Statutory Audit vs Tax Audit vs Internal Audit — India FY 2025-26

Navigating the Indian compliance landscape feels like walking through alphabet soup, especially as SMEs scale. Terms like “statutory audit,” “tax audit,” and “internal audit” get used interchangeably by finance teams + consultants. Each serves a distinct purpose, reports to a different regulatory body, and carries unique penalties for non-compliance.

This guide breaks down exactly what each audit is, the FY 2025-26 thresholds that trigger them, and the 60-day prep timeline that turns audit season from a firefight into a routine cycle.

The three audit types side-by-side

Feature	Statutory Audit	Tax Audit	Internal Audit
Governing law	Companies Act, 2013 — Section 139	Income Tax Act, 1961 — Section 44AB	Companies Act, 2013 — Section 138 + Rule 13 of Companies (Accounts) Rules, 2014
Primary purpose	Ensure financial statements present a “true and fair view”	Verify correct income, deductions, and tax compliance	Evaluate risk management, internal controls, and process effectiveness
Applicability	Every company (Pvt Ltd, Public, OPC, Sec 8) regardless of turnover	Turnover > ₹1 cr (or ₹10 cr if cash ≤ 5% of receipts + payments); professionals > ₹50 lakh	Pvt Ltd: turnover ≥ ₹200 cr OR borrowings ≥ ₹100 cr. Unlisted public: more criteria (see below).
Who can perform	Independent practising Chartered Accountant (CA)	Independent practising CA	CA, Cost Accountant, or Board-approved professional (may be in-house or external)
Key deliverable	Independent Auditor’s Report attached to financial statements	Form 3CA or 3CB + Form 3CD (40+ clauses)	Internal Audit Report — flexible format, presented to Board / Audit Committee
Due date (FY 2025-26)	Adopted at AGM (typically by 30 September 2026 for most companies)	30 September 2026 (31 October 2026 if Transfer Pricing audit also applies)	Ongoing; frequency decided by Board / Audit Committee
Penalty for default	Fines on company + directors; potential prosecution under Sec 147	0.5% of turnover OR ₹1.5 lakh — whichever is lower (Sec 271B)	General penalty under Sec 450: ₹10,000 + ₹1,000/day (capped)

Statutory audit: the financial truth-teller

The statutory audit is the baseline of corporate compliance. Mandated by Section 139 of the Companies Act, 2013, it applies to every registered company from the moment of incorporation — even at zero revenue or in loss.

Scope and standards

Statutory auditors follow the Standards on Auditing (SAs) issued by ICAI. The objective is “reasonable assurance” that the financial statements are free from material misstatement — not finding every ₹10 error. Auditors verify balance sheet items, vouch for P&L expenses, and ensure compliance with the applicable accounting framework (Ind AS for entities above the Ind AS threshold per the Companies (Indian Accounting Standards) Rules, 2015; Companies (Accounting Standards) Rules, 2021 — i.e. AS for others).

Types of audit opinion

At the end of the audit, the report carries one of four opinion types:

Opinion	Meaning
Unmodified (Clean)	Financial statements present a true + fair view. This is what every company wants.
Qualified	Largely accurate but with a specific, isolated material issue (e.g., inadequate provision for bad debts).
Adverse	Materially misstated; do NOT represent the company’s true financial health. Severe red flag for investors + lenders.
Disclaimer	Auditor could not obtain enough evidence to form any opinion (e.g., accounting records destroyed or withheld).

Key audit areas typical for SMEs

For scaling SMEs, statutory auditors typically focus on:

• Revenue recognition — are sales recorded in the correct period? (Ind AS 115 / AS 9 cut-off testing)
• Inventory valuation — do physical stock counts match the books? Is valuation at lower of cost / NRV? (Ind AS 2 / AS 2)
• Related-party transactions — are transactions with directors’ other businesses at arm’s length? (Companies Act Sec 188 + Ind AS 24 / AS 18)
• Going concern — does the company have cash flow to survive the next 12 months? (SA 570)
• Section 43B compliance — are statutory dues (PF, ESI, TDS, GST) paid before the ITR filing date? Unpaid statutory dues are disallowed under Section 43B.

Tax audit: the revenue department’s checkpoint

The tax audit under Section 44AB of the Income Tax Act, 1961 is a magnifying glass for tax compliance. It ensures income isn’t understated, deductions aren’t fabricated, and TDS / TCS compliance is in order.

When Section 44AB applies (FY 2025-26 thresholds)

Entity type	Threshold
General business	Turnover > ₹1 crore
Digital-first business (cash receipts AND cash payments each ≤ 5% of total)	Turnover threshold lifts to ₹10 crore
Professionals	Gross receipts > ₹50 lakh (unless opting for Section 44ADA presumptive scheme, which covers up to ₹75 lakh if 95%+ digital)
Presumptive opt-outs	If you previously opted for presumptive taxation (Section 44AD / 44ADA) but decide to declare income LOWER than the prescribed percentages, tax audit is mandatory regardless of turnover

Form 3CA vs Form 3CB

The auditor’s report is filed using one of two forms depending on entity type — per Rule 6G of Income Tax Rules, 1962:

• Form 3CA — used when the business is already mandated to get accounts audited under another law (e.g., a Pvt Ltd company undergoing statutory audit under the Companies Act). The statutory auditor reuses their report for tax-audit purposes.
• Form 3CB — used when the business is NOT required to be audited under any other law (e.g., sole proprietorships or partnership firms crossing the turnover threshold).

Both forms attach Form 3CD — the detailed tax-audit questionnaire.

Form 3CD — clause-by-clause for SMEs

Form 3CD has 40+ clauses. Key SME focus areas:

Clause	What it captures
16	Items not credited to P&L (checking for hidden income)
18	Particulars of depreciation (Income Tax Section 32 block-of-assets basis vs Companies Act Schedule II accounting basis)
21(b)	Amounts disallowed under Section 40(a)(ia) — TDS non-deduction triggers 30% expense disallowance
26	Section 43B disallowances — unpaid GST, PF, bonus, gratuity not cleared before ITR filing
34	Detailed TDS / TCS compliance — every Section 192 / 194C / 194J / 194I / 194Q / 194H deduction scrutinised against rates + thresholds

Worked example. If books show ₹5 lakh paid to a consultant but TDS at 10% (Section 194J) was not deducted, the tax auditor flags this under Clause 21(b). Consequence: 30% of ₹5 lakh = ₹1.5 lakh is added back to taxable profit for the current year. The disallowance reverses in the year the TDS is eventually deducted + deposited — but in the meantime, the entity pays tax on phantom income.

Internal audit: the operational X-ray

While statutory + tax audits look backwards at what happened, the internal audit under Section 138 of the Companies Act, 2013 looks forward + sideways — evaluating whether internal controls, operations, and risk-management systems actually work.

Mandatory thresholds — Rule 13, Companies (Accounts) Rules, 2014

Private limited companies — internal audit is mandatory if, in the preceding FY:

• Turnover ≥ ₹200 crore, OR
• Outstanding borrowings from banks / public financial institutions ≥ ₹100 crore at any point during the FY

Unlisted public companies — stricter thresholds (any ONE triggers internal audit):

• Paid-up capital ≥ ₹50 crore, OR
• Turnover ≥ ₹200 crore, OR
• Outstanding borrowings ≥ ₹100 crore, OR
• Outstanding deposits ≥ ₹25 crore

Listed companies — internal audit is mandatory regardless of size.

Voluntary internal audit (for SMEs below threshold)

Even when not statutorily required, implementing voluntary internal audit at the ₹50-75 crore turnover band is highly recommended. It bridges the gap between owner-operator oversight + scaled professional operations.

Two methodology approaches:

• Compliance-based — tick-box approach. Did we pay PF on time? Are invoices authorised? Are vendor payments approved? Useful for early-maturity SMEs.
• Risk-based — the modern standard aligned with the IIA (Institute of Internal Auditors) International Professional Practices Framework. Focuses on vulnerabilities: is IT secure against ransomware? Is vendor onboarding susceptible to kickbacks? Is revenue recognition resistant to channel-stuffing? Recommended for SMEs above ₹100 crore.

Auditor independence + the Audit Committee

To ensure audits aren’t compromised by internal pressure, the Companies Act enforces structural boundaries.

Section 141 + 144 — auditor independence

Section 141 — the statutory auditor must be completely independent. Disqualifications include:

• An officer or employee of the company
• A person holding securities of the company
• Indebted to the company for an amount exceeding ₹5 lakh (per Rule 10 of Companies (Audit and Auditors) Rules, 2014)
• A partner / employee of any of the above

Section 144 — restricts the statutory auditor from providing 8 specified non-audit services to the audit client (or its holding / subsidiary / associate):

1. Accounting + bookkeeping services
2. Internal audit services (Section 144(b) — directly relevant to the topic of this page)
3. Design + implementation of any financial information system
4. Actuarial services
5. Investment advisory services
6. Investment banking services
7. Outsourced financial services
8. Management services

If the firm keeps the company’s books, it cannot audit them. If it does the internal audit, it cannot also be the statutory auditor.

Section 177 — the Audit Committee

While generally applicable to listed entities + larger public companies (every listed entity + every public co with paid-up capital ≥ ₹10 cr OR turnover ≥ ₹100 cr OR aggregate borrowings + debentures + deposits > ₹50 cr), growing SMEs should understand the structure.

An Audit Committee must have a minimum of 3 directors with independent directors forming a majority. The committee acts as the buffer between management + auditors — reviewing financial statements before Board approval, defining the scope of internal audit, and approving related-party transactions.

Audit preparation timeline — T-minus 60 days

Don’t wait until August to prepare for a September deadline. The reverse timeline below turns audit season into a routine cycle.

Day	Stage	Action
−60	Pre-audit meeting + requirements	Schedule kickoff with statutory + tax auditor. Request the “Prepared by Client” (PBC) checklist for FY 2025-26. Assign owners per schedule (HR for payroll, Operations for inventory, Finance for the rest).
−45	Reconciliations + Trial Balance lock	Complete all major reconciliations: bank, GST vs books (GSTR-1, GSTR-3B vs GSTR-2B matching), 26AS / AIS matching, TDS receivable. Lock the draft Trial Balance.
−30	Physical verifications + provisioning	Complete + document physical verification of fixed assets + inventory. Pass all provision entries (audit fees, unbilled revenue, accrued expenses, bonus, gratuity).
−15	TDS + statutory dues cleared	Ensure all pending statutory liabilities (PF, ESI, TDS, GST) are paid. Section 43B requires payment before ITR filing date to claim the expense in the current year — unpaid statutory dues get disallowed. Compile challans.
0	Fieldwork kickoff	Provide auditor with final Trial Balance, draft financial statements, completed PBC folder. Core finance team available to answer queries without delay.

The discipline that makes this 60-day timeline work starts with the monthly book closing checklist — clean monthly books mean the year-end isn’t a clean-up project.

Penalty exposure summary

Audit	Penalty for default	Cap
Statutory audit (non-appointment / non-compliance)	Sec 147: ₹25,000-₹5,00,000 on company; ₹10,000-₹1,00,000 + imprisonment up to 1 year on officer in default	—
Tax audit (Sec 271B)	0.5% of total turnover OR ₹1,50,000 — whichever LOWER	₹1.5 lakh
Internal audit (Sec 450 — general penalty as no specific penalty prescribed)	₹10,000 base + ₹1,000/day continuing default	₹2 lakh for company; ₹50,000 for officer in default (per Companies (Amendment) Act 2020)

Section 271B waiver is possible under Section 273B if “reasonable cause” is proved — rare in practice; treat the deadline as hard.

For SMEs that want to outsource the discipline

A clean monthly book-closing routine + a 60-day pre-audit preparation cycle requires consistent execution that many growing SMEs find hard to staff in-house. The coordinated bookkeeping service routes monthly bookkeeping + audit-preparation engagements to vetted CA partners under their own credentials — including the monthly closing rigour from the 13-step checklist + audit-ready trial balance handover on the agreed cadence.