As per section 138 of Indian Companies Act 2013 read with Rule 13. Of Companies (Accounts) Rules, 2014, certain class of companies are required to appoint Internal Auditors.

An extract of Rule 13 is

Companies required to appoint internal auditor.-

(1) The following class of companies shall be required to appoint an internal auditor or a firm of internal auditors, namely:-

(a) every listed company;

(b) every unlisted public company having-

(i)    paid up share capital of fifty crore rupees or more during the preceding financial year; or

(ii) turnover of two hundred crore rupees or more during the preceding financial year; or

(iii)    outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year; or

(iv)    outstanding deposits of twenty five crore rupees or more at any point of time during the preceding financial year; and

(c) every private company having-

(i) turnover of two hundred crore rupees or more during the preceding financial year; or

(ii)   outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year:

Provided that an existing company covered under any of the above criteria shall comply with the requirements of section 138 and this rule within six months of commencement of such section.

Explanation.- For the purposes of this rule –

The internal auditor may or may not be an employee of the company;

The Audit Committee of the company or the Board shall, in consultation with the Internal Auditor, formulate the scope, functioning, periodicity and methodology for conducting the internal audit.

However, the rule specifies that an internal auditor may or may not be an employee of the company. The Internal auditor may be a CA/CWA or any other professional. And also neither the rules nor the Act, has specified the duties and responsibilities. So even if the rules and act made the appointment of Internal Auditor mandatory, the same rules and Act provides option to companies to appoint any person as internal auditors. And also any one who has the knowledge can became an Internal Auditor, because the rules did not define the word “any other professional”