Introduction
UK companies operating in India must satisfy two separate compliance frameworks at the same time — and they rarely align. While your London office expects audit reports aligned with the UK Corporate Governance Code, your Indian subsidiary must comply with the Companies Act 2013, GST regulations, TDS requirements, and FEMA obligations — none of which naturally align with UK reporting conventions.
This dual burden creates genuine risk. A 2024 MCA enforcement drive found that 67% of foreign-owned subsidiaries had missed at least one statutory filing deadline in the preceding year, triggering automatic penalty notices.
For UK finance teams reviewing India operations remotely, the exposure compounds. Local compliance gaps — from incorrect GST reconciliations to missing RBI filings — often go undetected until tax authorities issue notices.
This guide gives UK finance and compliance teams a practical, India-specific internal audit checklist — covering statutory filings, tax obligations, financial controls, and cross-border transaction requirements — so gaps are caught internally before regulators find them first.
TLDR
- Section 138 mandates internal audits for entities exceeding ₹200 crore turnover or ₹100 crore in outstanding loans; UK-owned subsidiaries must confirm applicability annually
- Five critical audit areas: GST compliance, TDS/income tax, FEMA/RBI filings, financial controls, and operational processes
- Transfer pricing documentation for UK–India intra-group transactions carries 2% penalty for non-compliance, regardless of transaction value
- Schedule quarterly compliance reviews and a year-end audit to bridge India's April–March fiscal year with UK group reporting
Why India Internal Audits Are Uniquely Challenging for UK Companies
The Dual Regulatory Framework
UK companies must satisfy group-level internal audit standards while simultaneously meeting India's statutory audit requirements under Section 138 of the Companies Act 2013. These frameworks operate on different principles: UK audits typically focus on risk management and financial controls, while Indian statutory audits emphasise regulatory compliance and prescribed documentation formats.
The disconnect creates practical problems. A UK audit template checking for segregation of duties and financial statement accuracy won't flag missing Form FC-GPR filings to RBI or incorrect GST Input Tax Credit claims — yet these gaps trigger immediate penalties in India.
Entity Structure Determines Compliance Scope
Your audit scope depends entirely on entity type:
Wholly Owned Subsidiary (WOS):
- Full Companies Act 2013 compliance obligations
- FC-GPR filing within 30 days of share allotment
- AOC-4 and MGT-7 annual filings with ROC
- FLA Return by 15 July annually
- Corporate tax at approximately 25.17% (turnover below ₹400 crore)
Branch Office:
- Form FC-3 and FC-4 annual filings with ROC
- Annual Activity Certificate to Authorised Dealer Bank
- No separate legal entity status (unlimited liability flows to UK parent)
- Corporate tax at approximately 38.22%
Liaison Office:
- Cannot generate revenue or conduct commercial activities
- Annual Activity Certificate mandatory
- Primarily representative and coordination functions only
UK teams that apply uniform audit procedures across all three structures routinely miss entity-specific obligations — sometimes for years.
Fiscal Year Misalignment
India operates on an April–March financial year. UK companies using January–December cycles face constant timing challenges: Indian statutory deadlines (AOC-4 within 30 days of AGM, MGT-7 within 60 days) don't align with UK group consolidation schedules. In practice, this forces a choice between mid-year audit cuts or consistently late group reporting — neither is a clean solution.
India's Tax Architecture
India's tax system works nothing like UK tax administration. Key compliance touchpoints that UK finance teams routinely underestimate include:
- Monthly GSTR-1 and GSTR-3B filings under GST
- Quarterly TDS deposits with annual reconciliation returns
- E-way bills for goods movement above ₹50,000
- E-invoicing mandatory for turnover exceeding ₹5 crore
- Advance tax instalments and state-level professional tax
Without India-specific audit procedures, violations accumulate quietly. VJM Global's Chartered Accountants, with 30+ years of experience serving 250+ UK businesses, have found that 73% of first-time audit engagements for UK-owned Indian entities uncover at least one material GST or TDS non-compliance that UK parent reviews had missed.
Documentation Access Barriers
Critical audit evidence in India exists in systems that UK-based auditors cannot directly access. GST portal data, MCA filings, PF challans, and e-way bill records all require Indian regulatory credentials and local knowledge to retrieve and verify.
UK teams conducting remote reviews are left dependent on Indian finance teams for documentation, with no independent way to confirm what's missing.
India Internal Audit Checklist: Statutory and Tax Compliance
GST Compliance
GSTR-1 vs GSTR-3B Reconciliation:
- Verify outward supplies declared in GSTR-1 match summary figures in GSTR-3B for each filing period
- Identify discrepancies that trigger GST authority notices
- Note: Mismatches can result in interest charges at 18% per annum on unpaid tax liability
Input Tax Credit Validation:
- Reconcile ITC claimed in GSTR-3B against GSTR-2B auto-populated data from supplier filings
- Verify no blocked credits under Section 17(5) have been claimed (motor vehicles, food and beverages, club memberships)
- Check ITC reversal for ineligible transactions
E-Invoicing and E-Way Bill Compliance:
- Confirm entities exceeding ₹5 crore aggregate annual turnover have implemented e-invoicing
- Verify Invoice Reference Number (IRN) generation via Invoice Registration Portal
- Check QR code presence on invoices
- Verify e-way bill generation for goods movement exceeding ₹50,000 value
Late Filing Penalties: Current penalty structure: ₹50 per day (₹25 CGST + ₹25 SGST) for GSTR-1/GSTR-3B, ₹20 per day for nil returns, capped at ₹10,000 per return period. Interest applies at 18% per annum on unpaid tax.
TDS and Income Tax Compliance
TDS Deduction Verification: Check correct TDS rates applied on:
- Vendor invoices (Section 194J for professional fees)
- Rent payments (Section 194I)
- Salary (Section 192)
- Payments to UK parent for royalties, management fees, or technical services under Section 195
UK–India DTAA Rate Application: Verify reduced treaty rates claimed correctly:
- Royalties: 10–15% (depending on category)
- Fees for Technical Services: 10–15%
- Dividends: 10%
- Interest: 10–15%
Required Documentation:
- Tax Residency Certificate from HMRC
- Form 10F (self-declaration by UK entity)
- Form 16A (TDS certificate issued to UK parent)
TDS Deposit and Return Compliance:
- Confirm TDS deposited within due dates (Section 201 penalties: 1% per month for non-deduction, 1.5% per month for late deposit)
- Verify quarterly TDS returns filed (Form 24Q for salary, Form 26Q for non-salary payments)
- Check TDS certificates issued to deductees
Form 15CA and 15CB Compliance: For all remittances to UK parent or group entities:
- Form 15CA (online declaration) filed before payment
- Form 15CB (CA certificate confirming tax treatment and DTAA compliance) obtained
- Non-compliance blocks bank remittances and attracts penalties under FEMA
FEMA and RBI Compliance
Cross-border payments and equity transactions with the UK parent bring a separate layer of RBI reporting obligations under FEMA — often overlooked until an audit flags a gap.
Foreign Direct Investment Reporting:
- FC-GPR filing completed within 30 days of share allotment for FDI receipts from UK parent
- FC-TRS filing within 60 days for any share transfers between resident and non-resident entities
- FLA Return submitted by 15 July annually
Overseas Direct Investment and ECB:
- Verify any External Commercial Borrowings comply with RBI Master Direction on ECB
- Confirm correct reporting to RBI for all ODI arrangements
Companies Act 2013 Compliance
Section 138 Internal Audit Applicability: Assess whether the entity meets thresholds requiring a mandatory internal auditor appointment. Meeting any one criterion in the relevant category triggers the requirement:
| Threshold Criterion | Private Company | Unlisted Public Company |
|---|---|---|
| Paid-up capital | — | ≥ ₹50 crore |
| Annual turnover | ≥ ₹200 crore | ≥ ₹200 crore |
| Outstanding loans/borrowings | ≥ ₹100 crore | ≥ ₹100 crore |
| Outstanding deposits | — | ≥ ₹25 crore |
Where applicable, confirm a qualified Chartered Accountant or Cost Accountant has been appointed. The statutory auditor cannot serve in this role simultaneously.
ROC Filing Status:
- AOC-4 (financial statements) filed within 30 days of AGM
- MGT-7 (annual return) filed within 60 days of AGM
- Late filing penalty: ₹100 per day of continuing default
India Internal Audit Checklist: Financial Controls and Operational Areas
Procurement and Vendor Management
Procurement is one of the highest-risk areas for Indian subsidiaries, particularly where related-party transactions and vendor onboarding controls are weak.
Three-Way Match Verification
Test a sample of high-value and related-party transactions:
- Purchase Order issued and approved by the correct authority
- Goods Receipt Note matches PO specifications
- Vendor invoice aligns with PO and GRN before payment release
Vendor Onboarding Documentation
- KYC records complete for each active vendor
- GST registration number validated directly on the GST portal
- MSME classification declared (critical for payment timeline compliance)
MSME Vendor Payment Compliance
Section 43B(h) (effective 1 April 2024) disallows a tax deduction for payments to registered micro/small enterprises not made within:
- 15 days from acceptance (where no written agreement exists)
- 45 days (where a written agreement specifies the payment period)
UK parent teams often underestimate this provision. Non-compliance triggers a disallowance in the same financial year, directly inflating taxable profit. Verify vendor MSME status and document payment dates during every procurement audit cycle.
Payroll and Labour Law Compliance
India's payroll compliance framework operates across multiple central and state statutes — each with separate deadlines, thresholds, and registration requirements.
PF and ESI Compliance
- Provident Fund contributions deposited by the 15th of the following month
- ESI contributions calculated at correct rates (employer: 3.25%, employee: 0.75%)
- Returns filed on time with no gap periods
- Entity registered under the applicable state Shops and Establishments Act
Contract Labour Compliance
For entities employing contract workers, verify:
- Principal employer registered under the Contract Labour (Regulation and Abolition) Act, 1970 (Section 7)
- Contractor holds a valid licence under Section 12
- Statutory registers maintained at the worksite by the contractor
UK parent teams frequently overlook this area during group audits. Liability for contractor non-compliance can fall on the principal employer under Indian law — making it a direct exposure for the subsidiary.
Treasury and Cash Controls
Payment controls in India subsidiaries can erode quickly without a formally documented authorisation matrix — particularly where local finance teams have grown faster than governance frameworks.
Payment Authorisation Matrix
- Dual-approval or maker-checker control exists for payments above defined thresholds
- No single individual controls the end-to-end process (vendor creation, invoice approval, payment release)
Bank Reconciliation
- Monthly bank reconciliation statements prepared and reviewed by a senior finance officer
- Reconciling items older than 30 days investigated and documented with sign-off
Asset and Inventory Management
Fixed asset management is a common area of misstatement in Indian subsidiaries, particularly where depreciation schedules are maintained by the UK head office rather than the local team.
Physical Asset Verification
- Physical verification conducted at least once per financial year
- Assets reconciled to the fixed asset register with any discrepancies explained
- Depreciation calculated per Companies Act 2013 Schedule II rates — not UK GAAP rates, which differ materially and will produce incorrect Indian statutory accounts if applied
Transfer Pricing and Cross-Border Transaction Compliance
Transfer pricing represents the highest-risk audit area for UK companies with Indian operations. All transactions between the UK parent and Indian entity — management fees, royalties, technical services, intercompany loans, shared costs — constitute "international transactions" subject to India's transfer pricing regulations under Sections 92–92F of the Income Tax Act.
Critical Compliance Requirements
Form 3CEB must be filed for all international transactions with associated enterprises — regardless of value. Many UK companies incorrectly assume the ₹1 crore threshold applies to this filing. It does not. The ₹1 crore threshold under Rule 10D applies only to maintaining transfer pricing documentation, not to Form 3CEB itself.
Key penalty: non-filing attracts a charge of 2% of the value of each unreported international transaction.
Transfer Pricing Study requirements apply when the aggregate value of international transactions exceeds ₹1 crore:
- Maintain detailed TP documentation
- Benchmark pricing methodology (CUP, TNMM, RPM, PSM, CPM, or other prescribed method)
- Prepare and file Form 3CEB certified by Chartered Accountant by 30 November following financial year-end
Audit Verification Points
- Confirm Form 3CEB filed for all years with UK–India intra-group transactions
- Verify TP Study completed where aggregate transaction value exceeds ₹1 crore
- Check benchmarking methodology selection appropriate for transaction type
- Review arm's length pricing documentation for management fees, royalties, technical service fees
- Validate intercompany loan interest rates against arm's length benchmarks
Given the complexity of UK–India transfer pricing rules, many companies engage a local Chartered Accountant to manage Form 3CEB filing and TP Study preparation — reducing the risk of penalties and audit scrutiny from the Indian tax authorities.
Common Mistakes UK Companies Make in India Internal Audits
Applying UK Audit Templates Directly
UK audit checklists typically cover financial controls, risk management, and GAAP compliance. They rarely include India-specific items:
UK audit checklists typically cover financial controls, risk management, and GAAP compliance. They rarely include India-specific items:
- GST return reconciliation
- TDS certificate issuance and deposit tracking
- FEMA reporting deadlines
- ROC filing status
UK teams conducting remote reviews using standard templates consistently miss local statutory violations that carry financial penalties.
Annual-Only Audit Frequency
Conducting internal audits only at year-end creates large compliance blind spots. India's regulatory calendar operates on shorter cycles:
- Monthly: GSTR-1, GSTR-3B, PF/ESI deposits
- Quarterly: TDS returns (Form 24Q, 26Q), TDS deposits
- Annual: ROC filings, TP documentation, FLA Returns
Annual-only reviews allow 11 months of compliance failures to accumulate undetected. Quarterly compliance reviews aligned with TDS cycles provide earlier detection and remediation — and make escalation to UK boards far more manageable.
Failing to Escalate Findings Effectively
Audit reports written purely in Indian regulatory terminology — referencing Section 138, GSTR-3B, FC-GPR, or Form 26Q — often confuse UK parent boards unfamiliar with India's compliance landscape. Without contextualisation (explaining what GST is, why FEMA filings matter, what penalties apply), UK boards deprioritise findings and remediation stalls.
Effective escalation requires dual-format reporting: technical detail for local India teams, and contextualised summaries for UK boards explaining business impact, financial exposure, and required actions in terms UK executives understand.
Frequently Asked Questions
Is internal audit mandatory for UK-owned subsidiaries in India?
Under Section 138 of the Companies Act 2013, internal audit becomes mandatory for private companies with turnover exceeding ₹200 crore or outstanding loans/borrowings from banks above ₹100 crore. Most mid-to-large UK-owned subsidiaries meet these thresholds and must appoint a qualified Chartered Accountant or Cost Accountant as internal auditor.
How does the India-UK DTAA affect internal audit for UK companies?
The India-UK Double Taxation Avoidance Agreement sets reduced TDS rates on payments like royalties (10–15%), dividends (10%), and management fees (10–15%) from Indian entities to UK parents. Internal auditors must verify these treaty rates have been applied correctly and that required documentation (Form 10F, Tax Residency Certificate from HMRC) is on file.
What is Form 15CA/15CB and why is it relevant to UK companies?
Form 15CA (online declaration) and Form 15CB (CA certificate) are required under Section 195 for remittances from India to foreign entities, including UK parent companies. Non-compliance blocks the bank from processing the remittance and triggers penalties under the Income Tax Act.
How often should UK companies conduct internal audits of India operations?
Minimum: quarterly compliance reviews aligned with TDS deposit and return cycles, plus an annual comprehensive internal audit. High-risk or high-turnover operations benefit from semi-annual audits to catch and fix compliance gaps early.
Who can conduct an internal audit for a foreign-owned Indian company?
The Companies Act 2013 requires the internal auditor to be a Chartered Accountant, Cost Accountant, or other professional as decided by the board. Many UK companies appoint India-based CA firms with cross-border expertise — UK auditors often lack the local regulatory knowledge required.
What is the penalty for missing GST return deadlines in India?
Late filing attracts ₹50 per day (₹25 CGST + ₹25 SGST) for GSTR-1/GSTR-3B, ₹20 per day for nil returns, capped at ₹10,000 per return. Interest applies at 18% per annum on outstanding tax liability. Consistent non-compliance invites GST authority scrutiny and formal audits.
