Inhouse internal audit vs. external internal auditor

The Companies Act does not contain a provision making the internal audit compulsory for any Company. However, as per Companies (Auditor's Report) Order, 2003 (CARO), point 4 read in conjunction with clause (vii) reads "Matters to be included in the auditor's report. - The auditor's report on the account of a company to which this Order applies shall include a statement on the following matters, namely:

• in the case of listed companies and/or other companies having a paid-up capital and reserves exceeding Rs.50 lakhs as at the commencement of the financial year concerned, or having an average annual turnover exceeding five crore rupees for a period of three consecutive financial years immediately preceding the financial year concerned, whether the company has an internal audit system commensurate with its size and nature of its business". 
•  

Hence, an Internal Audit is not mandatory for a private limited company and it is the choice of the management to get it done (There are exceptions such as SEBI / IRDA regulations making it mandatory for stock brokers/trading members/clearing members/insurers). Although, private limited companies meeting any one of the following criteria have to specify whether an adequate Internal Audit System is in place:

• Paid up capital and reserves exceeding Rs. 50 Lakhs at the commencement of the financial year concerned 
• Average annual turnover exceeding Rs. 5 Crores for a period of three consecutive financial years immediately preceding the financial year concerned

An Internal Auditor does not require any fixed qualifications, as there is no law or provision detailing this and the management can appoint any person they deem fit for the role, as the Internal Auditor. They can be set-up in-house or be outsourced, although after the emergence of the Satyam scam, many large companies are increasingly outsourcing their Internal Audits to strengthen their corporate governance mechanism. Additionally, the Institute of Chartered Accountants of India (ICAI) has asked the government to make outsourcing of internal audit functions mandatory for companies. Finally, the clause 138 in the new Companies Bill, 2011 states that "Such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a chartered accountant or a cost accountant, or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company.".