A clause-by-clause field guide to the Companies (Auditor’s Report) Order, 2020 — and how to read the answers like an analyst rather than a compliance officer.
If you have ever opened an Indian annual report and turned past the standalone auditor’s report — past the opinion paragraph, past the key audit matters, past the basis-for-opinion section — you will have hit a separate report headed “Annexure A to the Independent Auditor’s Report” or “Annexure referred to in paragraph 1 under ‘Report on Other Legal and Regulatory Requirements’”. That annexure is the auditor’s response to the Companies (Auditor’s Report) Order, 2020, and it is something the United States 10-K does not have, the United Kingdom annual report does not have, and the IFRS-jurisdiction filings of the European listed company do not have. CARO is a uniquely Indian instrument, and once you learn to read it, you will rarely look at an Indian company again without first scrolling to the back of its auditor’s report.
The Order is issued by the Ministry of Corporate Affairs under section 143(11) of the Companies Act, 2013, which empowers the Central Government, in consultation with the National Financial Reporting Authority, to direct that the auditor’s report on the financial statements of certain classes of companies include a statement on prescribed matters. CARO 2020, notified on 25 February 2020 and applicable to audits of financial years commencing on or after 1 April 2021, replaced CARO 2016. The previous order had sixteen clauses; the present one has twenty-one clauses and thirty-eight sub-clauses, with seven entirely new heads of inquiry and substantial redrafting of the heads that survived.
The shift from 2016 to 2020 is not cosmetic. Read in sequence, the seven new clauses tell a clear story about what the regulator wanted auditors to look at after the corporate failures of 2018 and 2019 — IL&FS, DHFL, the alleged window-dressing at certain large private-sector banks, the diversion of borrower funds into related-party investments. The new clauses cover the disclosure of previously unrecorded income surrendered during income-tax assessments, willful-defaulter status, the end-use of term loans, the use of short-term funds to finance long-term assets, evergreen lending between group companies, fraud by or on the company, the consideration given to issues raised by outgoing auditors, and material uncertainty assessments grounded in financial ratios. Each is a specific lesson learned from a specific failure. None of them is in CARO 2016.
What CARO is, and what it is not
CARO is not an audit opinion. The auditor’s principal opinion — on whether the financial statements present a true and fair view — sits in the main report and follows the structure of SA 700 (the Indian equivalent of ISA 700). CARO is appended to that opinion and answers a fixed, government-prescribed questionnaire. The answers can be “Yes”, “No”, “Not applicable” or, more usefully for the reader, a paragraph of explanation that begins “Yes, except…” or “No. However…”. Those qualifications are where most of the analytical value sits.
The Order does not apply to a banking company governed by the Banking Regulation Act, an insurance company, a Section 8 (not-for-profit) company, a One Person Company, or a small company (paid-up capital not exceeding four crore rupees and turnover in the immediately preceding financial year not exceeding forty crore rupees, both thresholds applied at the standalone level). Private companies that exceed certain size thresholds — paid-up capital and reserves above one crore, borrowings above one crore at any point in the year, or turnover above ten crore — fall in. In practice, every listed Indian non-bank, non-insurer is covered; so is every unlisted subsidiary of any consequence.
A second nuance worth fixing in mind: with one exception, CARO applies only to the auditor’s report on the standalone financial statements. The standalone is the legal entity in isolation; the consolidated is the parent plus every subsidiary, joint venture and associate, eliminated and aggregated. The single clause that does survive into the consolidated auditor’s report is clause (xxi), which requires the principal auditor to flag any qualifications or adverse remarks in the CARO reports of the components — with the paragraph numbers, and the names of those components, listed. This means that the way to read the CARO landscape of a group is: read the parent’s twenty-one clauses in full; then read clause (xxi) on the consolidated side to get a directory of which subsidiaries had which issues; then, where the issues look material, pull the relevant subsidiary’s standalone auditor’s report from its own filings on the MCA portal and read the underlying clause. This is laborious. It is also where the real analytical edge lies. Most readers stop at the parent’s CARO.
The twenty-one clauses, regrouped for analysts
The official numbering of CARO 2020 runs i through xxi in the order the Order itself prescribes. That is the order the auditor must answer in. It is not the order an analyst should read them in. Below, the same twenty-one clauses are regrouped into the five questions an external reader is really trying to answer about the business.
The asset question: are the things on the balance sheet really there, and worth what is claimed?
Clause (i) asks whether the company maintains proper records of property, plant and equipment and of intangible assets, whether PPE has been physically verified at reasonable intervals (the auditor must state the intervals and any material discrepancies), whether title deeds of all immovable property are held in the company’s name (and if not, provide a tabular disclosure of property description, gross carrying value, the name in whose favour the deed actually stands, and the reason), whether the company has revalued PPE or intangible assets during the year, and whether any proceedings have been initiated or are pending against the company under the Benami Transactions (Prohibition) Act, 1988. The title-deed sub-clause is particularly diagnostic in Indian real-estate and infrastructure companies. The revaluation sub-clause is new: auditors must state whether the revaluation, if any, is based on the valuation of a registered valuer and whether the change is more than ten percent of the aggregate net carrying value of each class.
Clause (ii) asks about inventory: whether physical verification has been conducted at reasonable intervals, whether the procedure was appropriate to the size and nature of the business, whether discrepancies of ten percent or more in aggregate for each class were properly dealt with. There is also a second leg — applicable to companies with sanctioned working capital limits in excess of five crore rupees from banks or financial institutions on the security of current assets — which requires the auditor to state whether the quarterly returns or statements filed with such banks or financial institutions are in agreement with the books of account. This second leg is consequential. Quarterly stock statements filed with lender banks have historically been a place where Indian companies overstated inventory and debtors to maximise drawing power, then “trued up” at year-end in the audited accounts. The 2020 redrafting forces the auditor to publicly note the discrepancy. Where this clause carries the words “material differences have been observed”, treat them as worth investigating.
The liability question: is the company in good standing with its creditors, its lenders, and the state?
Clause (vii) asks whether the company is regular in depositing undisputed statutory dues — provident fund, employees’ state insurance, income tax, GST, customs duty, excise duty, value added tax, cess and any other statutory dues — and lists any undisputed amounts outstanding for more than six months from the date they became payable. It also lists disputed dues by amount, period, and the forum where the dispute is pending. This clause is one of the cheapest tells of working-capital stress in the entire annual report. A company that is well-funded does not let provident-fund contributions sit unpaid for nine months. Disputed dues, by contrast, are largely noise — most large Indian companies have some service-tax or income-tax assessment pending at the Income Tax Appellate Tribunal or the High Court — but the size of the disputed amount relative to net worth is worth a glance.
Clause (ix) covers borrowings. The auditor must state whether the company has defaulted in the repayment of loans or other borrowings or interest to any lender; if yes, the period and amount of default by lender category. The clause then continues into newer ground: whether the company has been declared a willful defaulter by any bank, financial institution or other lender; whether term loans were applied for the purpose for which they were obtained; whether short-term funds were used for long-term purposes (the classic asset-liability mismatch that brought down DHFL); whether funds taken from any entity were applied to meet obligations of its subsidiaries, associates or joint ventures; and whether loans were raised on the pledge of securities held in subsidiaries, joint ventures or associates, with the details. Read carefully, clause (ix) is the most informationally dense single clause in the Order.
Clause (v) addresses public deposits accepted under sections 73 to 76 of the Companies Act, including any non-compliance with the directions of the Reserve Bank of India, any order of the National Company Law Tribunal, or any non-compliance with the Companies (Acceptance of Deposits) Rules, 2014. For most listed manufacturing and services companies the answer here is a clean “Not applicable” because they have not accepted public deposits. Where the answer is anything other than that, it is worth understanding why.
The promoter-and-related-party question: who is the company really run for?
Clause (iii) is the new heart of CARO 2020 on related-party financial flows. The clause requires the auditor to state, in respect of loans, advances in the nature of loans, guarantees and securities given by the company: whether the company has provided any during the year to subsidiaries, joint ventures or associates, with aggregate amounts; whether the company has provided any to parties other than subsidiaries, joint ventures or associates; whether the investments made, guarantees or securities provided, and the terms and conditions of the grant of loans and advances in the nature of loans, are not prejudicial to the company’s interest; whether the schedule of repayment of principal and payment of interest has been stipulated and whether the repayments are regular; whether any amount is overdue, and if so, whether reasonable steps have been taken by the company for recovery; whether any loan or advance in the nature of loan granted has fallen due during the year and has been renewed or extended, or fresh loans granted to settle the overdues of existing loans (this is the evergreening sub-clause, and it is a wholly new question added in 2020); whether loans or advances in the nature of loans have been granted that are repayable on demand or without specifying any terms or period of repayment, and if so, what is the percentage to total loans granted and the aggregate amount of such loans to promoters and related parties.
When an Indian parent reports under clause (iii) that it has loans to related parties that are repayable on demand, an analyst should read that as: this money is not coming back on any defined schedule; the parent is exposed to the credit of the related party; and the loan can be carried on the balance sheet at full carrying value indefinitely because no maturity has been triggered.
Clause (iv) sits next to (iii) and addresses compliance with sections 185 and 186 of the Companies Act — the two sections that restrict loans, guarantees, and investments by a company in respect of its directors and other connected entities. In a well-run company the disclosure here is short and uneventful.
Clause (xiii) asks whether all transactions with related parties are in compliance with sections 177 (audit committee approval) and 188 (specific approval of certain related-party transactions), and whether the details have been disclosed in the financial statements as required by the applicable accounting standards. Disclosure compliance is normally good; the discipline imposed by clause (xiii) is to make sure the auditor has actively checked it.
Clause (xv) addresses non-cash transactions with directors or persons connected with them and compliance with section 192.
Clause (xviii), new in 2020, asks whether there has been any resignation of the statutory auditors during the year and, if so, whether the auditors have taken into consideration the issues, objections or concerns raised by the outgoing auditors. The Indian auditing market has, over the last decade, seen a stream of mid-year resignations by Big-Four firms from large-cap and mid-cap clients — frequently associated with disagreements over revenue recognition, related-party loans, or recoverability of receivables. The 2020 clause forces the incoming auditor to publicly note whether the outgoing auditor’s concerns have been considered. Where you see this disclosure flagged as anything other than a clean “Not applicable, no such resignation”, treat it as material.
The earnings-quality question: are profits real?
Clause (viii), new in 2020, asks whether any transactions not recorded in the books of account have been surrendered or disclosed as income during the year in tax assessments under the Income Tax Act, 1961. In plain English: did the income-tax authority find unaccounted-for income, and did the company accept it? Where the answer is yes, the auditor must state the amount. This is, in practice, the cleanest possible signal of historical reporting integrity. Companies that have had a surrender under section 132 or 133A do not usually become high-quality companies overnight.
Clause (xvii), new in 2020, asks whether the company has incurred cash losses in the financial year and in the immediately preceding financial year, and if so, state the amount of cash losses in both. For users of profit-and-loss statements this might seem redundant: cash losses can be derived from the cash-flow statement. They cannot, in fact, always be derived cleanly, because Indian companies report cash flows under the indirect method, and reconciling working-capital movements to a clean “operating cash loss” number sometimes requires assumptions. Forcing the auditor to state the amount removes the ambiguity.
Clause (xix), new in 2020, asks the auditor to state, on the basis of the financial ratios, ageing and expected dates of realisation of financial assets and payment of financial liabilities, other information accompanying the financial statements, the auditor’s knowledge of the board of directors and management plans, whether the auditor is of the opinion that no material uncertainty exists as on the date of the audit report that the company is capable of meeting its liabilities existing at the date of balance sheet as and when they fall due within a period of one year from the balance sheet date. This is in addition to, and not a substitute for, the going-concern paragraph the auditor would carry in the main report under SA 570. The CARO 2020 language is explicitly grounded in observable, quantitative items — ratios, ageing schedules, dated cash flows. Where this clause does not return a clean affirmative — where the auditor uses phrases like “we are unable to comment” or “the company has incurred cash losses and current liabilities exceed current assets by…” — the reader is being warned in the most formalised way available in Indian audit reporting.
Clause (xx) is the corporate-social-responsibility clause. It requires the auditor to state whether, in respect of other than ongoing projects, the company has transferred unspent amounts to a fund specified in Schedule VII to the Companies Act within a period of six months of the expiry of the financial year (section 135(5)); and whether, in respect of ongoing projects, the company has transferred the unspent amounts to a special account in compliance with section 135(6). This is a compliance check rather than a quality-of-earnings check, but a company that consistently fails this clause is signalling administrative weakness.
The governance and infrastructure question: is there a system around the numbers?
Clause (vi) asks whether cost records have been maintained under section 148(1), where prescribed. This applies to companies in certain regulated sectors — pharmaceuticals, fertilisers, sugar, certain engineering industries.
Clause (x) has two parts. The first asks whether the money raised by way of an initial public offer, further public offer (including debt instruments) was applied for the purposes for which it was raised, and if not, the details together with delays and subsequent rectification. The second asks whether the company has made any preferential allotment or private placement of shares or convertible debentures (fully, partly or optionally convertible) during the year and, if so, whether the requirements of section 42 and section 62 of the Companies Act, 2013 have been complied with and the funds raised have been used for the purposes for which they were raised. End-use of fresh equity capital is one of the most under-read items in Indian disclosures. A company that has raised four hundred crore rupees in a QIP and used it for purposes other than those stated in the placement document has a governance issue, regardless of whether the alternative use produced better economics.
Clause (xi) is the fraud clause. The auditor must report whether any fraud by the company, or on the company, has been noticed or reported during the year. If yes, the nature and amount must be stated. The auditor must also report whether any report under sub-section (12) of section 143 has been filed by the auditors in Form ADT-4 with the Central Government (this is the formal route by which auditors report frauds above one crore rupees directly to the MCA). And the auditor must report whether the auditor has considered whistle-blower complaints, if any, received during the year by the company. Read this clause carefully every year. Where the auditor reports a fraud “noticed during the year”, the actual amount is sometimes small and the disclosure short — but the fact that a fraud was found, and not disclosed in the prior year, says something durable about the control environment.
Clause (xii) is the Nidhi-companies clause. For listed equity investors this is almost always not applicable.
Clause (xiv) asks whether the company has an internal audit system commensurate with the size and nature of its business, and whether the reports of the internal auditors for the period under audit were considered by the statutory auditor. Where the answer is “Yes, considered”, the analyst should look at the company’s section in the annual report dealing with internal financial controls and read what the internal audit committee actually does.
Clause (xvi), the NBFC clause, asks whether the company is required to be registered under section 45-IA of the Reserve Bank of India Act, 1934, and whether the registration has been obtained. It also covers whether the company has conducted any non-banking financial or housing finance activities without a certificate of registration, whether the company is a Core Investment Company as defined in the RBI regulations, and if so whether it continues to fulfil the criteria, and whether the group has more than one CIC. The last sub-clause is consequential for diversified Indian business houses: a group with multiple unregistered CICs is in regulatory non-compliance.
The consolidation question
Clause (xxi) — the only clause of CARO that applies to the consolidated auditor’s report — requires the auditor to state whether there are any qualifications or adverse remarks by the respective auditors in the CARO reports of the companies included in the consolidated financial statements. If yes, the auditor must indicate the details of those companies and the paragraph numbers of the CARO reports containing the qualifications or adverse remarks. This is the clause that makes the rest of CARO genuinely useful for groups. Without clause (xxi), an analyst would have to chase down every subsidiary’s standalone auditor’s report on the MCA portal to find issues. With clause (xxi), the consolidated auditor effectively publishes a directory: subsidiary X, clause (iii)(c); subsidiary Y, clause (vii)(a); subsidiary Z, clause (xi)(a). The directory is short. Following each entry to its source is not.
How to read CARO in practice
The Order is a closed-ended questionnaire. The auditor either answers each clause or marks it not applicable. The reader’s job is therefore not interpretation but pattern recognition. There are three patterns worth learning to spot.
First: the cumulative profile. A company with three or more clauses returning anything other than a clean “Yes” or “Not applicable” is, statistically, a company with system issues. The clauses where this happens most often in poorly-run Indian companies are (iii), (vii), (ix), (xi), and (xix). When a company has issues in three of those five in a single year, that is a sustained pattern, not a one-off.
Second: the year-on-year change. Read the CARO of the previous year side by side with the current year. A clause that has gone from a clean affirmative to a qualified affirmative — particularly clauses (iii) on related-party loans, (vii) on undisputed statutory dues, or (ix) on borrowings — is a deterioration signal that often precedes accounting issues in the main statements by a year or two.
Third: the consolidated clause (xxi) cross-check. If the parent’s standalone CARO is clean but clause (xxi) of the consolidated CARO lists five subsidiaries each with qualifications, the group’s financial profile lives downstairs. This is precisely the pattern observed in several Indian holding-company structures over the last decade.
Where CARO falls short
The Order requires the auditor to answer questions, but it does not require the auditor to opine on materiality. A fraud “noticed during the year” of fifty lakh rupees in a company with revenues of fifteen thousand crore rupees is technically disclosable under clause (xi); so is a fraud of fifty crore rupees. The reader has to do the work of normalising the amount against the size of the business.
The Order also does not require the auditor to project. Clause (xix) is the closest CARO gets to forward-looking commentary — and even there, the language is grounded in observable items as at the balance-sheet date. CARO will not tell you that a company’s business model is breaking; it will tell you that the company has missed three months of provident-fund deposits, has overdue related-party loans, and was found to have surrendered four crore rupees of undisclosed income in a tax assessment. The construction of the prospective inference is the analyst’s job.
There is one final, important limitation. CARO is a creature of the Companies Act and the audit profession. It does not bind, and is not commented on by, the company’s management. The Board’s report sits separately and is signed by the directors; management discussion and analysis is the company’s voice. CARO is the auditor’s voice. When the two voices say different things in the same annual report — when the MD&A is upbeat and CARO is full of qualifications — read both, and weight CARO higher.
The instrument was sharpened in 2020 with the addition of evergreening, fraud-on-the-company, end-use of borrowed funds, asset-liability mismatch, cash losses, going-concern ratios, and outgoing-auditor consideration. The instrument did not exist in this form in 2003, when CARO was first notified, or in 2016. There is no analogue in the United States, the United Kingdom, or the European Union. It is a specifically Indian response to specifically Indian failures, and that is exactly why a foreign reader of Indian listed equity should make time for it.
The single best paragraph in any Indian annual report sits at the back. Read it.