Internal audit serves the board and management by testing controls and processes through the year. External audit serves shareholders by giving an opinion on the financial statements. They overlap in what they look at, but not in who they answer to. A statutory auditor can use internal audit work in some ways, under SA 610, but the opinion remains the auditor's alone.
Last reviewed: 17 October 2026. Facts checked. We ran a web search on SA 610 and read search-result extracts quoting the ICAI text from a third-party site, plus ISA 610 adoptions from other countries. We did not open the ICAI site's own copy of SA 610, so paragraph numbers are not quoted. We did not find, and could not confirm, any Indian rule that bars direct assistance. Check the current standard, the Companies Act and any sector regulator's rules before relying on this.
Our longer guide to the three audit labels is internal vs external vs statutory audit. This post is the short comparison and the reliance question.
One-page comparison
| Internal audit | External audit | |
|---|---|---|
| Main reader | Board, audit committee, management | Shareholders and other users of the financial statements |
| Question | Are controls and processes working, and what should improve? | Do the financial statements give a true and fair view? |
| Scope | Chosen by the board or audit committee; can cover any process, compliance or risk | Set by law and auditing standards |
| Output | Observations, recommendations, action tracking | An audit report with an opinion |
| Timing | Through the year, to a plan | Mostly around the year end, with interim work |
| Who appoints | The board, on a resolution, for companies covered by section 138 | Shareholders, under the Companies Act appointment process |
| Who can do it | A CA, cost accountant or other professional the board decides on, employee or firm | A chartered accountant or firm eligible to be an auditor under the Act |
| Independence from management | Reports to the board or committee; objectivity matters but it is part of the entity's governance | Must be independent of the entity under the Act and the ICAI Code |
| Opinion | No audit opinion | Audit opinion |
The statutory auditor cannot be the company's internal auditor under section 144, as discussed in our post on appointing an internal auditor.
Who relies on whom
The reliance runs in a few directions, and it is not equal.
The statutory auditor looks at internal audit. The auditor needs to understand the entity's internal control and may find internal audit reports useful for risk assessment. That is a normal part of understanding the entity. Beyond that, SA 610 deals with whether and how the external auditor uses the internal audit function's work.
The audit committee looks at both. It reads internal audit's observations and the external auditor's communications on control deficiencies and key matters. Each gives it a different view.
Internal audit looks at external audit's findings. Matters raised in a management letter or in communications with those charged with governance often become areas for follow-up or inclusion in the next year's plan.
Management should rely on neither as a substitute for its own controls. Both are checks on the control system, not the control system itself.
What SA 610 is about
From the text we read, SA 610 covers two things.
- Using the work of the internal audit function. The external auditor decides whether the function's work can be used for the purposes of the audit, and if so, in what way. The standard asks the auditor to evaluate things such as the function's objectivity, competence and whether it applies a systematic and disciplined approach. We did not open the full list of factors, so check the standard for it.
- Direct assistance. Using internal auditors to perform audit procedures under the external auditor's direction, supervision and review. The reproduction we read says some jurisdictions restrict or prohibit this by law or regulation, and that the standards do not override such law. We found that other countries, such as the UK, Ireland and Australia, restrict or bar direct assistance, per the articles and adoptions we read. We could not confirm whether any Indian rule bars it, so treat that as an open question to check with the ICAI text and current regulatory position.
What stays with the external auditor
Even where internal audit work is used, the principle in the standard, as we understood it, is that the external auditor alone is responsible for the opinion. Using internal audit work does not reduce that responsibility. In practice that means:
- The auditor decides what work is used and how much, and documents the reasons.
- The auditor re-performs or tests some of the work to be satisfied it is adequate.
- Judgements on significant risks, such as fraud or management override, are not delegated.
- The audit file shows what was used, how it was evaluated and what conclusion followed.
A worked scenario (invented)
A company's internal audit team has tested bank reconciliations for all 12 months across ten bank accounts, and its working papers are well organised. The statutory auditor reads the reports, reviews a selection of the working papers, and re-performs four of the reconciliations. She considers the team's competence and objectivity, notes that the head of internal audit reports to the audit committee, and decides to reduce her own sample on bank reconciliations at year end. She still confirms the year-end balances directly with banks. The file records the evaluation, the re-performance and the reasoning.
She does not use the team to carry out the bank confirmations under her direction until she has checked what applies in India.
What internal auditors can do to make their work more usable
- Document tests clearly, so another reader can see what was tested and what was found.
- Show sample sizes, selection methods and exceptions.
- Keep objectivity visible: reporting line, no operating responsibilities.
- Share the annual plan and reports with the statutory auditor early.
- Close the loop on findings, so the auditor can see which were fixed.
Our guide to quality assurance for internal audit covers how a function shows its work is reliable.
Frequently asked questions
What is the difference between internal and external audit?
Internal audit tests controls and processes for the board and management during the year. External audit gives an opinion on the financial statements for shareholders.
Can the statutory auditor rely on internal audit?
The auditor can use internal audit work in some ways under SA 610 after evaluating it, but remains solely responsible for the opinion.
Is external audit the same as statutory audit?
For a company, the statutory audit is the audit required by law and done by the appointed auditor. In everyday use people often say external audit to mean the same thing.
Can the same firm do both?
Not for the same company. The statutory auditor cannot be the internal auditor under section 144.
Does internal audit give an opinion?
It gives observations and conclusions on its scope, not an audit opinion on the financial statements.
Last reviewed: 17 October 2026. Facts checked. Opened: web search results on SA 610; a third-party reproduction of the ICAI text; ISA 610 adoptions from Ireland, Luxembourg and Australia; our own site posts. Could not open: the ICAI site copy of SA 610; any Indian regulation on direct assistance.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error