rotation for specified classes of companies)
Section 140	Removal, resignation of auditor — including the auditor's own ADT-3 filing on resignation
Section 141	Eligibility, qualifications and disqualifications of an auditor
Section 143	Powers and duties of auditors, form and content of the audit report, fraud-reporting obligation
Section 144	Restrictions on auditor providing specified non-audit services to the same company
Section 147	Punishment for contravention (fines/penalties on the company and the auditor)

Exceptions and red flags

Risk: Assuming rotation requirements (maximum term limits for individual auditors/audit firms) apply to every company — they apply only to the specified classes of companies prescribed under the Companies (Audit and Auditors) Rules, not universally.
Risk: Overlooking that Section 144's restricted non-audit services list applies to the auditor, their relative, and associated persons/entities as prescribed — not just the signing partner personally.
Risk: Confusing a Companies Act statutory audit with an Income Tax Act tax audit (Section 44AB) — they have different applicability thresholds, different reporting formats (audit report vs Form 3CA/3CB+3CD), and can apply independently of each other.

Implementation checklist

✓ Confirm Section 141 eligibility and independence before accepting, and re-confirm at least annually thereafter.
✓ Communicate with the outgoing auditor before accepting a re-appointment engagement.
✓ Record the engagement letter (SA 210) before substantive fieldwork begins.
✓ Track rotation-applicability status separately from general appointment tracking, since it applies only to specified company classes.

Q&A

Does every private company need a statutory audit?	Yes — the Companies Act audit requirement has no small-company or private-company size exemption; size-based exemptions apply to specific reporting add-ons like CARO, not to the audit requirement itself.
Who can be disqualified from being an auditor?	A body corporate (other than an LLP), an officer/employee of the company, a person holding securities in the company, a person indebted above the prescribed limit, or a person providing a Section 144-restricted service, among the grounds listed in Section 141(3).
Is the Companies Act audit the same as a tax audit?	No — they are separate obligations under separate statutes, with separate applicability thresholds and separate report formats, though the same firm often performs both.
Can this be used as professional advice?	No. Confirm the entity's specific facts against the current Companies Act provisions, Rules, and applicable Standards on Auditing before acting.

Finin2min Summary

Audit Framework in 2 minutes: Every company needs a Companies Act audit (Sections 139-148) regardless of size; the SA numbering block (200s general, 300s risk, 500s evidence, 600s reliance on others, 700s reporting) maps directly to the audit's own stages. Independence and eligibility under Section 141 must hold throughout the engagement, not just at appointment.

Source log

ICAI — Standards on Auditing, complete text — SA complete text
MCA — Companies Act, 2013 (Sections 139-148) — Companies Act page
ICAI — Guidance Notes on Auditing Aspects — Guidance Notes