Audit of a Cyprus company: rules and process

For a Cyprus company, the audit is the default, not the exception. Under the Companies Law, companies prepare financial statements and have them assured by a licensed auditor regardless of size or activity — dormant companies included. What has changed recently is the relief valve: the smallest private companies may replace the full audit with a lighter review engagement, and the turnover limit for that option rose to €300,000 for financial years beginning on or after 6 February 2026.

Who needs a full audit — and who can take the review

The baseline rule is simple: essentially every Cyprus company needs its financial statements audited. The carve-out works like this:

Three honest footnotes. First, the review is lighter assurance, not a free pass — it is performed by the same licensed profession, and the statements still get prepared and filed. Second, a further increase of the turnover limit to €400,000 has been discussed in parliament; as of July 2026 the threshold actually in force is €300,000, and we will update this page if that changes. Third, many companies that qualify for a review keep the full audit anyway, because banks, investors and future buyers ask for audited statements — downgrading to save a little assurance work can cost you elsewhere.

The date trap in the new threshold

The €300,000 limit applies to financial years beginning on or after 6 February 2026 — and that wording, not the headline number, decides when it reaches you.

Work it through for the ordinary case. A company with a 31 December year end starts its 2026 financial year on 1 January 2026 — five weeks before the cut-off. So FY2026 is still tested against the old €200,000 limit. The first calendar year actually covered is FY2027, reported in 2028. A company with a year end of, say, 31 March gets there sooner: its financial year beginning 1 April 2026 falls after the date, so the new limit applies straight away.

The two-year test compounds this. The relief needs both conditions — turnover and gross assets — satisfied for two consecutive years, so a company that only now drifts under the limit does not qualify on the strength of one good year. It also cuts the other way: a company that breaches a limit once does not lose the option instantly, but a second consecutive breach puts it back into full audit. In practice this means the decision is made looking at two years at a time, not at the year in front of you.

Groups: the audit that catches people out

Where a Cyprus company holds subsidiaries, the question is no longer only “audit or review” but whether consolidated financial statements are required on top of the company’s own. Consolidation is its own workload — uniform accounting policies across the group, intra-group balances and transactions eliminated, a group audit opinion — and it is the item most often discovered late by founders who built a holding structure without asking what it does to the year end.

Exemptions from consolidation exist, most usefully for small groups and for intermediate parents inside a larger group whose own parent consolidates them. Whether you land inside one is a question of facts about the whole group, not just the Cyprus entity, so it is worth settling when the structure is built rather than when the auditor asks.

When to keep the full audit even though you could drop it

Qualifying for the review is a permission, not an instruction. The full audit usually stays worth it when:

• A bank relationship is live or wanted. Onboarding and periodic reviews ask for audited statements, and “we qualified for a review” is a conversation you do not want to be having with a compliance officer.
• There are outside shareholders, investors or a future sale. Diligence works from audited numbers; a gap year of reviewed statements gets renegotiated, not forgiven.
• The company applies for licences, tenders or credit. Regulators and counterparties set their own document lists, and they rarely track Cyprus threshold changes.
• The group consolidates. A parent’s auditor generally wants audited components, whatever the local exemption allows.

Conversely the review genuinely fits a dormant company, a small holding vehicle with a couple of transactions a year, or an owner-managed company with no external stakeholders — the cases where the assurance was never being read by anyone.

What the audit involves — and what we prepare

The auditor is independent; the file is ours to build. A statutory audit in practice means evidence: ledgers reconciled to bank statements, sales and purchase documentation, loan and related-party agreements, support for judgment areas like revenue recognition and going concern, and formal confirmations from banks. Our accounting team prepares the financial statements, assembles that file, answers the auditor’s queries and keeps the exchange moving.

Most of the difference between a quick audit and a painful one is the state of the file, not the strictness of the auditor. Books that were reconciled every month produce a short question list; books reconstructed in February produce a long one.

When does it have to be done?

There is no single “audit day” in the calendar — the pressure arrives through the filings that need the audited statements:

• The corporate income tax return is prepared from the audited financial statements — the tax side of the chain is covered on the corporate tax page.
• The HE32 annual return to the Registrar of Companies is filed within 28 days of the company’s return date and carries the previous year’s financial statements. Late filing triggers Registrar penalties — the exact figures are on the HE32 page.

Miss the audit, and the delay cascades into both. That is why we plan the audit backwards from the filing calendar rather than treating it as a spring surprise.

Our model: independent ICPAC firms

We are not an audit firm, and we consider that a feature. Statutory audits and review engagements for our clients are performed by licensed Cyprus audit firms — ICPAC members — that we work with regularly. You get one accountable contact who owns the deadline and the preparation, while the opinion itself stays independent. We do not promise “an audit by Friday”; we promise a file the auditor can actually sign off without drama.

How we run it

1. Pre-year-end check. Around the financial year end we review the books for issues — missing documents, unreconciled balances, related-party loose ends — while they are still fixable.
2. Statements and file prepared. IFRS financial statements plus the supporting schedules and confirmations, assembled into an audit-ready pack.
3. Auditor engaged. A licensed ICPAC firm runs the audit or, where the company qualifies and it genuinely makes sense, the review engagement.
4. Queries handled. We answer the auditor’s questions directly, involving you only where a decision is genuinely yours.
5. Statements put to work. The signed statements flow into the tax return and the HE32 — on time, because the whole chain was planned backwards.