Auditing

What is auditing?

Auditing (German: Wirtschaftsprüfung) denotes the professional work of public auditors (Wirtschaftsprüfer) and audit firms, above all the statutory audit of financial statements. In it, an independent judgement is made on whether the bookkeeping, the annual financial statements and the management report comply with the statutory provisions and the supplementary provisions of the articles of association. The management report is the management's report on the course of business, the position and the outlook of the company. The result of the audit is summarised in the auditor's opinion (Bestätigungsvermerk), a written audit opinion that, for statutory audits, is published together with the financial statements.

Professional law is regulated by the German Public Auditor Act (Wirtschaftsprüferordnung, WPO). Audit firms (Wirtschaftsprüfungsgesellschaften) are companies recognised by the Chamber of Public Auditors (Wirtschaftsprüferkammer) that are managed predominantly by public auditors. Statutory audits of financial statements are reserved for public auditors and audit firms; for medium-sized GmbHs (German limited liability companies), sworn bookkeeping auditors (vereidigte Buchprüfer) may also audit. In addition, public auditors perform voluntary audits, review engagements, due diligence investigations, valuation reports and tax advice. In a GmbH, the shareholders elect the auditor, and the management awards the engagement. In funding rounds and company sales, the audit helps decide how much trust investors and buyers place in the figures presented.

Audit requirement under the HGB

Under Section 316(1) of the German Commercial Code (Handelsgesetzbuch, HGB), the annual financial statements and management report of corporations that are not small within the meaning of Section 267 HGB must be audited. The same applies to partnerships with limited liability such as the GmbH & Co. KG and to consolidated financial statements. Medium-sized and large companies thus become subject to audit. A company becomes medium-sized if, on two consecutive balance sheet dates, it exceeds at least two of the three thresholds for total assets, revenue and number of employees. The thresholds were raised in 2024 and, as of 2026, stand at EUR 7.5 million of total assets, EUR 15 million of revenue and 50 employees on annual average. Without the mandatory audit, the annual financial statements cannot be adopted, that is, cannot be approved bindingly by the shareholders.

The auditor is to be elected before the end of the financial year to which the audit relates (Section 318(1) HGB). The auditor must be independent. Anyone who took part in keeping the books or in preparing the financial statements to be audited is excluded as auditor under Section 319 HGB. The firm that prepares bookkeeping and financial statements therefore cannot audit the financial statements at the same time.

Procedure and subject matter of the audit

The audit follows a risk-based approach under the auditing standards of the Institute of Public Auditors in Germany (Institut der Wirtschaftsprüfer, IDW), which today are based on the International Standards on Auditing (ISA). The auditor gains an understanding of the business model, processes and the internal control system, that is, the rules and controls with which the company prevents errors in accounting. In the design review, the auditor assesses whether these controls are appropriately set up; in tests of operating effectiveness, the auditor tests whether they work effectively in everyday operation. The auditor sets a materiality threshold, an amount above which an error would distort the picture given by the financial statements, and concentrates the audit procedures on the items with the highest risk of error.

Typical procedures are samples from the bookkeeping, written confirmations of open balances by banks, customers and suppliers (balance confirmations), observation of the stocktake and plausibility comparisons with prior years and key figures. The work is often split between an interim audit before the reporting date and a main audit after the financial statements are prepared.

What is audited is the accounting, not the management. Whether strategy, investments or pricing are appropriate is not assessed by the audit. Similarly, a car's mandatory periodic inspection establishes whether the vehicle complies with the regulations, but not whether it was a good purchase. The audit of financial statements is designed to detect material misstatements, including those resulting from violations. It is not a guarantee that every item is free of error. For the management report, the auditor checks whether it is consistent with the financial statements and presents the opportunities and risks of future development accurately.

The auditor reports on the result in two documents. The audit report under Section 321 HGB is detailed, is addressed to the company and is not published. It contains findings on the company's position, on objections and explanations of individual items. The auditor's opinion is the summary judgement and is published with the financial statements. Many auditors add a letter to the management with suggestions for improving the internal control system (management letter).

The auditor's opinion

The audit opinion under Section 322 HGB can take four forms:

• Unqualified opinion: The auditor has no material objections.
• Qualified opinion: There are objections to separable parts, but the financial statements otherwise give a true picture.
• Adverse opinion due to objections: The objections are so material and pervasive that the financial statements as a whole do not give a true picture.
• Disclaimer of opinion (denial because no audit opinion is issued): The auditor cannot form an opinion even after exhausting all reasonable possibilities, for example because material documents are missing.

Irrespective of the opinion, the auditor addresses in a separate section risks that threaten the company's continued existence. This section on a material uncertainty relating to going concern is not an audit opinion of its own. For banks, suppliers and investors, it is nevertheless often the most important passage of the auditor's opinion.

Voluntary audit and review engagement

Small companies can have their financial statements audited voluntarily. If the audit corresponds in nature and scope to a statutory audit of financial statements, the auditor issues an auditor's opinion, otherwise a certificate. Frequent occasions are a bank that demands audited figures for a larger credit line, an upcoming funding round, or investors who have an audit contractually assured from a certain company size.

The review engagement (review) is a critical appraisal with limited assurance. It rests above all on enquiries and analytical assessments, not on tests of individual cases. The result is a negatively worded statement: nothing has come to the auditor's attention that speaks against proper preparation. In transactions, it is used, for example, for interim financial statements or for the closing balance sheet of a locked-box mechanism.

Significance for investors and buyers

An audited annual financial statement reduces the counterparty's information risk, because the existence and valuation of the material items have already been independently assessed. The financial due diligence builds on the audited figures and concentrates on questions that an audit of financial statements does not answer: sustainable earnings, revenue quality, working capital and net financial debt. For this, buyers demand, in addition to the financial statements, the audit reports of the last years and the management letters.

Before a sale process, sellers often commission an audit firm to carry out a vendor due diligence. Its report is made available to prospective buyers and shortens their own investigation. In the purchase agreement, the balance sheet warranty ties in with the audited financial statements, and in loan agreements, banks require the submission of audited financial statements within certain periods as a covenant (covenants).

Practical example: first audit of a software GmbH

A software GmbH exceeds two of the three thresholds for small corporations for the first time at 31 December 2025. Revenue is EUR 16 million, 60 employees are employed on annual average, total assets are EUR 6 million. The management plans a Series B round, that is, a later funding round with venture capital investors, whose due diligence is to begin in the second quarter of 2027. The sequence:

• For 2025, the company remains small, because only one reporting date is above the limits. If it also exceeds the thresholds at 31 December 2026, it is medium-sized for the financial year 2026 and its 2026 financial statements are subject to audit.
• As a precaution, the shareholders elect the auditor in autumn 2026, the management awards the engagement; an interim audit takes place in November.
• As a first audit, the audit also covers the opening balance sheet figures at 1 January 2026, which were previously unaudited.
• The focal points are revenue recognition on multi-year software contracts, capitalised development costs and the completeness of provisions.
• Preparation by the end of February 2027, main audit in March, auditor's opinion before the start of due diligence.

The Series B investors thus receive audited financial statements for the last full financial year. For the current year, they rely on monthly financial statements whose reconciliation to the audited financial statements can be followed.

Distinctions: tax advice, financial due diligence and valuation

• Tax advice and preparation of financial statements: The tax adviser prepares bookkeeping and financial statements and gives advice; the auditor assesses independently. A compilation certificate, even with a plausibility assessment, is not an audit.
• Financial due diligence: a transaction-related investigation on behalf of a buyer or investor. It asks about sustainable earnings and risks to the purchase price, not about the propriety of the accounting.
• Valuation report: determination of a business value, often by public auditors under professional principles. The audit of financial statements makes no statement about the value of the company.

Common mistakes

• Electing the auditor too late. Auditors are heavily booked in the first quarter. Anyone who starts looking only after the reporting date loses the interim audit and often the planned date.
• Underestimating the first audit. In the first audit, opening figures and the accounting methods of prior years must also be evidenced. The effort is considerably higher than in later years.
• Preparing documents incompletely. Missing contracts, stocktake lists or balance confirmations lengthen the audit and raise the fee.
• Overrating the opinion. An unqualified auditor's opinion confirms the propriety of the accounting, not earning power or the business model.
• Filing away the management letter. Comments on the internal control system that remain unaddressed come back in due diligence as a question about the organisation of the finance function.

Frequently asked questions

What does an audit of financial statements cost?

For a medium-sized GmbH that has only just become subject to audit and has a clear structure, the fee is, as a rough rule of thumb, in the low to mid five-figure range in euros. It depends above all on the time required; a first audit, group structures, complex revenue recognition and poor preparation increase it.

May one's own tax adviser audit the financial statements?

Not if the adviser took part in the bookkeeping or the preparation of the financial statements. Pure tax advice alongside the audit is in principle possible, as long as independence is preserved. Stricter rules apply to public-interest entities, such as listed companies, banks and insurers.

Does an auditor's opinion replace due diligence?

No. It makes it easier, because the figures have already been audited. However, due diligence investigates the business model, customer contracts, sustainable earnings and future prospects independently.

What does a reference to risks threatening the company's continued existence mean?

The auditor considers that a material uncertainty about the continuation of the company exists, for example because financing for the next twelve months is not secured. The audit opinion can nevertheless be unqualified. In growth companies, the uncertainty often falls away only when the next funding round closes.

How long does an audit of financial statements take?

For a well-prepared medium-sized company, the on-site work is usually spread over a few weeks, with interim audit and reporting in addition. More time must be allowed for a first audit.

The Roemer Capital view

For larger funding rounds and in sale processes, we discuss early with the management whether audited financial statements will be available for the last completed financial year. If there is no obligation, we clarify whether a voluntary audit or a review engagement makes sense. Audited figures shorten the financial due diligence and leave the counterparty less room for renegotiating individual items.

The audit itself lies with the auditor. Our contribution is to align the audit date with the process timetable and to reconcile the audited financial statements, monthly figures and the financial model.