CAG audit comes in three types: financial audit, compliance audit and performance audit. Financial audit asks whether financial information is fairly presented. Compliance audit asks whether activities followed the rules. Performance audit asks whether economy, efficiency and effectiveness were achieved. One audit can combine more than one type.
Last reviewed: 17 October 2026. Facts checked. We opened the cag.gov.in page for CAG's Auditing Standards, 2017 and read its descriptions of the three types (the page is long and we read about the first 100,000 characters). We also read a cag.gov.in page on the audit provisions of Section 13 of the 1971 Act. We did not open the full standards PDF. The worked example below is invented for illustration and describes no real entity.
This post compares the types side by side. For the wider background, see government audit in India and the three types.
The three types at a glance
| Financial audit | Compliance audit | Performance audit | |
|---|---|---|---|
| Main question | Is the financial information presented fairly? | Did activities follow the authorities that govern them? | Are economy, efficiency and effectiveness achieved? |
| Benchmark | The financial reporting framework | Constitution, Acts, rules, regulations, budget resolutions, contracts | Suitable criteria set for the programme |
| Kind of engagement | Always attestation | Generally direct reporting | Essentially direct reporting |
| Typical output | An opinion on material misstatement | Conclusions | Findings, causes and recommendations |
The descriptions come from CAG's Auditing Standards, 2017. The standards are organised by type of audit, not by process, and took effect on 1 April 2017.
Financial audit
A financial audit tests whether an entity's financial information follows the applicable reporting framework. The standards say financial audits are always attestation engagements: the responsible party prepares the information, and the auditor gives a view on it. The result is an opinion on whether the information is free of material misstatement from fraud or error.
This will feel familiar to any chartered accountant. It is the closest public-sector match to a statutory audit. For the private-sector version, read statutory audit explained.
Compliance audit
A compliance audit checks whether activities, financial transactions and information comply in all material respects with the authorities that govern them. The standards list the Constitution, Acts, rules, regulations, budgetary resolutions and contracts.
Compliance audit is generally a direct reporting engagement. The auditor measures activity against the criteria and reports conclusions.
A CAG page on Section 13 audit describes related tests used in expenditure audit:
- Regularity: does spending conform to the governing authority?
- Propriety: was it wise, faithful and economical?
Performance audit
A performance audit looks at whether interventions, programmes and institutions work with economy, efficiency and effectiveness, and whether there is room for improvement. It sets suitable criteria, analyses the causes of any gap, and offers recommendations. It is not normally expected to give an overall opinion of the kind given on financial statements.
In plain words:
- Economy is about cost of inputs.
- Efficiency is about getting the most output for the inputs.
- Effectiveness is about whether intended results were reached.
We compare it with a similar-sounding review in performance audit vs operational audit.
One example, three audits
Suppose a State department runs a programme to build village water tanks. These are invented facts.
- A financial audit checks the department's accounts: are grants and expenditure properly recorded, and are the statements fairly presented?
- A compliance audit checks that contracts were awarded under the procurement rules, that sanctions existed before payment, and that funds went to approved works.
- A performance audit asks whether the tanks were built on time, at reasonable cost, and whether villages now have more water.
Same department, three questions, three kinds of conclusion.
Combined audits
The standards state that SAI India undertakes financial audit, compliance audit, performance audit and combinations of these. A report may therefore contain a compliance finding next to a performance finding.
What the types share
All three follow the CAG's standards, rely on sufficient and appropriate evidence, and end in a report to the legislature. Before the report is final, the department gets a chance to reply. The steps are in how CAG reports are prepared and tabled.
Which type fits which question
- If a regulator or the legislature wants assurance on numbers, financial audit is the fit.
- If the concern is whether orders, sanctions and procurement rules were followed, compliance audit is the fit.
- If the concern is whether a programme delivers for its cost, performance audit is the fit.
Choosing the type first keeps the audit focused. A compliance audit that wanders into outcomes, or a performance audit that turns into a voucher check, usually satisfies neither question.
Frequently Asked Questions
What are the three types of CAG audit?
Financial audit, compliance audit and performance audit, as set out in CAG's Auditing Standards, 2017.
Which CAG audit gives an opinion?
Financial audit. It results in an opinion on whether the financial information is free of material misstatement. Performance audit is not normally expected to give an overall opinion.
Is a compliance audit the same as a financial audit?
No. Compliance audit tests adherence to laws, rules and contracts. Financial audit tests the fair presentation of financial information.
Does performance audit judge government policy?
The standards frame performance audit around economy, efficiency and effectiveness of programmes against suitable criteria. It is not a review of whether a policy is right.
Can one report contain more than one type?
Yes. The standards describe combined audits.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error