A growing public company assumes its statutory audit covers it — until a secretarial audit surfaces a string of missed MGT-14 filings, an improperly constituted board and a registered office that was never verified. None of those are financial, so the statutory auditor never flagged them. All of them are exactly what a secretarial audit exists to catch.
Secretarial audit under Section 204 is mandatory for listed companies, public companies above ₹50 crore of paid-up capital or ₹250 crore of turnover, and any company with borrowings of ₹100 crore or more — and only a Practising Company Secretary can sign the MR-3 report.
The bottom line
Applies to: every listed company; every public company with paid-up capital of ₹50 crore or more or turnover of ₹250 crore or more; and any company, public or private, with borrowings from banks or public financial institutions of ₹100 crore or more.
Who signs it: only a Practising Company Secretary holding a valid Certificate of Practice, reporting in Form MR-3, annexed to the Board's Report.
New since 1 April 2025: the secretarial auditor of a listed company must be a peer-reviewed CS.
Who must get one
Section 204 with Rule 9 of the Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014 makes it mandatory for every listed company including SME-listed ones, every public company with paid-up share capital of ₹50 crore or more or turnover of ₹250 crore or more, and every company with outstanding loans or borrowings from banks or public financial institutions of ₹100 crore or more.
The thresholds are tested on the latest audited financial statement.
That third limb catches people. A private company with ₹100 crore or more of bank borrowings is in scope even though it is neither listed nor a large public company, and its board is usually not expecting the requirement.
What the audit covers
The MR-3 report is broad. It examines compliance with the Companies Act, the SCRA and the Depositories Act, FEMA covering FDI, ODI and ECB, and the SEBI regulations including LODR, SAST, PIT and ICDR, plus the Secretarial Standards and any laws specific to the company's industry.
It also reports on whether the board is properly constituted — the balance of executive, non-executive, independent and woman directors — and whether changes to it were made in compliance.
CSAS-4, the auditing standard effective from April 2020, requires the auditor to identify all applicable laws for the particular company, which is why an industry-specific licence regime is inside the scope even where nobody thought to mention it.
Who can conduct it
Only a Company Secretary in Practice — an ICSI member holding a valid Certificate of Practice — can conduct a secretarial audit and sign MR-3 under Section 204(1). An internal company secretary cannot, and neither can a chartered accountant or cost accountant.
Under the SEBI (LODR) Third Amendment, from 1 April 2025 the secretarial auditor of a listed company, and of its material unlisted subsidiaries, must additionally hold a valid ICSI peer-review certificate. Appointing a non-peer-reviewed CS for a listed company is now a SEBI compliance problem rather than a preference.
Appointing the auditor
The Board appoints the Practising Company Secretary by resolution at a board meeting, on the audit committee's recommendation where one exists, fixes the remuneration, and files MGT-14 within 30 days under Section 179(3).
The auditor then examines the company's registers, minutes, filings and policies and prepares the MR-3, which must be ready before the Board's Report is approved, since it is annexed to it. Starting the audit late is the scheduling error that delays the whole annual report.
Listed companies also file an Annual Secretarial Compliance Report with the stock exchanges within 60 days of year end.
How it differs from a statutory audit
A statutory audit under Section 139 is a financial audit by a chartered accountant, reporting on whether the accounts are true and fair.
A secretarial audit under Section 204 is a governance and legal compliance audit by a company secretary, reporting on whether the company followed the law and its own procedures.
They are complementary. One checks the books, the other checks the conduct, and where both apply the findings should line up rather than contradict each other.
What non-compliance costs
Where the company, any officer in default, or the Practising Company Secretary contravenes Section 204, Section 204(4) makes each liable to a fine of not less than ₹1 lakh and up to ₹5 lakh.
The fine is not really the point. The value of the audit is preventive — it finds the missed filing or the governance gap before it becomes a regulator's enforcement action, which is a far more expensive way to discover the same thing.
Common mistakes
- Assuming the statutory audit covers governance. It does not, and the two auditors look at different things entirely.
- Missing the ₹100 crore borrowings limb, which can pull in a private company on its own.
- Appointing a non-PCS, or for a listed company a CS who is not peer-reviewed.
- Starting the audit too late. MR-3 must be ready before the Board's Report is approved.
- Ignoring qualifications in MR-3. The Board must explain any qualification or adverse remark in its report.
A working routine
- Test applicability against all three limbs: listed, public company size, or ₹100 crore of borrowings.
- Appoint a Practising Company Secretary, peer-reviewed for a listed company, by board resolution, and file MGT-14 within 30 days.
- Give the auditor full access to registers, minutes, filings and policies.
- Obtain the MR-3 report before approving the Board's Report, and annex it.
- Explain any qualifications or adverse remarks in the Board's Report.
- For a listed company, file the Annual Secretarial Compliance Report within 60 days of year end.
Frequently asked questions
Which companies need a secretarial audit? Listed companies, public companies with ₹50 crore or more of paid-up capital or ₹250 crore or more of turnover, and any company with ₹100 crore or more of borrowings from banks or public financial institutions.
Who can sign the MR-3 report? Only a Practising Company Secretary with a valid Certificate of Practice, and for a listed company from April 2025, a peer-reviewed one.
Is it the same as the statutory audit? No. The statutory audit covers the financials and is done by a chartered accountant. The secretarial audit covers legal and governance compliance and is done by a company secretary.
Where does the MR-3 report go? It is annexed to the Board's Report in the annual report.
What is the penalty for non-compliance? A fine of ₹1 lakh to ₹5 lakh on the company, the officer in default, or the Practising Company Secretary, under Section 204(4).
Can a private company be in scope? Yes, through the borrowings limb, at ₹100 crore or more from banks or public financial institutions.
Primary sources
- Section 204, Companies Act, 2013; Rule 9, Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014
- Form MR-3 and CSAS-4, the Auditing Standard on Secretarial Audit
- SEBI (LODR) Regulation 24A, and the SEBI (LODR) Third Amendment Regulations, 2024, on peer review effective 1 April 2025