Internal audit
Outsourced internal audit in Romania, compliant with the law and useful to management
For companies whose financial statements are subject to statutory audit, with or without a group, internal audit is a legal requirement. We run it in full or alongside your team, with reports for local management and for the group.
60 minutes online with the partner · free, no obligation · written summary within three working days
Not sure you are subject to statutory audit? Check in under a minute →
Reference framework
Legal framework
Group internal audit does not always meet the Romanian requirement
If a company's financial statements are subject to statutory audit, the law also requires an internal audit function (Article 65(7) of Law no. 162/2017). This applies to Romanian companies that are not part of a group as well.
For subsidiaries of foreign groups, group internal audit usually covers group-level risks, not local requirements: the annual plan, reporting to the management of the Romanian entity and the documentation requested during an inspection.
imposed by ASPAAS if the internal audit requirement is not met (Article 40(7)(a) of Law no. 162/2017, as amended by Government Emergency Ordinance no. 137/2024, approved with amendments by Law no. 137/2025).
How we work
Three options, depending on your existing structure
Outsourced
We take over the function in full: the charter, the annual plan, the engagements, the reports and the follow-up of recommendations.
Co-sourcing
We work alongside your team or the group's team, in areas where resources or expertise are missing: IT, procurement, payroll, SOX.
Targeted engagements
A single area: payments and suppliers, inventory, month-end close or compliance.
The first year
From assessment to the first report
- Week 1
Assessment
What the group already covers, what the law requires and where the significant risks lie.
- Weeks 2–3
Charter and annual plan
Approved by management, with the engagement schedule. Charter and plan are usually ready within 2–3 weeks of receiving the information we need.
- Months 2–4
First engagement
In the highest-risk area; findings are discussed before the report is issued.
- Quarterly
Reporting to management and the group
Progress against the plan and status of recommendations, in Romanian and English.
Short answers
Frequently asked questions
The group already has internal audit. Is that enough?
Rarely in full. The group usually covers group-level risks, but not a locally approved annual plan, reporting to Romanian management or the documentation for an ASPAAS inspection. In the assessment we check exactly what is missing.
Can internal audit be outsourced?
Yes. The function can be staffed internally or outsourced to a specialist firm. Outsourcing is common for subsidiaries, where the workload does not justify a full-time role.
Do you perform SOX testing for Romanian subsidiaries of US groups?
Yes. Walkthroughs, tests of design and operating effectiveness for key business controls and IT general controls, sample selection to the group's methodology, deficiency write-ups and remediation retesting. The documentation is in English so the group and its external auditor can rely on it, and we are available until 20:00 Romanian time (13:00 US Eastern) for calls with group headquarters.
How long does it take, and who needs to be involved on our side?
In the first year, the charter and annual plan are ready within 2–3 weeks, and each engagement takes a few weeks. On your side, the finance director and the owners of the audited processes are usually involved, with grouped requests and a timetable agreed at the outset.
Can the reports follow the group's format?
Yes. Reports can follow the format and rating scale used by your group internal audit, in English, and separately for local management, in Romanian.
Can you also be our statutory auditor?
No. We never provide statutory audit and internal audit to the same company, for independence reasons. Independence rules also restrict combining the statutory audit with financial statement preparation or other services involving management decisions. For public-interest entities, Regulation (EU) No 537/2014 (Article 5) also prohibits internal audit services, and for designing and implementing internal control or financial IT systems the prohibition also covers the financial year immediately before the audited period. We assess your situation in the first conversation.
Proof
See how we work
Internal audit for a retail group subsidiary
Function contracted for 2025–2027; we observe counts in stores of a network of more than 100.
Read the case study →InsightMandatory internal audit: what the law requires
Who must comply, what ASPAAS checks and how to set up the function in year one.
Read the article →Free guideWhen group internal audit does not cover the Romanian requirement
What the law requires, with a five-question test.
Get the guide →Free 60-minute assessment
60 minutes with the partner: find out what to do, and in what order
An online conversation, with no obligation: which requirements apply to your company, from which year, which risks we see and what is worth preparing now. Within three working days you receive a 1–2 page written summary. The summary is not an audit report.
What the assessment includes →
Already know what you need? Request a proposal →
Cătălin MaziluManaging Partner · FCCA, CIA
Online booking
Only available slots are shown, Monday to Friday between 08:00 and 20:00 (Romanian time), at least one day in advance.
Choose a time in the calendarYou book through Microsoft Bookings, which opens in a new tab.