Secretarial audit vs statutory audit: what each covers, and why investors ask for both

A founder once told me, "We already have an audit — the CA does it every year." He meant the statutory audit. He did not know the secretarial audit existed until an investor's diligence list asked for the MR-3.

Two audits, two different questions, two different professionals. Here is what each one does, who has to get them done, and why a serious investor wants to see both.

What does the statutory audit check?

The financials. The statutory auditor — a chartered accountant appointed under Section 139 — examines whether your financial statements give a true and fair view of the company's affairs. They test revenue recognition, expense booking, asset values, related-party disclosures in the accounts, and internal financial controls.

Their report goes to the shareholders, and for most companies it carries the CARO annexure — the Companies Auditor's Report Order — a long checklist of specific verifications. If the numbers are wrong, this is the audit that catches it.

What does the secretarial audit check?

The law, not the numbers. The secretarial auditor — a practising company secretary — examines compliance with the Companies Act, the secretarial standards, and, for listed companies, SEBI regulations, FEMA, and other applicable laws. The report is Form MR-3.

It answers questions like: were board meetings properly convened? Are the statutory registers maintained? Were filings made on time? Are share transfers and allotments legally clean?

It applies to listed companies and to public companies meeting the thresholds — paid-up capital of Rs 50 crore or more, or turnover of Rs 250 crore or more. Private startups below those lines are not legally required to get one. Many get one anyway. Read on.

Why do investors ask for both?

Because they answer different fears. The statutory audit tells an investor the numbers can be trusted. The secretarial audit tells them the company legally owns what it claims to own — that the shares being bought were validly issued, that the board validly approved the things it approved, that no filing default is waiting to surface.

In diligence, the secretarial audit is a shortcut. A clean MR-3 lets the investor's lawyers move faster; a qualified one tells them exactly where to dig.

If the company were a car, the statutory audit checks the engine — does it run, are the readings honest. The secretarial audit checks the paperwork — registration, insurance, pollution certificate. You need both to drive it off the lot, and any serious buyer inspects both.

What does a clean MR-3 look like in practice?

Short, specific, and boring — which is exactly what you want. It lists the laws examined, confirms the board composition and meeting discipline, notes that registers and filings are in order, and carries no qualifications.

A qualified MR-3 is not a disaster; it is a to-do list written by someone who knows the law. The worst MR-3s I see are not qualified — they are vague, three pages of boilerplate that say nothing. An investor's team can work with a qualified report. They cannot work with an empty one. If you are getting the audit done voluntarily, ask your CS for specifics: which filings were checked, which registers verified. The value is in the detail, not the certificate.

What happens if you skip the secretarial audit?

If it applies to you and you skip it, there are penalties — on the company and on every officer in default. But the more common story is the voluntary skip: a private startup that was never required to get one, now facing a diligence list that asks for it.

Then the secretarial audit becomes a retrospective exercise — two or three years of registers, minutes, and filings reconstructed under time pressure. It is doable. It is also the most expensive way to buy something you could have had incrementally, year by year, for a fraction of the cost.

Questions founders ask