A statutory auditor performs an audit required by applicable law or regulation and issues an independent opinion on specified financial statements. An internal auditor evaluates the organization’s risks, controls and activities, then reports findings and recommendations to management and the board. The roles can examine overlapping controls, but their mandates, independence arrangements, audiences and outputs are different—and statutory rules vary by jurisdiction.
How the roles differ at a glance
| Area | Statutory auditor | Internal auditor |
|---|---|---|
| Mandate | An audit required by applicable law or regulation for an entity or set of financial statements. The rules depend on jurisdiction and entity type. | An organizational assurance function guided by its charter, professional standards, risk assessment and governance arrangements. |
| Main purpose | Gather sufficient appropriate evidence to support an opinion on financial statements. | Analyze and evaluate organizational activities, providing assurance, recommendations and information to management and the board. |
| Independence | Must be independent of the audited entity under applicable legal requirements. | Must maintain objectivity and organizational independence, supported by appropriate reporting arrangements and safeguards. |
| Typical coverage | The financial statements within the statutory audit mandate. | May include financial reporting, operations, compliance, asset protection, controls and governance. |
| Main output | A formal auditor’s report and opinion. | Assessments, findings, assurance and recommendations. |
| Reporting relationship | Recipients and duties are set by applicable law and auditing standards. | The chief audit executive should report functionally to the board and interact directly with it; administrative reporting may also sit with management. |
What a statutory auditor does
A statutory audit exists because a law or regulation requires an audit for a particular entity or financial statement. The auditor’s central task is to obtain evidence that supports an opinion on the statements—not to provide a broad review of every part of the organization. The Public Company Accounting Oversight Board describes the financial-statement auditor’s responsibility in AS 2605.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Auditing & Assurance Services ISE | $67.00 | Buy on Amazon |
| 2 |
|
Contemporary Auditing | $59.36 | Buy on Amazon |
| 3 |
|
Auditing & Assurance Services | $77.50 | Buy on Amazon |
| 4 |
|
Auditing For Dummies (For Dummies Series) | $16.99 | Buy on Amazon |
| 5 |
|
Loose-leaf for Auditing and Assurance Services | $62.93 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What must be audited, who may be appointed, how long an appointment lasts and where the report must go depend on local law and the entity’s category. “Statutory auditor” is therefore not a single worldwide set of appointment or reporting rules.
What an internal auditor does
Internal audit is an assurance function serving the organization. Its scope can reach beyond financial statements to operational processes, compliance, safeguarding assets, reliability of reporting, internal controls and governance. Its priorities are shaped by the function’s charter, risk assessment and governance arrangements.
#1 Best Overall
Internal auditors may be employees or work through an external service provider. In either case, the function is intended to provide the organization’s management and board with analysis, evaluation, assurance and recommendations. As the PCAOB puts it, “Internal auditors are responsible for providing analyses, evaluations, assurances, recommendations, and other information to the entity’s management and board of directors or to others with equivalent authority and responsibility” (AS 2605, section .03).
Independence is different for each role
Statutory auditor: independent of the audited entity
For statutory audits in the European Union, Directive 2006/43/EC requires the auditor or audit firm to be independent of the audited entity and not involved in its decision-making. It also requires reasonable steps to prevent conflicts and relevant relationships from affecting independence. These are EU requirements; they should not be treated as a universal legal rule. See the consolidated EU directive text.
Rank #2
Internal auditor: organizational independence and individual objectivity
Internal audit is part of, or engaged by, the organization it assesses, so its independence is structured differently. The Institute of Internal Auditors’ standards call for organizational independence, direct interaction between the chief audit executive and the board, and freedom from interference in setting scope, performing work and communicating results. The IIA’s Attribute Standards describe functional board reporting as the way organizational independence is effectively achieved.
Objectivity also applies to individual engagements. The IIA’s Code of Ethics says auditors should avoid activities or relationships that may impair—or appear to impair—their unbiased assessment. The IIA’s 2021 Internal Audit Assessment Tool for Audit Committees summarizes the distinction: external auditors are independent of the organization, while internal auditors demonstrate organizational independence and objectivity and are independent of the activity they audit.
Rank #3
Who receives the reports, and what do they contain?
Statutory audit report
The statutory auditor issues a formal report and opinion on the financial statements covered by the audit. The law and applicable standards determine the required form, recipients and any additional reporting duties. In the EU framework, the cited directive includes a requirement for statutory auditors of public-interest entities to report key matters to the audit committee, particularly material weaknesses in internal control related to financial reporting. Applicability depends on the entity and current national implementation; consult the directive provision alongside the law that applies to the entity.
Internal audit communications
Internal audit communicates its assessments, findings, assurance and recommendations to management and the board, or an equivalent governing authority. The IIA standards call for the chief audit executive to have functional reporting to the board. That relationship includes board involvement in the internal audit charter, risk-based plan, budget and resources, receipt of communications, and the chief audit executive’s appointment and remuneration. Administrative reporting to a manager can coexist with this functional relationship; it should not prevent the function from determining its work or reporting results.
Rank #4
Can the two auditors examine the same issue?
Yes. Both may consider a financial-reporting control, for example, but they do so under different mandates. The statutory auditor considers evidence relevant to an opinion on financial statements. Internal audit may assess the control’s design and operation as part of a wider review of risks, processes or governance, then recommend corrective action. Overlap in subject matter does not make their responsibilities or reports interchangeable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Are internal auditors appointed by the audit committee?
There is no universal answer. Appointment and approval arrangements depend on the jurisdiction and the organization’s governance structure. IIA standards assign the board an important functional oversight role, including involvement in the chief audit executive’s appointment and remuneration, but that does not establish one appointment procedure for every organization.
Best Value
Which role does an organization need?
The answer depends on the question being asked. Where law requires a financial-statement audit, the organization needs a statutory auditor who meets the applicable eligibility and independence rules. Internal audit serves a different purpose: it gives management and the board assurance and insight into risks, controls and activities across the organization. An internal audit function does not replace a required statutory audit, and a statutory audit opinion is not a substitute for the broader work internal audit may perform. For professional context, the IIA’s Global Internal Audit Standards overview describes internal audit’s role and areas of contribution.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
