Audit Firm in Paris: Statutory & Financial Audit Services

An audit that merely ticks a regulatory box is a missed opportunity. When conducted with genuine analytical rigour, an audit provides the management team, shareholders, lenders and investors with something far more valuable: a credible, independent assessment of whether the financial statements are a faithful picture of the business, and an early-warning system for control weaknesses, fraud risks and compliance gaps that could otherwise go undetected for years. Hayot Expertise, located at 58 rue de Monceau, Paris 8, brings that level of rigour to every engagement, combining the technical standards of the CNCC (French statutory auditor body) with data-driven audit analytics and a practical, communication-first approach.

An audit firm steps in for two reasons. The first is legal: your company must appoint a statutory auditor (commissaire aux comptes) once it exceeds, at year end, two of the three thresholds set by Article D. 221-5 of the French Commercial Code (EUR 5M balance-sheet total, EUR 10M turnover excluding VAT, 50 employees), lowered to EUR 2.5M, EUR 5M and 25 employees (Article D. 821-172) for a significant controlled company within a group. The second is contractual: an audit freely commissioned before an acquisition, a fundraise or a sale, or requested by a bank, an investor or a funding body. Hayot Expertise takes on both types of engagement from Paris 8, with reports signed by a registered statutory auditor.

Understanding the regulatory framework helps you commission the right type of engagement. France distinguishes sharply between statutory audit (commissariat aux comptes, CAC) and contractual audit (audit contractuel).

The statutory CAC is a legally mandated appointment governed by Book VIII of the French Commercial Code (Articles L. 821-40 et seq.). The PACTE Act of 2019 first raised the thresholds for mandatory CAC appointment (EUR 4M balance sheet, EUR 8M turnover, 50 employees), before Decree no. 2024-152 of 28 February 2024 brought them to their current level: SAS and SARL companies below the following two-out-of-three thresholds are exempt (balance sheet total EUR 5M, revenue EUR 10M, headcount 50). This exempted tens of thousands of SMEs from the legal obligation but has, paradoxically, increased the voluntary take-up of contractual audits, particularly from institutional investors and banks requiring independent financial review as a credit condition.

At the European level, the 2014/56/EU Audit Directive (transposed into French law) introduced mandatory rotation of CAC firms for public interest entities (EIP) every 10 years and reinforced independence requirements, under the oversight of the French audit regulator, today the Haute autorité de l'audit (H2A, successor to the H3C since 1 January 2024). The CNCC has fully adopted ISA (International Standards on Auditing) translated into French as NEP (Normes d'Exercice Professionnel), making French audit methodology internationally aligned.

Since Decree no. 2024-152 of 28 February 2024, a French commercial company must appoint a statutory auditor (commissaire aux comptes) once it exceeds, at year end, two of the three thresholds set by Article D. 221-5 of the Commercial Code: EUR 5M balance-sheet total, EUR 10M turnover excluding VAT, 50 employees. The earlier amounts introduced by the PACTE Act (EUR 4M and EUR 8M) no longer apply. The obligation itself is still carried, form by form, by Book II of the Code: Article L. 227-9-1 for the SAS and SASU, L. 223-35 for the SARL, L. 225-218 for the SA.

Two further rules apply within groups (Article L. 821-43):

• the parent company: a company that controls one or more others (within the meaning of Article L. 233-3) must appoint a statutory auditor when the group they form together exceeds, on an aggregate basis, two of the three thresholds of EUR 5M, EUR 10M and 50 employees; it is exempt if it is itself controlled by an entity that has already appointed one;
• significant controlled companies: they fall under the lower thresholds of Article D. 821-172, namely EUR 2.5M balance-sheet total, EUR 5M turnover excluding VAT, 25 employees.

Two specific situations complete the picture: shareholders holding at least one third of the capital can obtain the appointment of a statutory auditor for a three-year mandate; and a company that no longer exceeds two of the three thresholds over the two preceding financial years falls outside the obligation, with current mandates running to their term.

A Six-Year Mandate or a Three-Year Mandate (Known as the ALPE Audit)#

The standard mandate runs for six financial years (Article L. 821-44). Where the statutory auditor is appointed voluntarily, or under the group rules, the company may limit the mandate to three financial years (Article L. 821-46). In that framework, known in practice as the small-entity statutory audit (ALPE), the auditor issues, in addition to the certification report, a report to management identifying financial, accounting and management risks, and is exempted from several reports and verifications (Article L. 821-57). The relevant standards have been updated: the order of 24 July 2026 approved the revised NEP 911 and NEP 912.

What a Mandatory CAC Mission Covers#

Our statutory audit missions follow the full NEP framework and cover:

• Audit of annual financial statements (balance sheet, income statement, notes) under a risk-based approach: understanding of the entity and its environment (NEP 315), risk assessment and response (NEP 330), completion and reporting (NEP 700)
• Certification opinion: unqualified, qualified, adverse or disclaimer of opinion, depending on the nature and materiality of findings; we communicate our preliminary conclusions before the final report, avoiding surprises
• Verification of the management report (rapport de gestion) and all shareholder communications for consistency with the certified accounts
• Mandatory disclosure of criminal facts to the public prosecutor if facts constituting a criminal offence are identified during the mission (a non-delegable legal obligation)
• Alert procedure (procédure d'alerte) if facts are identified that may jeopardise the going concern of the entity: a structured escalation process to management, supervisory body and ultimately the commercial court if unresolved
• Limited review of interim financial statements (examen limité) for listed groups or their significant subsidiaries

Voluntary CAC Appointment#

Even below the mandatory thresholds, voluntary appointment of a statutory auditor is increasingly common:

• Associations receiving public grants above €153,000 annually are legally required to appoint a CAC regardless of their legal form
• LBO/OBO holding companies whose senior and mezzanine lenders typically require contractual audit certification as a financial covenant
• Startups preparing Series B+ funding rounds or IPOs, seeking to demonstrate accounting credibility before institutional investors conduct their own due diligence
• Subsidiaries of foreign listed groups where the parent's audit committee or SEC/FCA obligations require subsidiary-level statutory audit across all material entities
• Non-profit foundations under public utility status, subject to Cour des Comptes oversight

How a Statutory Audit Unfolds in an SME: From Engagement Letter to Opinion#

The engagement starts before the first test. The statutory auditor is appointed by the ordinary general meeting or the equivalent body (Article L. 821-40); a deputy auditor is only required where the appointee is an individual or a single-shareholder firm. The firm checks its independence, accepts the engagement, then sets out the scope, timetable and hours budget in the engagement letter.

Over a financial year, the work is organised in three stages:

1. Understanding the entity and planning: grasping the business, its significant cycles (sales, purchases, payroll, cash, inventory) and its control environment, so the work targets the actual risk areas.
2. Interim phase, before year end: review of procedures and internal control, tests on the selected cycles, and immediate flagging of points that can still be corrected in the current year's accounts.
3. Final phase, after year end: audit of the annual accounts (direct confirmations from banks and third parties, review of estimates and provisions, subsequent events), summary of proposed adjustments, then issuance of the report.

The certification report (Article L. 821-53) is presented to the meeting that approves the accounts. Where relevant, the special report on related-party agreements is added: prior authorisation by the board then a shareholder vote in the SA (Articles L. 225-38 and L. 225-40), review after the fact in the SAS, where shareholders vote on the report (Article L. 227-10, a simple entry in the register of decisions in a SASU). The procedures follow the French professional practice standards (NEP), drawn up by the standard-setting commissions attached to the Haute autorité de l'audit and approved by ministerial order (Article L. 820-23).

Outside the CAC framework (which carries mandatory independence and incompatibility rules), we conduct contractual audit missions that allow a more advisory relationship:

Financial Due Diligence (Buyer-Side and Vendor)#

Financial due diligence is the analytical foundation of any M&A process. For the buyer, it validates the business plan assumptions, uncovers hidden risks (tax disputes, off-balance-sheet commitments, social liabilities, undisclosed litigation) and calibrates the scope of the representations and warranties (R&W) required in the SPA. For the seller, a vendor due diligence (VDD) report commissioned in advance speeds up the process, increases buyer confidence and typically supports a higher valuation multiple.

Our standard due diligence report structure:

• Earnings quality analysis: normalised EBITDA restatements, non-recurring items identification, pro-forma adjustments for acquisitions/disposals completed during the historical period
• Working capital analysis: calculation of the normalised working capital target (for locked-box or closing mechanism purposes), identification of seasonal cash flow patterns, deep-dive into debtor and creditor ageing
• Net debt analysis: definition of net debt for SPA purposes, off-balance-sheet commitments (operating leases pre-IFRS 16, earn-outs, performance bonds), underfunded pension liabilities, deferred revenue
• Tax risk assessment: open tax positions, pending or recently closed audits, compliance gaps in VAT, CIT and social charges, group tax consolidation risks
• Revenue and contract accounting: recognition policy review, milestone billing, contract modifications, churn analysis for SaaS businesses

Audit of IT Financial Systems#

Financial data integrity increasingly depends on robust IT general controls. We audit the financial IT environment of your ERP or accounting system (Sage, SAP, Cegid, Pennylane, NetSuite) to assess:

• Access controls and segregation of duties: who can post, approve and pay, and whether there are compensating controls where segregation is limited?
• Change management: are modifications to financial system parameters (account mappings, tax codes, approval workflows) authorised and tested before deployment?
• Data completeness and accuracy: are transactions from subsidiary systems (sales, inventory, fixed assets) correctly and completely interfaced into the general ledger?
• Audit trail integrity: are journals complete, sequential and unalterable?

Grant and Public Funding Audit#

Companies and organisations receiving public or European funding (BPI grants, FEDER/ESF European funds, public research contracts) frequently face mandatory justification audits imposed by the funding authority. We conduct these missions against the specific reference frameworks required (ANR, European Commission, Regional Councils) and produce reports in the required formats, including the ISRS 4400 (agreed-upon procedures) format often stipulated for European funds.

What Distinguishes a Contractual Audit From the Statutory Audit#

A contractual audit is an audit of the accounts conducted outside any certification mandate, on a contractual basis, leading to a reasonable-assurance opinion. The CNCC framed the practice in a technical opinion dated 4 November 2019. Three concrete differences from the statutory audit:

• the trigger: a decision of the entity, not a statute; scope, timetable and deliverable are defined in the engagement letter;
• who can perform it: only statutory certification is reserved to auditors registered on the list kept by the Haute autorité de l'audit; a contractual audit can also be carried out by a chartered accountant;
• the permitted scope: a statutory auditor only conducts a contractual audit in an entity where it holds no mandate; for its audit clients, and the entities controlling or controlled by them, its work falls under non-audit services (SACC).

The requests seen in practice: acquisition audit and due diligence, fundraising at investors' request, a bank requirement or financing covenant, sale of a business, justification requested by a funding body or under a grant, reporting for a foreign group. Two related cases stem from the law, not from contract: a works council (CSE) exceeding two of the three thresholds of Article D. 2315-33 of the Labour Code (50 employees, EUR 1.55M balance sheet, EUR 3.1M annual resources) must have its accounts certified by a statutory auditor distinct from the company's own (Article L. 2315-73); and paying an interim dividend before the accounts are approved requires an interim balance sheet certified by a statutory auditor, even in a company that has not appointed one (Article L. 232-12: the profit shown caps the interim dividend, and any distribution beyond it is a fictitious dividend).

Risk-Based Planning#

Before any procedure, we invest heavily in understanding your business, sector dynamics, competitive environment, control environment and accounting system. This planning phase (NEP 315) is what distinguishes a genuinely useful audit from a formulaic one: by identifying the high-risk areas early, we allocate our work precisely where it matters and avoid spending time on low-risk areas.

Audit Data Analytics#

We systematically import and analyse your FEC file (Fichier d'Écritures Comptables, the standardised electronic audit trail mandated by French tax law) using data analytics tools. This allows us to:

• Apply Benford's Law to first-digit distributions in monetary amounts to detect statistical anomalies
• Identify duplicate transactions, sequential gaps in invoice or journal numbering
• Flag unusual timing patterns: after-hours postings, weekend transactions, end-of-period manual journals
• Detect intercompany inconsistencies across entities in a group FEC consolidation
• Perform ratio trend analysis across 24 to 36 months to identify breaks in patterns that warrant explanation

This data-first approach consistently uncovers issues that traditional sampling-based audit procedures would miss.

Communication Throughout: No Surprises at the End#

We operate on a principle of continuous communication. Significant findings are discussed with management as they arise, not saved for the final report. This means the audit remains a constructive process rather than a confrontational one, and management has the opportunity to provide context or correct issues before the opinion is formed.

Management Letter: Constructive Recommendations#

Every audit concludes with a management letter (lettre de recommandations) accompanying the formal report. It documents internal control weaknesses identified during the audit, rates them by risk level (significant deficiency, material weakness) and provides specific, actionable recommendations for remediation. This is the component of an audit that delivers direct operational value beyond mere compliance.

• Technology and SaaS: IFRS 15 revenue recognition for subscription businesses, capitalisation of internal development costs under IAS 38, BSPCE and BSA equity instrument accounting, consolidation in high-growth group structures
• Real estate and property development: VEFA (off-plan sales) revenue recognition on a percentage-of-completion basis, decennial guarantee provisions, land bank valuation, SCI and OPCI structures
• Retail and distribution: inventory valuation (FIFO vs weighted average cost), supplier rebate and volume discount accounting, franchise agreement treatment
• Professional services firms: work-in-progress recognition, bad debt provisioning, partner remuneration structures, professional liability provisions
• Non-profits and foundations: comptes emploi-ressources, allocation of costs by purpose, public grant accounting, Cour des Comptes reporting requirements

What Drives the Budget#

The indicative grid above gives orders of magnitude; the quote itself is built engagement by engagement. Five factors carry the most weight:

• the quality of the accounting: up-to-date books, a clean FEC file and accessible supporting documents directly reduce the hours of testing;
• the entity's complexity: multiple sites, subsidiaries, inventory counts, long-term contracts, intragroup transactions;
• internal control: formalised procedures with genuine segregation of duties allow the auditor to rely on them rather than extend substantive testing;
• the first year of the mandate: the initial understanding of the entity takes more time than a routine year;
• the framework of the engagement: the voluntary three-year mandate carries exemptions from several reports and verifications (Article L. 821-57); a contractual audit is priced on the agreed scope alone.

The quote details the hours per cycle and the intervention timetable, which makes the fee discussion verifiable item by item.