Every board signs a line on "all applicable laws". Can yours prove it?

Section 134(5)(f) of the Companies Act, 2013 requires the Board's report to state that the directors "had devised proper systems to ensure compliance with the provisions of all applicable laws and that such systems were adequate and operating effectively". It sits in every directors' responsibility statement, and it is often approved with little discussion.

It sits beside other promises in the same statement: clause (c) on adequate accounting records and preventing and detecting fraud, and, for a listed company, clause (e) on internal financial controls that are adequate and operating effectively. Clause (f) is the widest, because it covers every law, not only those that touch the accounts.

Listed entities, other than those exempted under Regulation 15(2), carry more. Regulation 17(3) of SEBI's Listing Regulations requires the board to "periodically review compliance reports pertaining to all laws applicable to the listed entity", together with the steps taken to fix any non-compliance. Under amendments made in December 2024, from 1 April 2025 a listed entity's secretarial auditor must be a peer-reviewed company secretary appointed by shareholders for a fixed term: one term of five years for an individual, or two for a firm, followed by a five-year cooling-off period. An annual secretarial compliance report goes to the stock exchanges within 60 days of the year end.

The Regulation 15(2) exemption is narrower than it sounds. It covers a listed entity whose paid-up equity capital does not exceed ₹10 crore and whose net worth does not exceed ₹25 crore on the last day of the previous financial year, and an entity listed on an SME Exchange. A company that crosses the thresholds has six months to comply, and once the governance provisions apply they continue until both figures have stayed below the thresholds for three consecutive financial years. Since 1 April 2025, the related party rules in Regulation 23 also apply to SME-listed entities whose paid-up equity capital exceeds ₹10 crore or whose net worth exceeds ₹25 crore.

Unlisted companies are not outside this. A secretarial audit under section 204 also applies to public companies with paid-up capital of ₹50 crore or more or turnover of ₹250 crore or more, and to any company with outstanding borrowings of ₹100 crore or more from banks or public financial institutions. The board must explain in full any qualification the auditor makes.

The question behind the sentence

A director who signs that statement should be able to answer three questions. Which laws apply to us? Who owns each obligation? How do we know it was met? The answer is not a policy. It is a compliance framework: the laws that apply to each entity, unit and State, broken into actionable compliances, each with an owner, a due date, a risk rating and the evidence required, and reported to the board on a fixed rhythm.

"All applicable laws" is a list. A board that cannot see the list is signing a sentence it cannot support.

Who tells the board what

Several provisions feed the same sentence, and each carries a signature. Section 205(1)(a) makes it a function of the company secretary to report to the Board on compliance with the Act, the rules made under it and other laws applicable to the company. Under Regulation 17(7) and Part A of Schedule II, the minimum information placed before a listed board includes any non-compliance with regulatory, statutory or listing requirements, and show cause, demand, prosecution and penalty notices that are materially important.

Regulation 17(8) adds a certificate from the chief executive officer and the chief financial officer, in the form set out in Part B of Schedule II. They certify that the financial statements comply with accounting standards and applicable laws and regulations; that, to the best of their knowledge and belief, no transaction in the year was fraudulent, illegal or in breach of the code of conduct; that they accept responsibility for internal controls over financial reporting and have disclosed any deficiencies to the auditors and the audit committee; and that they have told both of significant changes in those controls and of instances of significant fraud they became aware of. In the annual report, the corporate governance section must then disclose non-compliance, penalties and strictures imposed by the stock exchanges, SEBI or any statutory authority on capital market matters over the last three years.

Each of these documents is only as good as the register beneath it. A chief executive who certifies that no transaction was illegal is relying on the same list of laws the board is.

How a compliance framework is built

Building a framework starts with scope, not software. List every legal entity, plant, office, warehouse and State, the licences each holds and the thresholds each crosses: headcount, contract workers, turnover, borrowings, listing status. Then identify the laws that apply at each point, central and State, with the rules, notifications and regulator circulars made under them. Break each law into the specific things someone must do, such as keeping a register, filing a return, renewing a licence or displaying a notice. Each becomes a line with its Act and rule reference, frequency, due date, authority, owner, risk rating and the evidence that proves it was done.

What a defensible system looks like

• A register of applicable laws for every entity, unit and State, refreshed when the business or the law changes, as it did when the Labour Codes replaced 29 central laws.
• A checklist of actionable compliances, each with the Act and rule reference, frequency, authority, owner and risk rating.
• Evidence on file for each compliance, not just a tick in a tracker.
• Exception reporting to the board or audit committee: what was missed, why, and what was done about it.
• Periodic independent testing, such as a statutory compliance audit, so that management's view is checked.
• Board and general meetings run to the Secretarial Standards, which section 118(10) makes mandatory. The current versions of SS-1 and SS-2 apply from 1 April 2024.

How it should reach the board

Regulation 17(3) asks for compliance reports "periodically" but does not fix the frequency. A quarterly cycle aligned with the results meeting is a practical rhythm. Owners certify their compliances with evidence, the company secretary consolidates them, and the board or audit committee sees the exceptions with their cause, cost and fix, rather than a page of green ticks. Once a year the cycle closes with the CEO and CFO certificate, the secretarial audit and the directors' responsibility statement.

Consider a hypothetical listed manufacturer with plants in three States. When the Labour Codes came into force on 21 November 2025, its register still cited the Factories Act and the Payment of Wages Act at every plant. In a working framework, the change in law triggers a review, the company secretary reports the gap, plant owners re-map their obligations to the Codes and to each State's rules, and the next quarterly report shows the old references retired and the new registrations, returns and appointment letters in place. In a weak one, the board approves the same responsibility statement the following year with the old checklist still in use.

Questions for the board

• Can management show us the list of laws that apply to each entity and State?
• When was the checklist last updated for a change in law, and who signed it off?
• Which compliances were missed last year, and what did each cost us?
• Has the secretarial auditor qualified anything, and has the board explained each qualification in full?
• Do the CEO and CFO certificate and the company secretary's compliance report rest on the same register that we review?
• If we rely on the Regulation 15(2) exemption, when did we last check our paid-up capital and net worth against the thresholds?