Statutory audit is mandatory. Every company registered with RJSC under the Companies Act 1994 must have its annual accounts audited by an ICAB-registered Chartered Accountant. No exceptions.
Internal audit is not mandatory (except for banks and insurance companies). It’s a management tool — useful, sometimes essential for foreign investors, but your choice.
If you’re a foreign company operating in Bangladesh and wondering which audit applies to you: both can apply, but only 1 is legally required. This article explains the difference, what each covers, who can perform each, and when foreign companies need both.
If you haven’t chosen your entity type yet, read our guide on types of company registration in Bangladesh first — the entity type affects some of the audit obligations below.
Statutory audit vs internal audit: quick comparison
| Statutory Audit | Internal Audit | |
| Mandatory? | Yes — Companies Act 1994, Section 183; Income Tax Act 2023, Section 73 | No (except banks and insurance companies) |
| Who mandates it? | RJSC, NBR (National Board of Revenue), Bangladesh Bank | Board of Directors (voluntary) |
| Who performs it? | ICAB-registered CA with Certificate of Practice (CoP), enlisted by FRC | Internal team, outsourced firm, or CMA from ICMAB — no ICAB qualification required |
| Frequency | Annual (once per financial year) | Continuous, quarterly, or periodic — your choice |
| Scope | Financial statements: balance sheet, P&L, cash flows | Controls, systems, operations, procurement, HR, IT |
| Output | Audit report with formal opinion — filed with RJSC, NBR, Bangladesh Bank | Internal report to management only — not filed with any regulator |
| Penalty for skipping | RJSC non-compliance, corporate tax return blocked, bank facilities at risk | No legal penalty — but operational and financial risk accumulates |
The verdict: get your statutory audit done every year without fail. Decide on internal audit based on your size, risk exposure, and HQ requirements.
What is a statutory audit in Bangladesh?
A statutory audit is an independent examination of your company’s financial statements by a qualified Chartered Accountant. The word ‘statutory’ means it’s required by law — not by your board, not by your investors, but by the Bangladesh government.
In Bangladesh, the requirement comes from 2 laws. Companies Act 1994, Section 183: every company registered with RJSC must appoint an auditor and have annual accounts audited. Income Tax Act 2023, Section 73: audited financial statements are required to file the corporate income tax return.
The auditor must be a Chartered Accountant registered with ICAB (Institute of Chartered Accountants of Bangladesh) and hold a Certificate of Practice (CoP). Since 2023, auditors must also be enlisted by the FRC (Financial Reporting Council of Bangladesh). An ICAB member without FRC enlistment cannot sign statutory audit reports for limited companies. Check your auditor’s FRC status before you appoint them.
Who needs a statutory audit in Bangladesh?
Every company registered with RJSC needs one annually. This includes:
1. Private limited companies — all sizes, no turnover threshold
2. Subsidiary companies — same requirements as private limited
3. Branch offices — audited accounts required for RJSC annual filing and Bangladesh Bank FDI reporting
4. Liaison offices — audited accounts required for BIDA annual progress reporting
The audit covers the period 1 July to 30 June (Bangladesh’s financial year). Companies that follow a different financial year for group consolidation purposes may adjust the period, subject to approval from the Deputy Commissioner of Taxes.
What does the statutory audit cover?
The statutory auditor examines your company’s financial statements:
1. Balance sheet
2. Income statement (Profit & Loss Account)
3. Cash flow statement
4. Notes to the accounts
5. Supporting records: bank reconciliations, ledgers, vouchers, contracts, and board minutes
The output is a formal audit report with 1 of 4 opinions:
| Audit Opinion | What it means |
| Unqualified opinion | Accounts present a true and fair view — the clean result RJSC, NBR, and Bangladesh Bank expect |
| Qualified opinion | Accounts are true and fair except for specific issues the auditor has identified |
| Adverse opinion | Accounts do not present a true and fair view — serious finding that triggers regulator attention |
| Disclaimer of opinion | The auditor could not obtain sufficient evidence to form any opinion |
A qualified or adverse opinion raises immediate questions from RJSC, NBR, and Bangladesh Bank. If you’re receiving a qualified opinion repeatedly, the underlying issues need to be fixed — not just disclosed.
When is the statutory audit due?
The statutory audit report must be ready in time to meet 4 separate deadlines:
| Deadline | Requirement |
| Before AGM | Audited accounts must be presented at the Annual General Meeting |
| Within 30 days of AGM | Filed with RJSC along with audited financial statements (Companies Act 1994, Section 190) |
| With corporate tax return | Audited accounts required for income tax filing (Income Tax Act 2023, Section 73) |
| 15 January | Audited accounts submitted with VAT return for December quarter (VAT Act 2012, Section 90Ka) |
For companies with a 30 June year-end, start your audit in August or September at the latest. Auditors need 2-3 months for a clean set of accounts. Leaving it until April or May guarantees missed deadlines.
We handle statutory audits for foreign-invested companies in Bangladesh. See our audit and assurance services for how we approach this.
What is an internal audit?
An internal audit is a review of your company’s internal controls, processes, and operations. It’s done by your own internal audit team or outsourced to an accounting or consulting firm.
The person conducting an internal audit does not need to be an ICAB Chartered Accountant. You can use a qualified accountant, a CMA (Cost and Management Accountant from ICMAB), or an outsourced firm. There’s no FRC enlistment requirement because internal audit reports go to management — not to RJSC, NBR, or Bangladesh Bank.
Internal audit is not required by the Companies Act 1994 for most companies. The exceptions:
1. Banks — required by Bangladesh Bank guidelines
2. Insurance companies — required by IDRA (Insurance Development & Regulatory Authority)
3. DSE/CSE listed companies — required under stock exchange listing rules
For all other foreign-invested companies — private limited, subsidiary, branch office, liaison office — internal audit is optional.
What does internal audit cover?
Internal audit looks at how your business operates, not just whether the numbers are accurate. A typical internal audit scope for a foreign-invested company includes:
1. Financial controls: segregation of duties, approval limits, payment authorisations
2. Procurement: are purchasing processes followed? Are vendor relationships legitimate?
3. Inventory and assets: are stock records accurate? Are fixed assets accounted for?
4. Payroll: are salaries and deductions correct? Are ghost employees present?
5. IT and data: are financial systems secure? Is data access properly controlled?
6. Compliance: are statutory obligations being met on time?
The output is an internal audit report to management. It identifies weaknesses and recommends fixes. It’s a private document — your board sees it, not the regulators.
Why foreign companies use internal audit in Bangladesh
The most common reason: HQ requires it. Many multinationals run group-level internal audit cycles that include their Bangladesh subsidiary or branch office.
The second reason: distance. Foreign investors operating from outside Bangladesh use internal audit to verify that local management is following group policies, that cash controls are working, and that financial data reported to HQ is accurate.
We most often see this with companies in their 2nd or 3rd year of Bangladesh operations — after the formation process settles and day-to-day operations are running. A single internal audit in year 2 often uncovers payroll irregularities, unapproved vendor relationships, or inventory discrepancies that the statutory audit wouldn’t flag.
Do foreign companies in Bangladesh need both?
Statutory audit: yes, always. Every foreign-invested company registered in Bangladesh needs one every year. Your HQ’s group statutory audit does not replace the Bangladesh statutory audit. They’re separate requirements under separate jurisdictions.
Internal audit: depends on your situation.
You likely need internal audit if:
1. Your HQ requires it as part of group audit cycles
2. Your Bangladesh operation has 15+ employees or BDT 5 crore+ in annual transactions
3. Your board has identified specific control risks in the Bangladesh operation
4. You’re preparing for a group-level audit that consolidates Bangladesh accounts
5. You’ve had staff turnover in key finance or operations roles
You can probably skip internal audit if:
1. You’re a small operation (under 5 employees, minimal transactions)
2. Your statutory auditor is already flagging control issues through the annual audit
3. Group HQ doesn’t require it and your risk exposure is low
The question we get most from foreign investors ‘We already have an internal audit team at HQ that reviews our Bangladesh subsidiary. Do we still need a local statutory audit?’ Yes — always. Your HQ’s internal audit does not satisfy the Companies Act 1994 requirement. Bangladesh’s statutory audit must be done by an ICAB-registered CA enlisted by the FRC, covering the Bangladesh entity’s accounts specifically. There is no substitute.
Common mistakes we see
1. Assuming the statutory audit checks internal controls. It verifies financial statements, not operational processes. A statutory audit may note control weaknesses but won’t conduct a full controls review. That’s internal audit territory.
2. Using an auditor without FRC enlistment. Since 2023, all audit firm partners signing statutory audit reports for limited companies must be enlisted by the FRC. If your current auditor isn’t FRC-enlisted, your audit report may not be accepted by RJSC or NBR.
3. Starting the audit too late. Companies that begin in April or May for a 30 June year-end consistently miss RJSC and tax deadlines. Start in August. Your auditor needs 2-3 months minimum for a clean set of accounts.
4. Restricting auditor access. Statutory auditors need vouchers, ledgers, bank statements, contracts, and board minutes — not just the financial statements. Restricting access leads to qualified opinions and delayed filing.
5. Treating HQ’s group audit as a substitute. Your parent company’s statutory audit in Singapore, India, or the UK does not satisfy the Bangladesh requirement. Both must happen separately.
Frequently asked questions
Is statutory audit mandatory for branch offices in Bangladesh?
Yes. Branch offices registered with RJSC must have annual accounts audited by an ICAB-registered Chartered Accountant enlisted by the FRC. Audited accounts are required for RJSC annual filing and Bangladesh Bank FDI reporting. There is no exemption for branch offices of foreign companies.
Can the same firm do both statutory audit and internal audit for a company in Bangladesh?
Technically possible but not recommended. Statutory auditors must be independent. If the same firm conducts your internal audit, their independence on the statutory audit may be questioned by regulators. Most FRC-enlisted firms decline internal audit engagements to protect their statutory audit independence.
Who can perform an internal audit in Bangladesh?
There’s no legal requirement for the internal auditor to be a Chartered Accountant. Your internal audit can be conducted by your own accounting team, a CMA from ICMAB, or an outsourced accounting firm. The internal audit report goes to management, not to any regulator, so FRC enlistment is not required.
What happens if a company skips its statutory audit in Bangladesh?
The company cannot file its annual return with RJSC without audited financial statements. It also cannot submit the corporate income tax return. Banks may restrict credit facilities. For foreign-invested companies, Bangladesh Bank may flag missing audited accounts during FDI report reviews. The downstream consequences block normal operations.
How long does a statutory audit take in Bangladesh?
For a small foreign-invested company with clean records, 4-8 weeks from when the auditor receives complete documentation. For a mid-size operation with multiple cost centres or complex related-party transactions, 10-14 weeks. Start at least 3 months before your RJSC filing deadline.
Conclusion
Statutory audit in Bangladesh is not optional. Every company registered with RJSC needs one every year, performed by an ICAB-registered Chartered Accountant enlisted by the FRC. No size exemption. No substitution from HQ audits. No skipping.
Internal audit is your call. Most foreign-invested companies with 15+ employees or significant transaction volumes benefit from it — either because HQ requires it or because operating at a distance means you need someone checking controls on the ground.
We handle statutory audits for foreign-invested companies in Bangladesh through our KAC Risk-Control Audit Methodology — reviewing accounts thoroughly, not just signing off on them. We also help design and run internal audit programmes for companies that want local controls oversight.
If you want your Bangladesh audit handled properly, talk to our team. We give you an honest assessment of your current audit status before you commit to anything.
