Governance and controls assurance: what changes when a company lists.
Before listing, a control gap is a management problem. After listing, it is a disclosure, a certificate, an audit committee minute and a share price. What governance and controls assurance means, and what it changes for companies preparing to list, newly listed SME companies, main board companies and unlisted companies near the Section 138 thresholds.
1. A gap acquires a price.
In an unlisted company a control failure is expensive but private. The books are corrected and life continues. On the day the company lists, the same failure becomes a disclosure to the exchange, a certificate the CEO and CFO must sign, an audit committee minute and, if it is large enough, a number on the screen the next morning.
Three Ahmedabad companies show this better than any regulation.
Gensol Engineering: SEBI's interim order of 15 April 2025 found Rs 262.13 crore of term loans unaccounted for and lender "conduct letters" the lenders had not issued. From its 52-week high of Rs 1,125.75 the stock closed at Rs 123.65 on 16 April 2025, down 89 per cent.
Mishtann Foods: found on 5 December 2024 to have booked Rs 2,662.25 crore of sales with around sixteen group entities, Rs 96.92 crore diverted. Two lower circuits followed: 36 per cent gone in two sessions.
Seacoast Shipping Services: Rs 243.15 crore of fictitious FY21 sales; disgorgement of Rs 47.89 crore ordered on 30 September 2025.
None of the three failed on listing day. The controls had been missing for years. Listing did not create the gap; it priced it.
Before listing, a weak control is a cost. After listing, it is a disclosure, a certificate, a committee minute and a share price, in that order and usually within a week.
2. Why "audit" is the wrong frame.
Most promoters hear "internal audit" and think of a ritual: vouchers sampled, observations written, the report filed under Section 138 and never read twice. What a listed company actually needs is assurance to its board that governance and controls are designed properly and are operating, evidenced well enough to sign on. The law already describes this.
Section 134(5)(e) of the Companies Act, 2013 requires the directors of a listed company to state that internal financial controls are adequate and operating. Section 143(3)(i) requires the statutory auditor of every public company to opine on them. Regulation 17(8) of the SEBI LODR Regulations requires the CEO and CFO to certify that they have evaluated internal controls and disclosed deficiencies. Regulation 18 requires the audit committee to review the adequacy and coverage of internal audit. CARO 2020 clause (xiv) asks whether the internal audit system is commensurate with the business.
Together these describe one continuing, evidenced assurance that governance and controls work, reported to the people who sign. "Governance and controls assurance" is the honest name for it. Internal audit is the method; assurance to the board is the product.
3. Companies preparing to list.
Most obligations arrive before listing. Conversion to a public limited company removes the private company exemption from Section 143(3)(i); from that year the statutory auditor opines on internal financial controls, and an adverse opinion becomes a risk factor in the offer document.
SEBI's ICDR amendment of 3 March 2025 requires the lead manager of an SME issue to annex a site visit report, caps general corporate purposes at 15 per cent of the issue or Rs 10 crore, bars repayment of promoter loans from the proceeds and requires a monitoring agency above Rs 50 crore. Each is a control someone will test; better tested by the company first.
Section 138 applies from listing day without threshold, and the audit committee must set the scope of internal audit. A company that has never had an internal auditor cannot do this credibly in its first quarter. Start the controls work at least two closed quarters before the RHP: a gap assessment, a risk control matrix for the four or five processes that carry revenue and cash, one cycle of testing, remediation.
4. Newly listed SME companies.
Prime Database counts 254 SME IPOs raising Rs 10,944 crore in FY26, up from 196 and Rs 5,767 crore in FY24; Gujarat led with 31 SME listings in the first half of FY26. SEBI's consultation paper of 19 November 2024 reported that among the top fifty SME-listed companies in FY23, one in two had related party transactions above Rs 10 crore or 10 per cent of turnover, and forty SME stocks stood suspended. The pattern named was diversion of proceeds to promoter shells and circular trades among related parties.
The orders have followed. Debock Industries and Varanium Cloud received seven-year bans in August 2026 for inflated sales and diverted proceeds. Kore Digital's migration to the main board was blocked by SEBI's interim order of 18 September 2026 over Rs 541.30 crore of misstated revenue. In Synoptics Technologies, SEBI barred the merchant banker and put twenty other SME IPOs under review.
One rule change matters more than the orders. From 1 April 2025, Regulation 23 on related party transactions applies to any SME-listed entity with paid-up capital above Rs 10 crore or net worth above Rs 25 crore, with materiality at Rs 50 crore or 10 per cent of turnover, whichever is lower. Given SEBI's own data, this is the largest new control obligation most SME companies face.
For a newly listed SME company, assurance means an internal auditor with a scope set by the audit committee, a related party register tested against Regulation 23 every quarter, proceeds tracked against the prospectus objects, and evidence behind every statement of deviation filed with the exchange.
5. Companies already on the main board.
What has changed here is speed and the absence of discretion. Since the 2023 amendment to Regulation 30, material events are disclosed within 12 to 24 hours. Fraud or default by the entity, its promoter, director or KMP is disclosable without any materiality test. So is the start of a forensic audit.
IndusInd Bank disclosed on 10 March 2025 an internal accounting discrepancy on forex derivatives of about Rs 1,529 crore. The stock fell 27.17 per cent the next session. SEBI's order of 28 May 2025 recorded that senior management had known for around fifteen months. The market did not punish the accounting error; it punished the fifteen months.
The question is not whether an internal auditor exists, but whether internal audit reaches the areas where a Regulation 30 event could originate, whether findings escalate in days rather than quarters, and whether the evidence behind the IFC statement would survive a regulator reading it afterwards.
6. Unlisted companies approaching the thresholds.
Rule 13 of the Companies (Accounts) Rules, 2014 requires an internal auditor for every private company with turnover of Rs 200 crore or more or bank borrowings above Rs 100 crore at any point in the year, and for unlisted public companies at those limits or at Rs 50 crore paid-up capital or Rs 25 crore deposits. The test is on the preceding financial year: cross in FY 2025-26, appoint for FY 2026-27.
Two provisions bite earlier. Section 143(3)(i) applies to a private company from Rs 50 crore turnover or Rs 25 crore borrowings, and CARO clause (xiv) asks whether an internal audit system exists; a "no" appears in the report every lender reads. The choice is between a minimal appointment that satisfies the section and an assurance process that also prepares the company for the lender diligence, the term sheet or the DRHP that a Rs 200 crore company in Gujarat often faces within three years.
7. What the assurance consists of.
Four components, each of which a board can ask for by name.
A control architecture: controls documented so the directors can sign Section 134(5)(e) and the CFO can sign Regulation 17(8) on evidence rather than comfort.
Standard operating procedures and a risk control matrix: for each significant process, who does what, which risk each step addresses, and how the control is tested.
Continuous monitoring and reporting: full-population testing every quarter, observations rated, management responses recorded, an open items register the committee sees age.
Process improvement: the by-product of the first three. Once a process is documented and its exceptions measured, the waste in it can be priced.
The orders of the last two years read like a list of what happens when one of the four is missing: Gensol had no reconciliation of loan end-use to assets; Mishtann had no counterparty diligence; IndusInd's known finding did not escalate.
Sources: Companies Act, 2013, ss.134, 138, 143, 144; Companies (Accounts) Rules, 2014, Rule 13; MCA notification GSR 583(E) of 13 June 2017; CARO 2020; SEBI (LODR) Regulations, 2015, Regs 15, 17, 18, 23, 30, Schedules II and III, as amended 27 March 2025; SEBI (ICDR) (Amendment) Regulations, 2025; SEBI consultation paper on the SME IPO framework, 19 November 2024; SEBI orders in Gensol Engineering, Mishtann Foods, Seacoast Shipping Services, Debock Industries, Varanium Cloud, Kore Digital, Synoptics Technologies and IndusInd Bank on the dates stated; Prime Database IPO statistics. Share price movements as reported by Business Standard, Business Today and Upstox; the Gensol and Mishtann percentages are computed from the prices those reports cite.
This article is general in nature and does not constitute professional advice. Readers should seek specific advice before acting on any matter described here.
This website is meant for information purposes only. The contents are made available on a pull basis and are not intended to solicit work or advertise.
Frequently asked
Does Section 138 apply to a company listed only on an SME platform?
Yes, without threshold. The SME relaxations in Regulation 15(2) of the LODR concern Regulations 17 to 27, and from 1 April 2025 Regulation 23 applies to SME-listed entities above Rs 10 crore paid-up capital or Rs 25 crore net worth.
Can the statutory auditor also act as internal auditor?
No. Section 144 of the Companies Act, 2013 bars the statutory auditor from providing internal audit services to the company it audits.
