Internal Audit vs Statutory Audit: Key Differences Every Professional Should Know

I get asked this question regularly by articleship students and even by some clients who confuse the two. Internal audit and statutory audit serve fundamentally different purposes, even though both involve examining financial records.

PURPOSE
Statutory audit: Express an opinion on whether financial statements give a true and fair view in accordance with applicable accounting standards. It is a LEGAL requirement.
Internal audit: Evaluate the effectiveness of internal controls, risk management, and governance processes. It is a MANAGEMENT tool.

APPOINTMENT
Statutory auditor: Appointed by shareholders at the AGM. Must be a Chartered Accountant (individual or firm). Cannot be removed without Central Government approval.
Internal auditor: Appointed by the Board of Directors. Can be a CA, CMA, or any qualified professional. Can be removed by the Board.

REPORTING
Statutory auditor: Reports to the shareholders. The audit report is a public document filed with ROC.
Internal auditor: Reports to the Audit Committee or management. The report is an internal document.

SCOPE
Statutory audit scope is defined by law (Companies Act, Standards on Auditing). The auditor CANNOT be directed by management to limit scope.
Internal audit scope is defined by the Audit Committee or Board. It can be customized to focus on specific areas — IT controls, fraud detection, operational efficiency, compliance.

INDEPENDENCE
Statutory auditor has strict independence requirements — cannot provide certain non-audit services to the same company, rotation is mandatory (individual: 5 years, firm: 10 years).
Internal auditor needs functional independence (reporting line to Audit Committee) but is less restricted.

WHEN IS INTERNAL AUDIT MANDATORY?
Under Section 138 of Companies Act 2013, internal audit is mandatory for:
- Listed companies
- Unlisted public companies with turnover > Rs 200 crore OR loans/borrowings > Rs 100 crore
- Private companies with turnover > Rs 200 crore OR loans/borrowings > Rs 100 crore

THE PRACTICAL REALITY
In my experience, companies that take internal audit seriously — giving the internal auditor real access, acting on findings, tracking remediation — have significantly fewer issues in their statutory audit. The internal auditor catches problems before the statutory auditor reports them. Think of internal audit as your early warning system.