Statutory vs Internal Audit
Statutory vs internal audit is the distinction between an audit the law requires and one a business chooses or is required to run for its own control. A statutory audit is an independent examination of the financial statements mandated by the Companies Act; an internal audit reviews processes and controls throughout the year. It matters because they serve different masters — shareholders and the law versus management — and cannot substitute for each other.
What Is Statutory vs Internal Audit?
A statutory audit is a legally mandated, independent check on whether a company's financial statements give a true and fair view. It is performed by an external chartered accountant appointed by the shareholders, and it ends in an audit report addressed to them. An internal audit, by contrast, is an ongoing, management-facing review of how well the business's processes, risks and controls are working — its output is a report to the board or audit committee, not a public opinion on the accounts.
An Indian company meets both under the Companies Act 2013. Every company must have a statutory audit under Section 139, whatever its size. Internal audit becomes compulsory only for companies crossing the thresholds in Section 138 read with Rule 13 of the Companies (Accounts) Rules 2014. Below those limits a business may still run internal audit voluntarily, because the two look at different things — one certifies the numbers, the other strengthens how they are produced.
Key terms
- Standard Operating Procedure (SOP) — The documented processes internal audit tests against.
- Financial Internal Controls — The control framework both audits assess.
- Segregation of Duties (SoD) — A core control auditors check for during review.
Why Statutory vs Internal Audit Matters
Confusing the two, or skipping the one that is due, has real consequences:
- Missed statutory audit is an offence — A company that fails to get its accounts audited under Section 139 exposes directors and the company to penalties and filing defaults.
- Missed internal audit above threshold — Not appointing an internal auditor when Section 138 applies is a non-compliance the statutory auditor must flag.
- False comfort from the wrong audit — Assuming a statutory audit tests day-to-day controls leaves process weaknesses unaddressed all year.
- Weak controls surface late — Without internal audit, fraud or process gaps are found only at the statutory audit, when correction is costly.
- Governance and lender scrutiny — Boards, banks and investors expect the right audit structure; gaps weaken governance credibility.
How Statutory vs Internal Audit Works - Step by Step
The two audits run on different cycles but connect at the accounts:
- 1Appoint the auditors
Shareholders appoint the statutory auditor under Section 139; the board appoints the internal auditor under Section 138 where applicable.
- 2Internal audit runs through the year
The internal auditor tests processes, controls and compliance on a rolling plan, reporting findings to the audit committee.
- 3Management acts on findings
Control gaps raised by internal audit are remediated, strengthening the records the statutory auditor will later rely on.
- 4Statutory audit at year-end
The external auditor examines the finalised financial statements, often using internal audit work as supporting evidence.
- 5Reports issued to different bodies
The statutory report goes to shareholders with the accounts; the internal report goes to the board — the two artefacts serve distinct audiences.
Statutory vs Internal Audit: A Practical Example
| Particulars | Amount (INR) | Treatment |
|---|---|---|
| Unlisted company turnover, FY 2025-26 | 2,40,00,00,000 | Above ₹200 cr - internal audit mandatory |
| Statutory audit fee | 6,00,000 | Mandatory under Section 139 regardless of size |
| Internal audit fee | 4,50,000 | Mandatory here under Section 138 / Rule 13 |
| Control gap found and fixed mid-year | - | Internal audit; corrected before statutory audit |
A Bengaluru software company with a ₹240 crore turnover crosses the ₹200 crore mark, so internal audit is mandatory under Section 138 alongside its always-required statutory audit. During the year the internal auditor finds purchase approvals being bypassed and gets the control fixed. By the time the statutory auditor arrives, the process is clean — showing how the two audits complement rather than duplicate each other.
Assuming statutory audit covers controls: Relying on the year-end statutory audit to police daily processes leaves control gaps open all year → run internal audit for process assurance.
Statutory Position and Due Dates for Statutory vs Internal Audit
| Provision | Applies to | Due date / threshold |
|---|---|---|
| Statutory audit - Section 139, Companies Act 2013 | Every company, regardless of turnover or size | Auditor appointed at AGM; report with the annual accounts |
| Internal audit - Section 138 + Rule 13 (unlisted public co.) | Paid-up capital ≥ ₹50 cr, or turnover ≥ ₹200 cr, or loans/borrowings > ₹100 cr, or deposits ≥ ₹25 cr | Internal auditor appointed by the board |
| Internal audit - Section 138 + Rule 13 (private co.) | Turnover ≥ ₹200 cr, or loans/borrowings from banks/PFIs > ₹100 cr | Internal auditor appointed by the board |
| Tax audit - Section 44AB, Income Tax Act 1961 | Business turnover > ₹1 cr (> ₹10 cr if cash receipts & payments ≤ 5%); profession > ₹50 lakh | Report by the specified due date each year |
Law stated as at 22 July 2026. Statutory audit is universal; internal audit is threshold-based; tax audit under Section 44AB is a separate income-tax requirement. Verify the current thresholds before applying them, as limits are periodically revised.
Common Mistakes With Statutory vs Internal Audit
These errors flow from treating the two audits as interchangeable:
- Assuming statutory audit covers controls — Relying on the year-end statutory audit to police daily processes leaves control gaps open all year → run internal audit for process assurance.
- Missing the internal-audit threshold — Crossing the Section 138 limits without appointing an internal auditor is a non-compliance → monitor turnover and borrowings against the thresholds.
- Using the statutory auditor for internal audit — The same firm cannot do both for a company; independence rules bar it → appoint separate auditors for the two functions.
- Ignoring tax audit — Treating the Section 44AB tax audit as the same as the statutory audit misses a distinct income-tax duty → track the 44AB thresholds separately.
Statutory vs internal audit is the distinction between an audit the law requires and one a business chooses or is required to run for its own control. A statutory audit is an independent examination of the financial statements mandated by the Companies Act; an internal audit reviews processes and controls throughout the year. It matters because they serve different masters — shareholders and the law versus management — and cannot substitute for each other.
Need help with Statutory vs Internal Audit?
Statutory vs Internal Audit sits inside your day-to-day books. Patron's CA-led team keeps them accurate, compliant and audit-ready.
Applicable framework: Companies Act 2013 (Section 139 statutory audit; Section 138 + Rule 13 internal audit); Income Tax Act 1961 (Section 44AB). For general information only, not professional advice. Verify the current position for your entity before acting.