Many business owners treat audit as a single annual exercise: the auditors arrive, review the books, sign off, and leave. The reality is that there are two fundamentally different exercises at play, each with a distinct purpose, a different audience, and a different legal standing. Conflating the two leads to compliance gaps, missed governance opportunities, and genuine regulatory exposure. At CAK & Associates LLP, we frequently advise companies, from early-stage startups to established corporates, on exactly this question. Understanding the distinction between internal audit vs statutory audit is something that trips up even experienced finance teams, and the consequences of getting it wrong are measurable. This article breaks down what each audit does, who must have one under Indian law, and how to decide what your business actually needs.
What internal audit and statutory audit actually mean
Internal audit: a management-driven review of your controls
An internal audit is a structured, independent assessment of an organisation’s risk management, internal controls, governance processes, and operational efficiency. Its primary purpose is to help management improve, not to satisfy a regulator or reassure a shareholder. The audience for an internal audit is the board and senior management, and the findings stay inside the organisation. Because it serves management, it is advisory in nature, forward-looking, and process-oriented. A well-run internal audit function tells leadership what could go wrong before it actually does.
Statutory audit: the law-mandated opinion on your financials
A statutory audit is a legally required external examination of a company’s books of account and financial statements. The auditor’s job is to determine whether those statements present a true and fair view of the company’s financial position and performance. This audit is mandated by the Companies Act, 2013, and exists primarily to protect shareholders, lenders, and the public. The “internal vs external” framing that many people use is technically accurate here: a statutory audit is external by design, conducted by a party entirely independent of the company. It answers a different question from internal audit, not “are your processes working well?” but “are your published financials accurate and compliant?” The scope and objectives are defined by law and professional standards, not by management preference.
Internal audit vs statutory audit: scope and frequency compared
Internal audit: broad, flexible and ongoing
The scope of an internal audit can cover finance, operations, IT systems, payroll, procurement, compliance, and governance. Whatever the board or audit committee decides is a priority for that cycle falls within bounds. Frequency is risk-based: high-risk or fast-changing processes may be reviewed quarterly, while stable, low-risk areas might be covered once a year. There is no single mandated schedule. The audit committee typically approves the annual internal audit plan, and the scope can shift mid-year if new risks emerge, making internal audit a genuinely adaptive function rather than a calendar checkbox.
Statutory audit: fixed, annual and narrowly defined
The statutory audit scope is governed by applicable auditing standards and focuses squarely on the year-end financial statements: the balance sheet, profit and loss account, cash flow statement, and accompanying disclosures. It runs once per financial year, aligned to the accounting period ending 31 March. The audit report forms part of the company’s annual filings. The statutory auditor cannot simply decide to audit fewer areas because the company is small or the year was quiet.
Who conducts each audit and what independence requires
Appointment: who has the authority to hire each auditor
Under Section 138 of the Companies Act, 2013, the internal auditor is appointed by the Board of Directors for companies required to have an internal audit function. The internal auditor may be a chartered accountant, cost accountant, or another professional as the Board decides, and may be an employee of the company or an external firm. The statutory auditor follows different rules: the first statutory auditor is appointed by the Board within 30 days of incorporation, but all subsequent appointments are made by the shareholders at the Annual General Meeting. The statutory auditor must be a practising chartered accountant or a CA firm eligible under the Act.
Qualification and independence: where the rules get strict
Internal auditors must maintain functional independence, in practice, this means direct or effective reporting to the audit committee and no involvement in the functions they are auditing. Statutory auditors face considerably stricter legal disqualification rules under the Companies Act. One rule worth noting explicitly: a statutory auditor cannot simultaneously act as the internal auditor of the same company. These are not interchangeable roles, and the law treats the conflict seriously. On rotation, individual statutory auditors are limited to five consecutive years with a company, and audit firms to ten consecutive years, after which a cooling-off period applies before re-appointment is possible.
Which Indian companies must have a statutory audit by law
The Companies Act, 2013: mandatory with no turnover exemption
Every company incorporated in India must have a statutory audit, without exception. Private limited companies, public limited companies, One Person Companies, Section 8 companies, dormant companies, and small companies all fall within the requirement. There is no turnover threshold, no profit threshold, and no activity threshold that removes this obligation. A company with zero transactions in a financial year still needs its accounts audited. The key provisions governing this framework are Sections 129, 139, and 143, which cover the preparation of financial statements, auditor appointment, and auditor duties respectively.
What about LLPs and sole proprietorships?
LLPs are not companies under the Companies Act and are governed separately; their audit requirements are based on turnover and contribution thresholds rather than a blanket mandate. Sole proprietorships and partnerships are not covered by the Companies Act audit mandate at all, their audit requirements, if any, arise from other statutes such as the Income Tax Act or GST rules.
This distinction matters in practice for founders who convert from a partnership or LLP to a private limited company. The statutory audit obligation kicks in immediately from the year of incorporation, with no grace period based on size or revenue, a point that is easy to miss in the middle of a restructuring.
What each audit produces: reports, opinions and deliverables
Internal audit deliverables: findings, risk ratings and action plans
A typical internal audit report covers the scope and objectives of the review, control findings with root-cause analysis, a risk rating for each finding (high, medium, or low), specific recommendations, and a management action plan with named owners and target dates. For example, an IT access review might produce a finding such as: “Three user accounts remained active after employee termination; recommend monthly access recertification and same-day deprovisioning for leavers.” Follow-up reports then track implementation status of prior recommendations, giving the board real visibility on whether controls are actually improving or whether agreed actions are being deferred.
Statutory audit deliverables: the formal opinion and CARO
The statutory auditor issues an independent auditor’s report expressing an opinion on whether the financial statements give a true and fair view in accordance with applicable accounting standards and the Companies Act. Where applicable, the auditor also issues a report under CARO (Companies Auditor’s Report Order), which covers specific matters such as loans, fraud, and asset verification. If material weaknesses in internal financial controls are identified, a separate report on internal financial controls is issued as well. Management also typically receives a letter noting deficiencies for remediation, distinct from the formal audit opinion filed with the ROC.
Internal audit vs statutory audit: key differences for Indian companies
Before moving to compliance steps, it helps to see the core distinctions at a glance:
| Dimension | Internal Audit | Statutory Audit |
|---|---|---|
| Purpose | Improve controls, governance and operational efficiency | Express an opinion on financial statements |
| Primary audience | Board and senior management | Shareholders, lenders, regulators |
| Legal basis | Section 138, Companies Act, 2013 (threshold-based) | Sections 129, 139 & 143, Companies Act, 2013 (universal) |
| Frequency | Risk-based; quarterly to annual | Once per financial year |
| Output | Internal report with findings and action plans | Auditor’s report filed with ROC; CARO where applicable |
| Auditor independence | Functional independence required | Strict legal disqualification and rotation rules |
Choosing the right audit approach for your business
A short compliance checklist for statutory audit readiness
If you want to avoid last-minute scrambles before your AGM, work through this list well ahead of your filing deadline:
- First auditor appointed by the Board within 30 days of incorporation
- Subsequent auditor appointments ratified at the AGM
- Books of account maintained in accordance with Section 128 of the Companies Act, 2013
- Financial statements prepared per applicable accounting standards
- Auditor rotation tracked, with cooling-off periods noted in your compliance calendar
- Audit report filed as part of AOC-4 (within 30 days of AGM) and annual return filed via MGT-7 (within 60 days of AGM)
- CARO applicability assessed for the current financial year
Missing the auditor appointment deadline carries real consequences: under Section 147, a company can face a fine of ₹25,000 to ₹5,00,000, and officers in default face separate personal penalties. The downstream consequence is equally real, audited financial statements are needed before AOC-4 can be filed, so a delayed appointment creates a compliance pile-up.
When internal audit adds real value beyond regulatory compliance
Internal audit is not mandatory for every company, but Section 138 makes it compulsory for:
- Listed companies, all listed entities, regardless of size
- Unlisted public companies meeting any of the following thresholds: turnover of ₹200 crore or more; paid-up share capital of ₹50 crore or more; outstanding borrowings exceeding ₹100 crore; or deposits exceeding ₹25 crore
- Private limited companies with turnover of ₹200 crore or more, or outstanding loans exceeding ₹100 crore
Beyond the mandate, the business case is straightforward. Companies that invest in a structured internal audit function catch control failures before those failures become financial losses or regulatory action. Statutory auditors find problems after the year has closed; internal auditors find them while there is still time to fix them.
How CAK & Associates LLP can help you get both right
CAK & Associates LLP provides both statutory audit and internal audit services to clients across industries, advising on which combination of assurance is appropriate for a company’s size, sector, and risk profile. Founded in 1971 and operating from offices in Pune and Mumbai, the firm brings institutional depth and current regulatory knowledge built over decades of practice, including experience serving clients across 15 countries. Businesses that are unsure whether they need an internal audit, a statutory audit, or both are welcome to consult the team to map their obligations and build a genuinely audit-ready compliance posture.
The bottom line on audit obligations for Indian companies
When weighing up internal audit vs statutory audit, the starting point for any Indian company is straightforward: statutory audit is a legal obligation that every company incorporated in India must meet, full stop. There is no size-based escape, no dormancy exemption, and no flexibility on the appointment timeline. Internal audit is a management tool, mandated for certain company types above defined thresholds, but genuinely valuable for any business that wants to catch problems before external auditors or regulators do.
The two are not interchangeable. They serve different masters, produce different outputs, and carry different legal weight. A company that has its statutory audit in order but no internal audit function is compliant but exposed to undetected operational risk. A company with a strong internal audit function but a lapsed statutory auditor appointment is in outright default.
If your company has not reviewed its audit obligations this financial year, now is the right time, before your AGM deadline, not after. A review of your auditor appointment status, rotation schedule, and internal audit mandate takes considerably less effort than addressing a penalty notice at your next board meeting.
Frequently asked questions
Who must get a statutory audit in India?
Every company incorporated in India under the Companies Act, 2013 must have a statutory audit, regardless of turnover, profit, or activity level. This includes private limited companies, One Person Companies, small companies, and dormant companies. LLPs and sole proprietorships are governed by separate statutes and are not subject to the same blanket requirement.
Can the same firm conduct both internal audit and statutory audit?
No. Under the Companies Act, 2013, a statutory auditor is disqualified from simultaneously acting as the internal auditor of the same company. The two roles carry different independence requirements and must be held by different individuals or firms.
Is internal audit mandatory for private limited companies?
Not for all private limited companies. Under Section 138, internal audit becomes mandatory for private limited companies with a turnover of ₹200 crore or more, or with outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore. Companies below these thresholds are not legally required to have an internal audit, though it remains good governance practice.
What happens if a company misses its statutory auditor appointment?
Under Section 147 of the Companies Act, 2013, the company faces a fine of ₹25,000 to ₹5,00,000. Officers in default face separate personal penalties. A delayed appointment also creates a compliance cascade: without a completed statutory audit, the company cannot file its financial statements via AOC-4, which in turn delays the annual return filing via MGT-7.
