Mandatory internal audit in Romania: law and set-up

Entities whose financial statements are subject to statutory audit must organise an internal audit function (Article 65(7) of Law no. 162/2017). The requirement applies both to subsidiaries of foreign groups and to Romanian companies that are not part of a group. It sits with the Romanian entity, not the group.

What it means in practice

An internal audit charter and an annual plan approved by management, a few engagements a year in risk areas (for example receivables, inventory, payments), reports to management and follow-up of recommendations. In an inspection, the usual questions are whether there is an approved plan, whether the engagements were carried out and whether recommendations were followed up.

Failure to comply can be sanctioned by ASPAAS: following an administrative procedure, the entity's management can be given an administrative penalty of RON 10,000–⁠100,000 (Article 40(7)(a) of Law no. 162/2017, as amended by Government Emergency Ordinance no. 137/2024, approved with amendments by Law no. 137/2025).

Step by step: the first 90 days

1. Weeks 1–⁠2: confirm the financial year from which the requirement applies and decide which member of management internal audit reports to.
2. Weeks 2–⁠4: choose the model: in-house, outsourced, or co-sourced with group internal audit.
3. Weeks 3–⁠6: draft the charter (purpose, authority, independence, access to information, reporting) and have it approved.
4. Weeks 4–⁠8: assess the risks and approve the annual or multi-year plan.
5. Weeks 8–⁠12: carry out the first engagement, in the highest-risk area.
6. Then: a report to management, an action plan with owners and deadlines, and quarterly follow-up of recommendations.

In-house or outsourced

The function can be staffed internally or outsourced to a specialist firm. An in-house team makes sense when the workload justifies at least one full-time role, held by someone who does not work in the processes they audit. Outsourcing suits companies where internal audit means a few engagements a year. In subsidiaries, group internal audit usually covers group-level risks, not the local plan and reporting to Romanian management; the gap is covered through co-sourcing or local engagements.

Whichever model you choose, responsibility for organising the function stays with the entity's management. An external provider works to the charter and plan management has approved, and reports directly to it.

An example

An illustrative example with round numbers. The subsidiary of a foreign group has turnover of RON 60,000,000, 150 employees and three warehouses. Last year, group internal audit covered IT and procurement, but the reports went only to group headquarters.

For the following year, local management approves a charter and a plan with three engagements: inventory and stock counts, receivables and credit control, and supplier payments. The plan is aligned with the group's, so the same areas are not audited twice. Each report goes to the director, with a copy to the group, and recommendations are logged and reviewed quarterly. In an inspection, the company can show the approved plan, the reports and the follow-up.

Common mistakes

• Treating the group plan as sufficient, with no plan approved by Romanian management.
• Approving the charter and plan, then carrying out no engagements.
• Sending reports only to group headquarters, not to local management.
• Recommendations with no owner or deadline, so they cannot be followed up.
• Giving internal audit to the people who operate the controls, for example the chief accountant reviewing their own processes.
• Appointing the same firm as statutory auditor and internal auditor.

Independence

Statutory audit and internal audit are worth planning together, but with different firms. We do not provide statutory audit and internal audit to the same company, for independence reasons. More on the Internal audit page.

When to ask for help

If you are unsure from which year the requirement applies, whether group internal audit meets the local requirement or which model suits your company, our free 60-minute assessment gives you a written answer, with the risks and recommended next steps.

Sources

• Law no. 162/2017 – Article 65(7) and Article 40(7)(a) (in Romanian)
• Government Emergency Ordinance no. 137/2024 – amending Law no. 162/2017 (in Romanian)
• Law no. 137/2025 – approving GEO no. 137/2024 with amendments (in Romanian)