Internal Audit vs Certified Public Accountant (CPA): What Is the Difference, and Which Businesses Are Legally Required to Have One?

Internal Audit vs Certified Public Accountant (CPA): What Is the Difference, and Which Businesses Are Legally Required to Have One?

Internal audit is the process of reviewing an organization's internal control systems, carried out by in-house staff or an outsourced firm. A CPA (Certified Public Accountant) is a licensed auditor issued by the Federation of Accounting Professions (TFAC) whose role is to examine and certify financial statements. Every limited company is required by law to have a CPA under Section 1197 of the Civil and Commercial Code, while internal audit is only mandatory for companies listed on the Stock Exchange of Thailand.

Many business owners are confused about whether "internal audit" and "CPA" are the same thing — and whether their company needs both or just one. This misunderstanding can lead to fines of up to 50,000 THB without the owner realizing it.

This article explains the differences clearly and specifies which types of businesses must have what under Thai law.

What Is Internal Audit, and Who Is Legally Required to Have It?

Internal audit is the process of evaluating an organization's internal control systems, risk management, and governance. It is carried out by internal staff or an outsourced firm.

Internal audit does not mean "certifying financial statements." It is about checking whether the organization's operational systems comply with policy and are functioning efficiently.

For ordinary limited companies, Thai law does not require an internal audit function. Establishing an internal audit department or hiring an internal audit firm is entirely a management decision.

Businesses legally required to have an internal audit are companies listed on the Stock Exchange of Thailand (SET), because the Securities and Exchange Commission (SEC) requires them to have an independent Audit Committee and internal audit system.

What Is a Certified Public Accountant (CPA)?

A Certified Public Accountant (CPA) is a professional licensed by the Federation of Accounting Professions (TFAC) under the Accounting Professions Act B.E. 2547 (2004). A CPA's role is to audit the accuracy of financial statements and "certify" that those statements reflect the company's true financial position. A CPA acts as an independent external auditor, completely independent from the company being audited.

To obtain a CPA license, candidates must meet two key requirements: pass all examinations set by TFAC, and have at least three years of auditing experience.

A CPA has the authority to audit and certify the accounts of companies and registered partnerships of any size and type, with no restrictions on revenue or assets. A list of licensed CPAs can be found on the TFAC website at tfac.or.th.

What Is a Tax Auditor (TA) and How Does It Differ from a CPA?

A Tax Auditor (TA) is another type of auditor that many people confuse with a CPA. A TA is licensed by the Director-General of the Revenue Department and has authority only to audit small registered partnerships — a TA has no authority to audit limited companies.

A registered partnership eligible to use a TA must meet all three of the following size thresholds simultaneously:

• Registered capital at fiscal year-end not exceeding 5,000,000 THB
• Total assets not exceeding 30,000,000 THB
• Total revenue not exceeding 30,000,000 THB

If the partnership exceeds any single threshold, it must switch to a CPA immediately.

Comparing All Three: How Do Internal Audit, CPA, and TA Differ in Practice?

The three types of auditors in Thailand — Internal Audit, CPA, and TA — have entirely different scopes of authority and the business types they serve. Confusion among the three is common among SMEs because all three relate to "accounting and auditing," yet they have different legal standing.

Which Businesses Are Legally Required to Have a CPA?

Every limited company in Thailand, regardless of revenue size, must have a Certified Public Accountant (CPA) audit its financial statements annually under Section 1197 of the Civil and Commercial Code. Section 11(4) of the Accounting Act B.E. 2543 (2000) requires juristic persons with accounting obligations to have their financial statements certified by a licensed auditor every fiscal year.

This requirement applies even to companies that have not yet commenced operations or have no revenue at all. Even "blank" financial statements must be certified by a CPA.

Legal entities required to use a CPA include:

• Limited companies (บจ.) of any size and type
• Public limited companies with additional SEC requirements
• Foreign company branches operating in Thailand
• Medium-to-large registered partnerships that exceed the TA size thresholds

What Options Do Small Partnerships Have?

Registered partnerships that meet all three size thresholds may use a TA instead of a CPA. Engaging a TA typically costs less than a CPA and is suitable for small partnerships with uncomplicated accounting transactions.

For more details on which types of businesses are required to prepare and have their financial statements audited, see the article Why Financial Statements Must Be Audited by a Certified Public Accountant.

Case Study: When a Partnership Grows — At What Point Must It Switch to a CPA?

A registered partnership that has been using a TA must switch to a CPA as soon as its financial figures in any given fiscal year exceed even one of the size thresholds. Prae's situation is a common example among fast-growing online businesses in recent years.

Prae owns a registered partnership selling goods online via Shopee, TikTok Shop, and Lazada. Her two-year financial data is as follows:

In 2024, Prae's total revenue increased to 38,000,000 THB, exceeding the 30,000,000 THB threshold. Even though registered capital and total assets remain within the limits, exceeding just one condition is enough to make the partnership ineligible to use a TA. Prae must therefore engage a CPA to audit the 2024 fiscal year financial statements.

Deadlines and Penalties: What Happens If Financial Statements Are Not Audited by a CPA on Time?

The law prescribes a two-step timeline for auditing and filing financial statements, each with its own penalties. For companies with a December 31 fiscal year-end, the total combined deadline falls around late May each year.

Step 1: Present the CPA-audited financial statements to the annual general meeting for approval within 4 months of the fiscal year-end, under Section 1197 of the Civil and Commercial Code.

Step 2: Company directors must submit a copy of the balance sheet to the Registrar at the Department of Business Development (DBD) within 1 month of the approval date, under Section 1199 of the Civil and Commercial Code.

⚠️ Penalties for non-compliance:

In addition to fines, failure to file financial statements may also result in being blocked from conducting registration transactions with the DBD and may adversely affect creditworthiness for bank lending.

Not sure whether your company has met all deadlines? You can consult the Orbit Advisory team for free via LINE — no obligation.

What Is TFRS for NPAEs, and Do Businesses Using This Standard Still Need to Hire a CPA?

TFRS for NPAEs stands for Thai Financial Reporting Standards for Non-Publicly Accountable Entities — accounting standards for entities that are not publicly accountable. An NPAE entity is a company or partnership that is not listed on the stock exchange, is not a bank, and is not an insurance company. In short, approximately 90% of Thai SMEs fall into this category. The standard was updated and became effective in 2025, covering 28 chapters adapted to current Thai business conditions.

TFRS for NPAEs is an accounting "methodology" standard designed to be simpler than the full TFRS used by listed companies. However, TFRS for NPAEs does not in any way exempt the requirement to have a CPA audit the financial statements.

💡 A simple way to understand it: TFRS for NPAEs governs "how to record accounts," while a CPA governs "who audits those accounts." The two are completely independent of each other. A limited company using TFRS for NPAEs must still engage a CPA to audit and certify its financial statements every year as required by law.

For a better understanding of how cash flow statements and NPAEs standards relate to SMEs, see the article What Is Cash Flow?.

Summary: Which Type of Auditor Does an SME Need — Internal Audit or CPA?

The table below will help you decide immediately which type of auditor you need.

CPA fees for SMEs start at approximately 8,000 THB per year, depending on the size and complexity of accounting transactions.

Orbit Advisory has a team of CPAs specializing in auditing limited companies and registered partnerships of all sizes — from SMEs to companies with revenues in the tens of millions of baht. To learn about fees and the process, see Audit Services or request a free quote.

For businesses considering company registration to systematize accounting and tax management, see the Guide to Company Registration in Thailand.

Frequently Asked Questions (FAQ)

Q1: What meeting must a limited company use to appoint a CPA, and how often must the appointment be renewed? A: A limited company must appoint a CPA at the annual general meeting of shareholders under Section 1209 of the Civil and Commercial Code, and the appointment must be renewed each year. The meeting sets the CPA's remuneration and may reappoint the same CPA if shareholders agree. If a normal appointment cannot be made and at least 5 shareholders petition the court, the court may appoint a CPA under Section 1212 of the Civil and Commercial Code.

Q2: What is the practical difference between Internal Audit and External Audit (CPA)? A: Internal Audit evaluates internal control systems and operational efficiency, carried out by an in-house team or an outsourced firm — it has no legal authority to certify financial statements. External Audit (CPA) involves a TFAC-licensed auditor examining and certifying the accuracy of financial statements, which is a legal requirement for all limited companies under the Accounting Professions Act B.E. 2547.

Q3: Can a small registered partnership use a Tax Auditor (TA) instead of a CPA, and what are the eligibility thresholds? A: Yes, but the partnership must meet all three size thresholds simultaneously: registered capital at fiscal year-end not exceeding 5,000,000 THB, total assets not exceeding 30,000,000 THB, and total revenue not exceeding 30,000,000 THB. If any single threshold is exceeded, the partnership must switch to a CPA immediately, as a TA has no authority to audit partnerships that exceed the thresholds.

Q4: How many steps are there in the annual financial statement filing process for a limited company, and what are the deadlines? A: There are two steps. First, the CPA-audited financial statements must be presented at the annual general meeting for approval within 4 months of the fiscal year-end under Section 1197 of the Civil and Commercial Code. Second, the statements must be submitted to the DBD within 1 month after approval under Section 1199. For companies with a December 31 year-end, the combined deadline falls around late May each year.

Q5: If a limited company has its financial statements certified by a TA instead of a CPA, are those statements legally valid? A: No. Financial statements of a limited company certified by a TA are not legally valid, because a TA is only authorized to audit small registered partnerships that meet the eligibility thresholds. Such statements cannot be filed with the Department of Business Development, and the company may be fined up to 50,000 THB under Section 1199 of the Civil and Commercial Code.