Company Audit in France 2026: Types, Thresholds, Process and Costs

Updated 15 May 2026 — Reviewed by Samuel Hayot, Chartered Accountant registered with the Ordre des Experts-Comptables (Paris).

Company audits are often described as a compliance burden or an administrative obligation. That framing is misleading. A well-calibrated audit is a decision-making tool, a credibility signal, and a risk management instrument. The key is understanding which type of audit is relevant to your situation, what legal obligations apply, and what you can realistically expect from the engagement.

This guide covers the four main families of audit in France, the 2026 legal thresholds, the applicable professional standards, auditor selection criteria, realistic cost ranges, and the concrete deliverables you receive.

A company audit is an independent, methodical examination of a company's accounts, processes, or compliance, conducted according to recognised professional standards, with the purpose of forming an opinion or producing recommendations based on audit evidence.

Three elements distinguish an audit from an internal review: the independence of the auditor from the audited entity, a standardised methodology (evidence collection, sampling, interviews, analytical procedures), and the formalisation of conclusions in a written report addressed to defined recipients.

What Does the Statutory Audit Cover?#

The statutory audit (commissariat aux comptes) is a legal certification mission governed by Articles L823-1 and following of the French Commercial Code. The commissaire aux comptes (CAC) is a professional registered with the H2A (Haute Autorite de l'Audit, formerly the CNCC), subject to strict independence and ethical rules.

The primary purpose is to certify that the annual financial statements give a true and fair view of the company's financial position. The CAC issues an opinion with reasonable assurance — the highest level of assurance available — based on work conducted under the Normes d'Exercice Professionnel (NEP).

Beyond the accounts certification, the CAC has mandatory ancillary responsibilities:

• Special report on regulated related-party transactions (CCom L227-10 for SAS entities, L823-12 for all companies)
• Verification of fraud risks and anti-money-laundering vigilance
• Alert procedure (CCom L234-1) if facts threaten the company's ability to continue as a going concern

Mandatory CAC Thresholds in France (2026, post-PACTE Law)#

Since the PACTE Law of 22 May 2019, the thresholds for mandatory appointment of a CAC were raised significantly. A commercial company (SARL, SAS, SA, SNC, etc.) must appoint a commissaire aux comptes when it exceeds at least two of the following three criteria over two consecutive financial years:

• Balance sheet total above EUR 5 million
• Revenue (excluding VAT) above EUR 10 million
• Average headcount above 50 employees

These thresholds apply to the company on a standalone basis. Additional rules apply:

• Corporate groups: the parent company is subject to statutory audit when the consolidated group exceeds the thresholds. Individual subsidiaries may also be required to appoint a CAC depending on their individual size.
• SCI (civil real estate companies): different thresholds apply depending on the legal form and the nature of shareholders (to be verified case by case).
• Associations: associations receiving more than EUR 2 million in annual public subsidies are subject to the obligation (to be verified against applicable specific legislation).
• SAS: shareholders representing one-third of the share capital may request appointment of a CAC even below the legal thresholds.

NEP Professional Standards#

The CAC's work is governed by the NEP standards, approved by the French Ministry of Justice. The key ones are:

• NEP 100-200: general approach, ethics, documentation
• NEP 300: engagement planning, risk assessment
• NEP 500: collection of audit evidence (tests, confirmations, analytical procedures)
• NEP 700: forming the opinion and drafting the report

These standards guarantee methodological rigour and allow users of certified accounts to rely on a recognised framework.

A contractual audit is a voluntary engagement commissioned by management, shareholders, or a third party, and carried out by a chartered accountant (expert-comptable) registered with the OEC, or by a CAC outside their statutory mandate.

Three levels of engagement exist, from lightest to most thorough:

1. Compilation engagement (mission de présentation): verification of the coherence and plausibility of the accounts, without a systematic search for errors. Moderate assurance level. Suitable for small businesses where the cost of a full audit is not justified.

2. Limited review (examen limite): analytical procedures and targeted interviews. Limited assurance level (below statutory audit). Suitable for SMEs wishing to provide an additional level of comfort to banking or financial partners without the cost of a full audit.

3. Contractual audit: full audit approach based on audit standards, with extensive evidence collection. Reasonable assurance level, comparable to statutory audit. Suitable for business sales, significant fundraising rounds, or dispute situations requiring an independent opinion.

Typical situations: preparation for a sale (the acquirer commissions due diligence), capital increase with an incoming investor, group restructuring, SCI with significant assets, or a business owner seeking an external view of the reliability of accounts before a strategic decision.

Internal audit is a permanent function organised within the company that evaluates the effectiveness of internal controls, risk management systems, and governance. It follows the international standards of the IIA (Institute of Internal Auditors), represented in France by the IFACI.

Do not confuse it with management control (controle de gestion), which steers financial performance through budgets, variance analysis, and forecasting. Internal audit answers: "do our processes genuinely protect us from major risks?" Its findings feed the audit committee or senior management.

In SMEs and mid-market companies, this function is often outsourced or managed by the CFO. In listed groups or large associations, it is a dedicated function with a chief internal auditor reporting to the audit committee.

Acquisition Audit (Due Diligence)#

Carried out during a sale or acquisition, the acquisition audit (financial due diligence) aims to verify account quality, identify hidden liabilities, assess asset quality, and secure the warranty of assets and liabilities (garantie d'actif et de passif). It is conducted by the acquirer's financial firm or accountant, independently of the seller.

See our dedicated article on acquisition audit and financial due diligence for the detailed methodology and red flags.

ESG Audit#

With the phased implementation of the CSRD, companies in scope must have their sustainability report certified by an independent third-party body (OTI) or a CAC. The DPEF has been subject to third-party verification for large companies since 2018.

For SMEs anticipating these obligations or seeking positioning with large corporate clients, ESG audit and certification preparation is an increasingly strategic step.

Compliance Audit#

Compliance audit covers GDPR obligations, Sapin II (anti-corruption), and tax compliance matters (examen de conformite fiscale). See our article on compliance audit: GDPR, Sapin II, tax.

The choice of auditor directly conditions the value of the engagement.

For a CAC:

• Verify H2A registration on the public register
• Independence: no financial, family, or organisational ties with the audited entity
• Mandate duration: 6 consecutive financial years, renewable. Rotation is recommended (not always mandatory depending on company size)
• Sector specialisation: a CAC familiar with your sector (construction, SaaS, real estate, liberal professions) is more efficient than a generalist

For a chartered accountant (contractual engagement):

• Verify OEC registration on the official directory
• References on comparable engagements (size, sector, type of operation)
• Clarity of the engagement letter on scope, deliverables, and assurance level

Size fit: the size of the audit firm should be consistent with the size of the company. A Big Four or tier-two international firm on a EUR 5 million revenue SME is oversized and expensive. A solo practitioner on a EUR 200 million group is undersized and exposes the engagement to competence risk.

The ranges below are indicative. Actual cost depends on the complexity of operations, number of entities, quality of accounting organisation, and sector.

These ranges are indicative for 2026. They do not constitute a quote and do not apply to non-standard situations (cross-border groups, disputes, urgent timelines).

At the end of a statutory audit engagement, the CAC delivers:

• General report on the accounts: certification opinion (unqualified, qualified, or adverse/disclaimer), description of work performed
• Special report on regulated related-party transactions: list and assessment of transactions between the company and its directors or significant shareholders
• Management letter (note de synthese): improvement points on accounting processes and internal controls identified during the engagement
• Management representation letter: document signed by management confirming they have provided all necessary information and are not aware of undisclosed fraud

For contractual audits, deliverables are defined in the engagement letter and may take the form of an audit report, a compilation report, a summary note, or a factual memorandum.

The alert procedure is one of the statutory auditor's most important tools — and one of the least well understood by business owners. It is triggered when the CAC identifies facts likely to compromise the going concern of the company: accumulated losses, structural cash flow pressure, deteriorating working capital requirements, loss of major clients, significant litigation.

The procedure unfolds in three steps:

1. The CAC informs the managing director in writing. The director must respond within 15 days with the measures planned.
2. If the response is insufficient or absent, the CAC requests an extraordinary general meeting to deliberate on the situation.
3. If no satisfactory resolution emerges, the CAC may inform the president of the commercial court, who may open preventive insolvency proceedings (mandat ad hoc, conciliation) before the situation becomes irreversible.

Our read: the alert procedure is often perceived as a threat. In practice, it is a safety net. Companies that enter collective insolvency proceedings without their CAC having triggered an alert are typically those where the relationship with the auditor lacked transparency. A CAC who alerts early is an ally, not an adversary.

Case 1 — Industrial SME, Paris 18th arrondissement, EUR 8M revenue, 60 employees#

This company exceeds two of the three criteria (60 employees above the 50-employee threshold, and a balance sheet likely above EUR 5M for an industrial company of this size). Appointing a CAC is mandatory. The business owner must verify that a mandate is in place, or initiate the appointment procedure without delay. Failure to appoint a CAC exposes the company to legal sanctions and undermines the legal validity of shareholders' resolutions.

Case 2 — Digital SAS, EUR 4M revenue, 35 employees, preparing a fundraising round#

Below the legal thresholds. No CAC is required. However, any serious investment fund (seed to Series A) will request reviewed or certified accounts before committing. Voluntarily appointing a CAC — or commissioning a limited review by a chartered accountant — accelerates the investor due diligence process and signals mature governance. The cost (EUR 5,000 to 10,000) is negligible relative to a EUR 1-3M fundraise.

Case 3 — Patrimonial SCI, EUR 50M in real estate assets, 3 shareholders#

Generally no mandatory thresholds for an SCI of this nature. But the patrimonial complexity, asset valuations, related-party arrangements, and wealth transfer considerations justify a regular contractual audit (annual limited review or full audit every three years). This type of engagement secures distribution decisions, valuations in the event of a new shareholder's entry, or estate planning transactions.

In the files we handle, the most frequent blocking point is an undetected CAC threshold crossing. A fast-growing company can go from EUR 8M to EUR 12M in revenue over two financial years without anyone having formalised the appointment obligation. The result: a shareholders' meeting approving the accounts without a CAC in place when one was required — which legally weakens the resolution.

The solution is straightforward: include a threshold verification in the annual year-end review with your chartered accountant. If thresholds are being approached, anticipate the appointment rather than react once the obligation is already overdue.

Hayot Expertise, a chartered accounting firm in Paris, provides contractual audit engagements and advisory support for the appointment of, or relationship with, a statutory auditor.

Our services include: limited reviews and contractual audits for SMEs and SCIs, preparation for a CAC engagement (accounting organisation, process documentation, permanent file preparation), and guidance on selecting a commissaire aux comptes suited to your sector and size.

We do not ourselves perform statutory audit mandates (professional incompatibility with the accounting engagement), but we work with a network of sector-specialist CACs.

See our expertise comptable Paris and strategic advisory pages for the scope and structure of our engagements.

This article is provided for information purposes only. It does not replace a personalised analysis of your situation by a chartered accountant or statutory auditor, who alone can take into account the specific circumstances of your company, your sector, and the regulatory framework in force at the time of your decision.

Sources: Legifrance CCom L823, L227-10, L234-1 — PACTE Law No. 2019-486 — H2A NEP standards — Ordre des Experts-Comptables — IFACI — entreprendre.service-public.fr.