A statutory audit checks the numbers. A secretarial audit checks everything else — whether the company actually followed the Companies Act, SEBI rules, FEMA and its own governance procedures. For companies above the thresholds, it's mandatory, and only a Practising Company Secretary can sign it.
Applies to: listed companies; public companies above ₹50 cr capital or ₹250 cr turnover; and any company with ₹100 cr+ borrowings.
A growing public company assumes its statutory audit covers it — until a secretarial audit surfaces a string of missed MGT-14 filings, an improperly constituted board, and a registered office that was never verified. None of those are financial, so the statutory auditor never flagged them; all of them are exactly what a secretarial audit exists to catch. For companies crossing the Section 204 thresholds, this isn't optional, and the MR-3 report goes straight into the annual report for shareholders and regulators to read.
BOTTOM LINE
- Applies to: every listed company; every public company with paid-up capital ≥ ₹50 crore or turnover ≥ ₹250 crore; and any company (public or private) with borrowings from banks/PFIs ≥ ₹100 crore.
- Who signs it: only a Practising Company Secretary (PCS) with a valid Certificate of Practice — reported in Form MR-3, annexed to the Board's Report.
- New rule: from 1 April 2025, the secretarial auditor of a listed company must be a peer-reviewed CS.
Who must get a secretarial audit?
Governs this section: Section 204 & Rule 9, Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014
Secretarial audit is mandatory for:
- every listed company (including SME-listed);
- every public company with paid-up share capital ≥ ₹50 crore, or turnover ≥ ₹250 crore; and
- every company (public or private) with outstanding loans/borrowings from banks or public financial institutions ≥ ₹100 crore.
The thresholds are tested on the figures in the latest audited financial statement. Note the third limb: a private company with ₹100 crore+ of bank borrowings is in scope even though it's neither listed nor a large public company.
What the audit covers
Governs this section: Form MR-3 & CSAS-4
The MR-3 report is broad. It examines compliance with the Companies Act, the SCRA and Depositories Act, FEMA (FDI/ODI/ECB), and the SEBI regulations (LODR, SAST, PIT, ICDR, and others), plus the Secretarial Standards and any laws specific to the company's industry. It also reports on whether the board is properly constituted (the balance of executive, non-executive, independent and woman directors) and whether changes were made in compliance. CSAS-4 (the auditing standard, effective April 2020) requires the auditor to identify all "applicable laws" for the specific company.
Who can conduct it — and the peer-review rule
Governs this section: Section 204(1) & SEBI (LODR) Reg. 24A
PRACTITIONER'S NOTE — the 2025 peer-review rule
Only a Company Secretary in Practice — an ICSI member holding a valid Certificate of Practice — can conduct a secretarial audit and sign MR-3. Internal CSs, CAs and CMAs cannot. And under the SEBI (LODR) Third Amendment, from 1 April 2025 the secretarial auditor of a listed company (and its material unlisted subsidiaries) must additionally hold a valid ICSI peer-review certificate. Appointing a non-peer-reviewed CS for a listed company now risks a SEBI compliance issue.
The appointment process
Governs this section: Section 204 & Section 179(3)
The Board appoints the PCS by resolution at a board meeting (on the audit committee's recommendation, where one exists), fixes the remuneration, and files MGT-14 within 30 days. The auditor then examines the company's registers, minutes, filings and policies, and prepares the MR-3 — which must be ready before the Board's Report is approved, since it's annexed to it. Listed companies also file an Annual Secretarial Compliance Report with the stock exchanges within 60 days of year-end.
How it differs from a statutory audit
Governs this section: Section 204 vs Section 139
A statutory audit (Section 139) is a financial audit by a Chartered Accountant, reporting on the truth and fairness of the accounts. A secretarial audit (Section 204) is a governance and legal-compliance audit by a Company Secretary, reporting on whether the company followed the law and its procedures. They're complementary — one checks the books, the other checks the conduct — and where both apply, findings should be aligned.
What does non-compliance cost?
Governs this section: Section 204(4)
PENALTY — Section 204(4)
If the company, any officer in default, or the PCS contravenes Section 204, each is liable to a fine of not less than ₹1 lakh, up to ₹5 lakh. Beyond the fine, the audit's real value is preventive: it catches the missed filing or governance gap before it becomes a regulator's enforcement action.
Common mistakes
- Assuming the statutory audit covers governance. It doesn't — secretarial audit is a separate, non-financial check.
- Missing the ₹100 crore borrowings limb. A private company can be in scope purely on borrowings.
- Appointing a non-PCS (or, for listed companies, a non-peer-reviewed CS). Only a PCS signs MR-3; listed companies need a peer-reviewed one from April 2025.
- Starting the audit too late. MR-3 must be ready before the Board's Report is approved.
- Ignoring qualifications in MR-3. The Board must explain any qualification or adverse remark in its report.
Checklist
- Test applicability against the three limbs (listed / public-company size / ₹100 cr borrowings).
- Appoint a PCS (peer-reviewed, for listed companies) by board resolution; file MGT-14 within 30 days.
- Give the auditor full access to registers, minutes, filings and policies.
- Obtain the MR-3 report before approving the Board's Report; annex it.
- Explain any qualifications/adverse remarks in the Board's Report.
- For listed companies, file the Annual Secretarial Compliance Report within 60 days of year-end.
FAQ
Which companies need a secretarial audit? Listed companies; public companies with ≥ ₹50 crore paid-up capital or ≥ ₹250 crore turnover; and any company with ≥ ₹100 crore borrowings from banks/PFIs.
Who can sign the MR-3 report? Only a Practising Company Secretary with a valid Certificate of Practice — and, for listed companies from April 2025, a peer-reviewed one.
Is secretarial audit the same as the statutory (financial) audit? No. The statutory audit covers the financials (by a CA); the secretarial audit covers legal and governance compliance (by a PCS).
Where does the MR-3 report go? It's annexed to the Board's Report in the annual report.
What's the penalty for non-compliance? A fine of ₹1 lakh to ₹5 lakh on the company, the officer in default, or the PCS, under Section 204(4).
Primary sources
- Section 204, Companies Act, 2013; Rule 9, Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014
- Form MR-3; CSAS-4 (Auditing Standard on Secretarial Audit)
- SEBI (LODR) Regulation 24A; SEBI (LODR) Third Amendment Regulations, 2024 (peer review, eff. 1 April 2025)
Disclaimer: This article is general information on a fast-changing area of company law, current at the time of writing. It is not legal or professional advice for any specific company. Verify the position against the live MCA and SEBI rules and consult your company secretary.