An internal audit report fails to inform the statutory audit because the two functions typically run on entirely separate cycles — internal audit reports to the audit committee on its own quarterly or annual calendar, with its own scope decided independently — and unless the statutory auditor specifically requests and reviews internal audit's reports and working papers as part of planning, a finding that internal audit already identified, investigated, and closed can complete its entire lifecycle without the statutory auditor ever being aware it existed.
Why the information doesn't flow automatically
- Internal audit's reporting line runs to the audit committee or management, not to the statutory auditor, so there's no procedural requirement that triggers a handoff.
- The statutory audit's planning phase may happen before internal audit has completed its cycle for the year, or on a different schedule entirely.
- A finding gets marked "closed" internally once management's corrective action is implemented, and closed findings are rarely surfaced proactively to an external party.
- Internal audit's scope that year may have focused on operational efficiency rather than financial reporting risk, so even when shared, the report doesn't obviously connect to audit risk in the way it's written.
- The statutory auditor assumes internal audit coverage is adequate without actually reading the reports, treating the mere existence of an internal audit function as sufficient comfort.
The existence of an internal audit function is not, by itself, evidence that its findings informed the statutory audit's risk assessment. Relying on internal audit's work under SA 610 requires the statutory auditor to actually evaluate and use that work — not simply note that internal audit exists and move on.
What closes the gap
A direct request for internal audit's reports covering the period under audit, read specifically for financial reporting and control implications rather than taken at face value, is what actually connects the two functions — because nothing in the standard reporting structure connects them on its own.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCInternal audit vs statutory audit: what actually differsWhere internal audit and statutory audit genuinely differ — objective, reporting line, independence, and timing — and where coordinating the two saves real work on both sides.
- Internal audit & IFCSA 610: using the work of internal auditors, and the two decisions it actually requiresSA 610 asks two separate questions, in a specific order. Skipping to the second without answering the first is the standard's most common misapplication.
- Internal audit & IFCInternal audit checklist for CA firms taking on the mandateHow to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.