Company audit: CARO 2020 and the auditor's report

In short

A company audit under the Companies Act, 2013 ends in two written outputs: the statutory auditor's report under section 143, and the annexure to it required by the Companies (Auditor's Report) Order, 2020 (CARO 2020). The main report carries the opinion on whether the financial statements give a true and fair view, plus reporting under section 143(3), Rule 11 of the Companies (Audit and Auditors) Rules, 2014 and section 197(16); CARO adds twenty-one fact-based clauses on fixed assets, inventory, loans, deposits, statutory dues, defaults, fraud, CSR and more. CARO 2020 (issued 25 February 2020) applies from financial year 2021-22 onwards and replaced CARO 2016. This is a heavily examined area in CA Inter and Final Auditing papers, in B.Com/M.Com auditing, and in interviews at the Big Four, Grant Thornton, BDO, mid-tier Indian firms and in corporate internal-audit and financial-reporting roles.

Explained

The statutory frame of a company audit

• Appointment (s.139): first auditor by the Board within 30 days of incorporation; thereafter by members at the AGM for five years, ratification no longer required.
• Rotation (s.139(2) with Rule 5): listed companies and prescribed classes must rotate — an individual after one term of 5 years, a firm after two terms of 5 years, with a 5-year cooling-off.
• Eligibility and disqualification (s.141): only a chartered accountant or a firm whose majority partners are CAs; disqualified if holding security of the company, indebted beyond ₹5 lakh, giving a guarantee beyond ₹1 lakh, or rendering prohibited services under s.144.
• Powers and duties (s.143): right of access at all times to books, accounts and vouchers of the company and its subsidiaries/associates for consolidation; duty to inquire into the matters in s.143(1) (loans on security, book entries prejudicial, sale of investments below cost, loans shown as deposits, personal expenses charged to revenue, allotment for cash).
• Branch audit (s.143(8)), consolidated financial statements (s.129(4)), removal (s.140) with Central Government approval in Form ADT-2.
• Every report must carry a UDIN generated on the ICAI portal; audits of listed and other prescribed entities fall under NFRA oversight, others under ICAI.

Structure of the independent auditor's report (SA 700 Revised)

In this order: Title "Independent Auditor's Report" → Addressee (the members) → Opinion → Basis for Opinion → Material Uncertainty Related to Going Concern (SA 570, if any) → Key Audit Matters (SA 701) → Other Information (SA 720) → Responsibilities of Management and Those Charged with Governance → Auditor's Responsibilities → Report on Other Legal and Regulatory Requirements → signature, membership number, firm registration number, UDIN, place and date.

• Opinion paragraph names the entity, the statements audited, the period, and the framework — Accounting Standards or Ind AS under s.133 — and uses the phrase "true and fair view… in conformity with the accounting principles generally accepted in India".
• Key Audit Matters (SA 701): mandatory for listed entities (and where law or the auditor decides); these are matters of most significance in the current audit — they are *not* a substitute for a modified opinion or for a going-concern paragraph.
• Other Information (SA 720): the Board's Report and annexures; the auditor reads them for material inconsistency with the financial statements but expresses no opinion on them.

Types of opinion — SA 705 and SA 706

• Pervasive means the effect is not confined to specific elements, or if confined represents a substantial proportion, or relates to disclosures fundamental to users' understanding.
• Under SA 705 the heading changes to "Qualified Opinion"/"Adverse Opinion"/"Disclaimer of Opinion" and "Basis for Qualified Opinion" etc.; with a disclaimer the KAM section is normally omitted and the auditor's responsibilities paragraph is shortened.
• SA 706: an Emphasis of Matter draws attention to something already *properly disclosed* and fundamental (litigation outcome, catastrophe, early adoption of a standard); an Other Matter paragraph covers something not disclosed in the statements but relevant to users (prior-year audited by a predecessor, reliance on branch/other auditors). Neither modifies the opinion.
• Going concern (SA 570): if a material uncertainty exists and is adequately disclosed → separate "Material Uncertainty Related to Going Concern" section with an unmodified opinion; if not disclosed → qualified or adverse; if statements are prepared on a going-concern basis when that basis is inappropriate → adverse opinion.

Reporting under s.143(3), Rule 11 and s.197(16)

• s.143(3)(a)-(j): information and explanations obtained; proper books kept; branch returns adequate; statements agree with books; compliance with accounting standards; adverse effect on functioning; director disqualification under s.164(2); (h) any qualification, reservation or adverse remark relating to the maintenance of accounts — the route by which CARO qualifications and adverse remarks reach the main report; (i) adequacy and operating effectiveness of internal financial controls with reference to financial statements with a separate report; (j) any other prescribed matters.
• IFC exemption: reporting under s.143(3)(i) is not required for one person companies, small companies, and private companies with turnover below ₹50 crore as per the latest audited financial statement or aggregate borrowings from banks, financial institutions or any body corporate below ₹25 crore at any time during the year (the two limbs of the exemption notification are alternatives, not cumulative).
• Rule 11 of the Companies (Audit and Auditors) Rules, 2014: (a) impact of pending litigation on financial position; (b) provision for material foreseeable losses on long-term contracts including derivatives; (c) delay in transferring amounts to the Investor Education and Protection Fund; (e) management representations that no funds were advanced to intermediaries for onward lending to "ultimate beneficiaries", and none received with such an understanding, with a reasonableness check (the original clause (d) on demonetisation-era notes has been omitted); (f) compliance of dividend declared or paid with s.123; (g) audit trail — whether the accounting software used has an audit trail (edit log) feature, whether it operated throughout the year for all transactions recorded, whether it was tampered with, and whether it has been preserved as required for record retention. The audit-trail clause became effective for financial years beginning on or after 1 April 2023, that is FY 2023-24, and under ICAI's implementation guidance the preservation element is reported from FY 2024-25 onwards.
• s.197(16): whether managerial remuneration is paid in accordance with s.197 (applies to public companies; private companies are outside s.197).
• Fraud reporting, s.143(12) with Rule 13: fraud involving or expected to involve ₹1 crore or more → report to the Board or Audit Committee within 2 days seeking a reply within 45 days, then forward the reply (or note of no reply) to the Central Government in Form ADT-4 within 15 days, by registered post/speed post with e-mail, addressed to the Secretary, Ministry of Corporate Affairs. Below ₹1 crore → report to the Audit Committee or Board within 2 days; the company discloses nature, amount and action in the Board's Report.

CARO 2020 — applicability and the twenty-one clauses

Applies to every company including a foreign company under s.2(42). Does not apply to: a banking company; an insurance company; a company licensed under s.8; a One Person Company; a small company (s.2(85)); and a private company that is not a subsidiary or holding of a public company and satisfies all three tests — paid-up capital plus reserves and surplus not more than ₹1 crore on the balance sheet date, total borrowings from any bank or financial institution not more than ₹1 crore at any point during the year, and total revenue (including revenue from discontinuing operations) not more than ₹10 crore in the financial year. CARO does not apply to consolidated financial statements except clause (xxi).

The clauses of paragraph 3, in order:

1. (i) Property, plant and equipment and intangibles — proper records; physical verification at reasonable intervals and material discrepancies; title deeds of immovable property not in the company's name (tabular disclosure); revaluation of 10% or more in net carrying value of a class of PPE/intangibles by a registered valuer; proceedings under the Prohibition of Benami Property Transactions Act, 1988.
2. (ii) Inventory and working capital limits — physical verification coverage and procedure; discrepancies of 10% or more in the aggregate for each class of inventory; where sanctioned working capital limits exceed ₹5 crore in aggregate from banks or financial institutions on the security of current assets, whether quarterly returns or statements filed agree with the books.
3. (iii) Loans, investments, guarantees and security — aggregate amount and year-end balance for subsidiaries/JVs/associates and others; whether terms are prejudicial; schedule of repayment; overdue beyond 90 days; loans renewed or fresh loans granted to settle existing overdues (amount and percentage of total loans); loans repayable on demand or without specified terms.
4. (iv) Compliance with s.185 and s.186 — loans to directors and loans/investments/guarantees by the company.
5. (v) Deposits — compliance with ss.73-76, the Deposit Rules and RBI directions; whether orders of the Company Law Board/NCLT/RBI/court have been complied with.
6. (vi) Cost records — whether records prescribed under s.148(1) have been made and maintained (not an audit of them).
7. (vii) Statutory dues — (a) regularity in depositing undisputed dues (GST, provident fund, ESI, income tax, duty of customs, cess and others) and arrears outstanding for more than six months from the date they became payable; (b) disputed dues not deposited, with amount and forum.
8. (viii) Unrecorded income — transactions not recorded in the books that have been surrendered or disclosed as income in income-tax assessments, and whether they have since been recorded.
9. (ix) Defaults and use of borrowings — default in repayment of loans or interest to any lender, with lender-wise details; wilful defaulter declaration; term loans applied for the purpose taken; short-term funds used for long-term purposes; funds taken to meet obligations of subsidiaries/associates/JVs; loans raised on the pledge of securities held in subsidiaries/JVs/associates.
10. (x) Share and debenture issues — (a) moneys from IPO/FPO (including debt instruments) applied for the stated purposes; (b) preferential allotment or private placement of shares or convertible debentures — compliance with s.42 and s.62 and application of funds.
11. (xi) Fraud — (a) fraud by the company or on the company noticed or reported, with nature and amount; (b) whether Form ADT-4 was filed by the auditors with the Central Government; (c) whether whistle-blower complaints received during the year were considered.
12. (xii) Nidhi company — net owned funds to deposits ratio of 1:20; maintenance of 10% unencumbered term deposits; default in payment of interest or repayment of deposits.
13. (xiii) Related party transactions — compliance with s.177 and s.188 and disclosure as required by the applicable accounting standards.
14. (xiv) Internal audit — (a) whether the company has an internal audit system commensurate with its size and nature; (b) whether internal audit reports were considered by the statutory auditor.
15. (xv) Non-cash transactions with directors or persons connected with them — compliance with s.192.
16. (xvi) NBFC matters — registration under s.45-IA of the RBI Act, 1934; conduct of NBFC/Housing Finance activity without a valid certificate of registration; whether it is a Core Investment Company and meets the criteria; number of CICs in the group.
17. (xvii) Cash losses — in the financial year and the immediately preceding financial year, with amounts.
18. (xviii) Resignation of statutory auditors — whether the incoming auditor has considered the issues, objections or concerns raised by the outgoing auditor.
19. (xix) Financial ratios, ageing and realisation — on the basis of ratios, ageing and expected dates of realisation of financial assets and payment of liabilities, whether any material uncertainty exists about the company meeting its liabilities existing on the balance sheet date as and when they fall due within one year. The clause requires an express statement that this is not an assurance about future viability.
20. (xx) CSR — (a) unspent amount (other than ongoing projects) transferred to a Fund specified in Schedule VII within six months of the end of the financial year; (b) amount for an ongoing project transferred to a special account under s.135(6).
21. (xxi) Consolidated financial statements — whether any qualifications or adverse remarks appear in the CARO reports of the companies included in the consolidation, with company names, CIN and clause numbers.

How CARO is reported and how it feeds the main report

• CARO findings go into an annexure to the auditor's report, referred to in the "Report on Other Legal and Regulatory Requirements" section; a negative or unfavourable answer must state the reason.
• A CARO remark is factual reporting, not an opinion — it does not automatically qualify the opinion, but the underlying matter may. s.143(3)(h) requires the main report to mention CARO qualifications and adverse remarks.
• If the auditor is unable to form an opinion on a clause, that fact and the reason are stated.
• CARO 2020 added, over CARO 2016, the clauses on revaluation, benami proceedings, quarterly returns to banks, unrecorded income surrendered in tax assessments, wilful defaulter, pledging of subsidiary securities, whistle-blower complaints, cash losses, auditor resignation, material uncertainty on liabilities, CSR, and consolidation remarks — and it dropped the old CARO 2016 clause on managerial remuneration under s.197 read with Schedule V.

Key points

• CARO 2020 - Order under s.143(11), effective from FY 2021-22, 21 clauses in paragraph 3, annexed to the auditor's report.
• Exempt entities - banking, insurance, s.8, OPC, small company and the small private company meeting all three ₹1 cr / ₹1 cr / ₹10 cr tests.
• CFS - CARO does not apply except clause (xxi) on qualifications in component auditors' CARO reports.
• Clause (i)(c) - title deeds not in the company's name must be disclosed in a prescribed table with gross carrying value and reason.
• Clause (ii)(b) - triggered only when sanctioned working capital limits exceed ₹5 crore on security of current assets.
• Clause (iii) - 90 days is the overdue benchmark; evergreening of loans must be disclosed with amount and percentage.
• Clause (vii)(a) - undisputed statutory dues outstanding more than six months from the due date are reported.
• Clause (ix) - lender-wise default details, wilful defaulter status and diversion of short-term funds to long-term uses.
• Clause (xix) - a solvency-indicator clause for one year ahead; it is not a guarantee of future viability and must say so.
• Clause (xx) - six months for unspent other-than-ongoing CSR; a special Unspent CSR Account for ongoing projects.
• SA 700 - prescribes the structure and wording of the report; opinion comes first, before the basis.
• SA 705 - material-but-not-pervasive → qualified; pervasive misstatement → adverse; pervasive scope limitation → disclaimer.
• SA 706 - emphasis of matter needs the matter to be already properly disclosed; it never modifies the opinion.
• SA 701 - KAM is mandatory for listed entities and is not a substitute for a modification.
• Rule 11(g) - audit-trail reporting: existence of the feature, operation throughout the year, no tampering, and preservation.
• s.143(12) - frauds of ₹1 crore or more go to the Central Government in Form ADT-4; smaller frauds to the Audit Committee/Board.
• s.143(3)(i) - internal financial controls reporting, with exemption for OPC, small companies and small private companies.
• UDIN and NFRA - every signed report carries a UDIN; listed and prescribed entities' audits are regulated by NFRA.

Formulas and examples

Example 1 — Does CARO apply? Alpha Components Pvt Ltd (not a subsidiary or holding of a public company): paid-up capital ₹60 lakh, reserves and surplus ₹55 lakh, peak borrowings from a bank ₹85 lakh, total revenue ₹7.40 crore.

• Capital + reserves = 60 + 55 = ₹1.15 crore > ₹1 crore → test failed.
• Borrowings ₹85 lakh ≤ ₹1 crore and revenue ₹7.40 crore ≤ ₹10 crore → these pass.
• All three must be satisfied, so CARO 2020 applies. (Had reserves been ₹35 lakh, total ₹95 lakh, and the company were also not a small company by the s.2(85) definition, the exemption would hold.)

Example 2 — Inventory discrepancy, clause (ii)(a). Raw material: book value ₹420 lakh, physical verification value ₹378 lakh. Finished goods: book ₹310 lakh, physical ₹295 lakh.

• Raw material difference = 420 − 378 = ₹42 lakh → 42/420 × 100 = 10.0% → being 10% or more, it is reportable with the discrepancy properly dealt with in the books.
• Finished goods difference = 310 − 295 = ₹15 lakh → 15/310 × 100 = 4.84% → below 10%, not reportable under this clause (though materiality for the opinion is judged separately).

Example 3 — CSR, clause (xx). Net profits under s.198 for the three preceding years: ₹36 cr, ₹42 cr, ₹42 cr. Spent during the year ₹55 lakh. Of the unspent amount, ₹15 lakh relates to an ongoing project.

• Average = (36 + 42 + 42)/3 = ₹40 crore; required spend = 2% × 40 cr = ₹80 lakh.
• Unspent = 80 − 55 = ₹25 lakh; ongoing project ₹15 lakh, other than ongoing ₹10 lakh.
• For FY ending 31 March 2026: ₹15 lakh must go to a special Unspent CSR Account within 30 days of the year end (by 30 April 2026) under s.135(6) → clause (xx)(b); ₹10 lakh must go to a Schedule VII Fund within six months (by 30 September 2026) → clause (xx)(a). Non-transfer is reported with the amount.

Example 4 — Nidhi company, clause (xii). Outstanding deposits ₹200 lakh; net owned funds ₹9 lakh; unencumbered term deposits held ₹14 lakh.

• Maximum permitted deposits = 20 × 9 = ₹180 lakh; actual ₹200 lakh → ratio is 9:200 = 1:22.2, which breaches the 1:20 limit by ₹20 lakh of deposits.
• Required unencumbered term deposits = 10% × 200 = ₹20 lakh; held ₹14 lakh → shortfall ₹6 lakh.
• Both facts, with amounts, are reported under clause (xii).

Example 5 — Fraud and opinion interaction. During the audit of a listed company the auditor detects a ₹1.25 crore fictitious-vendor fraud by an employee; the company has recorded a provision and disclosed it fully.

• Amount ≥ ₹1 crore → report to the Audit Committee within 2 days, reply sought within 45 days, Form ADT-4 to the Central Government within 15 days of the reply.
• CARO clause (xi)(a) states the nature and amount; clause (xi)(b) confirms ADT-4 was filed.
• Because the matter is correctly accounted for and disclosed, the opinion is unmodified; the auditor may add an Emphasis of Matter under SA 706 or treat it as a Key Audit Matter under SA 701. Had the company refused to provide for it, and the amount were material but not pervasive, the opinion would be qualified.

Where it is used

• Statutory audit teams at Big Four and Indian firms (Deloitte Haskins & Sells, S.R. Batliboi, Price Waterhouse, Walker Chandiok, BSR, MSKA, Singhi, Lodha) — CARO working papers and the audit file are a core deliverable for every corporate client.
• Listed-company reporting: KAM paragraphs, SEBI (LODR) limited reviews, and annual report disclosures that mirror CARO remarks.
• Banks and NBFCs: credit teams read clauses (vii), (ix) and (xix) of the CARO annexure when appraising working-capital and term-loan proposals; clause (ii)(b) compares borrowers' stock statements with their books.
• Corporate finance and controllership roles: preparing the title-deed schedule, the statutory dues ageing, related-party registers and the CSR unspent account so that the CARO annexure comes out clean.
• Regulators: NFRA inspection orders and ICAI disciplinary cases frequently turn on CARO clauses answered without evidence and on inadequate going-concern or IFC reporting.
• Due diligence and transaction advisory: CARO annexures of target companies are a quick, standardised read on defaults, litigations and statutory non-compliance.

Interview questions

• Q: Which companies are outside CARO 2020? A: Banking companies, insurance companies, s.8 companies, one person companies, small companies, and private companies that are not subsidiaries or holding companies of a public company and meet all three thresholds of ₹1 crore capital plus reserves, ₹1 crore borrowings and ₹10 crore revenue.
• Q: Does CARO apply to consolidated financial statements? A: No, except clause (xxi), which requires reporting of qualifications or adverse remarks in the CARO reports of the companies included in the consolidation.
• Q: Does a negative CARO remark force a qualified opinion? A: No. CARO is factual reporting; the opinion is qualified only if the underlying matter causes a material misstatement or a scope limitation, though s.143(3)(h) requires CARO qualifications to be mentioned in the main report.
• Q: Difference between a qualified opinion and a disclaimer? A: A qualified opinion is given when a misstatement or scope limitation is material but not pervasive; a disclaimer is given when the auditor cannot obtain sufficient appropriate evidence and the possible effects are both material and pervasive.
• Q: What is the threshold for reporting fraud to the Central Government? A: ₹1 crore or more, in Form ADT-4, after reporting to the Board or Audit Committee within 2 days and allowing 45 days for a reply, then filing within 15 days.
• Q: What does clause (ii)(b) require? A: Where sanctioned working capital limits exceed ₹5 crore in aggregate on the security of current assets, whether the quarterly returns or statements filed with banks agree with the books of account, and if not, the differences.
• Q: What is reported about the audit trail? A: Under Rule 11 the auditor reports whether the accounting software has an audit-trail (edit log) feature, whether it operated throughout the year for all transactions recorded, whether it was tampered with, and whether the trail has been preserved as per the statutory record-retention requirement.
• Q: Is a Key Audit Matter a kind of qualification? A: No. KAM highlights matters of most significance in the current audit; it never replaces a modified opinion, a going-concern section or a required disclosure.
• Q: What does clause (xix) actually say? A: Based on ratios, ageing and expected dates of realisation of financial assets and payment of liabilities, whether a material uncertainty exists about meeting liabilities falling due within one year of the balance sheet date, with an explicit statement that this is not an assurance of future viability.
• Q: Which companies are exempt from internal financial controls reporting? A: One person companies, small companies, and private companies with turnover below ₹50 crore as per the latest audited financial statement or aggregate borrowings below ₹25 crore from banks, financial institutions or any body corporate at any time during the year — the two limbs are alternatives.
• Q: An amount is disputed and pending before the CIT (Appeals). Where does it go? A: Under clause (vii)(b), as a disputed statutory due not deposited, stating the nature of dues, amount, period and the forum where the dispute is pending.
• Q: What new clauses did CARO 2020 add over CARO 2016? A: Revaluation, benami proceedings, quarterly returns to banks, income surrendered in tax assessments, wilful defaulter, pledge of subsidiary securities, whistle-blower complaints, cash losses, auditor resignation, material uncertainty on liabilities, CSR and consolidation remarks.

Common mistakes

• Applying only one or two of the three private-company thresholds, or forgetting that the company must also not be a subsidiary or holding of a public company.
• Treating CARO remarks as opinions — writing "we qualify our opinion" in the annexure, or conversely ignoring s.143(3)(h) in the main report.
• Mixing the CSR deadlines: 30 days for an ongoing project's special account, six months for other unspent amounts.
• Reporting undisputed statutory dues outstanding at the year end instead of those outstanding more than six months from the due date.
• Placing an emphasis-of-matter paragraph for something the company has *not* disclosed — that calls for a modification, not an EOM.
• Writing CARO clauses from last year's file without re-testing: clause (xvii) needs the preceding year's cash loss too, and clause (xviii) applies only where an auditor resigned.
• Treating a material uncertainty on going concern as automatically a qualified opinion when adequate disclosure makes the opinion unmodified with a separate section.

Related topics

Standards on Auditing (SAs) · Internal control and internal audit · Audit planning, materiality, risk assessment and sampling · Professional ethics: the Code of Ethics and the Chartered Accountants Act 1949 · Forensic accounting and fraud detection · Bank audit, tax audit and special audits