Audit · internal vs statutory

Internal audit vs statutory audit: what actually differs.

Two different audits, two different laws, two different reporting lines. Section 138 applicability, who appoints whom, scope, and where the two functions intersect — for practising CAs and articled assistants.

Reviewed July 2026
6 min read
CA Anil Agarwal & the TatvaBooks team

What is internal audit vs statutory audit?

Statutory audit is an audit mandated by law — under the Companies Act 2013 for companies, or the LLP Act for LLPs above the notified threshold. Its job is narrow and specific: form an independent opinion on whether the financial statements give a true and fair view. It is annual, and the report goes to shareholders and gets filed with the Registrar.

Internal audit is a management function — an evaluation of the entity's internal controls, risk management and governance processes. For most companies it is a voluntary, Board-driven exercise. For prescribed classes of companies it becomes mandatory under Section 138 of the Companies Act 2013. Either way, it reports internally — to management or the Audit Committee — not to the public.

The two are not competing versions of the same thing. A company can have both running at once, appointed differently, reporting to different people, answering different questions.

Internal audit applicability — Section 138

Section 138 read with the relevant rules prescribes which companies must appoint an internal auditor. As a working framework:

Listed companies — internal audit is mandatory regardless of size.
Unlisted public companies — mandatory once paid-up share capital, turnover, outstanding loans/borrowings from banks or public financial institutions, or outstanding deposits cross the prescribed limits.
Private companies — mandatory once turnover or outstanding loans/borrowings from banks or public financial institutions cross the prescribed limits (private companies are not tested on the deposits or paid-up capital criteria the same way unlisted public companies are).

Note on exact figures: the specific turnover, borrowing and deposit thresholds are set by rule and are periodically revised. Verify the current limits on the MCA portal before advising a client on applicability — do not quote last year's number from memory.

Below the threshold, internal audit is optional — many well-governed private companies still choose to run one, especially ahead of a funding round or a bank facility renewal.

Side-by-side comparison

The two functions differ on almost every dimension except that both, in the end, look at the same underlying books.

	Internal audit	Statutory audit
Who mandates it	Board/management decision, or mandatory under Section 138, Companies Act 2013 once applicability thresholds are crossed.	Law — Companies Act 2013 (Section 139/143) or LLP Act, for every entity it covers, regardless of size.
Who appoints the auditor	The Board of Directors or Audit Committee; the internal auditor can be an employee, a firm, or a Chartered/Cost Accountant engaged externally.	Members at the AGM (subsequent auditors) or the Board for the first auditor — a strict, independent appointment process under the Act.
Who it reports to	Management / Audit Committee / Board — an internal stakeholder, for internal use.	Members (shareholders) — an external report, filed and available to regulators, lenders and the public.
Objective	Evaluate and improve the effectiveness of risk management, internal controls and governance processes.	Form an independent opinion on whether the financial statements give a true and fair view.
Scope	Set by management/Audit Committee — can cover operations, compliance, IT systems, fraud risk; not limited to financial statements.	Defined by law and Standards on Auditing (SAs) — centred on the financial statements and the books of account.
Frequency	Continuous or periodic through the year, as the Audit Committee directs.	Annual, for each financial year.
Independence requirement	Expected to be objective, but the internal auditor can have a closer, ongoing working relationship with management.	Strict independence under Section 144 and the ICAI Code of Ethics — barred from specified non-audit services for the same client.
Output	Internal audit reports/observations to the Audit Committee — not a public document.	Auditor's report annexed to the financial statements, filed with the Registrar and placed before shareholders.

Reporting lines — why this matters in practice

The reporting line is the fastest way to tell the two apart in a real engagement. An internal auditor reports to the Audit Committee (or the Board, where there is no Audit Committee) — their findings go into a management letter or internal audit report that is discussed, actioned and closed internally. It is not filed with the Registrar and the public does not see it.

The statutory auditor reports to the members — the audit report is annexed to the financial statements, tabled at the AGM, and filed with the Registrar of Companies. It is a public document that lenders, regulators and prospective investors can and do read.

This difference in audience drives everything else: independence rules are stricter for the statutory auditor because their opinion is relied upon by people outside the company, while an internal auditor is expected to work closely with management to actually fix what they find.

Common pitfalls for a practising CA

Assuming internal audit exemption because the company is unlisted. Private companies are pulled into Section 138 the moment they cross the turnover or borrowing threshold — check every year, not just at incorporation.
Letting the statutory auditor's firm quote for internal audit of the same client. This is a restricted non-audit service under Section 144 — the same firm (or a network firm) cannot do both for one entity. Confirm the current restricted-services list before pitching either engagement.
Treating internal audit findings as substantive audit evidence without independent evaluation. The statutory auditor may consider the internal audit function's work under the applicable Standards on Auditing, but must independently assess its adequacy and cannot simply adopt its conclusions.
Scoping internal audit like a mini statutory audit. Internal audit scope is set by the Audit Committee and can — and usually should — extend well beyond financial statement line items into operational efficiency, IT controls and fraud risk; a narrow, financial-statement-only internal audit misses most of its value.
Missing the Section 138 threshold check at year-end, not just at planning. A company can cross the turnover or borrowing limit mid-year — build a standing checklist item into the year-end close, not just the annual engagement letter review.

Where TatvaBooks fits

Both internal and statutory audit run faster when the underlying books are already clean. TatvaBooks keeps GSTR-2B reconciliation, the fixed asset register, payroll statutory challans and an append-only activity log in one place — so whichever audit your team is running, the trail from transaction to ledger to statement is already there instead of being reconstructed from scratch. See what's included on the for Chartered Accountants page.

Frequently asked questions

Is internal audit mandatory for all companies under the Companies Act?

No. Internal audit under Section 138 of the Companies Act 2013 applies only to prescribed classes of companies once they cross specific thresholds — for listed companies it is mandatory regardless of size, and for other companies it turns on criteria such as paid-up share capital, turnover, outstanding borrowings and outstanding deposits. These thresholds are set by rule and get revised, so verify the current figures on the MCA portal before advising a client on applicability.

Can the statutory auditor also act as the internal auditor of the same company?

No. The Companies Act specifically bars the statutory auditor (or a firm/network entity connected to them) from rendering internal audit services to the company they statutorily audit — internal audit is a restricted non-audit service under Section 144. The two functions must sit with different persons or firms for a given entity.

Does a private limited company need internal audit if it's not listed?

It depends on whether the company meets the prescribed thresholds under Section 138 and the related rules — being unlisted does not automatically exempt a company. A private company can still be pulled into mandatory internal audit if its turnover, borrowings, deposits or paid-up capital cross the notified limits. Check applicability every year, since a growing company can cross the threshold without anyone flagging it.

What is the main practical difference an articled assistant should remember?

Statutory audit answers one question — do the financial statements show a true and fair view — and reports externally to shareholders under a fixed annual cycle. Internal audit is broader and internal-facing: it looks at whether controls, processes and risk management actually work, reports to management/the Audit Committee, and can run continuously through the year on a scope the Board decides, not one fixed by statute.

Do internal audit findings affect the statutory audit?

Yes, indirectly. The statutory auditor is required to evaluate the entity's internal financial controls and often considers the internal audit function's work as part of forming their own risk assessment — but they cannot simply rely on internal audit findings without independently evaluating them under the applicable Standards on Auditing. A well-run internal audit function can reduce statutory audit effort in low-risk areas, but it never substitutes for the statutory auditor's own procedures.

Keep going.

For practising CAs

Audit reporting

Practice tools

Built for CA firms · India-hosted

Give your audit team books that already reconcile.

GSTR-2B matching, fixed asset register and an append-only activity log in one place — so internal and statutory audit both start from a clean trial balance.

Request beta access For Chartered Accountants