Internal Auditor's Checklist for India Subsidiary Oversight

Why Internal Audit Is Non-Negotiable for India Subsidiaries

Section 138 of the Companies Act 2013, read with rule 13 of the Companies (Accounts) Rules, 2014, mandates the appointment of an internal auditor or a firm of internal auditors. For a private company — which most foreign subsidiaries are — rule 13(1)(c) has only two triggers: turnover of INR 200 crore or more during the preceding financial year, or outstanding loans or borrowings from banks or public financial institutions exceeding INR 100 crore at any point during the preceding financial year. There is no paid-up capital test for private companies; the INR 50 crore paid-up capital and INR 25 crore deposits triggers in rule 13(1)(b) apply to unlisted public companies, and every listed company is caught under rule 13(1)(a). Check which limb your subsidiary actually falls under before assuming it is in or out. This checklist is organised into nine audit domains, each with specific verification points, and follows the Global Internal Audit Standards released by the Institute of Internal Auditors on 9 January 2024 and effective from 9 January 2025.

Even below those thresholds, best practice dictates quarterly internal audits as part of the parent company's group governance framework, because foreign-owned subsidiaries must comply with at least seven distinct compliance frameworks simultaneously: the Companies Act 2013, FEMA, Income Tax Act, GST laws, labour laws, transfer pricing regulations, and sector-specific licenses — and a single missed filing can cascade into penalties across multiple regulators. The red flags in subsidiary financial statements that headquarters often miss are precisely the issues a well-structured internal audit catches early.

Audit Planning: Scope, Frequency, and Risk Assessment

Before diving into the checklist, establish the audit scope and risk priorities. For an India subsidiary, the risk assessment should weight FEMA and transfer pricing compliance higher than operational controls, because the financial exposure from regulatory penalties in these areas can exceed the subsidiary's annual profit. Assign a risk rating (high, medium, low) to each of the nine domains below based on the subsidiary's specific profile — a technology services subsidiary has different risk concentrations than a manufacturing unit.

The audit cycle should align with the parent company's reporting calendar. Quarterly audits of high-risk areas (FEMA, transfer pricing, TDS) and semi-annual reviews of lower-risk domains (labour law, operational compliance) provide adequate coverage without overburdening the subsidiary's finance team. Ensure the internal audit charter, signed by the Board, grants the auditor unrestricted access to all records, personnel, and premises.

Domain 1: Entity Governance and Corporate Compliance

Board and Shareholder Meetings

• Verify that the Board meets at least four times per year with a maximum gap of 120 days between meetings, as required under Section 173 of the Companies Act
• Confirm that at least one director satisfies the resident director test in section 149(3) — a stay in India of at least 182 days during the financial year. This is a residence test, not an attendance test; check it against passport records, and check meeting quorum separately under section 174 (one-third of total strength or two directors, whichever is higher)
• Check that the Annual General Meeting (AGM) was held within 6 months of the financial year-end (i.e., by September 30)
• Review minutes of Board meetings for proper documentation of all related-party transactions, including intercompany loans, service agreements, and management fees
• Verify that the company secretary (if applicable) has maintained all statutory registers: register of members, register of directors, register of charges, and register of contracts

ROC Filings

• Confirm timely filing of AOC-4 (financial statements) and MGT-7 (annual return) with the Registrar of Companies within 30 and 60 days of the AGM respectively
• Verify filing of MGT-14 within 30 days for every special resolution passed. Confirm separately whether any board resolution the company passed required an MGT-14 filing — the answer differs between private and public companies, so establish the position for your entity type rather than filing or skipping by default
• Check that DIR-3 KYC has been filed by all directors as required — filed once every three financial years by 30 June (annual filing by 30 September was the rule until FY 2025-26, replaced by G.S.R. 943(E) effective 31 March 2026) — including foreign directors, and that fresh KYC was filed promptly for any director whose mobile, email, or other particulars changed
• Review any pending MCA compliance notices or adjudication orders

Domain 2: FEMA and RBI Compliance

Foreign Investment Reporting

• Verify that Form FC-GPR was filed within 30 days of allotment for all equity issued to foreign investors during the year
• Confirm that the FLA return was filed on the RBI FLAIR portal by July 15
• Check that the Single Master Form (SMF) on the FIRMS portal is current and reflects all foreign investment transactions
• Review the share pricing for any fresh equity issuance to foreign investors. Under the pricing guidelines in the Non-Debt Instruments Rules, 2019 the price of unlisted equity instruments must be not less than a valuation done as per any internationally accepted pricing methodology on an arm's length basis, duly certified by a Chartered Accountant, a SEBI-registered Merchant Banker or a practising Cost Accountant. DCF is no longer prescribed as the only method, and the certifier is not a "SEBI-registered valuer" — check the certificate names one of the three permitted certifiers. A separate registered-valuer report may be needed under section 62(1)(c) of the Companies Act for a preferential allotment

ECB and Cross-Border Lending

• For any External Commercial Borrowing, verify that a Loan Registration Number was obtained before the first drawdown by filing Form ECB through the designated AD Category-I bank, and that a revised Form ECB was filed for any change in the reported parameters
• Confirm ECB-2 returns are filed within 7 calendar days from the end of the month in which drawdown or debt servicing occurred, through the designated AD Category-I bank (a monthly return under the revised ECB framework, FEMA 3(R)(5)/2026-RB, effective 16 Feb 2026)
• Check the all-in cost (interest plus fees): for ECB with average maturity of 3 years or more, the all-in-cost ceiling has been removed and cost must be in line with prevailing market conditions; for ECB with average maturity under 3 years, the Trade Credit ceiling applies (benchmark + 300 bps foreign currency / + 250 bps rupee)
• Verify end-use of ECB proceeds against the stated purpose in the loan agreement — obtain an end-use certificate from management
• Confirm that every cross-border remittance was routed through the AD Category-I bank against the correct purpose code and supporting documentation, and that the tax-side paperwork matches — Form 145 (formerly Form 15CA) for the remittance, and Form 146 (formerly Form 15CB) where Part C applies, that is a taxable remittance exceeding INR 5 lakh made without an assessing officer's certificate

Downstream Investment

• If the subsidiary has made any downstream investments, verify compliance with the FDI sectoral caps and route requirements for the downstream entity's sector
• Confirm that downstream investment reporting was filed within 30 days on the FIRMS portal

Domain 3: Transfer Pricing and Intercompany Transactions

Documentation Review

• Verify that a transfer pricing study has been prepared contemporaneously for all international transactions with associated enterprises
• Check that the benchmarking analysis uses current-year comparable data (not stale data from prior years)
• Confirm that Form 48 (formerly Form 3CEB) (transfer pricing audit report) was filed by October 31 of the assessment year
• Review whether the aggregate value of international transactions exceeds INR 1 crore, triggering mandatory documentation

Intercompany Agreement Review

• Verify that written agreements exist for all intercompany transactions: management services, IT services, shared costs, royalties, technical fees, and loans
• Check that intercompany pricing is consistent with the transfer pricing policy and benchmarking analysis
• Review management fee or cost allocation charges — confirm they pass the benefit test (i.e., the Indian subsidiary receives tangible benefits from the services)
• For intercompany loans, verify the interest rate against the arm's length benchmark and the ECB all-in cost ceiling
• Confirm that no shareholder activity charges (costs that benefit the parent as a shareholder rather than the subsidiary as a service recipient) are being allocated to the Indian entity

Domain 4: Direct Tax Compliance

Corporate Tax

• Verify that advance tax installments were paid by the quarterly deadlines: June 15 (15%), September 15 (45%), December 15 (75%), March 15 (100%)
• Review the corporate tax computation for correct application of the applicable rate. The concessional regime for domestic companies is 22% under section 200 read with section 205(1) of the Income-tax Act, 2025 (section 115BAA of the Income-tax Act, 1961) — an effective 25.17% once the 10% surcharge and 4% cess are applied — and it comes at the cost of the listed exemptions and deductions. Outside that regime the ordinary domestic-company rate applies (25% where turnover does not exceed INR 400 crore in the prescribed base year, otherwise 30%), plus surcharge and cess. Confirm which regime the company has validly opted into, and that the option has not been withdrawn
• Check that MAT (Minimum Alternate Tax) credit from prior years is being tracked and utilized where the subsidiary has opted for the old regime
• Verify that the income tax return was filed by the due date (November 30 for companies requiring TP audit, October 31 for other tax-audit companies)

TDS Compliance

• Reconcile TDS deducted with amounts deposited with the government — match Form 168 (formerly Form 26AS) / AIS with the company's TDS ledger
• Verify TDS on payments to non-residents under section 393(2) of the Income-tax Act, 2025 (Table, Sl. No. 17; section 195 of the Income-tax Act, 1961), including management fees, royalties, technical service fees and interest on intercompany loans, and check that any lower or nil deduction relies on a valid certificate under section 395(2)
• Confirm that Form 145 (formerly Form 15CA) was filed for every remittance to a non-resident, and that Form 146 (formerly Form 15CB) was obtained where Part C applies — a taxable remittance exceeding INR 5 lakh made without an assessing officer's certificate
• Check TDS on domestic payments: salaries (Section 392 of the Income-tax Act, 2025 (section 192 of the Income-tax Act, 1961)), contractor payments (section 393(1) of the Income-tax Act, 2025 (Table, Sl. No. 6(i)/(ii)(a)/(iii); section 194C of the Income-tax Act, 1961)), professional fees (section 393(1) of the Income-tax Act, 2025 (Table, Sl. No. 6(iii); section 194J of the Income-tax Act, 1961)), and rent (section 393(1) of the Income-tax Act, 2025 (Table; section 194-I of the Income-tax Act, 1961))
• Verify timely filing of quarterly TDS returns (Form 138 (formerly Form 24Q) for salaries, Form 140 (formerly Form 26Q) for non-salary payments, Form 144 (formerly Form 27Q) for non-resident payments)

Domain 5: GST Compliance

• Verify that GST registration is active and covers all applicable states where the subsidiary has a place of business or supply
• Reconcile GSTR-1 (outward supplies) with the books of accounts — check for any invoices missing from the returns
• Match Input Tax Credit claimed in GSTR-3B against the auto-populated GSTR-2B. There is no tolerance band: credit is available only to the extent the supplier's invoice is reflected, since the 5% provisional-credit cushion in rule 36(4) was withdrawn with effect from 1 January 2022. Investigate every mismatch, in both directions
• Verify that GST on import of services from the parent company is paid under the reverse charge mechanism, in cash rather than by using ITC, with the GSTR-3B for the period (due the 20th of the following month for monthly filers; the 22nd or 24th for QRMP filers depending on the state)
• Check that e-invoicing is operational for all B2B supplies (mandatory for companies with aggregate turnover exceeding INR 5 crore)
• Review any GST demand notices or show-cause notices received during the audit period
• Confirm filing of the annual return (GSTR-9, mandatory above INR 2 crore aggregate turnover) and the self-certified reconciliation statement (GSTR-9C, mandatory above INR 5 crore) by 31 December following the financial year

Domain 6: Labour Law and Payroll Compliance

• Verify EPF (Employee Provident Fund) contributions: employer at 12% and employee at 12% of basic salary plus DA, deposited by the 15th of each month
• Check ESI (Employee State Insurance) contributions for all employees with wages up to INR 21,000 per month: employer at 3.25% and employee at 0.75%
• Confirm Professional Tax deductions and deposits according to the applicable state's schedule (varies by state — for example, Maharashtra has a maximum of INR 2,500 per annum)
• Review compliance with the Sexual Harassment of Women at Workplace Act: verify that an Internal Complaints Committee is constituted and an annual return is filed
• Verify that Form 130 (formerly Form 16) (TDS certificates for salaries) was issued to all employees by June 15
• Check that employment agreements cover notice period, confidentiality and IP assignment. Flag any post-termination non-compete clause the parent has imported from its home-country template: section 27 of the Indian Contract Act, 1872 makes an agreement in restraint of trade void, and Indian courts do not enforce post-employment non-competes — relying on one is a control weakness, not a control

Domain 7: Financial Controls and Reporting

Accounting Standards Compliance

• Confirm the correct accounting framework: Ind AS applies to unlisted companies with net worth of INR 250 crore or more, and to the holding, subsidiary, joint venture and associate companies of any company already applying Ind AS; other companies follow the Accounting Standards under the Companies (Accounting Standards) Rules, 2021. Check the group-membership limb, not just the net worth figure
• Review related-party transaction disclosures under Ind AS 24 — all transactions with the parent, fellow subsidiaries, and key management personnel must be disclosed
• Verify that the subsidiary prepares Ind AS-adjusted financial information for consolidation by the foreign parent, especially where the parent reports under IFRS or US GAAP

Bank Reconciliation and Cash Controls

• Perform bank reconciliation for all accounts, including INR and foreign currency accounts
• Review any large or unusual transactions, especially inter-company transfers within 30 days of the financial year-end
• Confirm that authorized signatories for bank accounts are current and align with the latest board resolution
• Verify that the subsidiary maintains sufficient documentary evidence for all repatriation of dividends, including the board resolution, tax clearance, and FIRC (Foreign Inward Remittance Certificate)

Domain 8: Data Protection and IT Controls

• Verify compliance with the Digital Personal Data Protection Act, 2023, particularly for cross-border data transfers of employee and customer personal data to the parent company's servers
• Review the IT General Controls (ITGC) framework: access management, change management, backup and recovery procedures, and segregation of duties in ERP systems
• Confirm that the subsidiary has a documented data breach notification procedure aligned with both Indian requirements and the parent company's global incident response protocol
• Check that software licenses are current and properly documented — unlicensed software exposes the subsidiary to litigation under the Copyright Act

Domain 9: Sector-Specific and Operational Compliance

• Review compliance with sector-specific licenses: STPI/SEZ registration, FSSAI license (food), drug manufacturing license, telecom license, or any other sector-specific approvals
• Verify that the Import-Export Code (IEC) is active if the subsidiary engages in international trade
• Review environmental clearances and pollution control board compliance if the subsidiary operates manufacturing facilities
• Verify compliance with Shop and Establishment Act registration in each state where the subsidiary has offices

Audit Reporting: Communicating Findings to Headquarters

The internal audit report for a foreign-owned India subsidiary should be structured for two audiences: the local Board of Directors and the parent company's group audit committee or CFO. Best practices include:

• Executive summary: One-page overview of critical findings, risk rating (high/medium/low), and estimated financial exposure
• Compliance scorecard: RAG (Red-Amber-Green) status for each of the nine audit domains
• Finding detail: For each finding, include the regulatory reference, observation, risk impact, root cause, and recommended remediation with a timeline
• Management response: Include management's agreed action plan and responsible owner for each finding
• Trend analysis: Compare current audit findings against prior audits to identify recurring issues or improvements

For subsidiaries that need help establishing a robust internal audit framework or addressing compliance gaps, our annual compliance services and tax advisory team can provide end-to-end support.

Key Takeaways

• Under section 138 read with rule 13, internal audit is mandatory for a private company only on turnover of INR 200 crore or more, or bank or public financial institution borrowings exceeding INR 100 crore — there is no paid-up capital trigger for private companies; the INR 50 crore capital and INR 25 crore deposits limbs apply to unlisted public companies
• FEMA compliance (FC-GPR, FLA return, ECB reporting) is the highest-risk domain because penalties can reach 3x the transaction amount
• Transfer pricing documentation must be prepared contemporaneously — a retrospective study will not withstand scrutiny during a tax audit
• Reconcile ITC claimed in GSTR-3B against GSTR-2B monthly to avoid GST mismatches that trigger automated notices
• Structure the audit report with both local Board and headquarters audiences in mind, using a compliance scorecard for quick executive review