Audits are often spoken about as a single activity, but in India two very different exercises sit behind the word. Internal audit and external (statutory) audit serve distinct purposes, follow different rules, and answer to different people. This 2026 guide explains how they differ under the Companies Act, 2013, who must conduct them, and when each becomes mandatory.<\/p>\n
An internal audit is an independent, ongoing review of a company's internal controls, risk management, and operational processes. Its goal is to help management run the business better by spotting weaknesses, inefficiencies, fraud risks, and compliance gaps before they become serious problems.<\/p>\n
The scope is set by the company's board or audit committee and can cover almost anything: procurement, inventory, IT systems, cash handling, statutory compliances, and internal financial controls. Because it is management-facing, internal audit is advisory and improvement-oriented rather than a pass or fail verdict on the accounts.<\/p>\n
An external audit, commonly called a statutory audit, is a legally mandated examination of a company's financial statements. Its purpose is to give shareholders and other stakeholders independent assurance that the accounts present a true and fair view and comply with applicable accounting standards.<\/p>\n
The statutory auditor expresses a formal opinion in the audit report that is filed with the financial statements. Unlike internal audit, the scope here is defined by law and auditing standards, not by management preference.<\/p>\n
| Basis<\/th>\n | Internal audit<\/th>\n | External (statutory) audit<\/th>\n<\/tr>\n<\/thead>\n |
|---|---|---|
| Purpose<\/td>\n | Improve controls, risk management & operations<\/td>\n | Give an independent opinion on financial statements<\/td>\n<\/tr>\n |
| Scope<\/td>\n | Decided by board\/audit committee; broad and flexible<\/td>\n | Fixed by law & auditing standards<\/td>\n<\/tr>\n |
| Who conducts it<\/td>\n | CA, Cost Accountant, or other professional (employee or outside firm)<\/td>\n | Only a practising Chartered Accountant or CA firm<\/td>\n<\/tr>\n |
| Governing law<\/td>\n | Section 138 & Rule 13, Companies Act, 2013<\/td>\n | Sections 139 to 143, Companies Act, 2013<\/td>\n<\/tr>\n |
| Appointed by<\/td>\n | Board of Directors<\/td>\n | Shareholders (members) at the AGM<\/td>\n<\/tr>\n |
| Reports to<\/td>\n | Board \/ audit committee \/ management<\/td>\n | Shareholders (members)<\/td>\n<\/tr>\n |
| Frequency<\/td>\n | Continuous or periodic through the year<\/td>\n | Once a year, after the financial year ends<\/td>\n<\/tr>\n |
| Applicability<\/td>\n | Only if thresholds are crossed<\/td>\n | Mandatory for every company<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nWho conducts each audit and how they are appointed<\/h2>\nThe independence rules matter here. A statutory audit can only be carried out by a Chartered Accountant in practice or a firm of CAs, appointed by the shareholders. Under Section 139, the first auditor is usually appointed by the board, and thereafter auditors are appointed at the annual general meeting, ordinarily for a five-year term, with mandatory rotation applying to certain classes of companies.<\/p>\n An internal auditor is appointed by the board of directors. The law allows more flexibility on who this can be: a Chartered Accountant, a Cost Accountant, or such other professional as the board decides. The internal auditor may be an employee of the company or an external firm.<\/p>\n The independence rule you must not miss<\/h3>\nA crucial point on independence: the same person or firm cannot act as both the statutory auditor and the internal auditor of the same company. Keeping the two roles separate protects the objectivity of the external opinion and avoids self-review.<\/p>\n Mandatory applicability under the Companies Act, 2013<\/h2>\n |