"We already have an auditor, why do we need another one?" We hear this every time a company crosses the internal audit threshold. The short answer: the two audits are done for different people and look at different things, and the law doesn't let one firm do both.
The one-line difference
A statutory audit tells your shareholders whether the year's financial statements are true and fair. An internal audit tells your Board, through the year, whether the processes behind those numbers are working and where money is leaking.
Internal audit vs statutory audit: side by side
| Point | Statutory audit | Internal audit |
|---|---|---|
| Law | Sections 139 to 148 of the Companies Act, 2013 | Section 138 and Rule 13 of the Companies (Accounts) Rules, 2014 |
| Who needs it | Every company, whatever its size | Listed companies, and other companies above the turnover, borrowing, capital or deposit thresholds |
| Who appoints | Shareholders at the AGM, usually for five years (the Board appoints the first auditor) | The Board, on the Audit Committee's recommendation where there is one |
| Who can do it | Only a Chartered Accountant in practice or a CA firm | A CA, a Cost Accountant (CMA) or another professional the Board decides on, including an employee |
| Reports to | Shareholders (members) | The Audit Committee or the Board |
| Scope | Set by law and auditing standards: an opinion on the financial statements, plus CARO matters | Set by the Board: processes, controls, compliance, cost and leakages |
| Timing | Once a year, after the books are closed | Through the year, usually quarterly or half-yearly |
| Removal | Before the term ends, only by special resolution with Central Government approval | By the Board |
Can the statutory auditor also do the internal audit?
No. Section 144 bars a company's statutory auditor from providing certain services to it, directly or through related entities. Internal audit is on that list, along with accounting and bookkeeping, design of financial information systems, actuarial services, investment advisory, investment banking, outsourced financial services and management services.
The reason is simple: an auditor shouldn't be auditing their own work. If your statutory audit firm has been "helping with internal audit" informally, fix it before the next audit cycle.
How the two audits connect
- CARO 2020, clause 3(xiv): the statutory auditor must report whether the company has an internal audit system matching its size and business, and whether the internal audit reports were considered.
- Reliance: a well-documented internal audit lets the statutory auditor rely on your controls, which usually means fewer last-minute queries at year-end.
- Early warning: issues the internal auditor finds in July can be fixed long before the statutory auditor sees the year-end numbers.
Where tax audit and cost audit fit
These are separate again. A tax audit is required under income-tax law once business turnover crosses the limit, and is usually done by the statutory auditor. A cost audit applies to companies in specified industries above the cost-audit thresholds, and must be done by a practising Cost Accountant. A manufacturer above the limits can need all four in the same year, done by at least two different firms.
Which one does your company need?
Every company needs a statutory audit. Internal audit becomes mandatory once you cross the thresholds, which for a private company means ₹200 crore turnover or borrowings above ₹100 crore in the previous year. The full rules are in our note on internal audit applicability, and our internal audit checklist shows what a proper review covers.
Frequently asked questions
What is the main difference between internal audit and statutory audit?
Statutory audit is an annual, legally required opinion for shareholders on whether the financial statements are true and fair. Internal audit is a continuous review for the Board of the company's processes, controls and compliance.
Can the statutory auditor do the internal audit of the same company?
No. Section 144 of the Companies Act, 2013 bars the statutory auditor from providing internal audit services to the company.
Who appoints the statutory auditor and the internal auditor?
Shareholders appoint the statutory auditor at the AGM, usually for five years, though the Board appoints the first auditor. The Board appoints the internal auditor.
Can a CMA do statutory audit?
No. Statutory audit of a company can only be done by a Chartered Accountant in practice. A CMA can be appointed as internal auditor and is the professional required for cost audit.
How Vitt-Marg helps
We act as independent internal auditor for companies whose statutory audit is with another firm, and coordinate with that firm so our work supports their CARO reporting. Our team of CMAs and CAs covers internal, cost and tax audit work. See how we run it as your internal auditor in Noida.
General information, current as of October 2026, not advice for a specific case. Company-law and tax rules change often — check with us before acting on it.