Why Most Founders and CFOs Confuse These Three

When a business reaches a certain scale — revenues crossing ₹10 crore, a board of directors, institutional investors, a finance team — the conversation about audits begins. And almost immediately, confusion follows.

‘We already have a statutory audit done every year. Now someone says we need an internal audit too. And our CA mentioned a tax audit before September. Are these three different things? Do we need all of them?’

Yes, they are different. And depending on your company’s size, structure, and activities, you may need all three — each for a different purpose, each with a different legal basis, each reported to a different audience.

This guide explains each type clearly, compares them in a side-by-side table, and helps you understand when a growing Indian business needs all three.

Statutory Audit Explained

Legal Basis – Companies Act 2013

A statutory audit is mandatory for every company registered under the Companies Act 2013 — whether it is a private limited company, a public limited company, an OPC, or an LLP (under the LLP Act). The legal basis is Section 139 of the Companies Act, which requires the appointment of an auditor and the annual audit of financial statements.

The objective of a statutory audit is to provide an independent opinion on whether the company’s financial statements — balance sheet, profit and loss account, cash flow statement, and notes — present a ‘true and fair view’ of the company’s financial position and performance.

Who Performs It and Their Independence Requirement

A statutory audit must be performed by a Chartered Accountant in practice who is independent of the company. Independence means the auditor or their firm cannot hold shares in the company, cannot be an employee, and cannot have any financial relationship with the company that could compromise objectivity.

The auditor is appointed by the shareholders at the Annual General Meeting (AGM) and cannot be removed without following the prescribed procedure. Rotation requirements apply for certain categories of companies.

Output – The Audit Report Under SA 700

The statutory auditor’s report is issued under Standard on Auditing 700 (SA 700 — Forming an Opinion and Reporting on Financial Statements). It contains:

• An opinion on whether the financial statements are true and fair
• The basis for the opinion (nature and scope of audit procedures performed)
• Key Audit Matters (for listed companies and certain public interest entities)
• Report on the Companies (Auditor’s Report) Order (CARO) for applicable companies
• Report on internal financial controls

This report is attached to the financial statements filed with the Registrar of Companies (ROC) and reviewed by lenders, investors, and regulators.

Penalty for Non-Compliance

Failure to get accounts audited or filing unaudited financial statements with the ROC attracts penalties under Section 147 of the Companies Act. The company and every officer in default can be fined. In serious cases of audit evasion, prosecution under Section 448 (false statements) applies.

Internal Audit Explained

The Section 138 Mandate

Internal audit under Section 138 of the Companies Act 2013, read with Rule 13 of the Companies (Accounts) Rules 2014, is mandatory for:

• Every listed company
• Every unlisted public company with paid-up share capital of ₹50 crore or more, or turnover of ₹200 crore or more, or outstanding loans / borrowings of ₹100 crore or more, or outstanding deposits of ₹25 crore or more
• Every private limited company with turnover of ₹200 crore or more, or outstanding loans / borrowings from banks or public financial institutions of ₹100 crore or more

Even companies below these thresholds often opt for internal audit voluntarily as a governance best practice — particularly those with investor reporting obligations, bank covenants, or complex operations.

Who Performs It and Reporting Lines

Unlike the statutory audit (which must be external and independent), the internal audit can be performed by:

• An in-house internal audit team (employees of the company)
• An outsourced internal auditor (a CA firm or advisory firm engaged for the purpose)

The internal auditor reports to the Audit Committee of the Board (where constituted) or directly to the Board. Importantly, the internal auditor is not independent in the same sense as the statutory auditor — they work for management and serve as an internal risk management function.

Output – Risk-Based Audit Reports

Internal audit reports are not standardised in the way statutory audit reports are. They are typically risk-based — the internal auditor identifies the company’s key risk areas, designs an audit plan to test controls and processes in those areas, and produces reports that:

• Identify control weaknesses and process gaps
• Quantify financial exposure or efficiency losses
• Recommend corrective actions with timelines
• Track implementation of prior recommendations

Internal audit adds the most value when it operates proactively — flagging issues before the statutory auditor finds them, and before they crystallise into losses or notices.

Tax Audit Explained

Section 44AB and Applicability Thresholds

A tax audit under Section 44AB of the Income Tax Act 1961 is mandatory for:

• Businesses with total sales, turnover, or gross receipts exceeding ₹1 crore in a financial year. (This threshold is ₹10 crore if cash receipts and payments do not exceed 5% each.)
• Professionals (doctors, lawyers, CAs, architects, etc.) with gross receipts exceeding ₹50 lakh
• Businesses or professionals opting for presumptive taxation under Sections 44AD, 44ADA, or 44AE but declaring income below the prescribed presumptive percentage

The tax audit is separate from the statutory audit and from the internal audit. A company can have all three simultaneously — and most growing companies do.

Form 3CA/3CB and Form 3CD

The tax audit report is submitted in one of two forms:

• Form 3CA: Used when the accounts are already audited under any other law (e.g., Companies Act). The CA certifies the statutory audit report and provides additional disclosures specific to tax.
• Form 3CB: Used when the accounts are not otherwise required to be audited. The CA audits the accounts specifically for tax purposes.

Both forms are accompanied by Form 3CD — a detailed statement containing 41 clauses covering every aspect of the taxpayer’s financial affairs relevant to income tax: revenue recognition, depreciation, loans and advances, related party transactions, deductions claimed, disallowances, and more.

Form 3CD is effectively a comprehensive tax disclosure document. It is reviewed by the Income Tax Department during assessment and is the primary source document for most income tax scrutiny proceedings.

Reporting Deadlines and Penalty

The tax audit report must be submitted on the Income Tax Portal by the taxpayer’s CA by September 30 of the assessment year (i.e., September 30, 2026 for FY 2025-26). If an international transaction is involved, the deadline extends to November 30.

The penalty for non-compliance is 0.5% of total sales, turnover, or gross receipts — subject to a maximum of ₹1.5 lakh. However, if the default is proved to be wilful, prosecution under Section 276B may also apply.

Side-by-Side Comparison

Criteria	Statutory Audit	Internal Audit	Tax Audit
Legal Basis	Companies Act 2013	Section 138, Companies Act	Section 44AB, Income Tax Act
Who Conducts	External CA firm (independent)	Internal team or outsourced CA	CA in practice
Mandate	All companies	Specified companies (turnover / paid-up capital thresholds)	Businesses above ₹1 Cr / ₹50 L threshold
Report Output	Audit Report under SA 700	Risk-based internal audit report	Form 3CA/3CB + Form 3CD
Reports To	Shareholders, regulators, banks	Audit Committee / Board	Income Tax Department
Frequency	Annual	Continuous / quarterly	Annual (before 30 September)
Focus Area	Accuracy of financial statements	Operational risk, internal controls	Tax compliance, books of accounts
Non-Compliance	Penalties under Companies Act	Penalties under Section 138	0.5% of turnover, max ₹1.5 lakh

When a Growing Business Needs All Three

Let us illustrate with a concrete example. Consider a Bengaluru-based private limited company with:

• Revenue of ₹85 crore in FY 2025-26
• Outstanding bank borrowings of ₹120 crore
• A statutory audit firm appointed under the Companies Act

This company needs:

• Statutory audit: Mandatory under Section 139 of the Companies Act. Required for ROC filings, lender reporting, and shareholder compliance.
• Internal audit: Mandatory under Section 138, because outstanding borrowings exceed ₹100 crore. Also essential for the bank’s covenant compliance monitoring.
• Tax audit: Mandatory under Section 44AB, because turnover exceeds ₹1 crore. Due by September 30 along with the ITR filing.

Not having all three in place is not just a governance gap — it is a legal exposure. For each audit type, the penalty provisions and potential prosecution clauses are distinct.

A practical note: the three audits can and should be coordinated. At BSD, we sequence the tax audit to begin only after the statutory audit is substantially complete — so that Form 3CD figures align with the audited financial statements. Misalignment between the two is a common scrutiny trigger.

How BSD Approaches Each

B S D & Co. has been conducting statutory audits for over 53 years. Our practice spans private limited companies, public limited companies, and listed entities across manufacturing, services, financial services, and healthcare.

For internal audit, we provide outsourced internal audit functions for companies that prefer an external CA firm over an in-house team — combining the independence of an external auditor with deep familiarity with the client’s operations over time.

For tax audits, our process begins with a pre-audit review of the company’s books well before the September deadline — identifying potential disallowances, related party transaction disclosures, and deduction documentation gaps before the formal audit begins.

Planning your audit cycle for FY 2025-26? Let’s talk. Call 080-4851 7108 or visit bsdgroup.in to schedule an audit consultation with our team.