Statutory Audit

A statutory audit is the independent examination of the financial statements that the Companies Act requires, leading to an opinion addressed to the shareholders. An internal audit serves management, reviewing controls, risks and operational efficiency on an ongoing basis and reporting internally. The statutory auditor is external and appointed by the shareholders, while the internal auditor supports the board and management. The two are complementary, and a company may have both.

Management and those charged with governance prepare the financial statements and are responsible for their accuracy, for the accounting policies applied, and for the internal controls that produce them. The statutory auditor does not prepare the statements. The auditor independently examines them and expresses an opinion on whether they give a true and fair view. This separation of roles is the basis of the assurance an audit provides.

A true and fair view means the financial statements, taken as a whole, present the company's financial position and performance fairly in accordance with the applicable accounting framework and are free from material misstatement. It is not a guarantee that every figure is exact or that no fraud exists. The opinion gives reasonable assurance, based on audit evidence and professional judgment, that the statements can be relied upon for decisions.

Standards on Auditing are the professional standards issued by ICAI and notified under the Companies Act that every statutory auditor must follow. They govern how the audit is planned, how evidence is gathered, how risks and fraud are addressed, and how the opinion is formed and reported. Following the standards is what makes the opinion credible and consistent, and the auditor's report confirms the audit was conducted in accordance with them.

An auditor does not test every transaction. The auditor sets a materiality level, the size of misstatement that could influence a reader's decisions, and assesses where the risk of material misstatement is highest, whether from the nature of an account, the complexity of an estimate, or the possibility of fraud. Audit effort is then concentrated on those higher-risk areas, which is why the depth of testing varies across different parts of the statements.

The auditor first evaluates whether the controls are designed appropriately, through walkthroughs of each significant process, and then tests whether they operated effectively across the year by examining a sample of transactions. Where a control is missing or fails, the auditor records a deficiency and considers its effect on the audit opinion. This evaluation is reported separately under Section 143(3)(i) for the companies to which that reporting applies.

There are four outcomes. An unmodified, or clean, opinion states the financial statements give a true and fair view. A qualified opinion is given when a specific matter is materially misstated or evidence is missing, but the issue is not pervasive. An adverse opinion is given when misstatements are both material and pervasive, so the statements as a whole are unreliable. A disclaimer is issued when the auditor cannot obtain enough evidence to form any opinion at all.

Key Audit Matters are the matters that, in the auditor's judgment, were most significant in the audit, such as a major estimate, a complex transaction, or a high-risk area. They are described in a dedicated section of the auditor's report, with an explanation of how the audit addressed each one. Reporting Key Audit Matters is required for audits of listed companies, and other companies may choose to include them. They add transparency without changing the opinion itself.

Alongside the opinion on the financial statements, the auditor attaches a CARO annexure reporting on a set of specified matters under the Companies (Auditor's Report) Order. For each matter the auditor gives a clear answer, and where a matter is not in order, the auditor records an unfavourable or qualified remark with the reasons. Such a remark does not by itself modify the opinion on the financial statements, but it signals a compliance or control issue that the company and its stakeholders should address.

The auditor plans and performs the audit to obtain reasonable assurance that the statements are free from material misstatement, whether caused by error or fraud, and applies professional scepticism throughout. Detecting every fraud is not the audit's purpose, since prevention is management's responsibility. However, where the auditor has reason to believe a fraud by an officer or employee involving Rs 1 crore or more has occurred, the matter must be reported to the Central Government in Form ADT-4, and smaller amounts are reported to the audit committee or board.

As part of the audit, the auditor assesses whether the company can continue to operate for the foreseeable future, since the accounts are normally prepared on that basis. The auditor reviews indicators such as recurring losses, negative working capital, loan defaults or the loss of a major customer. Where a material uncertainty exists, the auditor reports it, and if the going-concern basis is not appropriate at all, that affects the opinion. This assessment is a defined responsibility under the auditing standards.

Independence is what gives the audit opinion its value, so the law keeps the auditor separate from the work being audited. Under Section 144 of the Companies Act, the statutory auditor cannot provide certain other services to the same company, including book-keeping and accounting, internal audit, design of financial information systems, actuarial services, investment advisory, and management services. In practice, the firm that maintains a company's books cannot also be its statutory auditor, which is why these functions sit with different providers.

Mandatory rotation applies to listed companies and to prescribed classes, which include unlisted public companies with paid-up capital of Rs 10 crore or more, private companies with paid-up capital of Rs 50 crore or more, and companies with public borrowings of Rs 50 crore or more. For these companies, an individual auditor may serve one term of five years, and an audit firm two consecutive terms of five years each, after which a cooling-off period of five years applies. Companies below these thresholds are not subject to compulsory rotation.

The National Financial Reporting Authority is the independent regulator that oversees the auditors of larger companies. Its remit covers all listed companies and large unlisted public companies, broadly those with paid-up capital of Rs 500 crore or more, turnover of Rs 1,000 crore or more, or aggregate borrowings of Rs 500 crore or more, along with banks, insurers and similar entities. NFRA can inspect audit files, review audit quality, and impose penalties or debarment. For companies within its scope, audit quality is monitored directly by NFRA rather than only through ICAI.