Secretarial audit used to be a quiet annexure to the Board's report. It is not quiet any more. With effect from 1 April 2025, SEBI rebuilt regulation 24A of the Listing Regulations: the secretarial auditor of a listed company is now appointed by the shareholders, holds office for a fixed term, must hold a valid peer review certificate, and is barred from a list of other services. Separately, a limb of the Companies Act threshold that most people still read as a public company test in fact catches private companies too. This note sets out where the line now runs.
- Three thresholds under Rule 9. Paid-up capital of ₹50 crore or turnover of ₹250 crore catch a public company. Bank or public financial institution borrowings of ₹100 crore catch any company, private ones included.
- Regulation 24A was rebuilt by the SEBI (LODR) (Third Amendment) Regulations, 2024, effective 1 April 2025, with the detail in SEBI's circular of 31 December 2024.
- Term limits. An individual practitioner gets one term of five years; a firm gets two terms of five. Then a five-year cooling-off. Association before 31 March 2025 is not counted, so the clock started fresh.
- A sole proprietorship is treated as an individual, not a firm — so five years, not ten. SEBI said so in terms in its FAQs.
- Seven categories of service are now off limits to the secretarial auditor, including internal audit and outsourced compliance management.
- What is actually being penalised is housekeeping, not fraud: registered office, annual filings, significant beneficial owners, key managerial personnel and the contents of the Board's report.
Who has to have a secretarial audit
Section 204(1) of the Companies Act, 2013 requires every listed company, and every company of a class that may be prescribed, to annex a secretarial audit report given by a Company Secretary in practice to its Board's report. The prescribed classes are in Rule 9(1) of the Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014.
| Limb | Test | Who it catches |
|---|---|---|
| Rule 9(1)(a) | Paid-up share capital of ₹50 crore or more | Every public company, listed or unlisted |
| Rule 9(1)(b) | Turnover of ₹250 crore or more | Every public company, listed or unlisted |
| Rule 9(1)(c) | Outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more | Every company — and that word is not an accident |
The third limb is the one that surprises people. It is not drafted as a public company test. It says every company, so a private company that has borrowed ₹100 crore or more from banks needs a secretarial audit, and a great many well-funded private companies now do. The limb was inserted by the Companies (Appointment and Remuneration of Managerial Personnel) Amendment Rules, 2020, notified on 3 January 2020 and applying to financial years commencing on or after 1 April 2020.
On top of that sits regulation 24A of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, which requires a listed entity and its material unlisted subsidiaries incorporated in India to have a secretarial audit. A subsidiary is material for this purpose under regulation 16(1)(c) if its income or net worth exceeds ten per cent of the consolidated income or consolidated net worth of the listed entity and its subsidiaries in the immediately preceding accounting year. That obligation bites whether or not the subsidiary would itself cross the Rule 9 thresholds — which is how a modest Indian subsidiary of a listed group finds itself needing a secretarial audit it had never budgeted for.
The regulation 24A overhaul
This is the substantial change, and it is the reason this article exists. The SEBI (Listing Obligations and Disclosure Requirements) (Third Amendment) Regulations, 2024, notified on 12 December 2024, rewrote regulation 24A with effect from 1 April 2025. The operative detail — the disqualifications and the list of restricted services — is in SEBI circular SEBI/HO/CFD/CFD-PoD-2/CIR/P/2024/185 dated 31 December 2024.
Until then, a listed company appointed its secretarial auditor by a board resolution, for as long as it liked, with no eligibility test beyond being a Company Secretary in practice. All three of those things have gone.
Appointment is now a shareholder decision
The Board recommends; the shareholders appoint at the annual general meeting. Removal also requires shareholder approval at a general meeting. A casual vacancy is filled by the Board within three months, and that appointee holds office only until the next annual general meeting. The 2025 AGM season was the first in which listed company shareholders voted on who audits their secretarial compliance.
Fixed terms, and a rotation that will bite in 2030
| Appointee | Maximum tenure | Cooling-off |
|---|---|---|
| Individual practitioner, including a sole proprietorship whether or not it trades under a firm name | One term of five consecutive years. The appointment must be for five years, not for one year at a time | Five years before re-appointment in the same listed entity |
| Firm of Company Secretaries, including an LLP | Two terms of five consecutive years, that is ten years | Five years. A firm with a common partner with an outgoing firm is also barred for five years |
Regulation 24A(4) grandfathers what went before: any association as secretarial auditor before 31 March 2025 is not counted in computing the tenure. A practitioner who had audited the same listed company since 2015 therefore started a fresh five years on 1 April 2025. Appointments made before 2025 needed a fresh appointment for FY 2025-26, approved by shareholders at the first AGM held after 1 April 2025. The first mandatory rotations will therefore fall in the 2030 AGM season for individuals, and five years later for firms.
Eligibility: eleven disqualifications
The 31 December 2024 circular sets out who cannot be appointed. In summary: a body corporate other than an LLP; an officer or employee of the listed entity, or a partner or employee of one; a person holding securities of the entity or its group exceeding ₹1 lakh in face value, personally or through a relative or partner; a person indebted to them beyond ₹5 lakh, or who has given a guarantee beyond ₹1 lakh; a person with a business relationship, direct or indirect; a person whose relative is a director or key managerial personnel there; a person in full-time employment elsewhere, or already holding secretarial audit of more than fifteen companies; a person convicted of an offence involving fraud within the last ten years; and a person rendering any of the restricted services below.
A firm may be appointed in the firm name only if a majority of its partners practising in India are themselves eligible, and only the peer-reviewed partners may act and sign for it. Disqualification incurred after appointment causes the office to be vacated, and that is treated as a casual vacancy.
Seven things the secretarial auditor may no longer do
The circular bars the secretarial auditor from rendering, to the listed entity, its holding company or its subsidiary: internal audit; design and implementation of any compliance management system, system process of compliances, information system or policy framework; investment advisory services; investment banking services; outsourced compliance management, record keeping and maintenance services; management services; and anything else SEBI may specify. For an individual the bar extends to services rendered through a relative, a connected person, or an entity in which he has significant influence or control. For a firm it extends to any partner and to parent, subsidiary and associate entities.
One further asymmetry is worth noticing, and it has been criticised in the professional press: a secretarial auditor can be removed by an ordinary resolution, whereas removing a statutory auditor under section 140(1) of the Companies Act needs a special resolution and the prior approval of the Central Government. The independence that regulation 24A builds on one side it leaves thinner on the other.
What a secretarial audit actually covers
Form MR-3 names five bodies of law and then adds a sixth, open-ended head. The five are the Companies Act, 2013; the Securities Contracts (Regulation) Act, 1956; the Depositories Act, 1996; FEMA, 1999 to the extent of foreign direct investment, overseas direct investment and external commercial borrowings; and the regulations and guidelines made under the SEBI Act, 1992. To those are added the Secretarial Standards issued by ICSI and, for a listed entity, the Listing Regulations.
The SEBI limb is where stale checklists show. ICSI's Guidance Note on Secretarial Audit dates from 2018 and still names instruments that have since been replaced. As matters stand the relevant instruments are the SAST Regulations 2011, the Prohibition of Insider Trading Regulations 2015, the ICDR Regulations 2018, the Share Based Employee Benefits and Sweat Equity Regulations 2021, the Issue and Listing of Non-Convertible Securities Regulations 2021, the Registrars to an Issue and Share Transfer Agents Regulations 1993, the Delisting Regulations 2021, the Buy-Back Regulations 2018 and the Listing Regulations 2015. A report that still cites the ICDR Regulations 2009 or the ESOP Guidelines 1999 tells the reader something about the care taken over the rest of it.
The sixth head, and how it is scoped
“Other laws specifically applicable to the company” is the head that makes the engagement either useful or meaningless. ICSI's formulation is sectoral — for a bank, the laws applicable to banking; for an insurer, the laws applicable to insurance. In practice the scoping turns on a distinction. General laws — labour, environment, tax, GST, provident fund, POSH, MSME reporting — are ordinarily covered through the overall compliance systems paragraph of MR-3 rather than tested transaction by transaction. Sector laws — the RBI Directions for an NBFC, IRDAI regulations for an insurer, FSSAI, drugs, telecom licence conditions, SEZ or mining leases — are tested. The filter is materiality: a law whose breach would attract a penalty, suspend a licence, found a prosecution or trigger a disclosure to a regulator. Whatever is decided has to be written into the engagement letter, because CSAS-1 requires the scope, the limitations and the basis on which the other applicable laws were identified to be set out there.
SS-1 on Board meetings and SS-2 on general meetings are the only Secretarial Standards that are mandatory, by force of section 118(10). Both were revised, and the revised versions took effect on 1 April 2024. SS-3 on dividend and SS-4 on the Board's report remain recommendatory.
What regulators are actually penalising
It is worth being concrete, because it tells a secretarial auditor where to look. An analysis of Registrar of Companies adjudication orders for FY 2024-25 — roughly 1,150 orders, about a third of all orders published on the MCA portal that year — gives this distribution.
| Section | Subject | Orders, approximately |
|---|---|---|
| 92 and 137 | Annual return and financial statement filing | 225 |
| 12 | Registered office — maintenance, display of name, intimation of change | 175 |
| 90 | Significant beneficial owners — BEN-1, BEN-2 and the BEN-3 register | 83 |
| 134 | Contents of the financial statements and the Board's report | 55 |
| 172 | Residual penalty for Chapter XI — directors and board composition | 45 |
| 203 | Key managerial personnel | 40 |
| 135, 62, 42 and 29 | CSR, further issue of capital, private placement, dematerialisation | 53 between them |
The centre of gravity is housekeeping, not headline fraud. Those are precisely the paragraphs a secretarial auditor is best placed to qualify, and precisely what ends up disclosed as a material default when the company later goes to market. Section 42 deserves a mention of its own, because the penalties are not small: in one adjudication a company that had received ₹13 crore over two years without allotting, with no offer letters in Form PAS-4 and no separate bank account, was penalised ₹4 crore — the statutory cap of ₹2 crore for each financial year — and ordered to refund with twelve per cent interest.
The penalty under section 204(4) was decriminalised on 21 December 2020. It is now a penalty of ₹2 lakh, and it attaches to the company, to every officer in default, and to the Company Secretary in practice. Two consequences of a qualified report are routinely overlooked: section 204(3) requires the Board to explain in full every qualification in its report, and section 143(12), extended to a practising Company Secretary by section 143(14), means a suspected fraud of ₹1 crore or more must be reported to the Board within two days and then to the Central Government. That is a personal obligation on the auditor, not on the company.
Four things that get confused
These are four different instruments with four different sources, and they are routinely treated as interchangeable.
| Source | Who needs it | What it covers | |
|---|---|---|---|
| Secretarial audit | Section 204 and Rule 9; regulation 24A(1) for listed entities | Listed companies; public companies above the capital or turnover tests; any company with bank or PFI borrowings of ₹100 crore; material unlisted Indian subsidiaries of listed entities | Companies Act, SCRA, Depositories Act, FEMA to the extent of FDI, ODI and ECB, the SEBI regulations, other applicable laws, SS-1 and SS-2, and the Listing Regulations. Annexed to the Board's report |
| Annual Secretarial Compliance Report | Regulation 24A | Listed entities with listed equity | Securities laws only. Filed with the exchanges within 60 days of the year end. From 1 April 2025 it can be signed only by the secretarial auditor or a qualifying peer reviewed Company Secretary |
| MGT-8 | Section 92(2) and Rule 11(2) of the Management and Administration Rules | Listed companies, and companies with paid-up capital of ₹10 crore or more or turnover of ₹50 crore or more | The correctness of the annual return and compliance with specified Companies Act provisions. It is a Companies Act certificate and does not cover securities laws. Attached to Form MGT-7 |
| “Secretarial compliance report” | Not a statutory term | Nobody, as a matter of law | Whatever the engagement letter says. Useful as a voluntary health check, but it is not the Annual Secretarial Compliance Report and should not be described as one |
The trap is the second row. A listed entity needs both the MR-3 audit and the Annual Secretarial Compliance Report, they cover different ground, and since 1 April 2025 both are locked to signatories who satisfy regulation 24A.
What to do about it now
Questions we are asked
Yes. Rule 9(1)(c) applies to every company with outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more. It is not confined to public companies, and it catches a good number of well-funded private companies that assume they are outside it.
No. Regulation 24A(4) provides that any association before 31 March 2025 is not counted in computing tenure. The clock started fresh on 1 April 2025, so an individual has five years from then and a firm has ten. A practitioner may in any event hold not more than fifteen secretarial audits at a time.
No. SEBI's LODR FAQs say a sole proprietorship, whether or not it carries a firm name, is treated as an individual Company Secretary in practice. That means one term of five years, not two.
That is exactly the boundary that is unresolved. The circular bars “outsourced compliance management, record keeping and maintenance services”, and SEBI has issued no guidance on where routine filing support sits. Take a documented position, and take it before the appointment rather than after.
No, and this is the most common confusion. MR-3 is the audit report, annexed to the Board's report, covering the Companies Act and much else. The Annual Secretarial Compliance Report covers securities laws only and goes to the stock exchanges within sixty days of the year end. A listed entity needs both.
Not sure whether the audit applies to you
Send us your latest audited balance sheet position and we will tell you which limb you fall under, what has to be done for the year, and what it will cost.
Written by MPS & Associates, Company Secretaries, on the law as it stood on 3 August 2026. It draws on the Companies Act, 2013 and the rules made under it, the SEBI Listing Regulations and SEBI's circular of 31 December 2024, and on published Registrar of Companies adjudication data. Statutes, rules, thresholds and due dates change, and a proposition that holds for one company may not hold for another whose facts differ. Nothing in this article is legal, secretarial or tax advice, it is not an opinion on any set of facts, and no professional relationship arises from reading it. Please see our Disclaimer.