Your situation
Your group requires internal audit: what must be covered in Romania
Group internal audit and the Romanian legal requirement do not always overlap. We show you where the gaps are and how to cover them without duplicating work.
60 minutes online with the partner · free, no obligation · written summary within three working days
What you get from the free assessment
- A list of gaps between the group plan and the local requirement
- The options to cover them, with the estimated effort
- A timetable for the first year
In brief
Context, approach, next step
A requirement for the Romanian subsidiary too
Entities whose financial statements are subject to statutory audit must organise an internal audit function (Article 65(7) of Law no. 162/2017). Group internal audit does not always meet the local requirement.
We fill the gaps
Outsourced or co-sourced internal audit, aligned with the group plan, with reports in Romanian and English for local management and for the group.
The five-question test
Our three-page guide shows, in five questions, what group internal audit already covers.
What the subsidiary risks
The group plan does not replace the local function
The requirement in Article 65(7) of Law no. 162/2017 sits with the Romanian entity, not the group. In an inspection, the usual questions are whether the subsidiary has an approved annual plan, reports to local management and follow-up of recommendations.
The good news: most of the group's work can be reused. Usually only the local plan, a few engagements on Romania-specific risks and reporting to the subsidiary's management are missing.
One rule from the outset: we never provide statutory audit and internal audit to the same company. If we are already the subsidiary's statutory auditor, we will recommend another provider for internal audit, and vice versa.
imposed by ASPAAS if the internal audit requirement is not met (Article 40(7)(a) of Law no. 162/2017, as amended by Government Emergency Ordinance no. 137/2024, approved with amendments by Law no. 137/2025).
Options
Three ways to close the gap
Outsourced
We run the function for the Romanian entity: charter, annual plan, engagements and reports, aligned with the group plan.
Co-sourcing with the group
We work alongside the group internal audit team and add only what local law requires.
Local engagements
One or two engagements a year on Romania-specific risks, with a report to local management.
What we check in the assessment
We compare the group's internal audit plan for the last two years with the requirements that apply to the Romanian entity: whether there is an annual plan approved locally, whether reports reach the subsidiary's management and whether the documentation could be presented during an inspection.
The result is a short list of gaps and options to cover them: additional local engagements, co-sourcing with the group team or outsourcing the function for the Romanian entity.
Proof
See how we work
Internal audit for a retail group subsidiary
Function contracted for 2025–2027; we observe counts in stores of a network of more than 100.
Read the case study →InsightMandatory internal audit: what the law requires
Who must comply, what ASPAAS checks and how to set up the function in year one.
Read the article →Free guideWhen group internal audit does not cover the Romanian requirement
What the law requires, with a five-question test.
Get the guide →Free 60-minute assessment
60 minutes with the partner: find out what to do, and in what order
An online conversation, with no obligation: which requirements apply to your company, from which year, which risks we see and what is worth preparing now. Within three working days you receive a 1–2 page written summary. The summary is not an audit report.
Cătălin MaziluManaging Partner · FCCA, CIA
Online booking
Only available slots are shown, Monday to Friday between 08:00 and 20:00 (Romanian time), at least one day in advance.
Choose a time in the calendarYou book through Microsoft Bookings, which opens in a new tab.