Financial Audit: Process and Compliance with Standards

A financial audit is not intended to detect fraud or to guarantee the financial health of a company. Its purpose is narrower and more precise: to provide reasonable assurance that the annual accounts are compliant, truthful and give a true and fair view. Understanding this limitation avoids two opposite mistakes — expecting from the audit a guarantee it does not provide, and underestimating the actual scope of the opinion issued.

Statutory audit and contractual audit

Two very different situations share the same name.

The statutory audit is the engagement of the statutory auditor, carried out within a regulated framework: appointment for a term of six financial years, mandatory professional standards, strict incompatibility rules, and reporting obligations. The auditor is not the company's adviser: they are appointed by the shareholders and report to them.

The contractual audit is an engagement freely defined between the company and a professional: a limited review, an acquisition audit, or the examination of a specific area. Its scope, its recipient and its level of assurance are set out in the engagement letter. It carries none of the legal obligations attached to the statutory mandate.

Confusing the two leads to overestimating the scope of a contractual report, whose perimeter can be very limited.

When appointment is mandatory

The appointment of a statutory auditor becomes mandatory when the entity exceeds two of the three thresholds relating to total balance sheet, turnover and headcount. These thresholds are revised periodically and must be checked for the financial year concerned.

Three specific cases add to this principle:

• Parent companies controlling other companies are subject to their own rules, assessed at group level.
• The significant subsidiaries of a group that has a statutory auditor may need to appoint one too.
• A minority of shareholders may apply to the courts for the appointment of an auditor, even below the thresholds.

Voluntary appointment remains possible, and is common when a financial partner requires it. In that case, it carries the same obligations as a mandatory appointment.

How the engagement unfolds

The audit takes place in three stages, spread over the financial year rather than concentrated at year-end.

Understanding the business and assessing risks. The auditor analyses the activity, the environment and internal controls to identify the areas where a material misstatement is likely. This stage determines everything else: subsequent controls are proportionate to the risks identified.

Interim controls. Carried out during the financial year, these cover procedures and day-to-day operations. This is the point at which weaknesses in bookkeeping become apparent — chronology, supporting documents, segregation of duties.

Final controls. After year-end, these focus on the accounts themselves: validation of balances, third-party confirmations, and review of accounting estimates. The latter attract particular attention, as they rest on judgement: impairments of receivables, provisions, useful lives for depreciation.

The opinion and its three forms

The report concludes with an opinion, whose wording is standardised and each variant of which has a precise meaning.

An unqualified opinion states that the accounts are compliant, truthful and give a true and fair view.

A qualified opinion signals a disagreement or a limitation whose effect is material but not pervasive. This is a strong signal, often misread by third parties, who wrongly treat it as a minor remark.

An adverse or disclaimer of opinion arises when the effect is both material and pervasive, or when the auditor has been unable to obtain the necessary evidence.

An emphasis of matter may be added without affecting the opinion: it draws attention to a point in the notes, typically an uncertainty over going concern. It does not constitute a qualification.

The auditor's specific obligations

Two obligations clearly distinguish the statutory mandate from a contractual engagement.

Reporting of criminal offences. An auditor who identifies facts that could be classified as criminal offences must report them to the public prosecutor. This obligation allows no discretion, and failure to comply engages the auditor's liability.

The alert procedure. When the auditor identifies facts likely to jeopardise the going concern status of the business, they trigger a graduated procedure: requesting explanations from management, informing the corporate bodies, and then informing the president of the commercial court. The aim is to prompt a response before the company becomes insolvent — an issue directly linked to the personal liability of company directors, covered in our article on director liability.

Usage scenarios

Crossing the thresholds. The appointment requirement is assessed at year-end and applies for six financial years. Anticipating this a year in advance makes it possible to prepare procedures rather than face a first audit on accounts that are not ready.

Fundraising or sale. An acquisition audit is contractual and its scope is negotiated. Precisely defining what is being audited — and what is not — avoids misunderstandings about the scope of the report delivered.

An anticipated qualification. Address the cause before the following year-end. A qualification repeated from one financial year to the next weighs heavily on relationships with financial partners.

Frequently asked questions

When is a statutory auditor mandatory? When two of the three thresholds relating to the balance sheet, turnover and headcount are crossed, as well as in specific situations linked to groups or at the request of a minority of shareholders.

What is the difference between a statutory audit and a contractual audit? A statutory audit is carried out within a regulated framework, with a six-year mandate and specific obligations. A contractual audit has whatever scope is set out in the engagement letter, without those obligations.

Does the auditor detect fraud? That is not the purpose of the engagement, which focuses on material misstatements in the accounts. However, the auditor does design their procedures with fraud risk in mind.

What does a qualified opinion mean? A disagreement or a limitation with a material but not pervasive effect. This is a serious signal, distinct from a mere emphasis of matter, which does not affect the opinion.

What is the alert procedure? A graduated procedure triggered when going concern appears to be at risk, ranging from requesting explanations from management to informing the president of the commercial court.

Can the auditor advise the company? Not on matters relating to their engagement: independence rules and incompatibility requirements prohibit it. They are not the company's adviser but report to the shareholders.

Key takeaways

An audit provides reasonable assurance as to the compliance and truthfulness of the accounts — not a guarantee against fraud, nor an opinion on the company's financial health. This limited scope is what should be remembered before reading a report.

Three points deserve a director's attention. The exact form of the opinion, since the distinction between an emphasis of matter, a qualification and a disclaimer or adverse opinion is decisive for third parties. The auditor's specific obligations — reporting and alert — which make them something more than a service provider. And the fact that most of their work focuses on accounting estimates: this is where the company's judgements are examined, and where the quality of the documentation makes a difference, just as in a tax audit.