ROC Audit vs Internal Audit vs Statutory Audit: What Indian SMEs Need

A statutory audit under Section 143 of the Companies Act, 2013 is an independent examination of a company's financial statements by a Chartered Accountant. It is mandatory for every company regardless of size or revenue. The auditor expresses an opinion on whether the financial statements give a true and fair view. The signed audit report is filed with the ROC annually.

The statutory audit is external. Conducted by an independent CA firm that has no other business relationship with the company.

An internal audit evaluates a company's internal controls, risk management processes, and operational efficiency. Unlike the statutory audit (which focuses on financial statements), an internal audit looks at whether the business is operating efficiently and whether internal systems prevent errors and fraud.

Under Rule 13 of the Companies (Accounts) Rules, 2014, internal audit is mandatory for: every listed company; every unlisted public company with paid-up capital above ₹50 crore or turnover above ₹200 crore; and every private company with turnover above ₹200 crore or outstanding loans above ₹100 crore.

For SMEs below these thresholds, internal audit is not legally required. But it is good practice for any business above ₹5 crore turnover that wants to identify operational inefficiencies and control weaknesses.

The Registrar of Companies (ROC) does not conduct a separate 'ROC audit.' What people often call an 'ROC audit' is actually the process of preparing and filing the audited financial statements (Form AOC-4) and annual return (Form MGT-7) with the ROC annually. These filings require the statutory audit to be completed first.

The ROC may examine filings and issue notices if discrepancies are identified. This is an enforcement action, not a standard audit.