What is an audit? Definition, types and what it means for your business in France

Last updated 2026-05-26 — Reviewed by Samuel Hayot, registered expert-comptable

If you run a business in France, the word "audit" comes up more often than you might expect: when raising funds, when a bank asks for certified accounts, when you are buying or selling a company, or simply when your accountant mentions that you may now be legally required to appoint an auditor. The term covers several distinct realities, and confusing them leads to real operational problems — either bearing a cost you do not need, or missing a legal obligation that carries significant liability.

This article gives you a clear, up-to-date map of what an audit is, which type applies to your situation, and what the process actually involves.

In short: an audit is an independent and structured mission that examines information, processes or systems to assess their reliability, compliance or effectiveness. The auditor issues a documented conclusion supported by evidence gathered during fieldwork, and where relevant formulates operational recommendations.

An audit rests on three non-negotiable pillars.

• Independence of the auditor from the object being examined. Without independence, the conclusion carries no weight with third parties.
• A structured methodology grounded in recognised professional standards — the normes d'exercice professionnel (NEP) for statutory audit in France, IIA standards for internal audit.
• A reasoned conclusion supported by sufficient and appropriate audit evidence. This conclusion takes the form of a certification, a report or a documented opinion.

The concept of materiality is central. An audit does not aim to verify every single transaction — it focuses on identifying anomalies or risks significant enough to influence the decisions of those relying on the information. This is what separates an audit from a routine accounting review.

Our view: materiality is frequently misunderstood as a way of cutting corners. It is in fact a disciplined targeting tool — it directs effort towards what matters most for the financial picture of the entity, and it is set at the planning stage based on professional judgement and knowledge of the business.

An audit is fundamentally an answer to a question of trust. It gives a stakeholder — a director, shareholder, bank, investor or regulatory authority — reasonable assurance on a specific subject.

Concretely, an audit can:

• verify the reliability of financial, accounting or operational information;
• surface significant risks and anomalies before they crystallise into losses;
• assess compliance against an external framework (law, sector norms) or internal standards (procedures, policies);
• provide actionable recommendations to strengthen risk management and process efficiency;
• reinforce the credibility of the business with banks, investors, trade partners and public authorities.

In 2026, the scope of assurance has expanded well beyond annual accounts: tax compliance, anti-fraud controls, information systems security, and non-financial reporting are all areas where structured independent review is increasingly expected or required.

The word "audit" covers fundamentally different missions depending on who orders it, who performs it, and what conclusion is expected.

Statutory audit and the commissaire aux comptes#

The audit légal is a statutory account certification mission entrusted exclusively to a registered commissaire aux comptes (CAC). The CAC certifies that the annual accounts are regular, sincere and give a true and fair view of the company's assets and financial position. Professional standards are set by the H2A (Haute Autorité de l'Audit), which replaced the former H3C in 2024 as the regulatory authority for the profession.

The certification can be unqualified, qualified (with reservations) or refused. Each outcome carries specific consequences for how third parties — lenders, investors, tax authorities — read the accounts.

Small company statutory audit — ALPE#

Created under the loi PACTE, the ALPE (audit légal des petites entreprises) is a simplified, three-exercise mandate designed for small companies below the general thresholds that nonetheless appoint a CAC voluntarily or because they belong to a group that requires it. The scope of work is calibrated to the entity's size, making certification more accessible in terms of cost while maintaining independent assurance on the accounts.

Contractual audit#

A contractual audit is a voluntary mission with no statutory basis, undertaken at the request of a director, shareholder or third party. The scope is entirely flexible: targeted review of a balance sheet item, examination of a billing process, independent review of interim accounts before a fundraising round, or a full-scope audit of accounts not otherwise subject to statutory certification.

Its value lies in this adaptability: scope, depth, report format and expected conclusions are defined in a letter of engagement agreed with the client.

Internal audit#

Internal audit is an independent, objective activity exercised within the organisation that evaluates the effectiveness of internal controls, risk management and governance. It does not certify accounts — this is a fundamental distinction from external audit. Its framework in France follows the IFACI standards, the French affiliate of the global IIA (Institute of Internal Auditors).

Internal audit conclusions are directed at management and the board, not at external stakeholders. Its contribution is continuous improvement of processes and early detection of operational failures.

For a detailed view of the internal auditor's role, see our article zoom auditeur interne.

Acquisition audit (due diligence)#

An acquisition audit accompanies external growth transactions or disposals. It examines the financial, tax, employment and legal situation of a target business before a transaction is finalised. The objective is threefold: identify hidden liabilities (unprovisioned risks, pending disputes, employment or tax irregularities), adjust the acquisition price accordingly, and negotiate appropriate warranty and indemnity protections in the sale and purchase agreement.

A critical practical point: the choice between the two is not always free. Once a company crosses the statutory thresholds, appointment of a CAC is mandatory — a contractual audit cannot substitute for it.

The distinction turns on three axes: the auditor's position, the audience for the report, and the nature of the conclusion.

External audit (statutory or contractual) is performed by a party independent of the company. Its conclusion is addressed to third parties: shareholders, investors, lenders, regulators. It certifies or attests.

Internal audit is performed by a team or individual attached to the organisation. Its conclusions go to management and the governance bodies. It evaluates and recommends — without certifying accounts.

The two approaches are complementary in larger organisations: internal audit improves processes continuously; external audit provides independent assurance on the reliability of the outputs of those processes. In a typical French SME, formalised internal audit is rare — the expert-comptable, within an advisory engagement, often plays a risk-alerting role that partially overlaps with this function.

The statutory thresholds for mandatory appointment of a commissaire aux comptes were increased by 25% under decree n° 2024-152 of 28 February 2024, transposing a European delegated directive. These thresholds apply to financial years beginning on or after 1 January 2024.

A commercial company is required to appoint a CAC when it exceeds two of the following three thresholds at year-end:

• Balance sheet total: €5,000,000
• Net turnover: €10,000,000
• Headcount: 50 employees

Worked example: a French SARL in the distribution sector reports net turnover of €11.2m, a balance sheet of €3.8m and 22 employees. It exceeds only one threshold (turnover). No CAC obligation. The following year, the balance sheet reaches €5.3m — two thresholds are now exceeded. A CAC must be appointed before the close of the following financial year.

Some entities are subject to statutory audit by law regardless of size: companies with publicly traded securities, credit institutions, insurance undertakings, and associations receiving public subsidies above specified amounts (verify applicable thresholds by entity type).

For the full detail on the appointment obligation, see our article on obligation de commissaire aux comptes and our comparison of the expert-comptable and the commissaire aux comptes.

Whatever its type, an audit follows a structured methodological sequence.

1. Understanding the entity and planning. The auditor builds a picture of the business — sector, legal structure, organisation, information systems — identifies significant risk areas and sets the work programme. Materiality is determined at this stage.
2. Internal control assessment. The auditor tests the design and operating effectiveness of the controls the entity has in place. Strengths and weaknesses identified here shape the nature and extent of subsequent substantive work.
3. Substantive procedures. Detailed tests on account balances and transaction flows, analytical procedures, external confirmations (banks, customers, suppliers), and interviews with management. The auditor accumulates sufficient appropriate evidence to support a conclusion.
4. Evaluation of misstatements. Identified differences are assessed individually and in aggregate against the materiality threshold. The auditor distinguishes significant misstatements from minor irregularities and considers their impact on the financial statements.
5. Reporting and conclusion. The conclusion is formalised in a report. For statutory audit, this is the regulated certification report. For contractual or internal audit, the report includes findings, an assessment and actionable recommendations with priorities and timelines.

For a deeper look at how the auditor assesses the reliability of financial information at each stage, see our article on assertions d'audit.

This is one of the most common points of confusion in the files we handle, particularly when a company is growing and approaching the statutory thresholds for the first time.

The expert-comptable assists the director with bookkeeping, preparation of financial statements, tax declarations and management reporting. They are involved in the production of financial information.

The commissaire aux comptes examines and certifies that same information with complete independence. They are an external controller, entirely separate from the team that prepared the accounts.

The two roles are complementary but incompatible on the same scope: an expert-comptable cannot certify accounts they have themselves prepared. This incompatibility rule is absolute and foundational to the independence of statutory certification.

A scenario we see regularly: a director whose accounting is handled by a cabinet d'expertise comptable discovers, on crossing the statutory thresholds, that they need a CAC. They assume their expert-comptable can take on both roles. This is not possible. The expert-comptable remains responsible for producing the accounts; an independent CAC must be separately appointed for certification.

Understanding what an audit cannot guarantee is as important as knowing what it delivers.

• An audit provides reasonable, not absolute, assurance. Sophisticated fraud, collusion between employees, or document falsification can escape standard audit procedures even when conducted with appropriate diligence.
• An audit is not a substitute for day-to-day management. The auditor does not run the company and bears no responsibility for preparing the accounts. The quality of the internal controls maintained by management directly determines the reliability of the financial statements.
• An audit is not a box-ticking exercise. A rigorous audit requires professional judgement, targeted sampling and critical risk analysis — not mechanical application of administrative checklists.

The underestimated risk: treating an unqualified audit opinion as a "clean bill of health" for the business. An unqualified certification means the accounts give a true and fair view under applicable accounting standards — it says nothing about future profitability, the robustness of the business model, or the absence of operational risk.

The 2024 threshold increase has moved many SMEs out of the mandatory audit perimeter. Companies that appointed a CAC under the former thresholds (€4m/€8m) may no longer be legally required to have one. However, a decision to revoke an existing mandate should not be taken on the basis of the threshold change alone — minority shareholders, lending banks or major commercial partners may have a legitimate interest in maintaining independent certification.

The ALPE provides a useful middle ground. For companies below the statutory thresholds that nonetheless want to strengthen their credibility — for a fundraising round or when entering commercial relationships with large corporates — an ALPE mandate offers certification at a lower cost over three years.

Acquisition due diligence is often scoped too narrowly or run too quickly. In the transmission files we work on, due diligence conducted in under two weeks on complex targets regularly misses material tax or employment risks. The scope and timeline of the mission should be calibrated to the transaction's complexity and risk profile, not to the commercial calendar.

Up to date as of 2026-05-26. This article is for information purposes only and does not substitute for advice tailored to your specific situation. For your particular circumstances, consult a registered professional.