Financial Audit: Process and Compliance with Standards

The purpose of a financial audit is not to detect fraud or to guarantee a company’s financial health. Its aim is narrower and more specific: to provide an reasonable assurance that the annual accounts are in order, true and fair, and give a true and fair view. Understanding this limitation helps to avoid two symmetrical errors — expecting the audit to provide assurance that it does not, and overlooking the actual scope of the opinion issued.

Legal audit and contractual audit

Two very different situations share the same name.

The statutory audit This is the role of the statutory auditor, carried out within a regulated framework: appointment for a term of six financial years, mandatory professional standards, strict restrictions on conflicts of interest, and disclosure obligations. The statutory auditor is not the company’s adviser: they are appointed by the shareholders and report to them.

Contract audit is an engagement freely agreed between the company and a professional: a limited review, an acquisition audit, or an examination of a specific post. Its scope, intended recipient and level of assurance are set out in the engagement letter. It does not entail any of the legal obligations associated with a mandate.

Confusing the two leads to an overestimation of the scope of a contractual relationship, the scope of which may be very limited.

When registration is mandatory

The appointment of an auditor is required when the entity exceeds two of the three thresholds relating to total balance sheet assets, turnover and the number of employees. These thresholds are reviewed periodically and must be verified for the financial year in question.

There are three specific cases in addition to this principle:

• Companies group heads Companies controlling other companies are subject to specific rules, which are assessed at the group level.
• The significant subsidiaries A group that already has an auditor may be required to appoint one.
• A minority shareholders may apply to the courts for the appointment of an administrator, even where the thresholds are not met.

Voluntary designation remains possible, and is common where a financial partner requires it. It then entails the same obligations as a mandatory designation.

The course of the assignment

The audit takes place in three stages, spread throughout the financial year rather than concentrated at the end of the financial year.

Risk awareness and assessment. The auditor analyses the business, the environment and internal controls to identify areas where a material misstatement is likely. This step determines everything else: subsequent controls are proportionate to the risks identified.

Interim audits. Carried out during the financial year, they focus on procedures and day-to-day operations. This is when the weaknesses of the accounting are covered — chronology, supporting documents, segregation of duties.

Final checks. Following the year-end, the focus shifts to the financial statements themselves: validation of balances, circulation of statements to third parties, and review of accounting estimates. The latter are the main focus, as they are based on judgements: impairment of receivables, provisions, retention periods ofdepreciation.

Opinion and its three forms

The report concludes with an opinion, the wording of which is standardised and where each variant has a specific meaning.

Unqualified certification states that the accounts are in order, true and fair, and give a true and fair view.

Certification with reservations indicates a disagreement or a limitation whose effect is significant but not widespread. It is a strong signal, often misinterpreted by third parties, who mistakenly regard it as a mere comment.

Refusal to certify applies where the impact is both significant and widespread, or where the auditor has been unable to gather the necessary evidence.

A Observation may be added without affecting the opinion: it draws attention to a point in the notes to the accounts, typically an uncertainty regarding going concern. It does not constitute a qualification.

The specific obligations of the data protection officer

Two obligations clearly distinguish a legal mandate from a contractual assignment.

The disclosure of criminal offences. A commissioner who identifies facts that may constitute a criminal offence must report them to the public prosecutor. This obligation is not subject to any discretion as to its appropriateness, and failure to comply renders the commissioner liable.

The alert procedure. When it identifies circumstances likely to jeopardise business continuity, it triggers a step-by-step procedure: requesting explanations from senior management, informing the company’s governing bodies, and then notifying the president of the court. The aim is to prompt a response before insolvency occurs — an issue that is directly linked to the personal liability of the director, as discussed in our article on the directors’ liability.

Use cases

Exceeding thresholds. The appointment is assessed at the end of the financial year and is valid for six financial years. Planning one financial year in advance allows you to prepare the necessary procedures rather than facing an initial audit of accounts that are not yet ready.

Fundraising or sale. An acquisition audit is a contractual matter and its scope is subject to negotiation. Defining precisely what is being audited — and what is not — helps to avoid misunderstandings regarding the scope of the report provided.

Disclaimer. Address the issue before the next financial year-end. A reserve carried forward from one financial year to the next weighs heavily on relations with financial partners.

Frequently Asked Questions

When is an auditor required? Upon exceeding two of the three thresholds relating to the balance sheet, turnover and workforce, as well as in specific situations involving groups or at the request of a minority of partners.

What is the difference between a statutory audit and a contractual audit? Statutory audits are carried out within a regulated framework, with a six-year mandate and specific obligations. Contractual audits have the scope set out in the engagement letter, without these obligations.

Does the auditor detect fraud? This is not the primary focus of their remit, which centres on material misstatements in the accounts. However, they design their audits taking into account the risk of fraud.

What does ‘certification with reservations’ mean? A significant but not widespread disagreement or limitation of effect. This is a serious indication, distinct from a mere observation, which does not affect the opinion.

What is the alert procedure? A step-by-step procedure triggered when business continuity appears to be at risk, ranging from requesting explanations from senior management to notifying the president of the court.

Can the Commissioner advise the company? Not on matters falling within the scope of his remit: the rules on independence and conflicts of interest prohibit him from doing so. He is not the company’s legal adviser but reports to the partners.

Key points

An audit provides reasonable assurance as to the regularity and fairness of the accounts — it is not a guarantee of the absence of fraud, nor an opinion on the company’s financial health. This limited scope is the key point to bear in mind before reading a report.

Three elements deserve a manager’s attention. The precise wording of the opinion, as the distinction between an observation, a reservation and a refusal is crucial for third parties. The specific obligations of the auditor – disclosure and reporting – which distinguish them from a mere service provider. And the fact that the bulk of their work focuses on the accounting estimates: this is where the company’s decisions are scrutinised, and where the quality of the documentation comes into its own, just as in a tax audit.