A financial audit is an independent examination of an organization’s financial statements. The auditor checks whether the statements give a true and fair view of the financial position and results, in line with the applicable accounting framework. Investors, lenders, regulators and tax authorities rely on that opinion.
This guide explains who needs financial audits, the main types, the audit process, the possible opinions, and why IT controls matter more every year.
Who needs a financial audit?
In India, every company registered under the Companies Act, 2013 must have its annual financial statements audited by a Chartered Accountant, regardless of size. Other entities need audits too:
- listed companies, with extra requirements from SEBI;
- banks, NBFCs and insurers, under sector regulators;
- businesses above turnover limits for a tax audit under the Income Tax Act;
- trusts, societies and NGOs, depending on their registration and funding;
- companies seeking loans or investment, because lenders and investors ask for audited accounts.
Types of financial audits
| Type | Who performs it | Purpose |
|---|---|---|
| Statutory (external) audit | Independent Chartered Accountant firm | Opinion on annual financial statements required by law |
| Internal audit | Internal team or outsourced firm | Assurance to management on controls and processes |
| Tax audit | Chartered Accountant | Check compliance with tax rules and reporting |
| Forensic audit | Specialist investigators | Investigate suspected fraud or misconduct |
| Government audit | Comptroller and Auditor General (CAG) and others | Review public funds and government companies |
What the audit covers
A statutory financial audit looks at:
- the balance sheet, profit and loss statement and cash flow statement;
- notes and disclosures;
- accounting policies and significant estimates;
- internal financial controls, which auditors must report on for many Indian companies;
- compliance with accounting standards, such as Ind AS or AS.
The financial audit process
- Engagement and planning. The auditor understands the business, assesses risks of material misstatement and sets materiality.
- Internal control review. Next, the auditor evaluates controls over financial reporting, including IT general controls.
- Substantive testing. Then the auditor tests balances and transactions, for example by confirming bank balances, checking invoices and observing inventory counts.
- Analytical review. Ratios and trends highlight unusual items for follow-up.
- Completion. The auditor reviews subsequent events, obtains management representations and evaluates misstatements.
- Reporting. Finally, the auditor issues the audit report with an opinion.
Auditors in India follow the Standards on Auditing (SAs) issued by ICAI, which are based on the International Standards on Auditing.
Types of audit opinion
- Unmodified (clean): the statements give a true and fair view.
- Qualified: the statements are fair except for a specific issue.
- Adverse: the statements are materially misstated overall.
- Disclaimer: the auditor could not obtain enough evidence to form an opinion.
Why IT controls matter in a financial audit
Today, nearly every transaction flows through ERP and accounting systems. Therefore, auditors test IT general controls, such as:
- user access to accounting systems and segregation of duties;
- change management for financial applications;
- backup and recovery of financial data;
- controls over interfaces and automated calculations.
Weak IT controls can force auditors to do far more manual testing, or even lead to a modified opinion. Our guide to auditing entity-level controls explains the governance side.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
