Internal Audit vs Statutory Audit: Scope, Law and Who Needs Which
- Internal audit is a management tool you choose; statutory audit is a legal requirement you cannot skip once you cross the prescribed threshold.
- The Companies Act 2013 mandates statutory audit for every company regardless of size, while internal audit applies only above certain turnover or paid-up capital limits.
- Mixing up the two is a costly mistake — missing a statutory audit attracts penalties; skipping internal audit when mandatory can trigger regulatory scrutiny.
Here is the one-line answer: statutory audit is compulsory by law and its report goes to shareholders and regulators; internal audit is an ongoing check run for management to catch problems before they become disasters. They serve completely different purposes, can overlap in timing, but can never substitute for each other. If you run a private limited company, a partnership firm, or even a proprietorship above certain thresholds, you need to know exactly which audit applies to you — and what happens if you ignore it.
What Statutory Audit Actually Means
A statutory audit is an independent examination of a company's or firm's financial statements, mandated by a specific law. The auditor — a practising Chartered Accountant — gives an opinion on whether the accounts show a true and fair view. The key word is independent: the auditor cannot be an employee, director, or relative of a key managerial person of the company.
- Companies Act 2013 (Section 139): Every company — private, public, one-person — must appoint a statutory auditor. There is no turnover floor. A company with ₹1 lakh revenue still needs one.
- Income Tax Act 1961 (Section 44AB): This is the tax audit, a separate beast. Businesses crossing ₹1 crore turnover (or ₹10 crore if 95% transactions are digital) and professionals crossing ₹50 lakh gross receipts must get a tax audit done by a CA.
- LLPs: Limited Liability Partnerships must get their accounts audited if turnover exceeds ₹40 lakh or contribution exceeds ₹25 lakh, under the LLP Act 2008.
- Partnership firms and proprietorships: No mandatory Companies Act audit, but Section 44AB tax audit applies once they cross the income tax thresholds above.
The statutory auditor's report is filed with the Registrar of Companies (for companies), SEBI (for listed entities), or submitted with the income tax return. It is a public document. Failure to comply means penalties for the company and its directors — in some cases personal liability.
What Internal Audit Actually Means
Internal audit is a systematic review of a business's operations, internal controls, risk management, and compliance — done for the benefit of management, not regulators. Think of it as a health check you commission yourself. The internal auditor reports to the board or the audit committee, not to shareholders.
Under Section 138 of the Companies Act 2013, internal audit is mandatory for:
- Every listed company.
- Every unlisted public company with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans/borrowings of ₹100 crore or more, or outstanding deposits of ₹25 crore or more.
- Every private limited company with turnover of ₹200 crore or more, or outstanding loans/borrowings of ₹100 crore or more.
The internal auditor can be a CA, a Cost Accountant, or any other professional as the board decides — and can even be an employee of the company (unlike statutory audit). Many smaller businesses voluntarily appoint an internal auditor even when not required, simply because it saves money by catching errors early.
Side-by-Side Comparison
| Feature | Statutory Audit | Internal Audit |
|---|---|---|
| Mandated by | Companies Act / Income Tax Act / LLP Act | Companies Act (Section 138) — only above thresholds; otherwise voluntary |
| Who conducts it | Independent practising CA only | CA, Cost Accountant, or other professional; can be employee |
| Reports to | Shareholders, ROC, regulators | Board of directors / Audit committee |
| Frequency | Once per financial year (mandatory) | Quarterly, monthly, or continuous — as board decides |
| Scope | Historical financial statements | Operations, controls, risk, compliance — forward-looking |
| Can one substitute the other? | No. Never. | |
Worked Example: When Both Apply to the Same Company
Imagine Mehta Plastics Pvt Ltd — a private limited company in Surat with the following numbers for FY 2026-27:
- Turnover: ₹220 crore
- Outstanding bank loans: ₹85 crore
- Paid-up capital: ₹8 crore
- Net profit: ₹4.2 crore
Statutory audit (Companies Act): Mandatory simply because it is a private limited company. Full stop. No threshold needed. A practising CA firm must be appointed at the AGM. Estimated fee for a company this size: ₹3–6 lakh per year.
Internal audit (Section 138): Turnover of ₹220 crore exceeds the ₹200 crore threshold for private companies. So internal audit is also legally mandatory — not optional. If Mehta Plastics skips it, the company and every defaulting officer can face penalties under Section 450 of the Companies Act.
Tax audit (Section 44AB): Turnover of ₹220 crore far exceeds ₹1 crore. A separate tax audit report in Form 3CD must be filed by the due date (generally 30 September of the assessment year for tax audit cases). That is a third distinct engagement.
So Mehta Plastics needs three separate audits from at least two different professionals. Many small business owners are unaware of this and assume one CA signing off on the accounts covers everything.
Common Mistakes Business Owners Make
- Treating the tax audit as the statutory audit. A Section 44AB tax audit produces Form 3CA/3CB and Form 3CD — it checks compliance with income tax law. It does not replace the Companies Act statutory audit, which examines whether financial statements are true and fair. Two different forms, two different opinions, two different legal requirements.
- Assuming a small private company does not need a statutory audit. There is no minimum turnover or profit threshold under the Companies Act for companies. A company with zero revenue incorporated last month still needs an auditor appointed within 30 days of incorporation (by the Board) and ratified at the first AGM.
- Letting the internal audit lapse because "the statutory auditor will catch it anyway." The statutory auditor's job is to give an opinion on the final accounts — not to redesign your internal controls or prevent day-to-day fraud. An internal auditor doing quarterly reviews catches cash pilferage, vendor fraud, and policy breaches months before the statutory audit begins.
- Appointing the statutory auditor as the internal auditor too. Rule 13 of the Companies (Accounts) Rules 2014 explicitly bars the statutory auditor from being appointed as the internal auditor of the same company. Doing so renders both appointments non-compliant.
- Missing the internal audit threshold by ignoring outstanding borrowings. Many founders only check turnover. But a private company with ₹100 crore or more in outstanding loans or borrowings crosses the Section 138 threshold even if turnover is modest. Check all four parameters, not just revenue.
Which One Do You Need? Quick Decision Guide
Answer these questions in order:
- Are you incorporated as a company (private, public, OPC)? → Statutory audit under Companies Act is mandatory. No exceptions.
- Is your turnover above ₹1 crore (business) or ₹50 lakh (profession)? → Tax audit under Section 44AB is also mandatory. Consider KyaTax's Tax Audit Services to handle this end-to-end.
- Is your company listed, or do you cross any of the Section 138 thresholds? → Internal audit under the Companies Act is mandatory too.
- Are you a partnership or proprietorship below tax audit limits? → No statutory audit, no mandatory internal audit. But a voluntary internal review is still good practice if you have employees handling cash.
Penalties for Non-Compliance at a Glance
Missing a mandatory audit is not a paperwork inconvenience — it has real financial consequences:
- Statutory audit (Companies Act): The company and every officer in default can be penalised. Penalties scale with the duration of default and can run into lakhs.
- Tax audit (Section 271B): Penalty is 0.5% of turnover or gross receipts, subject to a maximum of ₹1,50,000. For a ₹5 crore turnover firm, that is ₹2.5 lakh wiped out for missing a deadline.
- Internal audit (Section 138): Penalties under Section 450 apply — currently ₹10,000 for the first day and ₹1,000 per day for continuing default, subject to maximums.
Do it yourself in minutes — free to try, no login needed.
Open Tax Audit Services →Frequently asked questions
Can the same CA firm do both the statutory audit and the internal audit?
No. Rule 13 of the Companies (Accounts) Rules 2014 specifically prohibits the statutory auditor of a company from also being appointed as its internal auditor. You must engage two separate firms or professionals.
Is internal audit mandatory for all private limited companies?
No. For private limited companies, internal audit under Section 138 of the Companies Act 2013 becomes mandatory only when turnover reaches ₹200 crore or more, or outstanding loans and borrowings reach ₹100 crore or more. Below these limits, it is voluntary but recommended.
Does a Section 44AB tax audit replace the statutory audit under the Companies Act?
Absolutely not. A tax audit under Section 44AB examines compliance with income tax provisions and results in Form 3CA or 3CB along with Form 3CD. The Companies Act statutory audit examines whether financial statements show a true and fair view and results in a separate auditor's report. Both are legally distinct and both can be mandatory at the same time.
What happens if a company files its income tax return without completing the mandatory tax audit first?
Filing the ITR without attaching the required tax audit report is treated as non-furnishing of the audit report. A penalty of 0.5% of turnover (up to ₹1,50,000) can be levied under Section 271B of the Income Tax Act 1961, unless the taxpayer can prove reasonable cause for the failure.
General information for FY 2026-27, not professional advice for your specific case. Rules change — verify against the latest notification or ask a KyaTax expert.
Related: All free tools · More guides · Virtual CFO