In this guide
The difference between an internal audit and a statutory audit comes down to who asks for it and why. A statutory audit is compulsory under Section 139 of the Companies Act, 2013: an independent chartered accountant examines the annual financial statements and gives shareholders an opinion on whether they show a true and fair view. An internal audit is a continuous management function that tests the reliability of controls, processes and compliance through the year, and it is only mandatory once a company crosses the size thresholds in Section 138. The two run in parallel, they answer to different people, and one firm is not allowed to do both.
Statutory audit meaning
A statutory audit is an audit that a statute makes compulsory. For companies, that statute is the Companies Act, 2013. Under Section 139, every company must appoint a statutory auditor at its first annual general meeting to hold office for five years, and under Section 143 the auditor reports to the members (the shareholders), not to management. The output is a formal audit report expressing an opinion on the financial statements prepared under the Schedule III format, tested against the applicable accounting standards notified by the Ministry of Corporate Affairs.
The statutory auditor must be independent. That independence is why the appointment sits with the shareholders and why the reporting line bypasses the finance team whose numbers are under examination. If you want the fuller commercial picture of assurance and closing work, our Accounts Reconciliation & Audit service page sets out how a review engagement is scoped and staffed.
Internal audit meaning and the Section 138 thresholds
An internal audit is an independent, in-house or outsourced review of how well a business runs its own controls. It does not produce an opinion for shareholders. Instead it reports to the audit committee or the board, flags weaknesses in financial internal controls, and recommends fixes. Section 138 of the Companies Act, read with Rule 13 of the Companies (Accounts) Rules, 2014, makes internal audit mandatory for a defined set of companies.
The companies that must appoint an internal auditor are: every listed company; every unlisted public company with paid-up share capital of Rs 50 crore or more, or turnover of Rs 200 crore or more, or outstanding borrowings from banks or public financial institutions exceeding Rs 100 crore, or outstanding deposits of Rs 25 crore or more; and every private company with turnover of Rs 200 crore or more, or outstanding borrowings exceeding Rs 100 crore. The tests are applied on the figures of the preceding financial year, so a company that grows past a limit this year picks up the obligation next year.
Internal audit vs statutory audit: the core differences
The cleanest way to hold the two apart is to compare them on who appoints, who receives the report, and what the output is. The table below summarises the points that matter in Indian practice.
| Feature | Statutory audit | Internal audit |
|---|---|---|
| Governing law | Section 139, Companies Act, 2013 | Section 138 + Rule 13 |
| Compulsory for | Every company | Only companies above the Section 138 thresholds |
| Appointed by | Shareholders (at the AGM) | Board or audit committee |
| Reports to | Members / shareholders | Board or audit committee |
| Who can do it | Chartered accountant in practice only | CA, cost accountant or in-house team |
| Output | Opinion on true and fair view | Findings and recommendations on controls |
| Timing | Once a year, after year-end | Continuous, through the year |
The two are not substitutes. A company crossing the Section 138 limits needs both, and Section 144 bars a statutory auditor from also rendering internal audit services to the same company, its holding company or its subsidiary. That prohibition extends to the firm's network entities. The statutory auditor may, however, place reliance on the internal auditor's work under Standard on Auditing (SA) 610 issued by the Institute of Chartered Accountants of India, provided it assesses that work for competence and objectivity first.
Difference between internal and external audit
People often use "external audit" and "statutory audit" interchangeably, and in the Indian company context they usually mean the same engagement: the independent audit required by law. The label "external" simply stresses that the auditor sits outside the organisation. The real contrast is external versus internal: an external (statutory) auditor is appointed by and reports to shareholders, while an internal auditor is appointed by and reports to management or the board. External audit looks backward at a completed set of accounts; internal audit looks continuously at the machinery producing those accounts, testing things like segregation of duties and the month-end close discipline.
Types of audit in India: the four you will hear about
When people ask about the two main types of auditing, they usually mean the internal versus external split covered above. When they ask about the four types of audit, they are pointing at the distinct statutory audits an Indian business can face at once. Each has a different appointing authority, scope and reporting format.
- Statutory audit under the Companies Act, on the financial statements.
- Internal audit under Section 138, on controls and processes.
- Tax audit under Section 44AB of the Income Tax Act, once turnover or gross receipts cross the prescribed limit, reported to the Income Tax Department in Form 3CA/3CB and 3CD.
- GST audit / reconciliation through the annual self-certified statement in Form GSTR-9C for registrations above the notified turnover.
A cost audit under Section 148 applies on top of these for specified manufacturers. Internal audit work itself is usually grouped into three streams: operational audits that test efficiency, compliance audits that test adherence to law and policy, and financial audits that test the reliability of reported numbers. Many charters add an information systems audit as a fourth stream. Reconciliation-heavy areas often trigger the deepest internal audit work; if that is your pressure point, see our note on common reconciliation errors and how to fix them.
The internal audit process: four phases
The internal audit process is commonly described as four phases (also called the four primary stages of an audit). Whether you run it in-house or outsource it alongside backlog bookkeeping and catch-up work, the sequence is the same.
- Planning: agree the scope with the audit committee, assess risk, and decide which processes and periods to test.
- Fieldwork: gather evidence, walk through transactions, sample entries and test whether controls such as three-way matching actually operate as designed.
- Reporting: write up findings, rate them by risk, and give management clear, actionable recommendations.
- Follow-up: revisit earlier findings to confirm that agreed fixes were implemented and are working.
The payables and receivables cycles are where most findings cluster, because that is where authority, cash and record-keeping meet. Outsourced accounts payable and accounts receivable teams that run to a documented standard operating procedure tend to sail through fieldwork with fewer exceptions.
The 5 C's, 7 principles and 5 standards of internal audit
Internal audit findings are conventionally written up against the five C's: Criteria (the standard that should have been met), Condition (what was actually found), Cause (why the gap arose), Consequence (the impact or risk), and Corrective action (the recommendation). Reporting each finding through all five keeps a report honest and useful rather than a list of complaints.
The seven principles commonly taught for internal auditing are integrity, objectivity, confidentiality, competence, independence, due professional care, and evidence-based reporting. These mirror the ethical and technical expectations the ICAI sets for members. The reference to the five standards of internal audit points to the ICAI's Standards on Internal Audit, which cover matters such as planning, evidence, documentation, reporting and internal audit in an information systems environment. For assurance work generally, the Standards on Auditing referenced above (including SA 610) sit alongside them.
Worked example: running the Section 138 threshold test
The mandate is not a single number; it is a set of "or" tests, and crossing any one triggers the obligation. Take a private company closing its preceding financial year with turnover of Rs 240 crore and outstanding bank borrowings of Rs 60 crore. Apply each test that a private company faces.
| Test (private company) | Company figure (Rs cr) | Threshold (Rs cr) | Triggered? |
|---|---|---|---|
| Turnover | 240 | 200 or more | Yes |
| Outstanding borrowings | 60 | Over 100 | No |
Turnover of Rs 240 crore is above the Rs 200 crore limit, so the company must appoint an internal auditor for the current year even though its borrowings are well below the Rs 100 crore mark. Because the tests are read as "or", you never need every box ticked: the first "Yes" settles it. Note that paid-up capital and deposit tests do not apply to a private company; those two extra tests only bite on unlisted public companies.
Key terms
- Statutory vs Internal Audit: the distinction between a law-mandated opinion audit and a management-commissioned controls review.
- Financial Internal Controls: the checks that keep transactions authorised, recorded and safeguarded.
- Segregation of Duties (SoD): splitting a task so no one person can both initiate and approve it.
- Standard Operating Procedure (SOP): the documented steps an auditor tests a process against.
- Month-End Close Checklist: the routine that produces reliable interim numbers for review.
Key takeaways
- Statutory audit is compulsory for every company and reports to shareholders; internal audit is compulsory only above the Section 138 thresholds and reports to the board.
- External audit and statutory audit mean the same engagement in the company context; the true split is external versus internal.
- One firm cannot do both under Section 144, but the statutory auditor may rely on internal audit work under SA 610.
- The internal audit process runs in four phases: planning, fieldwork, reporting and follow-up.
- The Section 138 tests are "or" tests on the preceding year, so crossing any one limit triggers the obligation.
If you are trying to work out which reporting framework and which audits apply to your entity before you scope any of this, the Ind AS Applicability Checker is a quick first filter, and the reconciliation groundwork is covered in our guide to account reconciliation types and process and the balance sheet reconciliation checklist.
Decision guide
