CARO NFRA Quality

CARO 2020, Section 143 reporting, NFRA inspections, EQCR, file archiving and common findings.

Section-wise decoding

1. Objective

Three separate frameworks sit on top of the ordinary audit and SA compliance: CARO 2020 (an additional reporting order for eligible companies), NFRA oversight (a statutory regulator with its own applicability criteria), and firm-level quality management (currently SQC 1, with SQM 1/SQM 2 issued but not yet mandatory).

2. Applicability — CARO 2020

CARO 2020 applies to every company including a foreign company, EXCEPT: banking companies, insurance companies, Section 8 companies, one-person companies, small companies, and private companies meeting ALL THREE of: paid-up capital + reserves ≤ ₹1 crore, total borrowings from banks/FIs ≤ ₹1 crore, and total revenue ≤ ₹10 crore. Note the small-company thresholds themselves were revised to ₹10 crore paid-up capital and ₹100 crore turnover effective 1 December 2025 — a company qualifying as "small" under the revised thresholds is automatically CARO-exempt with no further conditions to test.

3. Applicability — NFRA (Rule 3)

NFRA governs: (a) every listed company (any exchange, India or abroad) and its auditor; (b) unlisted public companies with paid-up capital ≥ ₹500 crore OR turnover ≥ ₹1,000 crore OR aggregate outstanding loans/debentures/deposits ≥ ₹500 crore; plus certain other prescribed classes. A company that ceases to meet these thresholds remains under NFRA for a further 3-year sunset period.

4. Practical Example

A private company with paid-up capital and reserves of ₹1.25 crore, borrowings of ₹70 lakh, and revenue of ₹8.2 crore is NOT exempt from CARO despite meeting two of the three conditions — all three must hold simultaneously, and it breaches the capital-and-reserves limit alone.

5. Common Mistake

Assuming SQM 1 and SQM 2 became mandatory on 1 April 2026 as originally scheduled. ICAI's Council, at its 451st meeting (30-31 March 2026), deferred the mandatory effective date until further announcement — SQC 1 continues to apply in the meantime. A firm's quality-control documentation dated after March 2026 that assumes SQM 1/2 compliance without confirming the current ICAI announcement risks referencing a standard not yet in force.

Three-framework applicability map

Exceptions and red flags

• Risk: Using pre-December-2025 small-company thresholds (the older, lower figures) to assess CARO exemption — the revised ₹10 crore/₹100 crore thresholds materially change which companies now qualify as small and therefore CARO-exempt.
• Risk: Presenting the Corporate Laws (Amendment) Bill 2026's NFRA changes as current law — as of August 2026 it has Joint Parliamentary Committee backing but has not been passed by both Houses or enacted.
• Risk: Testing only revenue or only borrowings for the private-company CARO exemption — all three conditions (capital+reserves, borrowings, revenue) must be satisfied together.

Implementation checklist

• ✓ Re-test CARO exemption status using the current (post-1-December-2025) small-company thresholds, not an older figure carried over from a prior year's file.
• ✓ Confirm NFRA applicability against both the listed-company limb and the unlisted-public-company threshold limb of Rule 3 independently.
• ✓ Check ICAI's current announcement on SQM 1/SQM 2 before assuming either the deferred date or a since-updated date applies to the firm's quality-management documentation.
• ✓ Track NFRA-covered entities for the full 3-year sunset tail after they cease to meet the applicability thresholds.

Q&A

Finin2min Summary

Source log

• ICAI — Standards on Auditing, complete text — SA complete text
• NFRA — Rules and applicability, and Audit Quality Inspection Guidelines — NFRA inspection guidelines
• MCA — Companies (Auditor's Report) Order, 2020 and Companies Act, 2013 — Companies Act page
• ICAI — Guidance Notes on Auditing Aspects (quality management transition) — Guidance Notes