Financial Audit: Process and Compliance with Standards

A financial audit is not designed to detect fraud or to guarantee a company's financial health. Its purpose is narrower and more precise: to provide reasonable assurance that the annual accounts are regular, accurate, and give a true and fair view. Understanding this limit avoids two symmetrical mistakes — expecting from the audit a guarantee it does not provide, and underestimating the real scope of the opinion issued.

Statutory audit and contractual audit

Two very different situations share the same name.

The statutory audit is the engagement of the statutory auditor, carried out within a regulated framework: appointment for a term of six financial years, mandatory professional standards, strict incompatibility rules, disclosure obligations. The auditor is not the company's advisor: they are appointed by the shareholders and report to them.

The contractual audit is an engagement freely defined between the company and a professional: limited review, acquisition audit, examination of a specific item. Its scope, recipient, and level of assurance result from the engagement letter. It does not carry any of the legal obligations attached to the statutory mandate.

Confusing the two leads to overestimating the scope of a contractual report, whose perimeter may be very limited.

When appointment is mandatory

The appointment of a statutory auditor becomes mandatory when the entity exceeds two of the three thresholds relating to total balance sheet, revenue, and headcount. These thresholds are periodically revised and must be checked for the relevant financial year.

Three special cases add to this principle:

• Parent companies controlling other companies are subject to their own rules, assessed at the level of the group as a whole.
• Significant subsidiaries of a group that has a statutory auditor may need to appoint one themselves.
• A minority of shareholders may petition the court for the appointment of an auditor, even below the thresholds.

Voluntary appointment remains possible, and it is common when a financial partner requires it. It then carries the same obligations as a mandatory appointment.

How the engagement proceeds

The audit takes place in three stages, spread over the financial year rather than concentrated at year-end.

Understanding the business and risk assessment. The auditor analyzes the activity, environment, and internal control to identify areas where a material misstatement is likely. This step determines everything that follows: subsequent testing is proportionate to the risks identified.

Interim testing. Carried out during the financial year, it covers procedures and routine transactions. This is when weaknesses in bookkeeping become apparent — chronology, supporting documents, segregation of duties.

Final testing. After year-end, it covers the accounts themselves: balance validation, third-party confirmations, review of accounting estimates. The latter attract particular attention, since they rely on judgment: receivable write-downs, provisions, depreciation.

The opinion and its three forms

The report concludes with an opinion, whose wording is standardized and each variant has a precise meaning.

An unqualified opinion states that the accounts are regular, accurate, and give a true and fair view.

A qualified opinion signals a disagreement or a limitation whose effect is material but not pervasive. This is a strong signal, often misread by third parties, who wrongly equate it with a simple remark.

A disclaimer of opinion occurs when the effect is both material and pervasive, or when the auditor was unable to gather the necessary evidence.

An emphasis of matter may be added without affecting the opinion: it draws attention to a point in the notes, typically an uncertainty about going concern. It does not constitute a qualification.

The statutory auditor's specific obligations

Two obligations clearly distinguish the statutory mandate from a contractual engagement.

Disclosure of criminal offenses. An auditor who identifies facts that may constitute a criminal offense must disclose them to the public prosecutor. This obligation leaves no room for discretionary judgment, and failing to comply engages the auditor's liability.

The alert procedure. When the auditor identifies facts likely to jeopardize the going concern, they trigger a graduated procedure: requesting explanations from management, informing the corporate bodies, then informing the president of the court. The goal is to prompt a reaction before the company becomes insolvent — an issue directly connected to the director's personal liability, as covered in our article on director liability.

Usage scenarios

Crossing the thresholds. The appointment requirement is assessed at year-end and applies for six financial years. Anticipating one year in advance makes it possible to prepare procedures rather than undergo a first audit on unprepared accounting.

Fundraising or sale. The acquisition audit is contractual and its scope is negotiable. Precisely defining what is audited — and what is not — avoids misunderstandings about the scope of the report delivered.

An anticipated qualification. Address the cause before the next year-end. A qualification carried over from one financial year to the next weighs heavily on the relationship with financial partners.

Frequently asked questions

When is a statutory auditor mandatory? Upon crossing two of the three thresholds relating to the balance sheet, revenue, and headcount, as well as in specific situations linked to groups or at the request of a minority of shareholders.

What is the difference between a statutory audit and a contractual audit? The statutory audit is carried out within a regulated framework, with a six-year term and specific obligations. The contractual audit has whatever scope the engagement letter gives it, without these obligations.

Does the auditor detect fraud? That is not the purpose of the engagement, which focuses on material misstatements in the accounts. However, the auditor designs their procedures taking fraud risk into account.

What does a qualified opinion mean? A disagreement or a limitation with a material but not pervasive effect. This is a serious signal, distinct from a simple emphasis of matter, which does not affect the opinion.

What is the alert procedure? A graduated procedure triggered when the going concern appears jeopardized, ranging from requesting explanations from management to informing the president of the court.

Can the auditor advise the company? Not on matters falling within their engagement: independence rules and incompatibility rules prohibit it. They are not the company's advisor but report to the shareholders.

Key takeaways

The audit provides reasonable assurance about the regularity and accuracy of the accounts — not a guarantee of no fraud, nor an opinion on the company's financial health. This limited scope is what should be remembered before reading a report.

Three points deserve a director's attention. The exact form of the opinion, since the nuance between an emphasis of matter, a qualification, and a disclaimer is decisive for third parties. The auditor's specific obligations, disclosure and alert, which make them something more than a service provider. And the fact that most of their work focuses on accounting estimates: this is where the company's judgments are examined, and where the quality of documentation makes its effect felt, as in a tax audit.