Statutory Audit Checklist
— Complete Advanced Guide

The Statutory Audit Framework

A statutory audit under the Companies Act, 2013 is a mandatory independent examination of a company's financial statements. The auditor must form an opinion on whether the financial statements give a true and fair view in accordance with applicable financial reporting frameworks.

Applicable Standards on Auditing (SAs)

Phase 1: Engagement Acceptance & Pre-Audit

Before commencing audit work, the auditor must confirm independence, assess competence to take on the engagement, and formalise terms with the client.

Engagement Acceptance Checklist

• Verify the auditor/firm is qualified under Section 141(2) — practicing CA or firm of CAs.
• Confirm no disqualification under Section 141(3) — not a relative of director, not an employee, no financial interest, no indebtedness exceeding ₹5 lakh.
• Check rotation compliance — Section 139(2) mandates mandatory rotation every 5 years for individual auditors and 10 years for firms (for certain class of companies). Confirm last appointment date.
• Assess ICAI Code of Ethics independence threats — self-interest, self-review, familiarity, intimidation, advocacy threats must be evaluated.
• Perform KYC of the entity — obtain last 3 years' audited financial statements, list of directors, group structure.
• Assess engagement risk — consider fraud history, regulatory scrutiny (SFIO, SEBI, MCA actions), litigation exposure, complexity of transactions.
• Agree on and issue an Engagement Letter per SA 210 — scope, responsibilities, limitations, fee arrangement.
• File Form ADT-1 with MCA within 15 days of appointment (Section 139(1)).
• Ensure UDIN (Unique Document Identification Number) registration is active on ICAI portal.
• Identify key engagement team members — Engagement Partner, Manager, Seniors. Document team's competence to handle sector-specific matters (banking, manufacturing, listed entity, etc.).

Phase 2: Audit Planning & Risk Assessment

Planning is the backbone of an efficient audit. An inadequate planning phase is the most common reason for audit failures and regulatory findings under SA 300 and SA 315.

Materiality Determination

Risk Assessment — SA 315 (Revised 2021)

• Obtain understanding of the entity — business model, industry, regulatory environment, ownership structure, governance, accounting policies.
• Conduct Preliminary Analytical Procedures — compare current year balances with prior year, budget, industry benchmarks. Identify unusual fluctuations.
• Identify and assess Risks of Material Misstatement (ROMM) at financial statement level and assertion level (Completeness, Accuracy, Existence, Cut-off, Rights & Obligations, Valuation, Presentation).
• Identify Significant Risks — risks requiring special audit consideration: fraud risks, complex/unusual transactions, highly judgmental areas (impairment, fair value, provisions), related-party transactions.
• Document Entity-Level Controls (ELC) — control environment, risk assessment process, information systems, monitoring activities.
• Perform Fraud Risk Assessment per SA 240 — brainstorm with team, consider incentives/pressures, opportunities, rationalizations (fraud triangle).
• Assess Going Concern risks under SA 570 — review net worth, current ratio, cash flow projections, loan covenants, pending litigation.
• Prepare and document Overall Audit Strategy and Detailed Audit Plan per SA 300.
• Identify related parties per SA 550 — list all related entities and key management persons (KMP). Obtain management's representation on completeness.
• If entity uses a service organization (payroll processor, data center), evaluate per SA 402 — obtain SOC 1 / ISAE 3402 report.

Phase 3: Internal Control Evaluation

Evaluating the design and operating effectiveness of internal controls helps the auditor calibrate the nature, timing, and extent of substantive procedures. For listed entities, ICFR (Internal Controls over Financial Reporting) must be separately reported under Section 143(3)(i).

Internal Control Evaluation Checklist

• Revenue Cycle: Verify order-to-cash controls — authorization of price lists and discounts, sales order approval, dispatch against approved orders, independent invoicing, credit limit controls, collection and receipt recording.
• Purchase Cycle: Check procure-to-pay controls — vendor approval, three-way match (PO vs GRN vs invoice), payment authorization matrix, segregation of duties between purchase and payment functions.
• Payroll Controls: Verify HR-to-payroll linkage — joiner/leaver controls, salary change authorization, independent payroll preparation and approval, bank mandate controls, statutory deduction (PF, ESI, PT, TDS) reconciliation.
• Fixed Assets Controls: Check capex authorization thresholds, capitalization policy adherence, physical verification schedule, disposal authorization, depreciation calculation review.
• Treasury Controls: Verify bank account opening/closure authorization, cheque signatory limits, payment controls (dual authorization for high-value), bank reconciliation timeliness and independent review.
• IT General Controls (ITGC): Access controls (user provisioning/deprovisioning, privileged access), change management (application and infrastructure changes), backup and recovery procedures, system availability and incident management.
• Month-End Close Controls: Verify journal entry controls — JE approval, restricted posting access, completeness of period-end accruals, reconciliation sign-off process.
• Perform walkthrough tests for significant transaction cycles — trace one transaction end-to-end through the system and controls.
• For high-risk controls, test operating effectiveness — select sample of control executions and verify evidence of operation (timestamps, approvals, signatures, system logs).
• Document control deficiencies per SA 265 — distinguish between significant deficiency and material weakness. Communicate to TCWG and management in writing.
• If IT-dependent controls are key — consider engaging an IT audit specialist. Reliance on manual controls in a highly automated environment is a red flag.

Phase 4: Substantive Audit Procedures

Substantive procedures provide direct audit evidence about whether financial statement assertions are materially misstated. These are performed irrespective of the results of control testing.

Revenue & Receivables

• Test revenue recognition against Ind AS 115 / AS 9 — check 5-step model compliance (identify contract, performance obligation, transaction price, allocation, recognition at point/over time).
• Vouch a sample of sales invoices with dispatch records, customer POs, and delivery confirmations. Check cut-off — ensure no revenue is pre-booked or deferred inappropriately.
• Perform debtors aging analysis — stratify by age bands. Critically examine debts over 180 days. Assess adequacy of provision for doubtful debts.
• Send independent balance confirmations to major debtors per SA 505. Reconcile differences; investigate non-responses.
• Examine credit notes issued after year-end — potential returns/rebates that affect revenue recognition.
• Check related-party sales — price at arm's length? Disclosed in notes per Ind AS 24 / AS 18?
• Analyze unusual journal entries to revenue accounts — especially large round-figure credits, entries by IT administrators, entries posted on weekends/holidays.
• GST reconciliation — reconcile sales as per books with GSTR-1 and GSTR-3B filed. Material differences must be investigated and adjusted.

Inventory

• Attend or observe physical stock-taking per SA 501 — mandatory for significant inventory balances. Document quantities counted; test count selected items.
• Verify inventory valuation at lower of cost and net realisable value (Ind AS 2 / AS 2) — check cost formula applied (FIFO / WA), consistency with prior year.
• Identify slow-moving, damaged, or obsolete stock — scrutinize provision for write-down. Obtain management's NRV assessment with supporting data.
• Perform cut-off tests — check GRNs and sales invoices around year-end. Goods in transit — confirm ownership (FOB terms).
• For manufacturing entities — verify WIP valuations, stage of completion, allocation of overheads per costing policy.
• If physical verification was not attended — document the impact and consider qualification of audit opinion if significant.

Fixed Assets (PPE)

• Reconcile fixed asset register to general ledger — trace opening balance to prior year audited accounts.
• Vouch a sample of additions against purchase invoices, capex authorization, and capitalization date. Verify capital vs revenue treatment.
• Verify depreciation — check useful lives applied under Schedule II of Companies Act, 2013 or Ind AS 16 component accounting. Recalculate for selected assets.
• Verify physical verification of assets — has management conducted it? Review physical verification report. Identify discrepancies and how they were handled.
• Check impairment indicators per Ind AS 36 / AS 28 — idle assets, significant decline in value, restructuring plans. If indicators exist — verify formal impairment testing.
• Examine disposals — authorization, proceeds received, gain/loss computation, removal from register.
• Verify title documents for land and buildings — registered sale deed, mutation, property tax receipts, encumbrance certificate.
• For leased assets — confirm Ind AS 116 / AS 19 treatment: Right-of-Use asset recognition, lease liability, discount rate applied.

Investments & Financial Instruments

• Obtain investment schedule — reconcile to general ledger. Verify classification (FVTPL / FVOCI / Amortised Cost under Ind AS 109 / AT cost under AS 13).
• Obtain third-party confirmations from depositories (NSDL/CDSL), demat accounts, fund houses, or banks for investment balances.
• Verify fair valuations — quoted securities at market price; unquoted at DCF/NAV. Assess reasonableness of valuation models used. Engage auditor's expert if complex.
• Check impairment of investments in subsidiaries/associates — review net worth of investee, business plan, market conditions.
• Verify inter-corporate loans — review loan agreements, interest accrual, FVTPL/EIR adjustments under Ind AS 109. Check compliance with Section 186 (loan limits, Board approval, register).

Loans, Borrowings & Finance Costs

• Obtain borrowing schedule — reconcile outstanding balances with loan statements from banks/NBFCs. Obtain independent bank confirmations per SA 505.
• Verify interest expense calculation — cross-check with EIR method under Ind AS 109. Verify classification between current/non-current based on repayment schedule.
• Check loan covenants — DSCR, leverage ratios, net worth requirements. Any breach? If so, assess reclassification to current liability and disclosure.
• Verify creation and satisfaction of security (charge) with MCA — check ROC records, Form CHG-1/CHG-4 filings.
• Examine new borrowings during the year — Board resolution, shareholders' approval (Section 180), end-use of funds.
• Verify foreign currency borrowings — ECB compliance (RBI master direction), hedge accounting if applicable.

Provisions, Contingent Liabilities & Commitments

• Verify employee benefits — obtain actuarial valuation report for Gratuity (AS 15 / Ind AS 19). Check assumptions: discount rate, attrition, salary escalation. Verify funding status with LIC/trust.
• Review legal cases — obtain management representation and legal counsel confirmations (lawyer's letters per SA 501). Assess probability of outcome. Ensure appropriate provision/disclosure.
• Check warranty provisions — methodology consistent with historical claim data? Sufficient?
• Verify income tax provisions — reconcile advance tax paid, TDS receivable, self-assessment tax. Obtain status of assessments from management.
• Review GST/indirect tax matters — pending SCNs, appeals, disputed credits. Obtain legal opinion for significant matters.
• Ensure disclosures in notes are complete — contingent liabilities, commitments (capital and other), guarantees given.

Cash & Bank

• Obtain bank confirmation letters directly from all banks — balances, facilities, security, guarantees, undisclosed borrowings.
• Verify Bank Reconciliation Statements (BRS) for all accounts as of year-end — check for old outstanding cheques (over 6 months), stale deposits, timing differences. Vouch independently.
• Physical cash count at year-end if material cash balance exists — conduct surprise cash count. Match with cashier's books.
• Check cash transactions — PMLA compliance for large cash transactions. Section 40A(3) — cash payments over ₹10,000 to same person in a day (₹35,000 for transport) — income tax disallowance risk.
• Review petty cash — check advance register, expense vouchers, physical balance.

Equity & Share Capital

• Verify share capital — reconcile issued/subscribed/paid-up capital with Register of Members, RoC filings (MCA21).
• Check any new share issuances — rights issue, private placement (Section 42), ESOPs (ESOP trust, SEBI SBEB regulations for listed entities), allotment against conversion of instruments.
• Verify reserves and surplus — appropriation of profits, dividend declarations and payments, buy-back of shares (Section 68).
• Verify capital reduction / forfeiture — court/NCLT order, compliance with procedure.

Analytical Procedures (Final)

• Compare final trial balance with prior year — ratio analysis: gross profit margin, net margin, current ratio, debt-equity ratio, inventory days, debtor days, creditor days.
• Flux analysis — identify line items with more than materiality-level change unexplained by known business events.
• Compare audited balances with management accounts/budget — large variances need investigation.
• Review overall financial statement presentation — is classification appropriate between current/non-current? Any reclassification from prior year? Corresponding previous year figures restated if required?

CARO 2020 — All 21 Clauses Checklist

The Companies (Auditor's Report) Order, 2020 (CARO 2020) applies to all companies except banking, insurance, and Section 8 companies. For small companies and OPCs, certain clauses are exempt.

Phase 5: Audit Completion Procedures

Completion procedures bring together all audit evidence and allow the auditor to form a final opinion. These are equally critical as substantive testing.

Going Concern Assessment

• Assess going concern indicators per SA 570 — review management's assessment. Consider financial (negative equity, net current liabilities, fixed-term borrowings approaching maturity), operating, and other indicators.
• If going concern doubt exists — obtain management's detailed business plan and cash flow projections. Test key assumptions (revenue growth, cost cutting, asset sales, refinancing).
• Evaluate likelihood of plans succeeding — consider whether events or conditions and management's plans mitigate the going concern doubt.
• Material uncertainty about going concern — ensure prominent disclosure in financial statements. If not adequately disclosed — qualified or adverse opinion.

Subsequent Events

• Perform subsequent events review per SA 560 — inquire of management about events between balance sheet date and auditor's report date that could require adjustment or disclosure.
• Read Board minutes, Audit Committee minutes, and Shareholders' minutes up to the date of audit report.
• Review management accounts and interim financials (if available) for material events.
• Specific inquiries — any litigation, regulatory actions, major contracts, going concern events, material asset disposals after year-end?

Written Representations

• Obtain Management Representation Letter per SA 580 — signed by CEO/MD and CFO.
• Key assertions in MRL: financial statements are complete and accurate; all related parties disclosed; all known actual or possible litigation included; post-balance sheet events disclosed; entity is a going concern; all assets belong to the company; all liabilities recorded; no fraud known to management; compliance with laws and regulations.
• CARO-specific representations — benami property, struck-off company transactions, undisclosed income.
• An unsigned or delayed MRL prevents issuance of the audit report. Do not sign the report without receiving the MRL.

Summary of Unadjusted Misstatements

• Prepare a Schedule of Unadjusted Differences (SOUP) — list all factual, judgmental, and projected misstatements identified.
• Evaluate whether individually or in aggregate, unadjusted misstatements are material — per SA 450.
• Communicate unadjusted misstatements to management — request correction. Document management's reasons for not adjusting.
• If uncorrected misstatements are material — modify audit opinion accordingly.

Engagement Quality Control Review (EQCR)

• For listed entities and other engagements requiring EQCR per SA 220 — appoint an independent EQCR reviewer before sign-off.
• EQCR reviewer to check: significant risks and responses, significant judgments and conclusions, consultations on contentious matters, appropriateness of proposed audit opinion.
• EQCR completed before audit report is signed. Document EQCR reviewer's concurrence.

Phase 6: Auditor's Report — Types & Requirements

The audit report is the auditor's public communication of findings. SA 700–720 govern the form and content. For listed companies, the format prescribed by ICAI under SA 701 (Key Audit Matters) is also applicable.

Auditor's Report Checklist — Companies Act 2013

• Report addresses to the Members of the Company (shareholders) — not to the Board of Directors.
• Title clearly states "Independent Auditor's Report".
• Introductory paragraph — identifies financial statements audited, management's responsibility, auditor's responsibility.
• Basis for Opinion paragraph — conducted audit per SAs, ICAI ethical requirements, planned and performed to obtain reasonable assurance.
• Key Audit Matters section (listed companies) — for each KAM: describe the matter, why considered significant, how it was addressed in the audit.
• Information Other than the Financial Statements — responsibility for and on other information (Annual Report, Directors' Report).
• Management's Responsibility — preparation per applicable financial reporting framework, internal controls.
• Auditor's Responsibility — express opinion, consider materiality, perform risk-based procedures.
• Opinion paragraph — clear statement of opinion (unmodified/qualified/adverse/disclaimer). If modified — specific description of the matter.
• Report on Other Legal and Regulatory Requirements (ROLRR) — Section 143(3) requirements: books of accounts maintained, branch visits, directors' report consistency, ICFR adequacy, disqualification of directors (Section 164(2)), pending litigations disclosed.
• CARO 2020 Annexure — if applicable, attach CARO report covering all 21 clauses.
• Signature — engagement partner's name and membership number, firm name and registration number, UDIN, place, and date.
• UDIN must be generated on the ICAI portal within 15 days of signing the report. Failure to generate UDIN is treated as professional misconduct.

Phase 7: Special Audit Areas

Advanced audit situations require specialized checklists beyond routine substantive testing. Below are high-risk areas demanding extra professional skepticism.

Auditing Revenue — Key Risks (Ind AS 115)

• Multiple Performance Obligations: Does the entity sell bundled products/services? Verify allocation of transaction price using standalone selling price (SSP). Check if each element is distinct.
• Variable Consideration: Are rebates, discounts, volume incentives, or penalties estimated correctly? Is the constraint on variable consideration appropriately applied (highly probable not to be significantly reversed)?
• Contract Modifications: How are mid-term changes to contracts treated — as new contracts or modifications? Accounting treatment correct?
• Bill-and-Hold Arrangements: Are bill-and-hold sales genuine? Customer-specific request? Risk transferred? Goods separately identified? Verify physical existence.
• Channel Stuffing: Check for unusual spike in sales to distributors near year-end. Review returns and credit notes post year-end. Confirm right of return terms.
• Long-Term Contracts (PoC Method): Verify stage of completion methodology — input method (costs incurred) or output method (survey). Recalculate estimated total contract costs and revenue.

Auditing Related Party Transactions

• Obtain complete list of related parties from management — verify against Register of Directors' Interests, shareholders' list, group company list.
• Search for undisclosed related parties — check payment beneficiaries, common directors across companies, shareholding patterns.
• For each significant RPT — verify arm's-length pricing, Audit Committee and Board approval (Section 177/188), shareholder approval if required.
• Ensure notes disclosures per Ind AS 24 / AS 18 are complete — nature of relationship, description of transaction, outstanding balances, impairment provisions.
• SA 550 requires the auditor to remain alert for RPTs not identified by management. Consider confirmation with counterparties and reviewing bank statements for unexplained transactions.

Auditing Management Estimates

• Identify all significant accounting estimates — impairment of assets, fair value measurements, expected credit loss (ECL), provisions, deferred tax asset recognition, pension/gratuity, warranty provisions, contingent liabilities.
• Per SA 540 (Revised) — assess whether the method, data, and assumptions used are appropriate. Test mathematical accuracy.
• Evaluate management's bias — has management consistently over/under-estimated in the past? Review prior year estimates vs outcomes.
• For complex estimates (ECL models, actuarial valuations, DCF models) — consider engaging an auditor's expert per SA 620.
• Document the point estimate or range and assess whether the financial statement amount is reasonable.

Group Audit Considerations

• Identify group structure — subsidiaries, associates, JVs, branches. Assess significance of each component per SA 600.
• For significant components — perform full audit or specific audit procedures. For insignificant components — apply analytical procedures.
• Issue Group Audit Instructions to component auditors — reporting deadlines, materiality, specific procedures required, group accounting policies.
• Review component auditor's work — assess competence and independence. Consider visiting component auditor if high-risk component.
• Consolidation audit — verify elimination entries (inter-company transactions, unrealised profits, investments vs equity), consistency of accounting policies, currency translation (Ind AS 21), goodwill and purchase price allocation (Ind AS 103).

Interactive Audit Progress Tracker

Use this real-time tracker to mark audit procedures as completed. Track your audit progress dynamically.

Audit Risk Analytics

Visual overview of key audit metrics, common qualification areas, and audit risk distribution patterns observed in Indian statutory audits.

Frequently Asked Questions

Common queries from audit practitioners on statutory audit compliance and reporting.