CARO Report: What the Auditor’s 21-Question Checklist Tells You

Flip to the back of any listed company’s annual report, past the glossy chairman’s letter and the segment numbers, and you will find the independent auditor’s report. Attached to it is an annexure that most investors never open: the CARO report. It is a set of yes-or-no answers the statutory auditor must give on 21 specific questions, from whether the company actually owns the land it says it owns to whether it has been sitting on unpaid GST and provident fund dues. We think it is one of the most underused documents in Indian equity research, because the questions are fixed by law and the auditor cannot simply skip the uncomfortable ones.

This piece walks through what the order requires, which companies it covers, and the clauses that deserve a slow read. The rules come straight from the text of the Companies (Auditor’s Report) Order, 2020 as notified by the Ministry of Corporate Affairs. If you want the wider picture of reading company numbers first, start with our guide on how to analyse quarterly results of a company.

What a CARO report is, and where the rule comes from

CARO stands for the Companies (Auditor’s Report) Order. The Central Government issued the current version on 25 February 2020 under Section 143(11) of the Companies Act, 2013, replacing the 2016 order, after consulting the National Financial Reporting Authority. The government’s press release on CARO 2020 described it as an order that would need enhanced due diligence by auditors and greater transparency about a company’s financial affairs.

The order was first meant to apply to financial years beginning on or after 1 April 2019. That date was pushed back, and the final extension came through an MCA order dated 17 December 2020, and as the ICAI announcement on the extension explains, CARO 2020 applies from FY 2021-22 onwards. So every annual report you read for FY22 or later, for a company within its scope, should carry these answers.

The mechanics are simple. Paragraph 3 of the order lists the matters the auditor must comment on, numbered (i) to (xxi). Paragraph 4 says that where any answer is unfavourable or qualified, the auditor must also state the basis for it. That second rule matters: a bare “no” is not allowed. You get the reason.

Which companies have to carry one

The order applies to every company, including a foreign company as defined in the Companies Act, with five exceptions:

• banking companies under the Banking Regulation Act, 1949;
• insurance companies under the Insurance Act, 1938;
• companies licensed to operate under Section 8 of the Companies Act;
• One Person Companies and small companies, as defined in Section 2(62) and Section 2(85) of the Companies Act;
• a private limited company that is not a subsidiary or holding company of a public company, provided its paid-up capital plus reserves and surplus is not more than ₹1 crore on the balance sheet date, its borrowings from any bank or financial institution never exceed ₹1 crore at any point in the year, and its total revenue (including from discontinuing operations) is not more than ₹10 crore for the year.

Two practical points follow. First, you will not find a CARO annexure in the annual report of HDFC Bank or a listed life insurer; that is by design, not an omission. Second, the small company exemption points to the definition in Section 2(85), not a fixed number, so whenever MCA revises the small company limits, the CARO exemption moves with it. For most listed companies this rarely matters, but it is worth knowing if you track unlisted firms before an IPO.

One more wrinkle. The order does not apply to the auditor’s report on consolidated financial statements, with one exception: clause (xxi). That clause asks whether the auditors of the companies included in the consolidation have made any qualifications or adverse remarks in their own CARO reports, and if so, which companies and which paragraph numbers. For a holding company with dozens of subsidiaries, this is the quickest way to find out whether trouble is hiding one level down.

The questions in a CARO report are fixed by law. The auditor can answer “no”, but must then explain why, and that explanation is often the most honest paragraph in the annual report.

The clauses that tell you the most

All 21 clauses are worth a glance, but a handful carry most of the signal for a shareholder. Here is how we read them.

Clause (i): does the company own what it says it owns?

The auditor must say whether proper records are kept for property, plant and equipment and intangible assets, whether management has physically verified the assets at reasonable intervals, and, crucially, whether the title deeds of all immovable properties shown in the financial statements are held in the company’s name. Leased property with a properly executed lease is carved out. Where a deed is not in the company’s name, the order prescribes a table: description of the property, gross carrying value, whose name it is held in, whether that person is a promoter, director, a relative of theirs or an employee, how long it has been held that way, and why. A factory sitting in a promoter’s personal name is exactly the sort of detail that never makes it to an earnings call.

The same clause asks about revaluation. If the company revalued its assets during the year, the auditor must say whether a registered valuer did it, and specify the amount of change if it is 10% or more of the aggregate net carrying value of any class of assets. It also covers any proceedings against the company for holding benami property under the Benami Transactions (Prohibition) Act, 1988.

Clause (ii): inventory and the bank’s stock statements

Two checks here. The first asks whether management physically verified inventory at reasonable intervals and whether discrepancies of 10% or more in aggregate for any class of inventory were found and dealt with in the books. The second applies when the company has been sanctioned working capital limits above ₹5 crore in aggregate, at any point in the year, from banks or financial institutions against the security of current assets. The auditor must then say whether the quarterly returns or statements filed with those lenders agree with the books, and give details if they do not.

That second test is quietly powerful. A company that tells its bank one inventory number and its shareholders another has a problem, and this clause is where the gap gets written down.

Clause (iii) and (iv): loans, guarantees and investments

Clause (iii) asks for the aggregate amount of loans, advances in the nature of loans, guarantees and security given during the year, and the balance outstanding at year-end, split between subsidiaries, joint ventures and associates on one side and everyone else on the other. The auditor must also comment on whether the terms are prejudicial to the company’s interest, whether repayment schedules exist and are being followed, and the total amount overdue for more than ninety days.

Look closely at sub-clause (e). If a loan falling due during the year was renewed, extended or settled by granting a fresh loan to the same party, the auditor has to give the aggregate amount and its percentage of the total loans granted during the year. Sub-clause (f) asks for loans repayable on demand or without any specified terms, including the amount given to promoters and related parties. Clause (iv) then asks whether, for loans, investments, guarantees and security, Sections 185 and 186 of the Companies Act have been complied with. Note that sub-clauses (a) and (e) do not apply to companies whose principal business is lending.

Clause (vii): unpaid statutory dues

The auditor states whether the company is regular in depositing undisputed statutory dues such as GST, provident fund, employees’ state insurance, income tax, customs duty and cess. Any arrears outstanding at year-end for more than six months from the date they became payable must be disclosed. Dues held back because of a dispute are listed separately with the amount and the forum where the dispute is pending, and the order specifically says a mere representation to the department does not count as a dispute.

A company that cannot pay its PF on time is usually short of cash, whatever the profit and loss account says.

Clause (ix): borrowings and defaults

This is the one lenders and credit analysts head to first. It asks whether the company has defaulted on any loan or interest payment, with a table showing the nature of the borrowing, the lender, the amount unpaid, whether it is principal or interest, and the number of days of delay. It also asks whether the company has been declared a wilful defaulter by any lender, whether term loans were used for their stated purpose, whether short-term funds were used for long-term purposes, and whether the company raised loans by pledging shares of its subsidiaries, joint ventures or associates.

Short-term money funding long-term assets is a classic early warning sign of an asset-liability mismatch. Here the auditor has to put a number on it.

Clauses (x) and (xi): fund use and fraud

Clause (x) asks whether money raised through an IPO or a follow-on public offer during the year, including debt instruments, was applied for the stated purposes. It also covers preferential allotments and private placements, and compliance with Sections 42 and 62. If you bought into an IPO, this is where the auditor confirms whether the issue proceeds went where the prospectus said they would. Our explainer on what an auditor resignation signals pairs well with this clause.

Clause (xi) asks whether any fraud by or on the company was noticed or reported during the year, with its nature and amount, whether the auditor filed a fraud report with the Central Government in Form ADT-4, and whether whistle-blower complaints received during the year were considered.

Clauses (xvii) to (xix): cash losses and the going-concern check

Clause (xvii) asks whether the company incurred cash losses in the year and in the previous year, and how much. Clause (xviii) asks whether the statutory auditor resigned during the year and whether the incoming auditor considered the issues raised by the outgoing one. If you have read our piece on auditor rotation rules in India, you will see why a mid-term exit is a very different thing from a scheduled change.

Clause (xix) is the closest CARO gets to a solvency opinion. Based on financial ratios, ageing and expected realisation of assets and payment of liabilities, the auditor states whether there is no material uncertainty, as on the report date, that the company can meet its liabilities as and when they fall due within one year from the balance sheet date.

If a company’s CARO annexure suddenly grows from two pages to six, the extra pages are rarely good news.

A worked example of reading a CARO report

Let us take a hypothetical mid-sized manufacturer, call it Company X. Every number below is invented purely to show the arithmetic.

Inventory check. Company X holds two classes of inventory. Raw materials show ₹4.00 crore in the books, and the year-end physical count finds ₹3.50 crore. The gap is ₹0.50 crore, or 12.5% of the book value. Finished goods show ₹6.00 crore in the books and ₹5.70 crore on the floor, a gap of ₹0.30 crore, or 5%. The order looks at discrepancies of 10% or more in aggregate for each class of inventory, so the raw material gap crosses the line and the auditor must report whether it was properly dealt with. The finished goods gap does not reach that threshold. Notice that if you lumped both classes together, the total gap would be ₹0.80 crore on ₹10.00 crore, just 8%, and the problem would vanish. That is precisely why the test works class by class.

Working capital limit. Company X has a cash credit limit of ₹12 crore sanctioned against its stock and receivables. That is above the ₹5 crore aggregate trigger, so the auditor must compare the quarterly stock statements sent to the bank with the books. Suppose the September quarter statement shows receivables of ₹9 crore while the books show ₹7 crore. The auditor has to report that the two do not agree and give the details.

Loan renewals. During the year Company X lent ₹20 crore in total to group entities. Of the loans that fell due, ₹6 crore were simply extended instead of being repaid. Under clause (iii)(e) the auditor reports the ₹6 crore and its share of total loans granted during the year: 6 divided by 20, or 30%. Nearly a third of the lending being rolled over is the kind of fact that does not show up in the headline EBITDA.

Put those three findings side by side and you have a company that may report healthy profits while its inventory records, bank filings and group lending all need a second look. None of that needs a forensic accountant. It needs twenty minutes with the annexure.

How to use the CARO report in your own research

• Compare years. Read the current CARO annexure next to last year’s. New qualifications, new defaults or new disputed tax amounts are more telling than a single year’s snapshot.
• Read the “basis” paragraphs. Paragraph 4 of the order forces the auditor to explain every unfavourable or qualified answer. Skip the boilerplate “yes” answers and go straight to these.
• Check consolidated clause (xxi). For groups, this tells you which subsidiaries carry adverse remarks in their own CARO reports.
• Match against the main audit opinion. A clean audit opinion with a messy CARO annexure is worth noting, and so is an emphasis of matter paragraph that points to the same issue.
• Don’t over-read a clean annexure. CARO answers are based on the auditor’s examination and the information given to them. A clean report lowers the odds of a nasty surprise; it does not rule one out.

Where the CARO report falls short

It is a checklist, and checklists have edges. The order tells the auditor what to answer, not how deeply to dig, and many responses are framed around whether something was “noticed” or “reported”. Banks and insurers are outside its scope altogether, so the tool simply does not exist for them. And it is an annual document. A default that happens in May will not appear until the next annual report, often more than a year later. Use it as one input among several, along with the cash flow statement, related party notes and the main audit opinion.

The bottom line on the CARO report

The CARO report is the statutory auditor answering the same 21 questions for every company within its scope, year after year. That consistency is its real value: you can compare companies and track one company across time on questions about title deeds, inventory, loans to group firms, unpaid dues, defaults, fund use and fraud. Read the qualified answers, compare with last year, and check clause (xxi) for groups. It costs nothing but time, and it is already sitting in the annual report you downloaded.

Disclaimer: This article is for education only and is not investment advice. The worked example uses hypothetical figures. Read the company’s full annual report and consult a SEBI-registered adviser before making investment decisions.