Internal audit serves management and the board and covers whatever they ask. External audit means any audit done by someone outside the company. Statutory audit is the external audit that the law requires, ending in an opinion to the members on the financial statements. So statutory audit is a kind of external audit, and internal audit is a different job altogether.
Last reviewed: 17 October 2026. Facts checked. We described the roles under the Companies Act 2013 (section 138 for internal audit, section 143 for the statutory auditor's duties) and the purpose of SA 610 from general knowledge; we did not open the statute or the standard. We did not check thresholds, fees or sector rules. For a side-by-side table that includes tax audit, see our existing internal vs statutory vs tax audit page. This page focuses on the terms and on how the two functions work together.
The terms, untangled
| Term | Meaning |
|---|---|
| Internal audit | Independent assurance and advice to management and the board, done by or for the company |
| External audit | Any audit by someone independent of the company |
| Statutory audit | The external audit required by law, such as under the Companies Act, 2013 |
Not every external audit is statutory. A lender may ask for a special external review. A bank-appointed stock audit is external but not statutory. See types of audit in India.
The differences that matter
| Point | Internal audit | Statutory audit |
|---|---|---|
| Source | Board decision and, for certain companies, section 138 | Law |
| Appointed by | Board or audit committee | Members, usually at the AGM, for companies |
| Reports to | Audit committee or board | Members |
| Output | Observations and recommendations | Opinion on the financial statements |
| Scope | Chosen by the board, any area | Set by law and auditing standards |
| Focus | Risk, controls, processes, compliance | Whether statements are true and fair |
| Timing | Throughout the year | Year-end plus interim work |
| Independence | From the managers it audits | From the company and its management |
| Looks | Forward, to improve | Back, to give an opinion |
Who can be internal auditor
Section 138 lets the board appoint a chartered accountant, a cost accountant or another professional it decides. The internal auditor may be an employee or an outside firm. It applies to prescribed classes of company. Check applicability with the internal audit applicability checker and read internal auditor appointment.
Who can be statutory auditor
A statutory auditor of a company is a chartered accountant or firm appointed under the Companies Act, subject to eligibility, independence and rotation rules. Eligibility is covered in the auditor disqualification checker. See also what is statutory audit.
How the two interact
The statutory auditor must report on the adequacy of internal financial controls over financial reporting for companies, under section 143(3)(i). That report depends on understanding the control environment, which includes internal audit.
For companies where it applies, CARO 2020 also asks the auditor to comment on whether the company has an internal audit system commensurate with its size and nature, and whether the reports of internal auditors were considered.
SA 610, "Using the Work of Internal Auditors", sets out how the statutory auditor may use the internal audit function's work. The auditor first judges the function's objectivity, competence and systematic approach. The auditor stays solely responsible for the opinion, and cannot hand that responsibility to internal audit.
Practical points:
- Share the audit plan so work is not duplicated.
- Let internal audit's tests inform risk assessment, not replace judgement.
- Keep a clear line between direct assistance and the audit opinion. Check current SA 610 text for the exact rules.
Common confusions
- "Internal audit replaces statutory audit." It cannot. The legal opinion comes only from the statutory auditor.
- "Statutory audit finds all fraud." It aims for reasonable assurance on material misstatement. See reasonable vs limited assurance.
- "The internal auditor reports to the CFO." Reporting to the CFO weakens independence. The audit committee is the better line.
A simple example
A manufacturing company has a 31 March year-end. The internal auditor reviews inventory controls in the second quarter and reports weak cut-off. Management fixes it. At year-end, the statutory auditor attends the stock count, reads the internal audit report during risk assessment, and tests cut-off itself. Both are useful. Only the statutory auditor signs the opinion.
Frequently Asked Questions
Is external audit the same as statutory audit?
No. Statutory audit is the external audit required by law. Other external audits exist, such as lender-requested reviews.
Can the same firm do both internal and statutory audit?
For companies, the Companies Act restricts certain services by the statutory auditor, and internal audit is one of them. Confirm against section 144 and current rules.
Does internal audit give an audit opinion?
No. It gives reports with observations and recommendations to the board and management.
Can the statutory auditor rely on internal audit?
Within limits set by SA 610. The auditor must assess the function first and remains responsible for the opinion.
Which one is mandatory?
Statutory audit is mandatory for companies. Internal audit is mandatory only for prescribed classes under section 138.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error