What Is Statutory Audit? Who Needs It, Auditor Appointment, CARO 2020 and Tax Audit in 2026

If you run a private limited company, the statutory audit is the one annual compliance you can't size your way out of: a company with ₹5 lakh of sales needs one just as much as a listed group. This guide explains what a statutory audit is, which businesses need one, how the auditor is appointed, rotated and removed under sections 139 to 148 of the Companies Act, 2013, what CARO 2020 adds and who is exempt, the audit limits for LLPs, and how it differs from the tax audit under the Income-tax Act, 2025. It's written for founders, directors and finance managers of small and mid-sized businesses, with a worked timeline from incorporation to the AGM. Thresholds were checked against the Act, MCA changes and CBDT circulars in October 2026.

Quick answer

A statutory audit is an audit the law makes compulsory. Under the Companies Act, 2013, every company must have its yearly financial statements audited by a chartered accountant appointed under section 139, who reports to shareholders on whether they give a true and fair view. There's no size exemption for companies.

• First auditor: appointed by the Board within 30 days of incorporation; then by members at the AGM for five years, with Form ADT-1 within 15 days of the meeting

• Small companies (paid-up up to ₹10 crore, turnover up to ₹100 crore) are exempt from CARO, internal-control reporting and rotation — not from the audit

• LLPs: audit needed only if turnover exceeds ₹40 lakh and contribution exceeds ₹25 lakh

• Tax audit is separate: section 63 of the Income-tax Act, 2025 above ₹1 crore business turnover (₹10 crore if cash is within 5%)

What a statutory audit is

"Statutory" simply means required by statute. A statutory audit is an independent examination of an entity's financial statements carried out because a law demands it, by an auditor whose appointment, qualifications and reporting duties are also set by that law. The auditor doesn't prepare the accounts — management does — but checks them against the books and evidence, and expresses an opinion on whether they present a true and fair view of the company's financial position and results, in line with the accounting standards.

For companies, the law is the Companies Act, 2013. Section 143 sets out what the auditor must examine and report on: whether proper books have been kept, whether the balance sheet and profit and loss account agree with them, whether the financial statements comply with accounting standards, whether any director is disqualified, and — for companies not exempt — whether internal financial controls are adequate and operating effectively. Where any answer is negative or qualified, the report has to give the reasons.

Other statutes create their own statutory audits: banks under the Banking Regulation Act, co-operative societies under state co-operative laws, public trusts under state trust Acts, and LLPs under the LLP Rules. In everyday business use, though, "statutory audit" usually means the company audit — and that's the main focus here.

A statutory audit is different from an internal audit, which management commissions to check its own processes (and which the Act requires only for certain larger companies under section 138), and from a tax audit, which the Income-tax Act requires for tax purposes. A business can need all three in the same year, and the same firm can sometimes do more than one — subject to the restrictions in section 144 discussed below.

Who needs a statutory audit

Who needs a statutory audit in 2026

Entity	Statutory audit?	Law	Notes
Private limited company	Always	Companies Act, s.139/143	No turnover or capital threshold — dormant companies too
One person company	Always	Companies Act	CARO and IFC reporting don't apply
Public company (listed or unlisted)	Always	Companies Act	Rotation applies to listed and to unlisted with paid-up ≥ ₹10 crore or more
LLP	Only above limits	LLP Rules, rule 24	Exempt if turnover ≤ ₹40 lakh or contribution ≤ ₹25 lakh
Partnership firm / proprietorship	No	—	Tax audit if section 63 limits are crossed
Government company	Always	Companies Act, s.139(5)	Auditor appointed by the CAG

Private limited company

Statutory audit?

Always

Law

Companies Act, s.139/143

Notes

No turnover or capital threshold — dormant companies too

One person company

Statutory audit?

Always

Law

Companies Act

Notes

CARO and IFC reporting don't apply

Public company (listed or unlisted)

Statutory audit?

Always

Law

Companies Act

Notes

Rotation applies to listed and to unlisted with paid-up ≥ ₹10 crore or more

LLP

Statutory audit?

Only above limits

Law

LLP Rules, rule 24

Notes

Exempt if turnover ≤ ₹40 lakh or contribution ≤ ₹25 lakh

Partnership firm / proprietorship

Statutory audit?

No

Law

—

Notes

Tax audit if section 63 limits are crossed

Government company

Statutory audit?

Always

Law

Companies Act, s.139(5)

Notes

Auditor appointed by the CAG

The key point for small businesses: company audit has no exemption by size. A private limited company that hasn't started trading still has to appoint an auditor, prepare financial statements and get them audited every year. What changes with size is the scope of the auditor's report, not whether there's an audit.

That could change. The Corporate Laws (Amendment) Bill, 2026, introduced in the Lok Sabha in March 2026, contains a clause allowing the government to exempt a prescribed class of companies from audit. The Joint Parliamentary Committee reported in August 2026 and recommended that the exemption not extend to public companies; the Bill wasn't passed in the Monsoon Session, and the class and conditions would still have to be prescribed by rules. Until both happen, plan for an audit.

Appointing the auditor: section 139 and a worked timeline

First auditor. Section 139(6) requires the Board of Directors to appoint the first auditor within 30 days of incorporation. If the Board fails, it must tell the members, who have 90 days to appoint one at an extraordinary general meeting. The first auditor holds office until the conclusion of the first annual general meeting. No ADT-1 is required for the Board's appointment of the first auditor, but keep the Board resolution and the auditor's consent on file.

Five-year appointment at the AGM. At the first AGM, members appoint an individual or a firm as auditor to hold office from the end of that meeting until the end of the sixth AGM (a five-year term). Before the appointment, the company must get the auditor's written consent and a certificate that the appointment is within the limits and that the auditor meets the eligibility criteria in section 141. The company then informs the auditor and files Form ADT-1 with the Registrar within 15 days of the meeting.

Casual vacancy. If the auditor's office falls vacant mid-term, the Board fills it within 30 days. If the vacancy arose from a resignation, the appointment must also be approved by members at a general meeting within three months.

If no auditor is appointed at an AGM, section 139(10) says the existing auditor continues.

Worked timeline — Sharma Precision Components Pvt Ltd (incorporated 10 June 2025)

By 10 July 2025

Board appoints the first auditor (30 days from incorporation); auditor's consent and eligibility certificate on file

31 March 2026

First financial year ends (it can run up to 15 months for a company incorporated after 1 January)

April–August 2026

Books closed, stock and fixed assets verified, audit fieldwork, Board approves financial statements, auditor signs the report

By 31 December 2026

First AGM — within nine months of the end of the first financial year; members appoint an auditor until the sixth AGM

Within 15 days of the AGM

File ADT-1 for the five-year appointment

Within 30 days of the AGM

File the audited financial statements in AOC-4

For later years the same company holds its AGM within six months of the year end (30 September); first AGM within nine months and files AOC-4 within 30 days of the AGM. Our balance sheet guide explains the Schedule III format the auditor will be checking.

Who can be the auditor, and what they can't do

Only a chartered accountant in practice, or a firm (including an LLP) whose partners are mostly practising chartered accountants, can be a company auditor. Section 141 disqualifies, among others, an officer or employee of the company, a partner or employee of an officer, a person (or relative) holding securities or owing money above set limits, a person with a business relationship with the company, and anyone convicted of fraud in the last ten years.

There's also a ceiling: under section 141(3)(g), a person can't be appointed if they already audit more than 20 companies. One person companies, dormant companies, small companies and private companies with paid-up capital below ₹100 crore are left out of that count under the June 2017 exemption, which is why a single practitioner can audit many small private companies.

Prohibited services. Section 144 bars the auditor from providing — directly or indirectly, to the company or its holding or subsidiary company — services such as accounting and bookkeeping, internal audit, design and implementation of financial information systems, actuarial, investment advisory, investment banking, outsourced financial services and management services. In practice, small companies often have their accountant also act as auditor; that isn't allowed if the same person or firm keeps the books. Other services, such as tax work, need approval from the Board or audit committee.

Removal and resignation. An auditor can be removed before the end of the term only by a special resolution with the Central Government's prior approval, after a hearing. An auditor who resigns must file Form ADT-3 with the company and the Registrar within 30 days of resignation, giving the reasons. Missing ADT-3 costs the auditor a penalty of ₹50,000 or the audit fee, whichever is less, plus ₹500 a day up to ₹2 lakh.

Auditor rotation: who must change auditors

Section 139(2) caps how long one auditor can audit certain companies. An individual auditor can serve only one term of five consecutive years; an audit firm can serve two terms of five consecutive years. After that, there's a cooling-off period of five years before the same individual or firm — or a firm with a common partner — can be reappointed.

Rotation applies only to the classes listed in rule 5 of the Companies (Audit and Auditors) Rules, 2014:

• listed companies;
• unlisted public companies with paid-up share capital of ₹10 crore or more;
• private companies with paid-up share capital of ₹50 crore or more (raised from ₹20 crore in June 2017); and
• any company below those limits with public borrowings from banks or financial institutions, or public deposits, of ₹50 crore or more.

Most small and mid-sized private companies therefore don't have to rotate. They can reappoint the same auditor every five years at the AGM, subject to eligibility. Members can also choose voluntarily to rotate the audit partner or appoint joint auditors under section 139(3).

CARO 2020 and what changes for small companies

The Companies (Auditor's Report) Order, 2020 — CARO — makes the auditor report on a list of additional matters in an annexure to the audit report. The order covers 21 clauses, including records and physical verification of property, plant and equipment; title deeds of immovable property; inventory verification and discrepancies of 10% or more; loans, guarantees and investments; deposits; statutory dues; defaults in repaying loans; use of borrowed funds; fraud and whistle-blower complaints; related-party transactions; cash losses; and going-concern doubts. It turns the audit report from a short opinion into a detailed checklist, and it's where most small-company audit findings appear.

CARO doesn't apply to banking companies, insurance companies, section 8 companies, one person companies and small companies. It also doesn't apply to a private company that isn't a holding or subsidiary of a public company if all three of these hold: paid-up capital plus reserves not more than ₹1 crore at the balance sheet date; borrowings from banks or financial institutions not more than ₹1 crore at any time in the year; and total revenue not more than ₹10 crore in the year. A short-term overdraft that touches ₹1.2 crore for a week is enough to bring CARO in.

The December 2025 small company change. From 1 December 2025, MCA raised the small company limits to paid-up capital up to ₹10 crore and turnover up to ₹100 crore — the maximum section 2(85) currently allows (they were ₹4 crore and ₹40 crore). A small company can't be a public company, a holding or subsidiary company, a section 8 company or a company governed by a special Act. Many more private companies now qualify, and for an audit that means:

What a small company is spared in its audit

0/6

• No CARO 2020 annexure in the audit report
• No auditor reporting on internal financial controls under section 143(3)(i)
• Outside the auditor-rotation classes in rule 5
• Doesn't count towards an auditor's 20-company ceiling
• No cash flow statement needed in the financial statements
• Still needs: a full statutory audit, AGM (or its equivalent), AOC-4 and MGT-7A filings

Share Print

Even outside the small company definition, the internal financial controls report isn't required for a private company with turnover below ₹50 crore as per the latest audited accounts and borrowings below ₹25 crore at any time in the year, under the June 2017 exemption notification. Check both conditions each year.

LLP audit limits

An LLP's accounts must be audited under rule 24 of the LLP Rules, 2009, unless its turnover in the financial year doesn't exceed ₹40 lakh or its partners' contribution doesn't exceed ₹25 lakh. Meeting either condition is enough to escape the audit. An LLP with ₹2 crore of turnover but only ₹10 lakh of contribution is therefore not required to be audited under the LLP Rules — though it may still need a tax audit. The partners appoint the auditor, and the audited (or unaudited, where exempt) Statement of Account and Solvency goes to the Registrar in Form 8 by 30 October. See our LLP registration guide for the other annual filings.

Statutory audit vs tax audit

The tax audit is a separate exercise under the Income-tax Act, with its own thresholds, form and deadline. From tax year 2026-27, it sits in section 63 of the Income-tax Act, 2025 (it was section 44AB under the 1961 Act, which still governs FY 2025-26).

Statutory audit vs tax audit

	Statutory audit (company)	Tax audit
Law	Companies Act, 2013, ss.139–148	Income-tax Act, 2025, s.63 (s.44AB for FY 2025-26)
Who needs it	Every company; LLPs above limits	Business turnover > ₹1 crore (₹10 crore if cash receipts and payments each ≤ 5%); professions > ₹50 lakh; some presumptive cases
Purpose	True and fair view to shareholders	Tax particulars for the Income Tax Department
Report	Audit report + CARO (if applicable)	Form 26 from tax year 2026-27 (Forms 3CA/3CB + 3CD for FY 2025-26)
Due date	Before the AGM (within six months of the year end (30 September); first AGM within nine months)	One month before the return due date; FY 2025-26: 21 October 2026 (extended)
Cost of default	Fine on company ₹25,000 to ₹5 lakh; officers fined	Fee ₹75,000 (≤ 1 month late), ₹1,50,000 after

Law

Statutory audit (company)

Companies Act, 2013, ss.139–148

Tax audit

Income-tax Act, 2025, s.63 (s.44AB for FY 2025-26)

Who needs it

Statutory audit (company)

Every company; LLPs above limits

Tax audit

Business turnover > ₹1 crore (₹10 crore if cash receipts and payments each ≤ 5%); professions > ₹50 lakh; some presumptive cases

Purpose

Statutory audit (company)

True and fair view to shareholders

Tax audit

Tax particulars for the Income Tax Department

Report

Statutory audit (company)

Audit report + CARO (if applicable)

Tax audit

Form 26 from tax year 2026-27 (Forms 3CA/3CB + 3CD for FY 2025-26)

Due date

Statutory audit (company)

Before the AGM (within six months of the year end (30 September); first AGM within nine months)

Tax audit

One month before the return due date; FY 2025-26: 21 October 2026 (extended)

Cost of default

Statutory audit (company)

Fine on company ₹25,000 to ₹5 lakh; officers fined

Tax audit

Fee ₹75,000 (≤ 1 month late), ₹1,50,000 after

Thresholds. A business needs a tax audit if turnover or gross receipts exceed ₹1 crore in the tax year. The limit rises to ₹10 crore if cash receipts are no more than 5% of total receipts and cash payments no more than 5% of total payments. A profession needs one if gross receipts exceed ₹50 lakh. Businesses and professionals on presumptive taxation who declare profit below the deemed rate (and whose income exceeds the basic exemption) also need one.

When a company needs both. A company with ₹4 crore of turnover and significant cash sales needs a statutory audit under the Companies Act and a tax audit under section 63. The tax auditor can rely on the audited accounts and reports in the tax audit form; the two are often done by the same firm, back to back.

Deadlines for FY 2025-26. The tax audit report is normally due one month before the return due date — 30 September for audit cases. On 28 September 2026, CBDT Circular 07/2026 extended the date for AY 2026-27 to 21 October 2026, and the return due date for audit cases from 31 October to 21 November 2026. For tax year 2026-27 onwards the default under the 2025 Act is 30 September, with the return due 31 October.

Penalty becomes a fee. Under the 1961 Act, failing to get a tax audit cost 0.5% of turnover up to ₹1.5 lakh. The Finance Act, 2026 replaced this, from tax year 2026-27, with a fixed fee under section 428: ₹75,000 for a delay of up to one month and ₹1,50,000 beyond that. The fee is automatic, so a small business can no longer hope for a lower figure on turnover.

How the statutory audit runs, and what it costs

The year-end statutory audit, step by step

1. 1

   Close the books

   Complete bank reconciliations, GST and TDS reconciliations, fixed asset register, and inventory counts as at 31 March. Book depreciation, provisions and accruals.

2. 2

   Prepare draft financial statements

   Management prepares the balance sheet, profit and loss account, notes and (unless exempt) cash flow statement in the Schedule III format.

3. 3

   Fieldwork and queries

   The auditor tests transactions, confirms balances with banks and parties, reviews statutory dues, related-party transactions and, where CARO applies, each CARO clause.

4. 4

   Board approval and audit report

   The Board approves the financial statements; the auditor signs the report under section 145. Qualifications must be explained in the Board's report.

5. 5

   AGM and filings

   Members adopt the accounts at the AGM; file AOC-4 within 30 days and the annual return afterwards; file ADT-1 if an auditor is appointed or reappointed.

Audit fees are not regulated and vary with size, complexity and city. As a rough market estimate based on quotes commonly published by Indian CA firms, a small private company with straightforward books typically pays from about ₹15,000 to ₹50,000 for a statutory audit, more if a tax audit, CARO or messy records are involved. Ask for a written engagement letter that separates statutory audit, tax audit and any other services, so you can check section 144 compliance and Board approvals.

The biggest driver of cost and delay is the state of the books. Unreconciled bank accounts, GST credits that don't match GSTR-2B, missing fixed asset records and undocumented loans from directors generate queries and, sometimes, qualifications. Our cash flow statement guide and balance sheet guide cover the statements the auditor will review.

Common mistakes and their consequences

Not appointing the first auditor. Many new companies forget the 30-day deadline. Appoint late rather than never, and regularise at the next general meeting.

Missing ADT-1. The five-year appointment at the AGM needs ADT-1 within 15 days of the meeting; late filing attracts additional fees on the MCA portal.

Using the bookkeeper as auditor. Section 144 forbids the auditor from keeping the company's books. Separate the two roles.

Assuming small means no audit. Small company status removes CARO and internal-control reporting — not the audit.

Confusing the two deadlines. The statutory audit must be done before the AGM; the tax audit has its own date. Missing either has separate consequences: fines under section 147 (₹25,000 to ₹5 lakh for the company, plus fines on officers in default) and the fee under section 428 for the tax audit.

Cost audit surprises. Section 148 lets the government require cost records and cost audit for prescribed industries above turnover limits. Manufacturing companies growing quickly should check whether the Companies (Cost Records and Audit) Rules now apply to them.

Official links

• Companies Act, 2013 (India Code)Sections 139–148 and 2(85)
• MCA portalFile ADT-1, ADT-3, AOC-4 and LLP Form 8
• Income-tax e-filing portalAssign the tax auditor and file the audit report
• Finance Bill, 2026Section 428 audit fee
• Income Tax Department — circularsCircular 07/2026 extension

What to do next

Check three things this month: that your company's auditor appointment and ADT-1 are on record, whether you're now a small company under the December 2025 limits (which removes CARO from this year's report), and whether your turnover and cash mix put you inside the tax audit — remembering the 21 October 2026 date for FY 2025-26. If you're still choosing a structure, our private limited company registration guide and LLP registration guide compare the audit burden of each.

This is general information, not legal or tax advice — confirm on the official source or with a professional.

Frequently asked questions

What is statutory audit?

A statutory audit is an audit that a law makes compulsory. For a company, the Companies Act, 2013 requires every company — private, public, small or one-person — to have its annual financial statements audited by a chartered accountant appointed under section 139. The auditor reports to the shareholders on whether the accounts give a true and fair view, and the report is filed with the Registrar.

Is statutory audit compulsory for a small private limited company?

Yes. There is no turnover or capital threshold for company audit — even a company with no business must be audited every year. Small companies get relief on what the auditor reports (no CARO, no internal financial controls report) and are outside auditor rotation, but the audit itself is mandatory. A 2026 Bill proposes a prescribed audit exemption, but it isn't law yet.

What is the difference between statutory audit and tax audit?

Statutory audit is required by company or LLP law and reports to shareholders on the financial statements. Tax audit is required by section 63 of the Income-tax Act, 2025 (earlier section 44AB) when business turnover exceeds ₹1 crore (₹10 crore if cash is within 5%) or professional receipts exceed ₹50 lakh. It reports tax-specific particulars to the Income Tax Department. A company can need both.

Does an LLP need a statutory audit?

Only above the limits. Under the LLP Rules, an LLP's accounts must be audited unless its turnover doesn't exceed ₹40 lakh or its partners' contribution doesn't exceed ₹25 lakh in the year. A proprietorship or partnership firm has no statutory audit under any company law, though it may still need a tax audit.

How is the first auditor of a company appointed?

The Board of Directors must appoint the first auditor within 30 days of incorporation. If it doesn't, members must appoint one at an extraordinary general meeting within 90 days. The first auditor holds office until the first AGM, where members appoint an auditor for a five-year term and the company files Form ADT-1 within 15 days of the meeting.

What is the tax audit due date for FY 2025-26?

CBDT Circular 07/2026 of 28 September 2026 extended the date for furnishing the tax audit report for AY 2026-27 (FY 2025-26) from 30 September to 21 October 2026, and the return due date for audit cases from 31 October to 21 November 2026.

Sources & verification

Figures on this page were checked against the sources below when it was last reviewed on 9 October 2026. Each rate and limit is stored once with its own official source and review date, and official update channels are monitored daily so changes are picked up. How we verify

1. 1.The Companies Act, 2013 (India Code) — Legislative Department, Government of India · accessed 9 October 2026
2. 2.CBDT Circular No. 07/2026 — extension of timelines for audit reports and ITRs, AY 2026-27 — CBDT (copy hosted by CAalley) · accessed 9 October 2026
3. 3.The Finance Bill, 2026 — section 428 fees — Ministry of Finance (India Budget) · accessed 9 October 2026
4. 4.Finance Bill 2026 — Memorandum explaining provisions — Ministry of Finance (India Budget) · accessed 9 October 2026
5. 5.Tax audit and time limits under the new Income-tax Act 2025 — TaxHeal · accessed 9 October 2026
6. 6.MCA continues to shower relaxations on private companies — Vinod Kothari & Company · accessed 9 October 2026
7. 7.Comprehensive guide to CARO 2020 — coverage and exemptions — The TaxCorp · accessed 9 October 2026
8. 8.The small company threshold and the limits of delegated legislation — IndiaCorpLaw · accessed 9 October 2026