CARO 2020: What Auditors Actually Have to Report On
CARO 2020 asks auditors to report on far more than CARO 2016 ever did, from whistle-blower complaints to a company's ability to pay its bills next year.
Key takeaways
- CARO 2020 applies to virtually every company by default; the exemptions for banking, insurance, Section 8 companies, OPCs, small companies, and qualifying private companies are the exception, not the rule.
- A private company can lose its CARO exemption purely by becoming a subsidiary of a public company, even if its own financials stay well within the exempt thresholds.
- The clause count rose from 16 in CARO 2016 to 21 in CARO 2020, with several additions, undisclosed income, whistle-blower complaints, internal audit, requiring judgment rather than simple verification.
- The one-year liability clause asks auditors to form a forward-looking view on solvency, not just confirm historical figures, raising the professional stakes of a clean report.
- Evidence for CARO's newer clauses, such as bank sanction letters, tax assessment records, and restructuring terms, needs to be built into the audit plan early, not assembled in the final week.
A newly qualified audit team preparing its first CARO annexure for a mid-sized manufacturing client quickly discovers that the report is not a formality tacked onto the end of the audit. It asks the auditor to state, in writing, whether the company has been declared a wilful defaulter, whether any whistle-blower complaints came in during the year and whether the audit actually considered them, and whether the company looks capable of paying its liabilities over the next twelve months. None of that sits comfortably within the traditional idea of an audit opinion on historical financial statements, and that discomfort is exactly the point. The Companies (Auditor's Report) Order, 2020 asks for a level of forward-looking, judgment-heavy commentary that its predecessor never did, and knowing which companies it even applies to is only the first of several questions an audit team has to get right.
Which Companies CARO 2020 Applies To
CARO 2020 is issued under Section 143(11) of the Companies Act, 2013, and applies to every company, including a foreign company, unless it falls within one of the Order's own exemptions. Banking companies, insurance companies, Section 8 companies, and One Person Companies are excluded outright, regardless of their size. So is any company that qualifies as a small company under the Companies Act, currently meaning paid-up capital of up to ₹4 crore and turnover of up to ₹40 crore, a status that exempts it from CARO automatically, without needing to check any further conditions. A private company that does not fall into the small company definition can still be exempt, but only if it satisfies three financial conditions together: paid-up capital plus reserves and surplus not exceeding ₹1 crore, borrowings from any bank or financial institution not exceeding ₹1 crore at any point in the year, and total revenue, including from discontinued operations, not exceeding ₹10 crore for the year. Missing any one of those three conditions brings the company back into CARO's scope in full.
There is a catch worth flagging on its own: the private company exemption is only available if the company is not itself a holding company or a subsidiary of a public company. A small, financially modest private company that happens to be a subsidiary of a listed parent does not qualify for the exemption at all, no matter how comfortably it clears the three financial thresholds. This is one of the more common places audit teams get caught out, usually when a group restructures and a private entity that was previously exempt quietly becomes a subsidiary of a public company partway through the year.
- Banking companies and insurance companies
- Section 8 companies, meaning companies with charitable objects
- One Person Companies
- Small companies, as defined under the Companies Act, regardless of borrowings or revenue mix
- Private companies meeting all three financial thresholds (capital plus reserves, borrowings, and revenue) that are not a holding or subsidiary of a public company
What Changed: CARO 2020's Expanded Reporting Matters
CARO 2016 asked auditors to report on 16 matters. CARO 2020 expanded that to 21, and the increase in scope is not evenly spread. Several of the additions ask the auditor to form an independent judgment rather than simply confirm a fact from the books. Some of the more consequential additions include disclosure of title deeds not held in the company's own name, whether property has been revalued by a registered valuer, whether any proceedings are pending under the Benami Transactions law, and whether working capital sanctioned against current assets of more than ₹5 crore matches what was actually reported to the lending bank in quarterly returns. Loans and investments to related entities now require far more granular disclosure too, including whether any overdue loan was simply renewed or extended rather than genuinely recovered, a pattern regulators treat as a red flag for evergreening.
| Reporting Area | What CARO 2020 Added |
|---|---|
| Undisclosed income | Whether any transaction not recorded in the books was later surrendered or disclosed as income in an income tax assessment |
| Fraud and whistle-blower complaints | Whether the auditor considered whistle-blower complaints received during the year, and whether a report under Section 143(12) was filed in Form ADT-4 |
| Internal audit | Whether the company has an internal audit system suited to its size and nature of business, and whether the statutory auditor considered those reports |
| Loan repayment discipline | Whether the company is a declared wilful defaulter, whether term loans were used for the purpose they were taken for, and whether short-term funds were diverted to long-term use |
| Cash losses | Whether the company incurred cash losses in the current year and the immediately preceding year, and the amount |
| Auditor resignation | Whether the outgoing auditor's stated concerns were considered by the company and the incoming auditor |
| One-year liability capability | Whether, based on ratios, ageing of assets and liabilities, and management's plans, any material uncertainty exists about the company meeting its liabilities within the next year |
| CSR compliance | Whether unspent CSR amounts were transferred to the prescribed fund or unspent account within the required timeline |
The Clauses That Ask Auditors to Exercise Real Judgment
Two additions stand out for how far they move beyond simply checking a box. The undisclosed income clause requires the auditor to report if the company surrendered or disclosed any previously unrecorded transaction as income during a tax assessment, search, or survey, which means the audit team has to actually ask about and cross-check against tax proceedings rather than assume the books tell the whole story. The clause on meeting liabilities within one year goes further still: it asks the auditor to form an opinion, based on financial ratios, the ageing of receivables and payables, and their own knowledge of management's plans, on whether the company looks capable of paying what it owes over the coming twelve months. That is not a historical fact to confirm, it is closer to a scaled-down, forward-looking solvency assessment sitting inside what used to be a purely retrospective report. Loan default reporting has picked up a similar flavour: where a company has defaulted and lenders have since put a debt resolution or restructuring arrangement in place, whether under the insolvency framework or through a bank-led restructuring scheme, auditors are expected to look at whether the company is actually keeping to those terms, not simply note that a default occurred and move on.
Why CARO Compliance Has Gotten More Demanding for Auditors
- The clause count grew by nearly a third between CARO 2016 and CARO 2020, and several of the new clauses require original analysis, not just verification of an existing figure
- Evidence-gathering has expanded well beyond the general ledger: bank sanction letters, quarterly returns filed with lenders, tax assessment records, and whistle-blower logs all now feed into a single audit report
- Regulatory scrutiny of audit quality has intensified generally in recent years, and clauses like fraud reporting and the one-year liability assessment carry real professional exposure if a company runs into trouble soon after a clean report was issued
- The reporting now reaches into other statutes entirely, the Benami law, the insolvency framework, RBI's rules for NBFCs, which means auditors need working knowledge well outside traditional accounting and auditing standards
- As small company and private company exemption thresholds get revised upward more slowly than many businesses actually grow, a steady stream of companies that used to be exempt find themselves inside CARO's scope for the first time
None of this means CARO 2020 is unmanageable, but it does mean the annexure can no longer be treated as a late-stage formality bolted onto the audit file. Confirming applicability correctly, especially the holding-and-subsidiary trap on the private company exemption, and building evidence for the judgment-heavy clauses into the audit plan from the start, rather than scrambling for it in the final week, is what actually keeps a CARO report defensible.
Frequently asked questions
Does CARO 2020 apply to a private limited company?
It depends on three financial conditions together, capital plus reserves up to ₹1 crore, borrowings up to ₹1 crore, and revenue up to ₹10 crore, and on whether the company is a holding or subsidiary of a public company. Meeting the financial thresholds is not enough on its own if the company fails that last condition.
Is a small subsidiary of a listed company exempt from CARO?
No. Being a subsidiary of a public company removes the private company exemption entirely, regardless of how small the subsidiary's own capital, borrowings, or revenue are. Only the small company exemption, which does not carry this restriction, could apply instead, and only if the subsidiary itself meets that definition.
What is the main difference between CARO 2016 and CARO 2020?
CARO 2020 expanded the number of reporting matters from 16 to 21, adding several clauses that ask the auditor to exercise independent judgment, such as whistle-blower complaints, undisclosed income surrendered in tax proceedings, and whether the company looks able to meet its liabilities over the next year, rather than simply confirming facts already recorded in the books.
Do One Person Companies and Section 8 companies need a CARO report?
No. Both are excluded outright under CARO 2020, regardless of their size, turnover, or borrowings.
What does the whistle-blower complaints clause actually require an auditor to do?
The auditor has to report whether whistle-blower complaints were received during the year and whether those complaints were taken into account while planning the nature, timing, and extent of audit procedures, which means the audit team needs to actively ask about and review any such complaints rather than rely on management not mentioning any.
Is CARO's one-year liability clause the same as a going concern opinion?
They are related but not identical. A going concern assessment under the auditing standards looks at least twelve months ahead from the balance sheet date as part of forming the audit opinion itself. CARO's clause sits alongside that and specifically asks the auditor to state whether material uncertainty exists about the company meeting its liabilities within one year of the balance sheet date, based on ratios, ageing, and management's plans, as a separate, explicit reporting requirement.
This article is for general informational purposes only and does not constitute professional tax, legal, or financial advice. Rules and rates change, so consult a qualified Chartered Accountant for advice specific to your situation.
Related reading
Key Ind AS Updates Every Practicing CA Should Track This Year
Ind AS never really sits still: it keeps absorbing convergence updates. Here's what practicing CAs should be watching, and why it matters for clients.
Forensic Audit Basics: When It's Commissioned and How It Differs From a Regular Audit
A forensic audit asks a different question than a statutory audit: not whether the statements are fair overall, but whether something specific actually happened.
Statutory Audit vs Internal Audit vs Tax Audit: Key Differences Explained
Three audits, three different laws, three different audiences: business owners often assume they're the same exercise done thrice. They rarely are, and mixing them up gets expensive.