For many small businesses, family-run enterprises and not-for-profits (NFPs), the word “audit” can be thought of as a purely compliance cost or obligation. But not all audits are created equal. Two of the most common types — statutory and internal audits — serve very different purposes.

Understanding these differences can help your organisation stay compliant, manage risks and boost performance.

What is a statutory audit?

A statutory audit is a legally required review of an organisation’s financial statements. In Australia, the Corporations Act 2001 outlines audit requirements. Typically, these apply to:

• Large proprietary companies

• Listed entities

• Certain not-for-profits and charities

These audits typically must be conducted by a registered company auditor (RCA) and follow the Australian Auditing Standards (ASAs). Even if your organisation isn’t required to have one by law, grant providers, investors, or trust deeds may still require a statutory audit.

Purpose: To provide an independent opinion on whether your financial reports present a “true and fair” view in accordance with accounting standards 

What is an internal audit?

An internal audit is not required by law. Instead, it’s initiated internally by the organisation, often by the board, senior management, or audit committee. Unlike a statutory audit, internal audits go beyond just the numbers. They assess:

• Internal controls

• Risk management

• Compliance with policies

• Operational efficiency

Though more common in large businesses or structured NFPs, small businesses can benefit too — especially as a proactive step to strengthen governance and prevent issues before they arise.

Purpose: To help improve your operations, controls, and overall decision-making. 

Key differences at a glance

 

Which audit does your organisation need?

• If you’re legally required to have a statutory audit (based on size, structure, or funding), then it’s non-negotiable.

• If you’re not legally obligated, consider:

• Stakeholder expectations (e.g. donors, partners, government grants)

• Operational complexity

• Appetite for improving internal processes and risk management

Internal audits — though voluntary — are underused by smaller organisations. But they can: 

• Reveal cost-saving opportunities 

• Prevent fraud or policy breaches 

• Strengthen internal control environments reducing risk 

• Strengthen business resilience 

Preparing for an audit

Whether you’re preparing for a statutory or internal audit, here are some key tips: 

• Understand your requirements and objectives of an audit 

• Organise financial records and supporting documentation 

• Assign a point-of-contact for auditors 

• Review past audit findings or compliance issues 

Final Thoughts

Statutory and internal audits each serve important but different purposes. Whether you’re aiming to meet compliance requirements or improve internal operations, understanding which audit suits your organisation is the first step toward better governance.