Internal audit vs statutory audit: what actually differs

Internal audit and statutory audit differ in who they ultimately serve and what question they are answering. Internal audit reports to management and the audit committee on whether the organization's processes, risk management and controls are working, on a continuous basis throughout the year. Statutory audit reports to the shareholders on whether the financial statements present a true and fair view, as a periodic, independent opinion at year end. The two can and should coordinate, but one is not a smaller version of the other.

The core differences, side by side

Why independence is drawn differently

The independence requirement for each function is calibrated to who it reports to. A statutory auditor's independence from the entity being audited is close to absolute, because the opinion is relied upon by people with no other way to check it — shareholders, lenders, regulators. An internal auditor's independence is organizational rather than absolute: an in-house internal audit head reports to the audit committee precisely so that management, whose processes are being reviewed, cannot direct or suppress the findings, but the internal auditor remains an employee of the same organization in a way a statutory auditor never is.

Where the two genuinely overlap

Both functions, at different points, look at controls over financial reporting. A statutory auditor forming an IFC opinion tests controls; an internal auditor covering the same process as part of its annual plan also tests controls. Run without coordination, this becomes the same walkthrough performed twice, the same sample pulled twice, and the same control owner interviewed twice in the same quarter — a cost with no corresponding benefit to either engagement.

How statutory audit can use internal audit's work

A statutory auditor is permitted to use the work of internal audit, but only after evaluating it — this is not an assumption that can be made because a report with a similar heading already exists in the client's files.

1. 01Assess internal audit's objectivity and organizational statusWho it reports to, whether it audits areas it is itself responsible for, and how insulated it is from management direction on scope and findings.
2. 02Assess the technical competence of the internal audit teamQualifications, experience, and whether the team has the training appropriate to the areas it has tested.
3. 03Assess whether internal audit applies a systematic and disciplined approachDocumented methodology, quality control over its own work, and proper supervision and review.
4. 04Re-perform a sample of internal audit's work directlyBefore placing any reliance, the statutory auditor tests a selection of internal audit's own testing to confirm it holds up, rather than taking the conclusion on faith.
5. 05Document the basis for reliance explicitlyWhich areas, to what extent, and the re-performance evidence that supports the decision — this has to be visible in the statutory audit file, not just assumed from a conversation with the internal audit head.

Where coordination pays off even without formal reliance

• Aligning the internal audit plan's coverage dates with the statutory audit timetable, so the same control is not walked through twice in the same quarter by two different teams.
• Sharing the risk control matrix and walkthrough documentation, so each team builds on the other's work rather than starting from a blank page.
• A joint discussion of fraud risk indicators and whistleblower complaints, since both functions have a legitimate interest in the same information and often hold different pieces of it.
• Internal audit flagging a control weakness early enough in the year that the statutory auditor can factor it into risk assessment, rather than both functions discovering it independently at year end.