Internal and Forensic Audit · Internal Audit: Introduction and Overview

Internal Audit vs External Audit: Key Differences for CS Professional

Updated 11 October 2026 · Fact-checked

Internal audit is an ongoing review of operations, risk and controls, done for management and the board by an appointed internal auditor. External (statutory) audit is a yearly independent opinion on the financial statements, done for shareholders under the Companies Act. They differ in appointment, scope, independence, objective, reporting and accountability.

Understand Internal Audit vs External Audit

Every company has two different needs. Management wants to know whether the business is running well, whether risks are controlled and whether policies are followed. Shareholders and other outsiders want to know whether the financial statements can be trusted. Internal audit serves the first need. External audit serves the second.

Internal audit is an independent, objective review of an entity's operations, risk management, controls and governance. It is carried out for the management and the board, usually through the audit committee. Under Section 138 of the Companies Act, 2013, it is mandatory only for prescribed classes of companies, such as listed companies and unlisted public and private companies above the thresholds in the Companies (Accounts) Rules, 2014. Other entities may adopt it voluntarily. Its scope is set by the management or the board, and it can cover any function: purchase, stores, payroll, IT, compliance and more. It looks at the year as it unfolds and works throughout the year.

External audit, also called statutory audit, is the audit of financial statements by an auditor appointed by the members of the company. The auditor gives an opinion on whether the statements give a true and fair view. The scope is fixed by law and by auditing standards, not by management. The auditor reports to the members, and the report is a public document.

The key link is that both rely on internal controls, but for different reasons. The internal auditor tests controls to improve them. The statutory auditor checks controls to decide how much testing of figures is needed. In a company, the statutory auditor also reports on internal financial controls under Section 143(3)(i). The statutory auditor may use the internal auditor's work, but remains solely responsible for the opinion.

In the exam, treat the comparison as a set of lenses: who appoints, who is served, what is covered, how independent, what is the aim, to whom reported, and who is accountable. Cover each lens with a short point on both sides.

Key rules to remember

Appointment: Internal auditor: appointed by the Board (on audit committee advice where applicable), where internal audit applies. Statutory auditor: appointed by the members at the general meeting.; Under Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014, the internal auditor may be a chartered accountant, cost accountant or other professional as the Board decides, or an employee. Internal audit is mandatory only for prescribed classes of companies. Statutory auditor must be a qualified chartered accountant or firm and cannot be an employee.
Objective: Internal audit: improve operations, risk management, controls and governance. Statutory audit: express an opinion on true and fair view of financial statements.; Internal audit is advisory and forward looking; statutory audit is an assurance on past financial results.
Scope: Internal audit: decided by management or the board. Statutory audit: decided by law and auditing standards.; Management cannot restrict the scope of the statutory auditor.
Reporting: Internal audit: report to management, board or audit committee. Statutory audit: report to members.; Statutory report is a public document; internal reports are normally confidential.
Frequency: Internal audit: continuous or periodic through the year. Statutory audit: annual, after the year end.; Internal audit can be done on any period or area as planned.
Independence: Internal auditor: independent of the activity audited, but part of or engaged by the entity. Statutory auditor: independent of the entity and management.; Statutory auditor independence is backed by statutory disqualifications and removal safeguards.

How to solve Internal Audit vs External Audit questions

Use this method for any question that asks you to compare, distinguish or apply the two audits to a case.

1Read the question and note whether it asks for a plain comparison, a comparison with a case, or a decision such as who should do a task.
2Set up the lenses: appointment, objective, scope, independence, reporting, frequency and accountability. Add qualification and removal if the question hints at them.
3Write each point as a pair, internal first and external second, in one or two lines each.
4Add the link between the two: reliance by the statutory auditor on the internal auditor's work, without sharing responsibility for the opinion.
5If the question has facts, apply them. Name which audit the described task belongs to and why.
6Close with a one-line conclusion that states the main difference: internal audit serves management and improves the business; statutory audit serves members and certifies the accounts.

Quickest way: Seven-point pair method

When to use it: Use when time is short and the question simply asks for the difference between the two audits.

List seven headings in the margin: appointment, objective, scope, independence, reporting, frequency, accountability.
Write one line for each side under each heading.
Add a final line on reliance: the statutory auditor may use internal audit work but stays fully responsible.
Check that every point names both audits so none reads as a one-sided description.

Common mistakes in Internal Audit vs External Audit

Saying internal audit is done only by employees.
The word 'internal' suggests someone inside the company.
Fix: State that the internal auditor may be an employee or an outside professional, such as a chartered accountant or cost accountant, as the board decides.
Saying the statutory auditor reports to the board.
Students link the report to the company's management because management pays the fee and supplies information.
Fix: Write that the statutory auditor reports to the members, who appoint the auditor. The internal auditor reports to management or the audit committee.
Claiming internal audit has no independence.
Students contrast it with the strong independence of the statutory auditor and overstate the gap.
Fix: Say the internal auditor must be objective and independent of the activities audited, usually by reporting to the audit committee, but is not independent of the entity in the way a statutory auditor is.
Treating the objectives as the same because both look at controls.
Both audits touch accounting records and controls, so they seem alike.
Fix: Separate the purpose. Internal audit aims to improve operations and controls. Statutory audit aims to give an opinion on the financial statements.
Writing that the statutory auditor can rely fully on internal audit and share responsibility.
Students assume reliance moves responsibility.
Fix: State that reliance is a matter of judgment, and the statutory auditor remains solely responsible for the audit opinion.
Writing a list of points without applying them to the facts in a case question.
Students memorise the table and stop.
Fix: After the comparison, name the audit that fits the facts and give the reason in one or two sentences.

Worked examples

Example 1

Distinguish between internal audit and statutory audit on the basis of appointment, scope, reporting and objective.

Show the solution

Appointment: the internal auditor is appointed by the board, where internal audit applies. Under Section 138 read with Rule 13, the person may be a chartered accountant, cost accountant, other professional as the board decides, or an employee. The statutory auditor is appointed by the members at the general meeting and must be a qualified chartered accountant or firm.
Scope: for internal audit, management or the board decides what is covered, such as operations, risk and compliance. For statutory audit, the law and auditing standards fix the scope and management cannot restrict it.
Reporting: the internal auditor reports to management or the audit committee. The statutory auditor reports to the members.
Objective: internal audit aims to improve operations, risk management and controls. Statutory audit aims to express an opinion on whether the financial statements give a true and fair view.

Answer: Internal audit is a management-driven, wide-scope review to improve the business, reported to the board. Statutory audit is a legally defined assurance on the financial statements, appointed by and reported to the members.

Example 2

Sundaram Textiles Ltd's board asks its internal auditor to review the efficiency of the stores function and to recommend ways to cut wastage. Separately, the members at the annual general meeting have appointed a chartered accountant firm to report on the annual accounts. A director asks whether the statutory auditors could also be asked to do the stores review and replace the internal auditor. Advise.

Show the solution

Identify the tasks. The stores efficiency review is an operational review, which is internal audit work. The report on the annual accounts is statutory audit work.
Check the objective. The stores review aims to improve efficiency and recommends action. The statutory audit aims at a true and fair opinion on the accounts.
Check scope and appointment. The board decides the internal audit scope. The members appointed the firm for a statutory purpose, and its scope is set by law.
Apply the law. Section 144 of the Companies Act, 2013 expressly prohibits the statutory auditor from providing internal audit services to the company, its holding company or its subsidiary company. The stores review is internal audit work, so the firm cannot be given it.
Conclude. The statutory auditor cannot take over the stores review or replace the internal auditor. Each has a different role.

Answer: The statutory auditors cannot replace the internal auditor. Operational review of stores is internal audit work for the board, and Section 144 of the Companies Act, 2013 expressly prohibits the statutory auditor from providing internal audit services to the company, its holding company or subsidiary. The firm must focus on reporting to the members on the accounts.

Exam tips

Answer comparison questions in a pair format, with one short line per side under each heading. This is easy for the examiner to mark.
Always include the reliance point: the statutory auditor may use internal audit work, but responsibility for the opinion stays with the statutory auditor.
In case questions, first label each task as internal or statutory audit, then give the reason in terms of objective and reporting line.
Mention independence for both audits, and avoid saying internal audit has none.
Use the exact terms 'members', 'board' and 'audit committee' for reporting lines.

Practice questions from Internal Audit: Introduction and Overview

Internal Audit vs External Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit vs External Audit: frequently asked questions

What is the main difference between internal audit and statutory audit?

Internal audit reviews operations, risk and controls for management and the board, and aims to improve them. Statutory audit gives an opinion on the financial statements to the members. The first is advisory and wide; the second is assurance and defined by law.

Can the statutory auditor do the internal audit of the same company?

No. Section 144 of the Companies Act, 2013 expressly prohibits the statutory auditor from providing internal audit services to the company, its holding company or its subsidiary. This protects the independence of the statutory auditor.

Who appoints the internal auditor in a company?

Where internal audit applies, the board appoints the internal auditor, usually on the advice of the audit committee where one exists. Under Section 138 read with Rule 13, the person may be a chartered accountant, cost accountant or other professional as the board decides, or an employee. Section 138 makes internal audit mandatory only for prescribed classes of companies.

Does the statutory auditor depend on the work of the internal auditor?

The statutory auditor may consider the internal auditor's work and use it to plan procedures, but that is a matter of professional judgment. The statutory auditor stays fully responsible for the audit opinion.