Legal Audit & Auditorship: Complete Guide 2026

This guide is written for expats and foreign founders by a French CPA, an English-speaking accountant in Paris, with practical focus on accounting in France, French corporate tax, business setup in France and French payroll.

In short. A legal audit is the independent review of a company's annual accounts, entrusted by law to a statutory auditor who certifies that they are regular, sincere and give a true and fair view. It becomes mandatory as soon as a company exceeds two of the following three thresholds: €5,000,000 total balance sheet, €10,000,000 turnover excluding taxes, 50 employees. The accountant prepares the accounts; the statutory auditor certifies them.

The legal audit is an independent examination mission of the annual accounts of an entity, carried out by an authorized professional: the auditor (CAC). Its objective is to express a reasoned opinion on the regularity, sincerity and faithful image given by the financial statements of the assets, financial situation and results of the controlled entity.

This mission is fundamentally different from an accounting mission. The accountant prepares the accounts; the auditor certifies them (or refuses to certify them) completely independently, in the interest of the partners, creditors and the public.

Legal audit, statutory audit, auditorship: the same thing#

These expressions all describe the same legal reality and are used interchangeably:

• Legal audit (or statutory audit of the accounts) refers to the mission: the examination of the accounts required by law.
• Auditorship (commissariat aux comptes) refers to the regulated function of the professional who performs it.
• The statutory auditor (commissaire aux comptes) is that professional, registered on the official list and supervised by the H2A.

A clear distinction must be kept, however, between the legal audit, imposed by law and leading to a certification, and the contractual audit freely commissioned by a company (acquisition due diligence, review of procedures), which produces no legal certification and is not reserved to statutory auditors.

The statutory auditor is governed by the provisions of the Commercial Code (articles L. 821-1 et seq., following the recodification by Ordinance no. 2023-1142 of 6 December 2023), the Code of Ethics and the approved Professional Practice Standards (NEP), whose application is overseen by the Haute Autorité de l'Audit (H2A), which succeeded the H3C on 1 January 2024.

For commercial companies#

The PACTE law of May 22, 2019 unified the thresholds for the mandatory appointment of an auditor, which decree no. 2024-152 of 28 February 2024 (transposing EU delegated directive 2023/2775) then raised by around 25%. A company is now required to appoint an auditor when it exceeds two of the following three thresholds at the close of the financial year:

These amounts are set by article D. 221-5 of the Commercial Code, as amended by decree no. 2024-152 of 28 February 2024, applicable to financial years opened on or after 1 January 2024.

A misconception to correct: the SA is not exempt from the thresholds. It is still often written that a public limited company (SA) must always appoint a statutory auditor, whatever its size. This has been false since the PACTE law. Article L. 225-218 of the Commercial Code provides that companies must appoint a statutory auditor when they exceed, at the close of a financial year, the thresholds set by decree for two of the three criteria above. An SA that stays below those thresholds therefore has no obligation to appoint one. The rule is now common to all corporate forms: SARL, SAS, SNC and SA fall under the same thresholds.

Cases where an auditor becomes mandatory despite the thresholds#

Even below the thresholds, an appointment can be imposed on the company (same article L. 225-218):

Both routes are minority safeguards: they allow shareholders without a majority to obtain an independent review of the accounts.

Crossing and exiting the thresholds#

This is the question that comes up most often in practice, and the answer is not symmetrical:

The most common trap. A company that falls back below the thresholds in the second year of the term believes it can part with its statutory auditor immediately. It cannot: the six year term exists precisely to protect the auditor's independence. The only consequence is that, at expiry, if the condition of two financial years below the thresholds is met, the meeting does not have to renew.

Not to be confused with the accounting size categories. Article D. 123-200 of the Commercial Code defines size categories (micro, small, medium sized company) that govern simplified presentation of the accounts, with entirely different amounts. Those are not the thresholds for appointing a statutory auditor.

For corporate groups#

In the context of a group, the parent company must appoint an auditor when it controls entities which, taken together (including the parent), exceed the thresholds mentioned above. Subsidiaries themselves may be subject to the obligation depending on their individual size.

For non-commercial entities#

The thresholds above only concern commercial companies. Other entities fall under their own regimes, which must not be mixed up:

A useful clarification: the €153,000 threshold targets the subsidies received, whereas the thresholds of 50 employees, €3,100,000 and €1,550,000 target the economic activity. An association may be caught by one, by the other, or by both.

Voluntary appointment (excluding legal obligation)#

It is also possible to appoint an auditor on a voluntary basis, even outside of cases of legal obligation. This approach is particularly useful for:

• Strengthen the credibility of accounts vis-à-vis banks and investors;
• Secure a fundraising or transfer of securities;
• Meet the requirements of a public call for tenders;
• Prepare calmly for the entry of a partner or the transmission of the company.

The opinion of the auditor#

At the end of his work, the auditor issues one of the following three opinions:

1. Unreserved certification: The accounts are regular, sincere and give a true and fair image. This is the favorable conclusion that every entity strives to achieve.

2. Certification with reservations: The accounts are generally faithful, but specific and material points raise disagreements or limitations. Each reservation must be clearly stated and its impact quantified if possible.

3. Refusal to certify: The disagreements are so fundamental or the limitations so extensive that the CAC cannot express a positive opinion. This is a serious red flag for third parties.

Audit procedures#

The auditor plans and conducts his work according to the Professional Practice Standards (NEP):

• NEP 300 (planning): Preliminary risk assessment, definition of the audit strategy and materiality threshold.
• NEP 315 (knowledge of the entity): Analysis of the sector, the economic model, the internal control environment.
• NEP 330 (responses to risks): Tests of procedures (controls) and substantive controls (verification of balances and transactions).
• NEP 450 (evaluation of anomalies): Assessment of the impact of uncorrected anomalies.
• NEP 700 (CAC report): Formalization of the opinion.

Specific verifications (NEP 9000 and following)#

Beyond certification, the CAC carries out specific verifications required by law:

• Sincerity and consistency of the management report with the accounts;
• Verification of the corporate governance report (SA);
• Equality between partners (particularly in terms of dividends);
• Sincerity of the information given in the prospectuses (if applicable).

The legal audit is not the only mission entrusted to an auditor. Depending on the legal life of the company, other legal or contractual missions are assigned to it:

Specific legal missions#

Contractual missions (certificates)#

The CAC can also produce certificates on specific financial information at the request of the entity: certificate of turnover for a call for tenders, certificate of repurchase value for a repurchase of shares, etc.

Phase 1: acceptance and maintenance of the mission#

First of all, the auditor verifies the absence of conflicts of interest and his independence in relation to the entity. The appointment is generally 6 financial years for companies (3 renewable financial years for certain entities).

Phase 2: risk awareness and assessment (NEP 315)#

The CAC meets with management, analyzes flows, information systems and internal control to identify risk areas of significant anomalies.

Phase 3: planning and materiality threshold#

A significance threshold (materiality) is set. Anomalies detected below this threshold are generally ignored; those above are processed.

Phase 4: field work (interim and final)#

Audit work often takes place in two phases:

• Interim audit (during the year): control of procedures, review of intermediate cycles.
• Final audit (after closing): validation of end-of-year balances, overall analytical review.

Phase 5: communication to managers#

At the end of the mission, the CAC sends a recommendation letter (management letter) to the managers, detailing the internal control weaknesses identified and the suggested improvements.

Phase 6: CAC report#

The auditor's report, containing his opinion, is presented to the General Assembly of partners which deliberates on the approval of the accounts.

The sections above describe the mission as seen by the statutory auditor. That leaves the question every director asks after crossing the thresholds: what exactly do I have to do? A first audit can be prepared, and serious preparation shortens the mission, limits back and forth, and reduces the risk of a qualified opinion.

Step 1: have the auditor appointed in due form#

The appointment is a matter for the ordinary general meeting. It must be decided before the auditor begins work on the financial year concerned, recorded in minutes and then filed with the trade and companies register. A late or irregular appointment legally weakens the meetings that follow.

Step 2: build the permanent file#

The statutory auditor will systematically ask for the documents describing the entity, which do not change every year:

• Up to date articles of association and a recent Kbis extract;
• Minutes of meetings and of management bodies for recent financial years;
• Share transfer register and list of shareholders;
• Leases, insurance policies, financing agreements and loan amortisation schedules;
• Significant contracts: major customers, strategic suppliers, subcontracting, licences;
• Legal organisation chart of the group and intragroup agreements.

Step 3: prepare the accounting file for the year#

This is the heart of the matter, and where first audits most often go off track:

• A compliant accounting entries file (FEC), exported and checked;
• General ledger balance and customer and supplier sub ledger balances;
• General ledger for the year;
• Bank reconciliations at closing, with the matching statements;
• Fixed asset and depreciation schedule;
• Details of inventories with the valuation method used and the physical stocktake minutes;
• Supporting evidence for every provision and every accrued expense.

Step 4: justify the sensitive items before the auditor arrives#

A few items concentrate most of the work and the questions. Documenting them upfront saves considerable time: inventories and work in progress, provisions for risks, shareholder current accounts, deferred income, doubtful receivables, and any unusual transaction during the year (disposal, restructuring, debt waiver). For each of them, prepare a one page note explaining the reasoning and the calculation.

Step 5: formalise internal control#

The statutory auditor assesses your procedures before testing your accounts. He does not expect a large group framework from an SME, but he does expect an identifiable segregation of duties (whoever commits the expense is not the one who pays it), a reliable audit trail from order to invoice to payment, and written signature delegations.

Step 6: anticipate external confirmation requests#

The auditor carries out circularisation: he writes directly to banks, lawyers and selected customers and suppliers to have balances confirmed. Prepare the list of contacts and warn them, since late replies are one of the leading causes of delay.

Step 7: set the timetable#

An audit takes place in two stages: an interim phase during the financial year and a final phase after the closing. The report must be available before the general meeting approving the accounts, which is held within six months of the closing. Working back from that date, the final phase is usually scheduled two to three months after the closing.

The procedures are not the same depending on the activity. Three families of files concentrate the recurring difficulties.

Construction, renovation and public works#

The dominant issue is revenue recognition on long term contracts. A site spanning two financial years requires a choice between the completed contract method and the percentage of completion method, and then consistency in applying it. The statutory auditor will check:

• Consistency between the technical progress of the site and the accounting progress recognised;
• The calculation and justification of provisions for losses on completion as soon as a site is loss making;
• The treatment of progress billings, retentions and signed or pending variation orders;
• Subcontracting: contracts, VAT reverse charge where applicable, and vigilance over the obligation to verify subcontractors.

Consulting and professional services#

Here the risk shifts to the allocation of revenue to the correct financial year. Fixed fee assignments, subscriptions and services billed in advance require a rigorous split between deferred income and invoices to be issued. Add to this the valuation of work in progress, dependence on a small number of clients (a risk to be disclosed in the notes) and the treatment of introducer fees.

Associations and subsidised entities#

The issue is compliance with the intended use of subsidies. The review focuses on the distinction between operating subsidies, investment subsidies and dedicated funds, on the justification of dedicated funds unspent at the year end, and on the traceability of the use of funds against the agreements signed with the funding bodies.

This is a very widespread confusion, and it has an immediate practical consequence: the firm that keeps your books cannot be the one that certifies your accounts.

The basis for this incompatibility is the requirement of independence. Article L. 821-31 of the Commercial Code prohibits the statutory auditor from taking, receiving or keeping, directly or indirectly, an interest in the person or entity for which he performs a mission. Certifying accounts one has prepared oneself would amount to reviewing one's own work: the opinion would have no value for third parties.

In practice, a company crossing the thresholds keeps its chartered accountant and appoints, in addition, a separate statutory auditor. That means two budgets, two contacts and two separate missions.

Hayot Expertise is a firm registered on the list of the Compagnie Régionale des Commissaires aux Comptes de Paris (CRCC de Paris). We work with SMEs, ETIs, associations and organizations subject to legal control, mainly in Île-de-France (Paris, Hauts-de-Seine, Val-de-Marne, Yvelines) but also remotely throughout France.

Our legal audit approach#

• Risk-based method: We focus our work on areas where the risk of anomaly is highest, ensuring maximum efficiency.
• State-of-the-art technological tools: We use Caseware (data analytics) and Revisaudit for FEC import and organization of the revision file in accordance with the NEP.
• Single contact: Samuel HAYOT, signatory auditor, is your direct contact throughout the mission.
• Dual qualification: Samuel HAYOT is registered both as a chartered accountant and as a statutory auditor. In line with the independence rule set out above, the two missions are never performed on the same entity: this dual qualification serves the understanding of the files, not their combination.

Scope of intervention#

The firm handles statutory audit engagements for commercial companies, associations and organisations subject to a certification requirement. Every file is subject to a prior independence review and to an engagement letter before any commitment.

Pricing#

The fees of an auditor are freely negotiated but must be proportional to the necessary diligence. Our fees are transparent and presented in the engagement letter. Contact us for a personalized quote tailored to the size and complexity of your entity.