What a statutory audit covers
The statutory auditor examines the company's books of account and forms an opinion on whether the financial statements give a true and fair view of its financial position, in accordance with the applicable accounting standards. Section 143 also requires the auditor to report on specific matters — whether proper books have been kept, whether the balance sheet and profit and loss account agree with the books, and whether the company has adequate internal financial controls, among other things.
For most companies, the audit report is also read together with the Companies (Auditor's Report) Order, 2020 (CARO 2020), under which the auditor comments on a further list of specific matters — fixed assets, inventory, loans and guarantees, statutory dues, and related-party transactions among them. Some companies are exempt from CARO reporting, based on criteria that have been revised more than once in recent years; we confirm whether CARO applies to your company at the planning stage rather than assuming last year's position still holds.
Because this report is what your bank, your investors and the Registrar all rely on, the audit is not a formality that happens after the year is over — planning and interim checks through the year make the year-end audit faster and reduce the chance of a last-minute surprise.
Statutory audit compared with tax audit and internal audit
| Feature | Statutory Audit | Tax Audit | Internal Audit |
|---|---|---|---|
| Governing law | Companies Act, 2013, Section 143 | Income Tax Act, 1961, Section 44AB | Not mandated by statute for most companies |
| Who must have one | Every company, every year | Businesses/professionals above the prescribed turnover or receipts limit | Commissioned by the board or management; mandatory only for certain larger companies under Section 138 |
| Purpose | True and fair view of the financial statements, for shareholders and the ROC | Verifying compliance with the Income Tax Act, for the tax department | Independent review of a process, control or risk area, for management |
| Report goes to | Shareholders, filed with the ROC | Filed on the income tax portal in Form 3CA/3CB and 3CD | Management or the audit committee — not publicly filed |
| Can the same CA do more than one? | A company's statutory auditor commonly also signs its tax audit report; the same firm generally cannot also be the internal auditor of the same company under Section 144(b). | ||
Documents and records required
- Books of account for the year — ledgers, cash book, bank book, journal.
- Bank statements for all accounts held during the year, and reconciliations.
- Sales and purchase invoices, and other supporting vouchers for expenses.
- Fixed asset register, with additions and disposals during the year.
- Loan and investment documents — sanction letters, statements, board resolutions for borrowings.
- Statutory registers maintained under the Companies Act — register of members, directors, charges.
- The prior year's audited financial statements and audit report.
- GST returns and TDS returns filed during the year, for cross-verification against the books.
- Payroll records, and details of statutory dues (PF, ESI, professional tax, TDS) paid and outstanding.
- Minutes of board meetings and the AGM held during the year.
The audit process, step by step
-
Appointment and engagement letter
The auditor is appointed by the board (first auditor) or at the AGM (subsequent auditors), and Form ADT-1 is filed with the ROC. An engagement letter sets out the scope, timeline and management's responsibilities before fieldwork begins.
-
Audit planning
The auditor assesses the business, identifies areas of higher risk, sets materiality levels, and plans the extent of testing required — a manufacturing company with significant inventory is planned differently from a services company with none.
-
Fieldwork
Vouching of transactions, verification of assets and liabilities, bank and balance confirmations, physical verification of inventory where applicable, and testing of internal controls are carried out against the audit plan.
-
Draft financial statements and findings
Draft financial statements are prepared or reviewed, and observations from fieldwork — including anything that could affect the audit opinion — are discussed with management before the report is finalised.
-
Management representation letter
Management formally confirms, in writing, matters the auditor cannot independently verify — the completeness of disclosures, contingent liabilities, and related-party transactions among them.
-
Finalisation and signing
The audit report, along with the CARO annexure where applicable, is finalised and signed by the partner, carrying their membership number and a valid UDIN.
-
Filing with the ROC
The audited financial statements, together with the audit report, are adopted at the AGM and filed with the Registrar in Form AOC-4 within the prescribed period.
Timelines and penalties
| Event | Timeline |
|---|---|
| Appointment of first auditor | Within 30 days of incorporation, by the board |
| Filing of auditor appointment (ADT-1) | Within 15 days of the AGM at which a subsequent auditor is appointed |
| Annual General Meeting | Within 6 months of the financial year end — by 30 September for a 31 March year end |
| Filing of financial statements and audit report (AOC-4) | Within 30 days of the AGM |
| Default | Consequence |
|---|---|
| Failure to appoint an auditor within the prescribed time | Penalty under Section 139, and the company cannot lawfully carry on business until an auditor is appointed |
| Late filing of AOC-4 | Additional fee of ₹100 per day of delay, with no upper limit |
| Auditor fails to report a fraud they've noticed | Personal liability for the auditor under Section 143(12), separate from any consequence to the company |
Practical notes from our engagements
- Fixed asset registers that don't match the books. Assets purchased and never added to the register, or disposed of assets still carried at cost, are one of the most common findings — and one of the easiest to prevent with a register updated through the year rather than reconstructed at audit time.
- Related-party transactions not flagged as such. A payment to a director's relative or an associate entity needs to be identified and disclosed as a related-party transaction; it's often missed simply because nobody flagged the relationship when the transaction was recorded.
- Provisions not booked at year end. Expenses incurred but not yet invoiced — a bonus payable, an audit fee, an outstanding utility bill — need to be provided for in the year they relate to, not the year the invoice arrives.
- GST and books not reconciled before the audit starts. A mismatch between turnover reported in GST returns and turnover in the books is exactly the kind of thing an auditor has to investigate and resolve, which takes far less time if it's caught during the year than at audit time.
- Physical stock verification skipped. Where inventory is material, the auditor needs evidence of a physical count, not just the books. Companies that don't conduct one near year end add time — and sometimes a qualification — to the audit.
- Prior-year qualifications carried forward unaddressed. If last year's report flagged an issue, this year's auditor will ask what's been done about it. "Nothing yet" is a legitimate answer, but it should be a deliberate one, not a surprise.
How we handle a statutory audit
The partner responsible for your audit reviews the business and sets the audit plan before fieldwork starts — what needs testing, what can be sampled, and where the risk actually sits, rather than a generic checklist applied regardless of the business. Fieldwork is carried out by the team, but observations that could affect the opinion are raised with you as they come up, not saved for a single meeting at the end.
We also flag compliance gaps that surface during the audit but sit outside its formal scope — a missed ROC filing, an unreconciled GST position, a lapsed licence — rather than limiting ourselves strictly to the audit opinion and leaving you to discover them separately. Audits are conducted from whichever of our seven offices is closest to your registered office or principal place of business.
Related services
Frequently asked questions
Is a statutory audit compulsory even if my company had no turnover this year?
Yes. Every company registered under the Companies Act must have its accounts audited every year under Section 143, regardless of turnover, profit or business activity.
Who appoints the statutory auditor?
The board of directors appoints the first auditor within 30 days of incorporation. Subsequent auditors are appointed by the shareholders at the AGM.
Can the statutory auditor be changed?
Yes, an auditor can be removed or can resign, subject to the procedure under the Companies Act, which includes shareholder approval for removal and a filing with the ROC in either case.
What is CARO, and does it apply to every company?
CARO 2020 is an order requiring the auditor to report on a specific list of matters beyond the core financial statements. Certain companies, including many small companies, are exempt — we confirm this for your specific company at the planning stage.
Can the same CA firm do both my statutory audit and my tax audit?
Yes, this is common and generally permitted — the independence restrictions that matter most concern internal audit and certain non-audit services, not the tax audit.
What happens if a company fails to appoint an auditor on time?
The company cannot lawfully carry on certain activities until an auditor is appointed, and a penalty applies under Section 139. It's treated as a serious default, not a minor delay.
Does a One Person Company (OPC) need a statutory audit?
Yes. The requirement under Section 143 applies to every company, including an OPC, regardless of size.
Can the audit be completed before the financial year officially closes?
No — the audit is performed on the completed financial statements for the year, so fieldwork on the final position can only conclude once the year has ended, though planning and interim work can happen earlier.
What is a management representation letter, and why is it needed?
It's a formal written confirmation from management on matters the auditor can't independently verify — such as the completeness of disclosures or the existence of contingent liabilities — and it's a standard part of every statutory audit.
What is a UDIN, and why does it matter?
A Unique Document Identification Number is generated by the signing Chartered Accountant for every audit report and certificate, as a safeguard against forged or fabricated documents being passed off as genuine. A report without a valid UDIN is not considered validly issued.
Can a company change its statutory auditor every year?
Yes, there's no requirement to keep the same auditor, though frequent changes without clear reason can themselves draw scrutiny from stakeholders or the ROC.
What if the auditor's report is qualified?
A qualified opinion means the auditor has identified a specific matter they can't confirm gives a true and fair view. It doesn't stop the filing, but it is visible to anyone who reads the financial statements, including banks and investors.
How far in advance should we start the audit process?
Ideally before the financial year ends, so planning and any interim testing can happen early. Starting only after year end is common but tends to compress the timeline unnecessarily.