Secretarial Audit Under Section 204: Complete Guide for Company Secretaries
CS RICHA KUMAR & ASSOCIATES
Secretarial Audit: A Practitioner's Note
Applicability, scope, process, and fraud reporting under Section 204 and CSAS-4
What Secretarial Audit Is
Secretarial Audit is the mechanism for auditing the non-financial aspects of a company — an independent verification of records, books, papers, and documents to check compliance status against applicable statutes, laws, rules, and regulations, and to confirm that adequate systems and processes exist to ensure that compliance going forward. It gives investors, management, regulators, and other stakeholders comfort that the company's affairs are being conducted according to law.
⚠ Only a member of ICSI holding a Certificate of Practice — a Company Secretary in Practice (PCS) — can conduct Secretarial Audit and issue the Secretarial Audit Report, under Section 204(1) of the Companies Act, 2013.
Applicability — Section 204(1)
Read with Rule 9 of the Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014, Secretarial Audit is mandatory for:
Every listed company
Every public company with paid-up share capital of ₹50 crore or more
Every public company with turnover of ₹250 crore or more
Every company with outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more
These thresholds are assessed as on the last date of the latest audited financial statement.
⚠ Important extension: a private company that is a subsidiary of a public company is deemed a public company under Section 2(71), and Secretarial Audit becomes mandatory for it too if it independently meets any of the above thresholds. Companies falling outside these thresholds may still opt for Secretarial Audit voluntarily.
The Listed-Entity Layer — SEBI (LODR) Regulation 24A
Following the Kotak Committee's 2017 recommendations, SEBI extended Secretarial Audit obligations specifically for listed entities and their material unlisted subsidiaries incorporated in India (a "material subsidiary" being one whose income or net worth exceeds 10% of the listed entity's consolidated figures in the preceding year):
Every listed entity and its material unlisted Indian subsidiaries must annex a Secretarial Audit Report to the annual report
Every listed entity must additionally submit an Annual Secretarial Compliance Report to stock exchanges within 60 days of each financial year-end — a separate, SEBI-specific compliance check, distinct from the Section 204 report
⚠ Exemption: Regulation 15(2)(a) exempts a listed entity with paid-up equity capital not exceeding ₹10 crore and net worth not exceeding ₹25 crore as on the last day of the previous financial year — though once these regulations become applicable, they continue to apply until the relevant figures stay below threshold for three consecutive financial years.
The Governing Standard — CSAS-4
The Auditing Standard on Secretarial Audit (CSAS-4), issued by ICSI's Auditing Standards Board, has been mandatory since 1 April 2021 (recommendatory from 1 July 2019). It applies to audits conducted under Section 204 and Regulation 24A specifically — it is not mandatory for the Annual Secretarial Compliance Report or for voluntary secretarial audits (though adherence is still recommended for the latter).
An auditor accepting a Secretarial Audit engagement must also comply with the principles in CSAS-1 (Audit Engagement), CSAS-2 (Audit Process and Documentation), and CSAS-3 (Forming of Opinion) — the four standards work together across the engagement lifecycle.
Scope of Secretarial Audit
Secretarial Audit verifies compliance under a defined set of enactments:
The Companies Act, 2013 and rules made thereunder
The Securities Contracts (Regulation) Act, 1956 and its rules
The Depositories Act, 1996 and its regulations/bye-laws
FEMA, 1999 — specifically to the extent of FDI, ODI, and External Commercial Borrowings
A defined set of SEBI Regulations — SAST, Insider Trading, ICDR, Share Based Employee Benefits, Debt Securities, RTA Regulations, Delisting, Buyback, and LODR
Other laws specifically applicable to the company — e.g., all banking-industry laws for a bank, all petroleum-industry laws for a petroleum company, and so on
Secretarial Standards issued by ICSI, and the company's Listing Agreements, if any
Beyond these, the auditor must also examine and report on:
Whether the Board is duly constituted with a proper balance of Executive, Non-Executive, Independent, and Women Directors
Whether changes in Board composition during the period complied with the Act
Whether adequate notice (at least 7 days) was given for Board meetings, with agenda and notes, and whether a system exists for seeking clarifications before the meeting
Whether majority decisions were carried through with dissenting views properly recorded in the minutes
Whether adequate systems exist, commensurate with the company's size, to monitor compliance with general laws — labour law, competition law, environmental law — not just the enactments listed above
On identifying which laws apply: identifying and segregating applicable laws (industry-specific vs. general) is primarily the auditee's responsibility — the auditor's role is to verify that this identification is appropriate and sufficient, exercising professional judgment, and to seek explanation from management where the segregation looks incomplete or hasn't been done at all.
The Secretarial Audit Process
Appointment — by resolution at a duly convened Board meeting (Rule 8, Companies (Meetings of Board and its Powers) Rules, 2014), consistent with ICSI's Auditing Standards.
Communication to the previous incumbent — mandatory in writing (registered/speed post or a recognised mode) before accepting the engagement, under Clause 8, Part I, First Schedule to the Company Secretaries Act, 1980.
Formal acceptance — a formal appointment letter from the company, accompanied by the Board resolution, with written confirmation of acceptance from the auditor.
Preliminary discussions and survey — understanding the company's business and interacting with relevant personnel before fieldwork begins.
Preliminary meeting — with senior management to agree scope, objectives, timeframe, and gather information on Board processes and existing controls.
Audit plan finalisation — briefing staff on fieldwork responsibilities, preparing detailed checklists for each compliance area.
Testing, interviews, and analysis — fieldwork proper: interviewing staff, reviewing procedure manuals, testing compliance against applicable laws and internal policy, assessing control adequacy.
Working papers — the documentary bridge between the company's records and the auditor's eventual opinion.
Audit summary discussion — findings shared with management for clarification or response before the report is finalised.
Report submission — in Form MR-3, addressed to the members but submitted to the Board, stating the auditor's opinion with or without qualification.
Why It Matters — Beyond the Legal Requirement
It gives promoters assurance that management is conducting affairs within legal bounds
It gives independent/non-executive directors comfort that appropriate compliance mechanisms are actually in place — directly relevant to their own oversight liability
It reduces the regulatory burden by surfacing issues early, before they escalate into formal enforcement action
It gives investors a genuine basis for informed decision-making, based on the company's actual compliance and governance standing
For companies entering joint ventures or foreign collaborations, a clean Secretarial Audit serves as a credible first line of due diligence for a foreign partner assessing legal risk
Detection and Reporting of Fraud — Section 143(12)
A Secretarial Auditor is expected to maintain professional scepticism throughout — a questioning mind, alert to conditions suggesting possible misstatement, whether through error or fraud. Suspicion, for this purpose, must rest on some evidence (even if tentative) — simple speculation isn't sufficient grounds. Signals that might reasonably raise suspicion include recurring negative operating cash flows alongside reported earnings growth, or unusual patterns around a company's stock price or earnings trend.
Where fraud is suspected, the categories most frequently implicated historically include related party transactions, excessive managerial remuneration, insider trading, inter-company transactions, and M&A-linked fraud — the ICSI material references cases from Satyam to IL&FS to Kingfisher Airlines as illustrative patterns, not an exhaustive list.
Reporting obligation is genuinely significant, not discretionary:
Fraud involving ₹1 crore or more must be reported directly to the Central Government
Fraud involving less than ₹1 crore must be reported to the Audit Committee or Board, within 2 days of the auditor becoming aware of it — specifying the nature of the fraud, the approximate amount, and the parties involved
Frauds reported to the Audit Committee/Board (but not the Central Government) must be disclosed in the Board's Report, including remedial action taken
Failure to report attracts a penalty of ₹5 lakh (listed company) or ₹1 lakh (any other company) under Section 143(15). Reporting in good faith is expressly protected — it can never itself be treated as a breach of the auditor's other duties
⚠ Who counts as an "auditor" for this reporting duty: Statutory Auditors, the Company Secretary in Practice conducting Secretarial Audit, the Cost Accountant conducting Cost Audit, and Branch Auditors. Internal auditors and professionals appointed under separate statutes (tax auditors under the Income Tax Act, GST auditors) are NOT covered by this specific Section 143 obligation.
Consequences of Non-Compliance — Section 204(4)
Contravention of Section 204 attracts a penalty of ₹2 lakh on the company, every officer in default, and the Company Secretary in Practice, as applicable
Separately, failure by the PCS to comply with reporting obligations under Section 143 carries penalties of ₹5 lakh (listed company) or ₹1 lakh (any other company)
Fraud itself, under Section 447, is punishable with imprisonment of 6 months to 10 years, plus a fine of 1x to 3x the amount involved — rising to a minimum 3-year term where public interest is involved
Repeated defaults within 3 years of an earlier offence attract double the fine for the subsequent occurrence, under Section 451
Beyond the Companies Act, a PCS remains separately liable for professional misconduct under the Company Secretaries Act, 1980
CS Richa Kumar & Associates
www.csrichakumar.com · richakumar86@gmail.com
This post is for general informational purposes and does not constitute legal advice. For guidance specific to your situation, consult a qualified professional.
← Back to all insights