Expert verified
Written By – PKC Desk, Edited By – Gowrav, Reviewed By – Vignesh
TL;DR Summary:
A statutory audit is a mandatory, once-a-year independent check by an external CA to confirm your financial statements are true and legally compliant. Internal audit is an ongoing (sometimes mandatory for larger firms) review of controls and processes performed for management to improve operations and prevent risks.
Understanding the difference between Statutory Audit vs Internal Audit in India is essential for corporate governance, legal compliance, and internal risk management.
While both audits are important, they serve distinct purposes, follow different regulations, and report to separate authorities. Learn all about these differences here.
Both involve a CA. Both involve looking at your numbers. After that, they’re really quite different. Here’s the whole thing side by side before we get into the details.
Difference Between Internal Vs Statutory Audit in India
Before we go into the details of the difference between internal audit and statutory audit in India, let’s take an overview in this comparison table
| Parameter | Statutory Audit | Internal Audit |
| Purpose | Check if financial statements are true and fair | Check if internal processes and controls actually work |
| Mandatory? | Yes, for every company | Only above certain size thresholds |
| Governing law | Companies Act, Section 143 | Companies Act, Section 138 & Rule 13 |
| Who conducts it | An independent practising CA or CA firm | A CA, cost accountant, board-approved professional, or even staff |
| Reports to | Shareholders (and the ROC) | The board or audit committee, and management |
| Frequency | Once a year | Ongoing — monthly, quarterly, or as the board decides |
| Main focus | Past year’s numbers and legal compliance | Risks, controls, efficiency, fraud prevention |
| Output | Formal audit report filed with the MCA | Internal report with findings and fixes for management |
| Independence | Must be fully external and independent | Independent of the area audited, but can be in-house |
| Can the same firm do both? | No — not for the same company | No — the statutory auditor is barred from this |
The Short Answer: What’s the Key Difference?
| In two sentencesA statutory audit is a once-a-year, legally required check by an outside CA to confirm your financial statements are accurate and meet the law.An internal audit is an ongoing, mostly voluntary review of how well your day-to-day controls and processes are working, done for management’s own benefit. |
Put simply: the statutory audit looks backward at your numbers to satisfy the law and your shareholders. The internal audit looks inward at your systems to help you run a tighter, safer business. One is about compliance; the other is about improvement. You can need both at the same time, and for bigger companies, you do.
Who Conducts Each: External CA vs Internal Function
A statutory audit must be done by an independent, practising Chartered Accountant or a CA firm, appointed by the shareholders. The whole point is independence – this person has no role in running the company, so their opinion carries weight with banks, statutory auditors for investors, and regulators.
An internal audit is more flexible on who does it. It can be a Chartered Accountant, a cost accountant, or another professional your board approves. It can even be a qualified employee, as long as they’re independent of the area they’re checking – you wouldn’t have someone audit their own department. Many companies bring in an outside firm anyway, because a fresh pair of eyes tends to spot what insiders miss.
Mandatory vs Voluntary: Who Needs What in India
This is where most of the confusion lives, so let’s be precise.
Statutory audit: mandatory for every company registered under the Companies Act, 2013 – private limited, public limited, even a one-person company. Profit, loss or no activity at all, it makes no difference. There’s no turnover threshold; being a company is enough.
Internal audit: only mandatory once you cross certain sizes under Section 138 and Rule 13. Here’s who’s actually required to have one:
• All listed companies — always, no matter the size.
• Unlisted public companies — if, in the previous year, turnover was ₹200 crore or more, OR paid-up capital was ₹50 crore or more, OR borrowings from banks/financial institutions crossed ₹100 crore, OR deposits were ₹25 crore or more.
• Private companies — if turnover was ₹200 crore or more, OR borrowings from banks/financial institutions crossed ₹100 crore.
LLPs and one-person companies are generally outside the internal audit rule. And here’s the thing worth remembering: even if you’re below these limits and not legally required to have an internal audit, plenty of smaller companies choose to run one anyway. If you’ve got inventory across several locations, lots of vendors, or you’re about to raise funding, an internal audit often pays for itself by catching leaks and weak controls before they cost you.
Scope, Reporting Line and Frequency, Compared
The two audits feel different in practice, mostly because of who they answer to and how often they happen.
Scope. The statutory audit is fixed by law — it’s about whether the financial statements are true and fair and follow the accounting standards. The internal audit’s scope is whatever your board or audit committee decides it should be: it might dig into procurement one quarter, payroll the next, and IT controls after that.
Reporting line. The statutory auditor reports to the shareholders, and the report is filed with the MCA for the world to see. The internal auditor reports privately to the board or audit committee — their findings are for management to act on, not for public filing.
Frequency. Statutory audit happens once a year, tied to your financial year-end. Internal audit is ongoing — monthly, quarterly, or whatever rhythm the board sets. It’s a continuous health check rather than an annual exam.
Can the Same CA Firm Do Both?
This comes up constantly, and the honest answer is: not for the same company. Under Section 144 of the Companies Act, 2013, a statutory auditor is specifically barred from also providing internal audit services to that same company (or its holding or subsidiary companies). The reason is independence — if the same firm designed and checked your controls, they’d effectively be reviewing their own work, which defeats the purpose of an independent audit.
So you’ll always need two different firms (or one firm and an in-house function) for the same company. That said, there’s nuance worth knowing:
• A firm that does the statutory audit for one company can happily do the internal audit for a completely different company. The bar is per-company, not blanket.
• The restriction applies while the firm is the statutory auditor. Once a firm has properly resigned or its term has ended, it may take on other roles later, subject to ethical safeguards and any rotation rules. This is a specialist area — get professional advice before relying on it.
A mid-tier firm like ours can absolutely handle both functions — just split across the right entities and engagements so the independence rules are never breached. That’s a normal part of how a multi-service CA firm is structured.
Which Audit Does Your Business Need Right Now?
Not sure where you stand? Run through these quick questions in order.
• Are you a registered company (private, public, or OPC)? If yes, you need a statutory audit — full stop, regardless of size. If you’re an LLP or a partnership firm, a statutory audit depends on your own governing law and turnover, so check separately.
• Are you a listed company? If yes, you also need an internal audit — always.
• Are you an unlisted public company? Check the four thresholds (turnover ₹200cr, capital ₹50cr, borrowings ₹100cr, deposits ₹25cr). Cross any one and internal audit is mandatory.
• Are you a private company? Internal audit is mandatory only if turnover hit ₹200 crore, or bank/FI borrowings crossed ₹100 crore, last year.
• Below all the thresholds? You’re not legally required to do an internal audit — but consider one voluntarily if you have complex operations or you’re prepping for investment.
| PKC Audit & Assurance ServicesWhether you need a statutory audit, an internal audit, or both across your group, PKC handles the full range — structured the right way so the independence rules are always respected.Talk to our audit team today — call +91 91761 00095 or book your FREE 30-minute consultation. |
Why It’s Worth Having Both When You Can
It’s easy to see the statutory audit as the “real” one because it’s compulsory, and to treat internal audit as optional extra cost. But they do genuinely different jobs. The statutory audit tells the outside world your numbers can be trusted. The internal audit tells you, the owner, where money might be leaking, where a control is weak, or where a process is quietly breaking. One protects your credibility; the other protects your cash. Companies that run both well tend to sail through their statutory audit precisely because the internal audit caught the problems months earlier.
Frequently Asked Questions
Is statutory audit mandatory in India?
Yes. Every company registered under the Companies Act, 2013 must have a statutory audit every year — private limited, public limited, and one-person companies included. It doesn’t matter whether the company made a profit, a loss, or didn’t trade at all. There’s no turnover threshold; simply being a company makes it compulsory.
What is the difference between internal and statutory audit?
A statutory audit is a yearly, legally required check by an independent outside CA, confirming your financial statements are accurate and follow the law, with the report going to shareholders and the ROC. An internal audit is an ongoing review of your internal controls and processes, done for management’s benefit and reported to the board, and it’s only mandatory above certain size thresholds.
Can an internal auditor also do the statutory audit?
Not for the same company. Section 144 of the Companies Act bars the statutory auditor from also acting as internal auditor for that company, to keep both roles independent. A firm can do the statutory audit for one company and the internal audit for a different company without any problem – the restriction is company-specific.
How often is internal audit required?
There’s no fixed legal frequency. The law leaves it to your board or audit committee to decide the scope and how often the internal audit runs – commonly monthly or quarterly, depending on the size and risk of the business. The statutory audit, by contrast, is once a year.
Disclaimer: This blog is for general information only and is not legal or financial advice. Thresholds and rules can change, and some entities have their own audit requirements. Please speak to a qualified professional about your specific situation.
