Statutory audit or internal audit: what is the difference

The two are often confused, and the confusion costs money: companies that needed a statutory audit have bought internal audit, and the other way round. The difference is not one of size, but of purpose, audience and obligation.

Who it is for

A statutory audit is for people outside the company: shareholders who do not run it, banks, funders, authorities. The report says whether the financial statements present the company’s position fairly.

An internal audit is for management. The report says where the risks are and what is not working in internal control. It is filed nowhere and is not public.

Who requires it

A statutory audit is required by law when a company exceeds, on two consecutive financial years, at least two of the thresholds: RON 16,000,000 total assets, RON 32,000,000 net turnover, 50 employees on average. It can also be required by contract, by a bank or an investor, below those thresholds.

Internal audit is mandatory for public entities. For private companies it is a choice, usually made once the company has grown beyond what the director can see alone.

What you receive

From a statutory audit: the report with the auditor’s opinion, filed together with the financial statements, plus the letter to management.

From an internal audit: engagement reports with findings, causes and an action plan with owners and deadlines, followed through to implementation.

Who can carry it out

A statutory audit can only be signed by a financial auditor registered with the oversight authority. Internal audit does not carry the same restriction, although for public entities the regulatory framework requires specific qualifications.

Are they mutually exclusive?

No. Many companies have both, and it helps: the internal auditor works through the year and knows the weak areas, so the statutory audit at the end finds fewer surprises.

What cannot happen is the same person carrying out the internal audit and signing the statutory report at the same company. That would mean checking their own work, and the independence the law requires would be lost.