पाठशाला Pathshala · संचालन Sanchālan, Operations · Lesson 18 · Build

The first statutory audit and how to make it painless

A company with twelve clean monthly closes finishes its audit in weeks; one without takes months and finds things. Work back from the AGM, hand the auditor a complete file, and know which reports apply to you.

Pathshala, The Founder Library · 11 October 2026 · 8 min read

A yellow tape measure lying on a dark surface under bright light. — Photograph: Lucent Designs Media International · Pexels

An audit is painful in proportion to what has been left for it to find. A company that closed its books properly every month hands the auditor a folder and gets its report in weeks. A company that did not spends the summer reconstructing a year, and the auditor finds things the founders did not know.

This lesson sets out what the statutory audit is and the dates it must meet, a timetable worked back from the annual general meeting, the file the auditor will ask for, which of the audit’s special reports apply to a startup, the findings that embarrass and how to prevent each, and a year-round habit that turns the audit into a formality.

What the audit is, and the dates it must meet

Every company in India, whatever its size, has its annual financial statements audited by an independent chartered accountant, who reports to the shareholders whether the accounts give a true and fair view. The first auditor is appointed by the board within thirty days of incorporation, as the [bookkeeping lesson](/library/bookkeeping-from-day-one) explains. The deadline that matters comes from the AGM, at which the shareholders receive the audited accounts. Under section 96 of the Companies Act the first AGM must be held within nine months of the close of the first financial year, and each later AGM within six months of the close of the year, with no more than fifteen months between two AGMs. The Registrar may extend the deadline by up to three months for a special reason, but not for the first AGM. For a year ending 31 March the usual deadline is therefore 30 September. After the AGM the accounts and the annual return are filed with the Registrar on forms AOC-4 and MGT-7, each within its own deadline; the [compliance calendar](/library/compliance-calendar-private-limited-company) sets out the dates.

How long the audit takes depends almost entirely on the books. Treelife’s month-end checklist observes that a startup with twelve months of clean, locked, reconciled closes, with schedules supporting every balance-sheet account, can complete a statutory audit in three to four weeks, while one with inconsistent closes can take three to four months. Three or four months is the difference between an AGM in July and an extension request in September.

Work backwards from the AGM

Plan the audit as a sequence of four blocks laid end to end from 1 April. Close the year: the March close plus the year-end entries such as depreciation, provisions, the deferred revenue roll-forward, the ESOP charge and the tax provision. Fieldwork: the auditor tests balances and transactions. Queries and adjustments: the auditor’s questions are answered and agreed adjustments are posted. Board approval and signing: the board approves the accounts, the auditor signs, and the AGM notice goes out. Agree the auditor’s dates in February, before the year ends, because good audit firms are busiest from June to September and a company that asks in July gets August.

Push the close to fourteen weeks and the queries to six, which is what a company without monthly closes can expect, and the deadline passes before the accounts are ready. Bring the close down to two weeks and the company is ready for its AGM by the first days of July with the rest of the summer to spare. The fieldwork block barely moves either way. The time is lost before the auditor arrives and after their questions start.

The auditor’s list, and how to work through it

Auditors call it the PBC list, for prepared by client, and its contents are predictable. Hand it over complete on the first day of fieldwork, in one shared folder with an index. The ledger: the closed trial balance, the general ledger and the audit trail export from the accounting software. Bank: reconciliations for every account at 31 March and the bank confirmations. Every balance-sheet line with a schedule that ties: fixed-asset register with additions and depreciation, receivables ageing with any customer over ninety days named, payables ageing with micro and small enterprise dues flagged, advances, deposits, prepaid expenses, accruals and provisions. Revenue: the revenue recognition schedule and the deferred revenue roll-forward, with the larger contracts available. Tax: GST returns reconciled to the sales and purchase registers, input credit reconciled to GSTR-2B, TDS returns reconciled to the ledger and to Form 26AS, and the tax computation. Payroll: salary registers, PF and ESIC challans, ESOP grant records and the valuation behind the charge. Equity: every share allotment with its board resolution, valuation report and filing. Governance: board and shareholder minutes, the related-party list with transactions, contingent liabilities, litigation, and the list of legal notices received.

Piles of aged brown paper envelopes stacked closely together. — The auditor’s list is predictable. A company that files each month’s papers as it goes hands it over on the first morning. Photograph: serdar barış · Pexels

Keep the auditor independent of the bookkeeper, and say so to investors before they ask. Sign an engagement letter in January or February with the timetable, the PBC list, the names of who does what and the date the signed report is due. Name one person in the company who owns the audit and answers every query; queries sent to five people get five answers. Keep a shared query log with an owner and a due date on every line, and review it twice a week during fieldwork. Ask the auditor to raise proposed adjustments as they find them rather than at the end, and to share a draft management letter before the board meeting, so that nothing in the signed report is a surprise to the board. At the end the company signs a management representation letter; read it, because it is the founders confirming in writing that everything material has been disclosed.

Which reports apply to you: CARO, internal controls and the audit trail

Beyond the opinion on the accounts, the auditor may have to report on three further matters, and whether each applies depends on the company. The small-company test decides much of it. Since 1 December 2025 a company is a small company if its paid-up capital does not exceed ₹10 crore and its turnover does not exceed ₹100 crore, as Taxmann’s summary of the amendment sets out, but holding companies, subsidiaries, section 8 companies and companies under a special Act are excluded whatever their size, as DPNC’s note records. A startup with an Indian subsidiary, or one that is the Indian subsidiary of an overseas parent, is not a small company.

CARO 2020, the Companies (Auditor’s Report) Order, adds a long list of specific matters to the audit report. It does not apply to small companies or one person companies, nor, as TaxGuru’s note sets out, to a private company that is not a holding or subsidiary of a public company, whose paid-up capital and reserves do not exceed ₹1 crore, whose bank and institutional borrowings never exceed ₹1 crore in the year, and whose revenue does not exceed ₹10 crore. Internal financial controls: the auditor need not report on them for a small company or for a private company with turnover under ₹50 crore or borrowings under ₹25 crore that has filed its returns on time; the [controls lesson](/library/internal-controls-and-fraud-you-did-not-expect) explains why that makes them the founders’ job. The audit trail: every company’s auditor must report whether the accounting software recorded an audit trail of every transaction through the year and whether it was tampered with, a requirement in force for years beginning on or after 1 April 2023 and explained in the ICAI’s journal. A company that switched software mid-year, or kept part of its books in a spreadsheet, will find this paragraph in its report.

Audits are not passed in August. They are passed in the twelve monthly closes before it.

The findings that embarrass, and how to prevent each

The same handful of findings appears in first audits again and again, and each has a monthly cure. Bank balances that do not reconcile: reconcile every account every month to zero difference. Revenue recognised on invoice for annual plans: keep the deferred revenue schedule from the first annual contract. ESOPs granted but never expensed: record the charge from the grant date using the valuation the grants were priced on. Share allotments with missing filings or valuation reports: keep the equity file complete as each round closes. GST and TDS that do not agree with the books: reconcile monthly, not annually. Dues to micro and small vendors paid late: flag them at each close; the [bookkeeping lesson](/library/bookkeeping-from-day-one) explains the tax rule that makes late payment expensive. Founder expenses without documents: stop paying company costs from personal accounts. Cut-off errors: accrue March’s bills in March. None of these is serious if found by the company in the month it happens. Each becomes a qualification or an awkward note if found by the auditor a year later.

A worked first audit

An illustrative Kochi software company, incorporated in May 2025, reaches the end of its first financial year on 31 March 2026 with twenty people, ₹3 crore of revenue and an Indian subsidiary set up for a hardware line. Because it holds a subsidiary it is not a small company; its revenue under ₹10 crore and its lack of borrowing keep it outside CARO, and its turnover keeps it outside internal-controls reporting. Its first AGM must be held by 31 December 2026. It has closed every month since June in five working days. The March close and year-end entries take ten days; the PBC folder goes to the auditor on 20 April against a timetable agreed in February; fieldwork runs three weeks. The auditor raises eleven queries, of which one matters: the ESOP charge for grants made in January had not been recorded. It is posted, the board approves the accounts on 10 June and the AGM is held in July with five months to spare. The audit report carries no qualification and the usual paragraph confirming the audit trail operated through the year.

The year-round audit file

Make the audit a by-product of the month. At every monthly close, save the bank reconciliations, the balance-sheet schedules, the GST and TDS reconciliations and the deferred revenue roll-forward into a folder named for the month. At every allotment, ESOP grant and board meeting, file the resolution and the supporting papers the same week. In January, agree the auditor’s timetable and the PBC list. In March, run a mock year-end on the February books and fix what it finds. By 15 April, close the year. On the first day of fieldwork, hand over the index. After the AGM, write down the three things that slowed this year’s audit and put each into the monthly close. The second audit should take half the time of the first.

Nothing here is legal, tax or investment advice. Thresholds and deadlines are stated as checked on 11 October 2026 and change; your statutory auditor and company secretary confirm which apply to your company.