Independent Statutory Audit Under the Companies Act: Company and LLP Audit

A statutory audit is the independent examination of a company's financial statements that the law requires every year. Under the Companies Act, 2013, every company – whatever its size or turnover – must appoint a chartered accountant or a firm of chartered accountants as its statutory auditor, who reports to the shareholders whether the accounts give a true and fair view. IMAK Advisory, an ICAI-registered CA firm in Bengaluru, carries out statutory audits of private and public companies, LLPs and other entities across India.

An audit report is read by shareholders, banks, investors, the tax department and the Registrar of Companies. A good engagement finds problems early, while there is still time to fix the accounts, rather than in a qualified opinion after the board has approved them. This page explains who needs a statutory audit, how the auditor is appointed, what the auditor's report contains, how CARO 2020 and internal financial controls reporting apply, how a statutory audit differs from a due diligence audit report, and what a statutory auditor is not allowed to do for you.

• Statutory audit of private limited, one person and public companies
• LLP audits where turnover or contribution crosses the limit
• CARO 2020 reporting and internal financial controls reporting where applicable
• Audit trail (edit log) reporting under the Companies (Audit and Auditors) Rules
• First-year audits of newly incorporated companies
• Audits of trusts, societies and Section 8 companies

"Statutory" means the audit is required by statute. In a statutory audit, the auditor examines the books, vouchers, contracts and confirmations behind the financial statements, tests the internal controls, and then gives an opinion: unmodified (a clean report), qualified, adverse, or a disclaimer.

A partnership firm or proprietorship has no statutory audit under company law, but it may need a tax audit if its turnover or receipts cross the income-tax limit. That is a different audit with a different report.

Business owners often use "audit" for any review by a chartered accountant. The four are different in purpose, reader and report.

A due diligence audit report is prepared for a specific decision – buying a company, investing in it or lending to it. Unlike a statutory audit, it has no fixed legal format, does not give a true and fair opinion, and is addressed to the buyer, investor or lender, not to the shareholders. Its scope is agreed in an engagement letter, and it often looks behind the audited numbers at quality of earnings, working capital, debt-like items, tax exposures and contracts.

A Typical Due Diligence Audit Report Format

Every engagement is different, but a common due diligence audit report format follows this order:

1. Executive summary of key findings and deal issues
2. Scope, sources of information and limitations
3. Business overview and ownership structure
4. Quality of earnings: normalised profit after one-time and non-recurring items
5. Net working capital and its seasonal pattern
6. Net debt and debt-like items, such as unpaid statutory dues and deferred payments
7. Tax review: income tax, GST and TDS exposures
8. Legal and regulatory compliance, including ROC filings
9. Key contracts, customers and suppliers
10. Findings with suggested protections for the agreement

About Due Diligence Audit Report Samples

People often look for a due diligence audit report sample before commissioning one. Real reports contain confidential client data, so we do not share them; what we can show is an illustrative outline like the one above, with headings and the kind of findings each section holds. If your bank or investor has its own template, use that as the format and agree the scope against it. The statutory audit report, on the other hand, has a fixed structure set by the Standards on Auditing and the Companies Act, explained below.

1. First auditor: the board appoints the first auditor within 30 days of incorporation; if it does not, the members appoint one within 90 days at an extraordinary general meeting.
2. First AGM: the members appoint an auditor to hold office from the first AGM to the sixth AGM – a term of five years.
3. Consent and certificate: before appointment, the auditor gives written consent and a certificate that it is eligible and within the permitted number of audits.
4. Form ADT-1: the company files the appointment with the Registrar within 15 days of the meeting.
5. Rotation: listed companies and specified classes of larger companies must rotate an individual auditor after one term of five years and an audit firm after two terms.
6. Removal and resignation: removing an auditor before the term needs a special resolution and Central Government approval; an auditor who resigns files Form ADT-3 within 30 days.

If you are changing auditors, the outgoing auditor's views should be sought before the new auditor accepts the appointment – a professional courtesy that is also an ICAI requirement for its members.

Only a chartered accountant in practice, or a firm in which the majority of partners practising in India are chartered accountants, can be appointed. The law also disqualifies people who could not be independent, including:

• An officer or employee of the company, or a partner or employee of such a person
• A person holding securities of the company, or whose relative holds securities above the permitted limit
• A person indebted to the company or that has given a guarantee for its debts above the permitted limit
• A person with a business relationship with the company of the kind the rules prohibit
• A person whose relative is a director or key managerial person of the company
• A person who is already auditor of more than 20 companies, counted as the law prescribes

Services a Statutory Auditor Cannot Provide

Section 144 of the Companies Act prohibits the statutory auditor from providing certain services to the same company, directly or through related entities. These include accounting and bookkeeping, internal audit, design and implementation of financial information systems, actuarial services, investment advisory and investment banking, outsourced financial services and management services. This matters if you use our bookkeeping or virtual CFO services: if we keep your books, another firm must audit them, and we will tell you so before you engage us.

1. Acceptance and independence check: we confirm eligibility, independence and the outgoing auditor's views.
2. Engagement letter: scope, responsibilities of management and auditor, timelines and reporting are agreed in writing.
3. Planning and risk assessment: we understand the business, set materiality and identify the areas most likely to contain errors.
4. Internal controls: we review and test controls over revenue, purchases, payroll, inventory and financial reporting.
5. Substantive testing: vouching, bank and party confirmations, inventory observation, cut-off checks, fixed asset verification and review of estimates.
6. Compliance checks: Companies Act requirements, related party transactions, statutory dues, CARO matters and audit trail.
7. Draft findings: we share observations and proposed adjustments with management before anything is finalised.
8. Board approval: the board approves the financial statements; management gives written representations.
9. Auditor's report: signed by the engagement partner with a UDIN, with all annexures.
10. ROC filing support: the audited financial statements go to the AGM and then to the Registrar in Form AOC-4.

Steps seven and eight are where most of the value of a statutory audit lies for management: adjustments agreed before the report avoid a modified opinion.

The auditor's report follows the structure in the Standards on Auditing, mainly SA 700, with additions required by Section 143 of the Companies Act.

When you receive a report, check the UDIN on the ICAI portal and read the "Basis for opinion" paragraph first – it tells you immediately whether the opinion is modified.

The Companies (Auditor's Report) Order, 2020 requires the auditor to report on 21 specific matters, from fixed asset records and inventory verification to loans given, statutory dues, defaults, fraud, whistle-blower complaints and cash losses. It applies to most companies, with these exceptions:

• Banking companies and insurance companies
• Section 8 companies
• One person companies
• Small companies
• Private companies that are not a holding or subsidiary of a public company and whose paid-up capital plus reserves is not more than ₹1 crore, whose borrowings from banks or financial institutions did not exceed ₹1 crore at any time in the year, and whose total revenue is not more than ₹10 crore

From 1 December 2025, a small company is one with paid-up capital up to ₹10 crore and turnover up to ₹100 crore, other than a public company, a holding or subsidiary company, a Section 8 company or a company governed by a special act. The higher limits mean many more private companies are now outside CARO, auditor rotation and some other requirements. We check your company against the current definition each year.

Internal Financial Controls Reporting

The auditor also reports whether the company has adequate internal financial controls over financial reporting and whether they work. This is not required for one person companies, small companies, and private companies with turnover below ₹50 crore or borrowings below ₹25 crore, subject to their filing conditions. Larger private and public companies should document their key controls well before the year end.

Audit Trail Reporting

Since 1 April 2023, every company using accounting software must use software that records an audit trail – an edit log of every change, with the date – that cannot be disabled. The auditor reports whether this feature was operating throughout the year and whether the log was preserved. Companies still using spreadsheets or software without this feature should change before the next year begins.

The auditor gives an opinion on financial statements that management prepares. The quality of the opinion depends on the quality of what is presented, so the preparation stage matters as much as the testing.

• Accounting framework: listed companies and companies with net worth of ₹250 crore or more, and their group companies, follow Indian Accounting Standards (Ind AS); most other companies follow the Accounting Standards notified under the Companies Act
• Format: balance sheet and profit and loss statement in the Schedule III format, with the notes it prescribes
• Disclosures added in recent years: ageing of receivables and payables, dues to micro and small enterprises, ratios with explanations for large movements, title deeds not in the company's name, and details of borrowings secured against current assets
• Cash flow statement, which a one person company, small company or dormant company need not prepare
• Related party disclosures and contingent liabilities, which are among the most frequently incomplete notes

A company that prepares its draft accounts in this format before the engagement starts saves weeks. We share a list of the disclosures that apply to your company at the planning stage, so that nothing is added at the last minute.

Company law places the responsibility for the accounts on the board, not on the auditor. Knowing who is responsible for what avoids misunderstandings at the end of the year.

• The board approves the financial statements, which are signed by the chairperson or two directors and, where applicable, the CEO, CFO and company secretary
• The directors' responsibility statement in the board's report confirms that proper accounting records were kept, that accounting policies were applied consistently, and that internal financial controls were in place
• Management gives written representations to the auditor confirming that all information and records were provided
• Management designs and runs internal controls, including the audit trail in the accounting software
• If the auditor finds a fraud of ₹1 crore or more by officers or employees, the law requires a report to the Central Government; smaller frauds are reported to the board or audit committee

In practice, the most helpful thing a board can do is to set a closing calendar: dates for reconciliations, the inventory count, the draft accounts and the board meeting. We agree this calendar with management at the start of each engagement.

ICAI requires a Unique Document Identification Number on every audit report, so a report can be traced to the member who signed it. It also requires firms that audit listed entities and certain larger or public-interest entities to hold a valid peer review certificate, brought in in phases. If your company falls in these categories, ask any proposed auditor for its peer review status before appointment.

• Trial balance, general ledger and the draft financial statements
• Bank statements and bank reconciliations for every account, and bank confirmations
• Sales and purchase registers, with invoices and contracts for large items
• Fixed asset register, with additions supported by invoices
• Inventory records and the physical count sheets at year end
• Loan agreements, sanction letters and statements from lenders
• Payroll records and statutory dues returns: TDS, GST, PF, ESI and professional tax
• Minutes of board and general meetings and statutory registers
• Related party list and agreements
• Previous year's audited accounts and auditor's report, and income tax and GST returns
• Details of litigation, notices and contingent liabilities

We do not publish fees. The cost of an audit depends on the work it needs, and our team shares the exact total after reviewing your trial balance, last year's accounts and the scope.

• Size of the company: turnover, assets and number of transactions
• Number of locations, branches, warehouses and bank accounts
• Whether CARO, internal financial controls and other extra reporting apply
• Condition of the books and the controls at the start of the audit
• Industry complexity: inventory, long-term contracts, foreign currency, group companies
• Whether this is a first-year audit or a change of auditor

ICAI rules do not allow audit fees to be tied to the outcome of the audit, and we do not offer any such arrangement.

A Startup's First Statutory Audit

A two-year-old software company had never had an audit beyond a basic first-year review, and its accounts were on spreadsheets. Before the year end, the work involved moving the books to software with an audit trail, setting up a fixed asset register, booking ESOP and share capital entries properly and confirming that the company was a small company under the revised limits, so that CARO and internal financial controls reporting did not apply.

A Trading Company Changing Auditors

A family-owned trading company wanted to change its auditor after many years. The work involved writing to the outgoing auditor, reviewing last year's report and working papers summary, checking opening balances, and getting the change approved through the proper resolution and Form ADT-1. Inventory observation at year end was planned in advance, because opening stock could not be verified later.

A Manufacturer Above the CARO Limits

A manufacturing company with bank borrowings well above ₹1 crore had to receive a full CARO report. The audit found that physical verification of inventory had not been done at reasonable intervals and that some statutory dues were paid late. Management corrected the inventory process and paid the dues before the report was signed, so the CARO comments described the position fairly and the actions taken.

• Books not closed or reconciled when the statutory audit starts
• No fixed asset register, or assets in the books that cannot be found
• Inventory never counted at year end
• Related party transactions without board or shareholder approval
• Late deposit of TDS, GST, PF or ESI, which must be reported under CARO
• Accounting software without an audit trail
• Directors' loans and advances given without following the Companies Act
• Missing board minutes for major decisions
• Appointing the auditor late, or not filing Form ADT-1

First-Year and Newly Incorporated Companies

The first statutory audit sets the opening balances for every later year. Share capital, preliminary expenses and the first bank and asset entries should be right from the start.

LLPs

An LLP needs an audit if its turnover exceeds ₹40 lakh or its contribution exceeds ₹25 lakh. The audited statement of accounts is filed in Form 8, and the annual return in Form 11.

Subsidiaries of Foreign Companies

Indian subsidiaries of foreign groups often need reporting to the parent's timetable and accounting framework, along with Indian statutory audit and transfer pricing and FEMA compliance.

Dormant or Loss-Making Companies

A company with no business still needs an audit every year unless it is struck off or applies for dormant status. Continued losses also raise going-concern questions that the auditor must address.

Holding and Subsidiary Groups

A company with subsidiaries, associates or joint ventures must also prepare consolidated financial statements, which are examined and reported on alongside the standalone accounts. Group companies should align their closing dates, accounting policies and inter-company balances well before the year end, because unreconciled inter-company accounts are the most common cause of delay in consolidation.

Section 8 Companies, Trusts and NGOs

Not-for-profit entities need audits under company, trust or society law and to keep their income-tax exemption, with careful reporting of how funds were used.

• An audit is not a guarantee that the accounts contain no error or fraud; it gives reasonable, not absolute, assurance
• We do not prepare your books and then audit them – Section 144 does not allow it
• We do not sign a report without completing the work the Standards on Auditing require
• We do not change an opinion to suit a bank, investor or deadline
• We do not act as a regulator or file complaints on your behalf
• We do not tie our fees to the result of the audit

If you run a proprietorship or partnership firm below the tax audit limit, you do not need a statutory audit at all; a well-maintained set of books and a correct income tax return are enough. If your LLP is below both the turnover and contribution limits, its accounts need not be audited, though a partner may still want an independent review. And if you only need a quick check of numbers before a decision, a limited review may suit you better than a full audit.

1. Is your firm independent of our company, directors and their relatives?
2. Who will be the engagement partner, and what is the ICAI membership number?
3. Does our company need CARO, internal financial controls or audit trail reporting this year?
4. If our company is in a peer review category, does your firm hold a valid peer review certificate?
5. What do you need from us, by when, so that the report is ready before our AGM?
6. Which non-audit services can you not provide to us as auditor?

Ask your bank or investor the matching questions: do they need the audited accounts by a date, and do they need any additional certificate from the auditor?

An auditor sees every ledger, contract and board minute. As chartered accountants we are bound by ICAI's Code of Ethics, including confidentiality. Working papers are kept for the period the standards require, access is limited to the engagement team, and information is shared only as the law or the Standards on Auditing require. Documents you send are stored in access-controlled folders, portal and software logins are requested only where needed and as read-only users, and nothing is shared with banks, investors or other parties without your written consent, except where the law requires it.

• Bank, customer, supplier and loan accounts reconciled
• Physical count of inventory and cash at the year end
• Fixed asset register updated and assets verified
• Statutory dues paid and returns filed
• Related party list updated and approvals in place
• Board minutes signed and registers updated
• Audit trail enabled in the accounting software
• Auditor appointed and Form ADT-1 filed
• Draft financial statements prepared in the Schedule III format

Our only office is in Whitefield, Bengaluru. Audits are planned so that most testing is done on records shared securely, with visits for inventory observation, asset verification and meetings where needed. For companies outside Karnataka, we agree in advance which visits are required and how they will be handled. We do not have offices in other cities. Before fieldwork begins, we agree a shared folder structure, a list of who in your team answers which questions, and the dates on which our team will be on site. Video meetings with the finance team are held at fixed times each week, so that queries do not pile up at the end.

What is a statutory audit?

It is the annual audit of a company's financial statements required by the Companies Act, 2013, in which a chartered accountant gives an opinion on whether the accounts show a true and fair view.

Is a statutory audit compulsory for a private limited company with no turnover?

Yes. Every company must have its accounts audited each year, even with no business or turnover, until it is struck off or obtains dormant status.

Does an LLP need a statutory audit?

Only if its turnover exceeds ₹40 lakh or its partners' contribution exceeds ₹25 lakh in the financial year.

Who appoints the first statutory auditor?

The board appoints the first auditor within 30 days of incorporation. If it does not, the members appoint one within 90 days.

How long is a statutory auditor appointed for?

At the first AGM, an auditor is appointed for five years, from that AGM to the sixth AGM, and the appointment is filed in Form ADT-1 within 15 days.

What is the difference between a statutory audit and a tax audit?

A statutory audit is required by company law and reports to shareholders on the financial statements. A tax audit is required by income-tax law and reports to the tax department on books and tax particulars.

What is a due diligence audit report?

It is a report prepared for a buyer, investor or lender before a transaction, covering quality of earnings, working capital, debt, tax and compliance risks. It has no fixed legal format and is different from a statutory audit report.

Can you share a due diligence audit report sample?

We do not share real reports, which contain confidential client data. We can share an illustrative outline of the sections a report usually contains.

What is the usual due diligence audit report format?

It usually has an executive summary, scope and limitations, business overview, quality of earnings, working capital, net debt, tax and legal review, and findings with suggested deal protections.

Which companies are exempt from CARO 2020?

Banking and insurance companies, Section 8 companies, one person companies, small companies, and private companies within the capital, borrowing and revenue limits that are not a holding or subsidiary of a public company.

What is a small company now?

From 1 December 2025, a company with paid-up capital up to ₹10 crore and turnover up to ₹100 crore, other than public, holding, subsidiary and Section 8 companies.

Can our statutory auditor also maintain our books?

No. Section 144 of the Companies Act prohibits the statutory auditor from providing accounting and bookkeeping, internal audit and certain other services to the same company.

What is audit trail reporting?

Since 1 April 2023, accounting software must keep an edit log of all changes. The auditor reports whether this feature worked throughout the year and whether the log was preserved.

How do I verify an audit report?

Check the UDIN printed on the report on the ICAI UDIN portal, and confirm the partner's membership number and the firm registration number.

How much does a statutory audit cost?

We do not publish fees. The total depends on the size of the company, locations, extra reporting and the state of the books, and our team shares the exact total after reviewing your trial balance and requirements.

Do you audit companies outside Bengaluru?

Yes. Our only office is in Whitefield, Bengaluru; we audit companies elsewhere in India using secure document sharing and planned visits where the audit requires them.

Tax Audit · Internal and Concurrent Audit · Due Diligence Audit · Annual ROC Compliance · Financial Statements and MIS · Company and LLP Registration · Income Tax Return

Share your last audited accounts, current trial balance and company details. Our team will check independence and eligibility, confirm which reporting applies to your company and propose a timeline that fits your AGM.

Contact Details

Office Address

IMAK Advisory, ITPL Main Rd, Pattandur Agrahara, Whitefield, Bengaluru, Karnataka 560066, India

Phone

+91 79798 50684 (call or WhatsApp)

Email

imakadvisoryteam@gmail.com

Sources: Companies Act, 2013, Sections 139–148, and Companies (Audit and Auditors) Rules, 2014 (mca.gov.in); Companies (Auditor's Report) Order, 2020; Companies (Specification of Definition Details) Amendment Rules, 2025, G.S.R. 880(E) dated 1 December 2025 (small company limits); Companies (Accounts) Rules, 2014, Rule 3(1) on audit trail; Limited Liability Partnership Rules, 2009; ICAI Standards on Auditing, UDIN portal and Peer Review Board announcements (icai.org). Checked 1 November 2026.