Internal Audit: How It Differs From the Statutory Audit

Internal audit is a function inside a company that examines its own processes, controls and risks. Internal audit differs from the statutory audit on five axes: who appoints it, who reads it, what it may cover, how often it runs, and what it is for. The statutory auditor reports once a year to shareholders on the financial statements. Internal audit reports continuously to the audit committee on whatever the business asks.

Start with a busy restaurant rather than a set of accounts. Once a year somebody from outside walks in, checks the kitchen against the rules everybody has to meet, and leaves a certificate that goes on the wall where customers can read it. Separately, the person who runs the place walks that same kitchen every week: is the fridge log actually being filled in, is the vegetable supplier charging the rate that was agreed, is the handwashing rule being followed at eight in the evening when the place is full. Two people, two walks through the same kitchen, and almost nothing in common between them.

The certificate is written for the customers. The weekly walk is written for nobody but the person who runs the restaurant, and no customer will ever be shown a word of it. Two examinations inside one company divide the same way. The second walk has a vocabulary of its own, and a hard limit: it produces nothing an outsider is ever entitled to see.

A statutory audit already has a familiar shape: it reads the statements and the notes, it ends in an opinion bound into the annual report, and the work behind that opinion runs to a materiality figure nobody ever prints. A second examination runs inside the same business at the same time. Most people have heard of it, and very few can place it correctly.

What is internal audit, and what is the statutory audit, taken one at a time?

Internal auditA team inside a company, either employed or brought in under contract, that examines the company's own processes, controls and risks and reports what it finds to the people who govern the company. is a function that sits inside the business. The function may be a department of employees, or one person, or a firm brought in under contract to do the work, and in each case the company itself engages it. Its job is to go and look at the company's own machinery: how an order becomes an invoice, whether the stock count is done the way the manual says, whether a supplier was approved before work was placed with them, whether a risk somebody flagged two years ago is still being managed. Internal audit writes up what it finds and hands the write-up to the people who govern the company.

The statutory audit is a different animal entirely. The law requires it. A professional from outside the company, who holds no other role in it and is appointed by the shareholders rather than by the management, performs the work, and the work is directed at one artefact only: the financial statements. The audit ends in a published opinion addressed to those shareholders, and anybody who gets hold of the accounts can read it. For Anjani Stationers Private Limited, an invented stationery business, the opinion came out unqualified, with nothing qualified and no matter emphasised. A plain trading business ordinarily receives exactly that, and it is not a distinction.

Both are called an audit, and neither is a smaller or larger version of the other: they are two different jobs that happen to share a word, and reading them as two grades of the same job is where almost every misunderstanding on this subject starts. Hold the restaurant in mind. Nobody thinks the weekly walk is a cheaper version of the annual inspection, or that the inspection is a grander version of the walk. The inspection and the walk answer different questions for different people. So do the statutory audit and internal audit.

Who appoints each one, and why does that decide everything else?

The statutory auditor of Anjani Stationers Private Limited is appointed by its members at a general meeting. The board may put forward a name, but the appointment itself belongs to the shareholders, and that is deliberate rather than ceremonial. The people who will read the opinion are the same people who engaged the person writing it, so the professional's engagement does not depend on the goodwill of the management being examined.

Internal audit is engaged by the company. In a large business that means the board or, where one exists, its audit committeeA committee of a company's board, usually made up of directors who hold no executive job in the business, that oversees financial reporting, the external auditor and the internal audit function., a committee of directors holding no executive job in the business. In a small one it means the board itself, or a director signing a contract with somebody who will come in and do the work. Either way it is a hiring decision made inside the company, funded from the company's own money, and revisable by the company at any time.

The statutory auditor is engaged by the people the report is written for. Internal audit is engaged by the people it examines, and that single asymmetry is the origin of every other difference between the two. Followed forward, the rest can be derived without being told. If a company engages a function itself, it decides what that function looks at, it decides how often, it receives what the function finds, and it decides what to do about it. Every one of those is one of the remaining four axes.

Who reads what each one produces?

The statutory audit produces a published opinion. The opinion is addressed to the members of Anjani Stationers Private Limited, it is bound into the same document as the accounts, and once that document is filed, anybody who can obtain it can read the opinion in full. A lender, a supplier, a rival stationery business, a student: the readership is not controlled and was never meant to be.

Internal audit produces reports that travel a very short distance. A finding is written so that somebody fixes it. A finding therefore goes to the audit committee or the board, and usually also to the manager of the process that was examined. The report is not published, not summarised in the accounts, not attached to the annual report, and not available on request. The report is an internal document in the plainest sense of the word.

The audience axis is the one readers collapse, and collapsing it is what turns a fact about governance into an imagined second opinion on the published numbers. If one row of the table is worth carrying away, it is this one. The statutory audit exists to tell an outside reader something. Internal audit exists to tell the board something. The outside reader is not on its distribution list, and there is no version of the arrangement in which the reader becomes one.

What is each function allowed to look at?

The statutory audit has a bounded scope, and the boundary is the financial statements. Everything the auditor examines is examined because it bears on whether those statements are free from material misstatement. Controls come into it, but only that far: a control is tested where testing it is the efficient route to a conclusion about a number, and a control that has no bearing on the statements is simply not the statutory auditor's business. Materiality then sizes the effort. On Anjani Stationers Private Limited's engagement the overall figure was Rs 1,90,000, the performance figure Rs 1,42,500 and the trivial figure Rs 9,500, and all three of those were settled by one professional for one engagement rather than read off any rule.

Internal audit has no such boundary. Its remitThe range of things a function is asked to examine. Internal audit's remit is set by the board or its committee rather than by law, so it can be widened or narrowed at any time. is whatever the board asks for this year, and it can be widened in a week. The stock counting routine in the warehouse. The way credit limits are set before an order from a school group is accepted. Whether the person who approves a supplier is the same person who selects them. None of that has to connect to a published number to be worth examining, and much of the most useful internal work never touches one.

A statutory audit tests controls only as far as the financial statements require. Internal audit's remit is far wider, and no materiality threshold bounds it at all. The second half of that is worth reading twice. There is no Rs 1,90,000 sitting at the front of an internal review. Somebody may be uneasy about a process, a manager may ask for it, or nobody may have looked at it for three years. Any of those is reason enough, and the rupee value attached to the process may be nothing at all.

How often does each one run?

The statutory audit is annual and it has a shape. The work starts after the year end, runs to a timetable driven by filing deadlines, reaches an opinion, and is then over until the following year. Whatever happened in Anjani Stationers Private Limited's warehouse in the third week of July is examined, if at all, months later and only through whatever record survived.

Internal audit is continuousRunning through the year rather than in one block. An internal audit plan usually rotates across processes, with individual pieces of work starting whenever they are needed.. There is usually a plan across the year, rotating from one process to the next, but a piece of work can also start on a Tuesday because something looked wrong on the Monday. The finding then goes to the committee at its next sitting, perhaps within weeks of the event rather than a year after it.

The statutory audit is a project with an end date and internal audit is a programme with none. The two therefore produce completely different kinds of finding. One produces a conclusion about a set of numbers at a point in time. The other produces a stream of observations about how the business is behaving, most of which will never be reduced to a number anybody publishes.

What is each function ultimately for?

The statutory audit exists to give outsiders something they can rely on. Its whole product is a short passage in a published document, and that passage is written for people who will never meet the business. Nothing in the statutory audit is designed to make Anjani Stationers Private Limited better at anything. The design serves one end, letting somebody outside decide whether the accounts can be used.

Internal audit exists to change the business. A finding that gets read, agreed and then not acted on is failed internal audit work. A statutory audit that produces an unqualified opinion and no change whatsoever has done exactly what it was engaged to do. The measure of success is different at the root.

The statutory audit exists to tell outsiders something and internal audit exists to change something inside, and neither is attempting the other one's job. A reader who grades them against each other has misread both. The two functions are not competing, they are not ranked, and one being present says nothing about the other being good.

What does internal audit cover that a statutory audit never reaches?

Four kinds of work sit almost entirely on the internal side, and they are worth naming individually rather than gesturing at. The first is operational auditExamining whether an activity is being run well, in terms of cost, time or waste, rather than whether it has been recorded correctly in the accounts., an examination of whether an activity is being run well rather than whether it has been recorded correctly. Is the delivery route to the Sunrise Public School group sensible, or is the same van going out half empty twice a week because nobody has looked at the schedule since it was set?

The second is compliance with the company's own policy, as distinct from compliance with the law. Anjani Stationers Private Limited may have a rule that two quotes are obtained before any binding work is placed, or that overtime in the warehouse needs written approval. No law requires either rule and no published number moves when the rule is broken, so no statutory auditor has any reason to look. Internal audit looks precisely because the company set the rule and wants to know whether it is real.

The third is fraud risk inside a specific process. Not fraud in the abstract, but the particular question of where in this company's own arrangement of duties a single person could both create something and approve it. The fourth is the one worth remembering. A control that exists on paper may or may not be followed on an ordinary Tuesday, and internal audit asks which. A signature box that everybody signs without reading is a control in a manual and no control at all in a warehouse.

None of those four questions changes a published figure. The statutory audit therefore does not ask them, and internal audit exists precisely to ask them. Think about the restaurant again. The annual inspection never asks whether the kitchen wastes vegetables. The weekly walk asks about very little else.

What happens when the statutory auditor uses internal audit's work?

The two functions are not sealed off from each other. A statutory auditor may make use of work that internal audit has already done, where that work is relevant to the audit of the financial statements and is of sufficient quality to be relied on. The saving is real. If internal audit has already tested a stock count in October, redoing the identical test in April serves nobody.

Using it is not automatic. Before any of it can be used, the statutory auditor has to form a view on two things about the internal function. The first is its objectivityWhether a person examining something is placed so that they can report what they find without their own position being at stake. Objectivity is about structure and incentives, not about honesty., and objectivity turns mostly on where the function reports and who decides its budget and its people. The second is its competence, meaning whether the work was done to a standard that can bear weight. Only after both are settled does it matter which specific work is used.

The statutory auditor remains solely responsible for the opinion however much internal audit work is used, and using that work transfers none of that responsibility to anybody. Readers most often get this part wrong. The opinion is not shared, not a joint conclusion, and carries no footnote about who did which part. If a conclusion turns out to have been wrong, the responsibility for it sits in exactly the same place it would have sat if internal audit had never existed.

Why is internal audit's independence a harder problem?

Take an everyday version first. A shop counts its till at closing, and the counting is done by the person who trained the cashier, sits beside the cashier all day and eats lunch with them. Nothing about that arrangement says either person is dishonest. The arrangement says that if the count ever went badly, the counter would be reporting on somebody whose good opinion they need tomorrow morning.

Internal audit sits in exactly that position. Because the position is easy to state unfairly, it is worth stating with precision. Internal auditors are employees, or contractors engaged by the company. Their salary comes from the company. Their careers, in many cases, continue inside the company after the review is over. The manager whose process they are examining may sit two desks away and may be in the same promotion queue. Set against that, the statutory auditor is a professional from outside, engaged by the shareholders, with no career inside the business at all.

The safeguard is structural rather than personal: a reporting lineWho a function formally reports to, meaning who receives its findings, sets its plan and decides on its people and budget. It is a structural fact about a company, not a description of anybody's character. that runs to the audit committee rather than to the management being examined. Establishing where that line runs is therefore the first thing worth doing about any internal audit function. If the head of internal audit reports to the finance director, then every finding about the finance function passes through the person it concerns. If the same head reports to a committee of directors holding no executive job, the finding arrives at people whose position does not depend on it being soft.

Nobody in that position is being accused of behaving badly. Integrity attaches to identifiable people, and a reporting line is an arrangement rather than a person. The point is narrower and more useful: a well designed structure does not require anybody to be a hero, and the reporting line is the structure. Where that line runs is the whole of the practical question.

What can an outside reader actually see of an internal audit function?

Almost nothing, and this section is the honest core of the subject. The complete list of what may reach an outside reader is short. A reader may be able to see that the function exists at all. A reader may sometimes be able to see where it reports, if the governance section of an annual report says so. A reader may occasionally see a short paragraph describing the plan for the year in general terms. The list ends there. There is no fourth item.

No reader will ever see a report. Not a summary of one, not a count of findings, not the topics covered, not whether last year's findings were fixed, not whether the head of the function agreed with the response. The reports go to the audit committee and stop there, and no mechanism exists by which a reader outside the company can request one.

The existence of the function and, sometimes, its reporting line are the entire information set available to an outside reader, and no further access to it exists. The limit is a hard boundary rather than a gap to be filled with inference. The quality of a function cannot be inferred from its existence, what it found cannot be inferred from what the accounts say, and the fact that its findings were acted on cannot be inferred from the absence of any problem in the numbers.

Compare it with a housing society that tells its members it has an internal committee which checks the society's accounts every quarter. The members now know the society has a habit of checking. The members have not been shown a single check, they do not know what the checks found, and they have no way of finding out. Knowing the habit exists is genuinely worth something. The habit is just worth very much less than a check anybody can see.

What does the arrangement look like at the scale of Anjani Stationers Private Limited?

Anjani Stationers Private Limited is a small, unlisted, private company. The company turns over Rs 2,70,00,000, holds Rs 1,80,00,000 of assets against Rs 38,00,000 of liabilities, and has 4,00,000 shares in issue. Its statutory audit is annual, works to an overall materiality of Rs 1,90,000, and produced an unqualified opinion carrying neither a qualification nor an emphasis of matter. A business of this kind gets that result every year, and it is not a compliment.

At that scale the picture a reader may be carrying, of a department of internal auditors reporting to a separate standing audit committee, does not describe the company at all. The audit committee function here is the board, sitting as itself. Any internal review is more likely to be a director asking Vaidehi Rao's finance team to go and check something, or a contracted person coming in for a fortnight, than a permanent function with a plan and a charter.

The elaborate two-audit structure a reader may picture belongs to larger companies, and knowing which structures apply at which scale is what stops a reader expecting disclosures that were never required in the first place. The size cut off, the turnover figure and the threshold at which any of it becomes required live in the Companies Act 2013 and the rules under it, and they are the kind of number that moves. The Ministry of Corporate Affairs is where they are best read.

Where do the two functions land on the Rs 8,00,000 of binding bought from Chitra Binding Works?

The case that settles the matter is worth working as arithmetic rather than asserting the conclusion. Chitra Binding Works, in which Anjani Stationers Private Limited holds 70 per cent, billed Anjani Stationers Rs 8,00,000 for binding across the year, and Rs 1,50,000 of that was still outstanding when the year closed. Chitra Binding Works is a related party, so the arrangement gets disclosed.

Now hold that Rs 8,00,000 against the statutory audit's own threshold. Overall materiality on this engagement was Rs 1,90,000. The Rs 8,00,000 is Rs 6,10,000 larger than that, more than four times the overall figure and more than five and a half times the performance figure of Rs 1,42,500. The binding is 2.96 per cent of the year's Rs 2,70,00,000 of revenue. The arrangement is nowhere near being too small for the statutory audit to notice; it sits comfortably inside the statutory auditor's reach, and any account of this subject that puts it below the threshold has the comparison backwards.

The second figure is tempting to reach for as the small one, so push on that one too. The Rs 1,50,000 still owed at the year end is Rs 40,000 below the overall figure of Rs 1,90,000, so on size alone it would not be material by itself. But it is still Rs 7,500 above the performance figure of Rs 1,42,500, so it is not a number the statutory audit would sail past either. There is no clean below-the-line item anywhere in this arrangement.

Which means the two functions are not divided by the size of the number at all: they are divided by the question each one asks about the same rupees. The statutory audit asks whether Rs 8,00,000 is the right amount, whether Rs 1,50,000 is the right closing balance, and whether the relationship with Chitra Binding Works is properly disclosed in the notes. Every one of those questions ends at the financial statements, and once they are answered the statutory audit has finished with the arrangement.

An internal review asks an entirely different set. Was the rate compared with anything before the work was placed? Did somebody with no interest in Chitra Binding Works approve the arrangement? Was binding actually delivered against every invoice? Has the volume drifted upward year on year without anybody revisiting it? Does any of it follow whatever purchase rule Anjani Stationers Private Limited set for itself? Not one of those answers changes a published figure. Not one of them is therefore a statutory audit question, and none of them turns on Rs 1,90,000 in any way.

From the starting position the financial statements route to the statutory audit alone, the audience is the members, and the result is visible in full. With the Rs 8,00,000 of binding selected, both functions light up, with different questions and different audiences, and only the disclosure reaches an outside reader. With the two quote rule, the delivery routing or the warehouse overtime rule selected, the statutory column goes dark every time, the audience becomes the board, and the visibility row reads never. Two items route to neither function: the plan for exercise books, and whether the school group will still be a customer in three years. No audit of any kind is an opinion on a decision or a forecast, and readers ask an audit report both of those questions constantly. Switch to the larger scale and the internal audience changes from the board itself to a separate standing committee, while the visibility row does not move at all.

How does a lender, an analyst or a household investor actually use this?

Three people hold this idea differently, and watching each one is more useful than another definition. A lender treats the existence of an internal audit function as an input about governance and never as extra comfort on the audited figures, an analyst asks where it reports rather than whether it exists, and a household investor should notice that they have been told about a habit rather than shown a result.

Start with the lender. A bank assessing Anjani Stationers Private Limited will note whether any internal review function exists and, more usefully, where it reports. The answer goes in the credit file under how the business is run, alongside who signs cheques and whether the board actually meets. The same answer does not go anywhere near the assessment of whether the Rs 2,70,00,000 of revenue is real. Such an assessment rests on the audited statements and on the bank's own work, and no internal function has contributed a single readable line to it.

The analyst's use is narrower still. Nothing about an internal audit function is published, so somebody comparing two unlisted stationery businesses cannot compare theirs. An analyst can read the governance section, note whether a reporting line is stated, and treat a stated line to an audit committee as slightly better evidence about the arrangement than silence. A stated reporting line is a small signal, and it should be held as a small signal.

And the household investor, putting money into a business a cousin runs, gets the most honest version of the lesson. Being told that somebody inside checks the books every quarter is worth having. Being told is not worth as much as one quarter's actual check, and confusing the two is how people end up feeling assured by an arrangement whose output they have never seen.

Where can any of this be checked at source?

An Act, a set of professional standards and a market regulator stand behind the arrangement, and each is named below. Periods, size cut offs, fee limits and reporting thresholds move between one reading and the next, so the only wording worth relying on is the wording at the source on the day it is read. A number belongs to that reading rather than to any secondary account of it.