Contractual audit: an audit at the client request

Quick answer. A contractual audit is an audit mission carried out at the request of a client or a third party, outside any legal obligation, within a framework set by an engagement letter. It differs from the statutory audit, which is a permanent legal audit triggered by thresholds. It is one-off and defined by contract.

A bank asks you for an independent opinion on your accounts before granting financing. An investor wants to check a stock item before entering your capital. A partner disputes the figures presented to the meeting. In all these cases, you are under no legal duty to appoint a statutory auditor, yet you need an independent professional view. This is precisely where the contractual audit applies.

The term often causes confusion. Many directors believe an audit is necessarily the statutory auditor's job, and therefore a legal constraint. In reality, the contractual audit follows the opposite logic: you request it, you define its scope, and you are its recipient. This article sets out what it covers, its forms, its professional framework, and the key distinction with the statutory audit.

A contractual audit is a review of accounts or procedures carried out at a party's request, outside any mandatory legal framework. Its scope, objectives and expected level of assurance are set by contract, formalised in an engagement letter signed before any work begins.

The defining feature is the freedom of scope. Whereas the statutory audit covers, by design, the annual accounts as a whole, the contractual audit may cover all the accounts or just one specific point: the reliability of a stock item, the accuracy of a period's revenue, compliance with a contractual clause, the accounting position of a target before acquisition. The requester frames exactly what they want checked.

The requester is not always the director. A bank, an investor, an acquirer, a franchisor, a foreign parent company or a minority partner may originate the request. The professional then acts in a tripartite relationship, which means identifying from the outset who commissions the mission and who will receive the report.

Our view. A contractual audit is not a cut-price statutory audit. It is a trust tool. Its value rests on two things: the independence of the person carrying it out and the precision of the agreed scope. A mission that is vague in its object produces a report that is hard to use. Time spent defining the request before starting is rarely time wasted.

A contractual audit may be conducted by a chartered accountant (expert-comptable) or a statutory auditor (commissaire aux comptes). Both professions are bound by independence, professional secrecy, a formal engagement letter and documentation of their work in a file.

For the chartered accountant, the contractual audit falls within the professional standards of the Order. The engagement letter is mandatory: it describes the object, the extent of the work, the limits and the level of assurance provided. This formalisation protects both client and professional, as it avoids misunderstandings about what was, or was not, checked.

For the statutory auditor, a mission requested outside the legal certification of accounts falls within services other than certifying the accounts, or within work directly linked to the mission when the auditor is already in place. The profession's ethical framework then strictly governs what may be accepted, in order to preserve independence regarding the statutory mission.

At the firm, we are both chartered accountants and statutory auditors. This dual registration lets us calibrate the mission to the real need and the expected level of assurance, without over-sizing. Not every request justifies the same formalism: that is exactly the purpose of the scoping phase.

A contractual audit is not a single mission but a family of missions, distinguished by the level of assurance provided. The higher the assurance, the more extensive the work, and the more demanding the mission. Choosing the right form means answering one question: what degree of guarantee does the recipient really need?

Three forms deserve explanation, as they are often confused.

The audit delivers reasonable assurance and leads to an opinion on the accounts. It is the most demanding level: the auditor performs extensive controls to conclude that the accounts are, or are not, true and fair. An institutional investor or a cautious acquirer often asks for this level.

The limited review provides moderate assurance. The conclusion is expressed in negative form: based on the work performed, the professional has not identified anything leading them to consider that the accounts are not properly prepared. The work is lighter than for an audit, so the cost is lower too.

Agreed-upon procedures, governed by the international standard ISRS 4400, are different in nature. The professional performs work defined precisely in advance with the client, then reports purely factual findings, without expressing an opinion or any assurance. For example: recalculating revenue, checking that a sample of invoices exists and is correctly recorded, verifying compliance with a ratio. The report describes what was done and what was found, nothing more. It is for the reader to draw conclusions.

The underestimated risk. Many requesters ask for an audit while thinking of agreed-upon procedures, or the reverse. Confusing the two has concrete consequences: an agreed-upon procedures report gives no assurance and is not an opinion. If a bank expects an opinion but receives factual findings, it may reject the document. The initial scoping must clear up this ambiguity in writing.

The most common confusion sets the contractual audit against the statutory audit. Both are audits and share an independence requirement, but their logic is opposite.

The statutory audit is a legal, permanent mission imposed by thresholds. The statutory auditor is appointed by the meeting of partners for a six-year mandate, certifies the annual accounts and issues a report on those accounts. The mission is continuous over the mandate and independence is strictly governed by law.

The contractual audit is, by contrast, a one-off, chosen mission, defined by contract. There is no statutory appointment, no multi-year mandate, no triggering threshold. You request it when you need it, on the scope you decide.

What they share is not incidental: independence, professional secrecy, an engagement letter and rigorous documentation. These safeguards give the report its credibility, whatever the framework.

Trade-off. If you cross the legal thresholds for appointing a statutory auditor, the contractual audit does not replace that duty: you must appoint a statutory auditor. Conversely, if you are below the thresholds and a third party demands a guarantee on your accounts, the contractual audit is the right tool, scalable to the expected level of assurance. The question is never one or the other by preference, but what the law requires and what your counterparty expects.

A contractual audit follows a stable logic, whatever its scope. These are the steps we apply.

1. Scope the request. Identify the requester, the report's recipient, the exact object (full accounts or a specific point) and the expected level of assurance. This step conditions everything else.
2. Choose the form of mission. Audit, limited review, agreed-upon procedures or due diligence, based on the real need rather than the requester's reflex.
3. Formalise the engagement letter. Describe the extent of the work, the limits, the deliverables, the timetable and the fees. Sign it before any work.
4. Gather and analyse the documentation. Accounts, ledger, FEC file, supporting documents, contracts, depending on scope. Perform the planned controls and document each step.
5. Report. Issue the report in the agreed form: opinion, negative conclusion, factual findings or attestation. Discuss the points raised with the requester.

The deliverable is not a mere oral view. It is written, dated, structured, and it expressly states the level of assurance provided. This precision protects everyone: it prevents an agreed-upon procedures report from being read as an audit opinion.

A common case: the audit requested by an investor#

An investor wishes to enter the capital of an SME and conditions the contribution on checking two points: the reality of the last twelve months' revenue and the valuation of stock. They do not ask for an opinion on the whole accounts, only assurance on these two items.

The right answer is not a full audit, longer and costlier than needed. It is a targeted agreed-upon procedures mission: recalculating revenue from invoices and receipts, checking a sample of documents, verifying the physical inventory and stock valuation. The report sets out factual findings, leaving the investor to draw negotiating conclusions. The scope, set by contract, is exactly the one that meets the need, no more.

There is no fixed price for a contractual audit. The cost depends on scope, the level of assurance requested, the volume of accounts and the quality of available documentation. An agreed-upon procedures mission on a specific point bears no comparison, in workload, with a full audit leading to an opinion.

The estimate is therefore made by quote, after scoping the request. This is also why the scoping phase is decisive: a clear object allows a fair price, whereas a vague request leads either to over-sizing out of caution, or to discovering unplanned work along the way.

Points to watch. Three pitfalls recur. First, an engagement letter that is imprecise on the level of assurance, a source of later dispute. Second, a poorly identified recipient, when the report may be relied on by a third party. Third, confusing a contractual audit with a legal obligation: if you cross the thresholds, no contractual mission exempts you from appointing a statutory auditor.