What Happens When Your Auditor Flags Non-Compliance

The Moment an Auditor Flags an Issue

A statutory audit is not a pass/fail exercise. When your auditor identifies a problem — a missed compliance deadline, an unapproved related party transaction, an inadequate provision, a FEMA violation — they do not simply note it and move on. Under the Companies Act 2013, the auditor has a legal obligation to report the issue in specific ways depending on its nature and severity. The consequences for your company depend entirely on what category the issue falls into and how quickly you respond.

For foreign-owned subsidiaries in India, audit qualifications carry outsized importance. The parent company's group auditor will flag the Indian subsidiary's qualifications in the consolidated audit report. The parent's board, audit committee, and external investors will ask questions. If the qualification relates to FEMA or RBI compliance, the reputational damage with Indian regulators can affect future investment approvals.

Types of Audit Opinions and What They Mean

The statutory auditor's report must contain one of four opinions under Standards on Auditing (SA 700/705/706):

1. Unqualified (Clean) Opinion

The financial statements present a true and fair view in all material respects. This is what every company aims for. No compliance issues were found that would materially affect the financial statements.

2. Qualified Opinion

The auditor found a specific issue that is material but not pervasive — meaning it affects specific line items or disclosures but does not undermine the financial statements as a whole. Common qualifications for foreign subsidiaries include:

• Late filing of FC-GPR or FLA Return (FEMA non-compliance)
• Non-compliance with transfer pricing arm's length requirements for intercompany transactions
• Inadequate provisions for tax disputes or contingent liabilities
• Related party transactions not approved under Sections 177/188 of the Companies Act
• Non-maintenance of statutory registers or failure to hold AGM within the prescribed timeline

3. Adverse Opinion

The auditor found issues that are both material and pervasive — the financial statements as a whole are misleading. This is rare and extremely serious. It typically arises when:

• The company has not maintained proper books of account
• Revenue recognition policies are fundamentally flawed
• The going concern assumption is questionable and not disclosed
• Multiple material misstatements across various financial statement components

4. Disclaimer of Opinion

The auditor was unable to obtain sufficient evidence to form an opinion. This can happen when the company restricts access to records, key management personnel are unavailable, or the scope of the audit is limited by circumstances beyond the auditor's control.

CARO 2020: The 21-Clause Reporting Framework

Beyond the main audit opinion, the Companies (Auditor's Report) Order 2020 (CARO 2020) requires the auditor to report separately on 21 specific clauses. For foreign subsidiaries, the most frequently flagged clauses are:

When the auditor reports an adverse or qualified answer on any CARO clause, the audit report must state the basis for that unfavourable answer, and the parent company's auditor must reference these qualifications in the consolidated CARO report with the specific paragraph numbers.

When Fraud Is Suspected: Section 143(12) Reporting

If the auditor has reason to believe that an offence of fraud is being or has been committed against the company by its officers or employees, a separate and far more serious reporting obligation is triggered under Section 143(12) of the Companies Act 2013:

For Fraud Amounts of INR 1 Crore or Above

1. The auditor must report the matter to the Board of Directors or the Audit Committee within 2 days of identifying the suspected fraud
2. The Board/Audit Committee must reply within 45 days
3. The auditor then files Form ADT-4 with the Central Government (Ministry of Corporate Affairs) within 15 days of receiving the Board's reply
4. If the Board does not reply within 45 days, the auditor files Form ADT-4 anyway

For Fraud Amounts Below INR 1 Crore

The auditor reports in the audit report itself, describing the nature of the fraud, the amount involved, and the parties involved. No Form ADT-4 filing is required for amounts below INR 1 crore.

The National Financial Reporting Authority (NFRA), through its circular dated June 26, 2023, has clarified that the auditor's obligation to file ADT-4 exists even if the auditor was not the first person to discover the fraud. Additionally, resignation does not absolve the auditor of their duty to report suspected fraud.

Regulatory Consequences: What Happens After the Flag

Ministry of Corporate Affairs (MCA)

Qualified audit reports are visible to the Registrar of Companies (ROC) when the company files its AOC-4 (financial statements) and MGT-7 (annual return). The ROC may:

• Issue a show-cause notice requiring the company to explain the qualification
• Order an inspection under Section 206 of the Companies Act
• In serious cases, refer the matter to the Serious Fraud Investigation Office (SFIO)
• Initiate prosecution for specific violations (e.g., failure to hold AGM, non-maintenance of registers)

Reserve Bank of India (RBI)

For foreign subsidiaries, FEMA-related qualifications attract RBI attention. If the auditor flags:

• Late FC-GPR filing: The company must apply for compounding under FEMA Section 15. The compounding fee is typically INR 5,000-50,000 depending on the delay and amount involved.
• Late FLA Return: Penalties can extend up to three times the amount involved under FEMA Section 13.
• Pricing violations: If shares were allotted to the foreign investor at a price below the minimum prescribed by RBI (fair market value under DCF or book value methods), the company must seek condonation through the RBI compounding process.
• ECB non-compliance: Breach of ECB end-use conditions or all-in-cost ceiling triggers separate RBI reporting and potential compounding.

Income Tax Department

Tax-related qualifications (inadequate provisions, aggressive tax positions, transfer pricing adjustments) can trigger:

• Scrutiny assessment under Section 143(2) — the Assessing Officer selects the case for detailed examination
• Transfer pricing audit under Section 92CA — the Transfer Pricing Officer examines intercompany transaction pricing
• Demand notices for additional tax, interest (Section 234A/B/C), and penalties (Section 270A — 50-200% of under-reported tax)

NFRA (National Financial Reporting Authority)

The NFRA has authority to review audit quality for listed companies and certain unlisted public companies. If the NFRA finds that the auditor failed to properly report non-compliance, it can:

• Impose monetary penalties of up to INR 5 lakh on the auditor (for listed companies) or INR 1 lakh (for others)
• Bar the auditor from practice for up to 10 years
• Refer the matter to ICAI for disciplinary proceedings

The Remediation Playbook: Step-by-Step

When your auditor flags non-compliance, follow this structured remediation process:

Step 1: Classify the Issue (Day 1-3)

Determine whether the non-compliance is:

• Procedural: Late filing, missed deadline, incomplete documentation (most common; usually remediable)
• Substantive: Pricing violation, unapproved related party transaction, inadequate controls (requires structural changes)
• Fraud-related: Suspected fraud by employees or officers (triggers Section 143(12) obligations)

Step 2: Engage Specialists (Day 3-7)

Depending on the classification:

• For FEMA issues: Engage an authorized dealer bank and a FEMA specialist to prepare the compounding application to RBI
• For tax issues: Engage a tax litigation specialist to assess the exposure and prepare the response strategy
• For Companies Act issues: Engage a Company Secretary to file the delayed forms and apply for condonation of delay with the ROC

Step 3: File Remediation Applications (Day 7-30)

• RBI compounding: File Form FC-GPR/FLA Return belatedly and simultaneously submit a compounding application under FEMA Section 15. The RBI typically processes compounding applications within 60-90 days.
• ROC condonation: File delayed annual returns (MGT-7, AOC-4) with additional fees (INR 100/day of delay) and apply for condonation through the MCA portal.
• Tax compliance: File revised returns if within the time limit (Section 139(5) allows revision within 12 months from the end of the assessment year), or prepare for assessment proceedings.

Step 4: Implement Controls (Day 15-60)

Address the root cause to prevent recurrence:

• Set up a compliance calendar with automated reminders for all regulatory deadlines
• Appoint a dedicated compliance officer or engage an annual compliance service provider
• Implement maker-checker controls for related party transactions
• Establish a quarterly internal audit review process

Step 5: Report to Parent Company (Day 7-14)

Prepare a board-level report for the parent company covering:

• Nature and cause of the non-compliance
• Financial exposure (penalties, additional tax, interest)
• Remediation steps taken and timeline for resolution
• Controls implemented to prevent recurrence
• Impact on the consolidated audit report

Penalty Framework Summary

Impact on the Parent Company's Consolidated Audit

For foreign-owned subsidiaries, audit qualifications have a direct upstream effect. The parent company's group auditor — whether it is a Big 4 firm or a regional audit network — must evaluate every subsidiary's audit report when forming an opinion on the consolidated financial statements.

Consolidation Implications

• Qualified subsidiary opinion: If the Indian subsidiary's statutory auditor has issued a qualified opinion, the group auditor must assess whether the qualification is material to the consolidated financial statements. If it is, the group auditor will include a corresponding qualification or an "Emphasis of Matter" paragraph in the consolidated audit report.
• CARO cross-referencing: Under CARO 2020 Clause (xxi), the parent company's auditor must specifically report all qualifications and adverse remarks from subsidiary auditors' CARO reports, including the paragraph numbers and the nature of each qualification. This means every CARO issue at the Indian subsidiary level is documented in the group-level report.
• Management letter findings: Even issues that do not rise to the level of a formal qualification — management letter observations, internal control weaknesses, and process deficiencies — will typically be communicated to the parent company's audit committee. For subsidiaries of US-listed companies subject to SOX 404, these observations can trigger additional work on the assessment of internal controls over financial reporting.

Practical Consequences at the Parent Level

The cascade effect can be significant. A qualified opinion at the Indian subsidiary level can lead to:

• Additional questions from the parent's board and audit committee requiring management explanations
• Increased audit fees as the group auditor performs additional procedures to assess the impact
• Disclosure in the parent company's annual report, visible to shareholders and investors
• Rating agency scrutiny if the qualification relates to financial misstatement or going concern issues
• For subsidiaries of listed companies, potential securities regulator inquiries (SEC, FCA, etc.)

Prevention: Building a Compliance-First Culture

The most effective approach is preventing audit qualifications before they occur. Foreign subsidiaries should implement these structural controls:

• Monthly compliance tracker: A dashboard tracking every regulatory deadline — GST returns (monthly by the 20th), TDS deposits (monthly by the 7th), advance tax installments (quarterly), board meetings (quarterly, gap not exceeding 120 days), and annual filings. Assign specific ownership for each obligation.
• Quarterly internal reviews: Conduct a quarterly compliance health check covering FEMA compliance (FC-GPR status, FLA Return preparation, ECB conditions), Companies Act compliance (board meeting minutes, register maintenance, charge creation), and tax compliance (advance tax payments, TDS reconciliation, GST input credit matching).
• Pre-audit preparation: Begin audit preparation 60 days before the auditor arrives. Reconcile all intercompany balances, prepare related party transaction registers, compile transfer pricing documentation, and ensure all statutory registers are updated. A well-prepared subsidiary reduces audit time, cost, and the probability of surprises.
• Auditor relationship management: Establish an open line of communication with the statutory auditor. When issues arise during the year (a missed deadline, a pricing question, a transaction structure concern), raise them proactively rather than waiting for the audit. Auditors are far more likely to accept a remediated issue than an unaddressed one.

Key Takeaways

• Act within 72 hours: The moment your auditor signals a potential qualification, engage specialists immediately. Early remediation (filing delayed forms, applying for compounding) dramatically reduces penalties and reputational damage.
• Know the escalation hierarchy: A qualified opinion stays in the audit report. A CARO adverse remark feeds into the parent's consolidated report. A Section 143(12) fraud report goes directly to the Central Government via Form ADT-4.
• FEMA issues are the highest risk: For foreign subsidiaries, FEMA-related qualifications (late FC-GPR, pricing violations, FLA Return delays) carry the most severe consequences — penalties up to 3x the amount involved and potential impact on future investment approvals.
• Prevention costs less than cure: A comprehensive FEMA and RBI compliance program with quarterly reviews typically costs INR 2-5 lakh annually. A single compounding application can cost INR 5-50 lakh in penalties alone, plus professional fees.
• Director disqualification is real: If ROC filings are overdue for 3+ consecutive years, directors face disqualification under Section 164(2) — a 5-year ban from serving on any company board. For foreign-appointed directors, this effectively removes the parent company's governance representation.