Updated Checked by the Tax-Services.ca editorial team How we check
Internal and external audits differ mainly in who does them and who they’re for. An internal audit is your own check on how the organization runs, done for management and the board. An external audit is an independent accountant’s opinion on the financial statements, done for the people who rely on them: shareholders, lenders and regulators.
Who does the work and who reads the result?
Internal auditors sit on your side of the table. They may be employees or contractors, and you’ll usually see their reports go to management or the board, where they turn into a to-do list of fixes rather than an opinion anyone outside reads.
External auditors are hired from outside, and their opinion is written for readers who can’t see your books. A banker in Halifax reading your audited statements has never met your bookkeeper. The signed opinion is what lets them trust the numbers anyway.
That gap explains most of the other differences. Nobody expects an internal auditor to be a stranger to the business, but an external auditor has to be one.
One practical result: internal findings are usually private and blunt, a list of what to tighten. External findings end up in a signed report that other people read. Plan your tone, and your timing, accordingly. Fix what the internal review finds before the external team arrives, and the year-end conversation gets a lot calmer.
Internal and external audits side by side
| Internal audit | External audit | |
|---|---|---|
| Done by | Staff or contracted team | Independent accountant |
| Question asked | Do our controls and processes work? | Are the financial statements free of material misstatement? |
| Reader | Management, board, audit committee | Shareholders, lenders, regulators |
| Standard | Set by the organization | Canadian Auditing Standards, reasonable assurance |
| Required by law | Not by the CBCA sections we read | Yes, unless every shareholder of a private CBCA corporation agrees to waive it for a year |
The legal row needs a careful reading. Under section 163 of the Canada Business Corporations Act, shareholders of a corporation that isn’t a distributing corporation may resolve not to appoint an auditor. Every shareholder has to consent, including those without a vote, and the resolution lasts only until the next annual meeting. Provincial corporations follow their own acts, which we didn’t review.
How do the audit committee and the auditor fit together?
A distributing corporation, meaning one that sells securities to the public, needs an audit committee under section 171 of the CBCA unless the Director grants an exemption. The committee has at least three directors and most of them can’t be officers or employees of the company or its affiliates. It reviews the financial statements before the board approves them, and the external auditor gets notice of its meetings and can attend.
So the committee is where the two audits meet. The internal auditor usually reports to it, and the external auditor talks to it. If you want the committee on its own, read what an audit committee does.
What does an internal audit look like in practice?
Pick payroll. Say you pay three employees $3,000 each every two weeks in Ontario. The payroll remittance estimate puts the total to send the CRA at $2,883.10 a pay period. Of that, $2,197.86 is held back from the employees and $685.24 is your own CPP and EI share.
An internal auditor would take that number, compare it with what the bank shows you actually remitted, and ask why any gap exists. Then they’d ask who approved the payment, and whether that person could also have edited the payroll file, because that combination is the sort of thing an internal audit exists to catch. That’s a control test. It runs all year, not once at the end.
The external auditor cares about the same payroll in a different way. Is the year’s expense recorded in the right amount? Are unpaid remittances shown as a liability at year end? You can size such numbers with the self-employed tax calculator or the corporate tax calculator, which both give estimates and neither replaces the books.
Does a small business need either one?
Often it needs neither. A small private corporation with a couple of shareholders can usually skip the external audit if all of them sign off, and a business with three staff and one bookkeeper doesn’t need an internal audit department. What it does need is the habit behind it. Once a year, have someone who didn’t write the cheques look at the bank reconciliation and ask where each odd number came from. That’s an internal audit in its simplest form, and it costs an afternoon, not a salary.
Mistakes when choosing between them
People often think one replaces the other. It doesn’t, and you shouldn’t budget as if it did. Strong internal audit work can make an external audit smoother, but the external opinion still has to be independent.
The second is buying an audit when a lender only asked for something lighter. Read the request. A review, for example, gives limited assurance and costs less effort, but we couldn’t confirm fee levels from any official source, so get quotes. For other employer tools, see the business tax hub.
What this page is based on
Section 163 and section 171 of the Canada Business Corporations Act (Government of Canada, linked above, consulted September 2026) supply the legal points. The audit objective of reasonable assurance comes from Canadian Auditing Standard 200 in the CPA Canada Handbook. The payroll figures are output from our own calculator for a 2026 Ontario payroll, and they’re estimates.
Frequently asked questions
What is the main difference between internal and external audits?
An internal audit checks your own controls and processes for management. An external audit gives an independent opinion on the financial statements for outside readers.
Does every Canadian company need an external audit?
No. Under the CBCA, shareholders of a non-distributing corporation can resolve not to appoint an auditor if all of them consent. Provincial acts and lender terms may differ.
Who hires an internal auditor?
The organization does, as an employee or a contractor. The report usually goes to management or the board.
Can an internal audit replace an external one?
No. The external opinion has to come from someone independent of the business.
What level of assurance does an audit give?
Reasonable assurance that the statements are free of material misstatement, under Canadian Auditing Standard 200.
- Dealing with the CRA: letters, audits and payments
Dealing with the CRA: what to do when a letter arrives, how a review differs from an audit, how My Account helps, and what to do if you can't pay