Audit requirements in Cyprus: which companies need one and when

Yes, every Cyprus limited company needs one. Every company's accounts end up in front of a licensed statutory auditor. Cyprus has no small-company exemption like the ones in the UK or Ireland, so size never removes the obligation. Size decides the form of the engagement. Since February 2026, more of the smallest private companies can have a lighter review engagement instead of a full audit.

Does every Cyprus company need an audit?

Yes. Under the Companies Law, every Cyprus company must prepare IFRS financial statements and submit them for audit by a statutory auditor licensed under the Auditors Law. IFRS are the international accounting standards. The only relief is the review engagement option for the smallest private companies, and a review still ends with a report signed by a licensed auditor.

The rule catches every structure founders assume sits outside it. The consultancy with one shareholder and one client needs sign-off. So does the holding company with three transactions a year. So does a company that traded nothing at all. Dormant companies still prepare financial statements and file them with the annual return, because there's no exemption for dormancy. The expensive version of this mistake is finding out a year late, with penalties already running.

Which companies qualify for a review engagement instead?

A private company qualifies when its net turnover is €300,000 or less and its gross assets €500,000 or less, both for at least two financial years in a row. The turnover limit was €200,000 until Law 2(I)/2026 raised it, in force from 6 February 2026. So some companies that needed a full audit last year can take the review this year.

Read the test slowly, because each condition trips up people who skim it. Both limits must be met, so a company invoicing €150,000 while holding €800,000 of assets stays in the full audit. They must be met for two years in a row, so one quiet year changes nothing. And net turnover counts rental income, interest, dividends and royalties. That's why holding companies that look tiny on trading revenue often fail the test anyway.

Only private companies can use the option. Public companies can't, whatever their size. Neither can companies in consolidated groups, or subsidiaries of a parent that doesn't consolidate but whose group exceeds the limits. If your company sits in a group of any shape, plan for the full audit until your auditor confirms otherwise. One more boundary to know. The raise to €300,000 applies to companies only. A self-employed person's review band still stops at €200,000 of turnover, so the two regimes now differ.

What is the difference between a review and an audit?

The depth of the evidence. A review gives limited assurance, built mainly on questions and analysis. The auditor asks questions, compares the numbers with what they'd expect, and reports whether anything came to their attention that suggests the statements are wrong. An audit gathers hard evidence. The auditor tests balances against bank statements, invoices, contracts and confirmations from third parties, then gives positive assurance that the statements show a true and fair view under IFRS.

Everything around the engagement stays the same. A licensed auditor does the review, the financial statements still get signed, and the HE32 and the corporate tax return are identical either way. What changes for you is time and cost, which is why the thresholds are worth checking every year.

In a company run by its owner, both engagements focus on the same few places. The auditor checks revenue cut-off around the year end, so each sale lands in the right year. They check that every expense has a document behind it. They look at anything that moved between the company and its owner, including the director's loan account. And they check VAT balances against what was actually filed. Know the list in August and the December close is cheap.

When do the audited accounts have to be ready?

In time for the two filings that carry them. The annual return, form HE32, is filed within 28 days of its made-up date, once per calendar year. The made-up date is the day the return's details refer to. The return must be accompanied by the previous financial year's financial statements. The statements have to be signed before you can attach them, so the real planning date sits months before the filing date. Our full HE32 guide explains how the made-up date is set.

The corporate tax return has its own timetable, and it also waits on the accounts. The return for tax year 2025 is due by 31 March 2027. From tax year 2026, the return and the self-assessed tax are due by 31 January of the second year after the tax year, so the 2026 return and balance are due by 31 January 2028. Every company deadline in one place is in our Cyprus tax deadlines guide.

Who is allowed to audit a Cyprus company?

Only a statutory auditor or audit firm licensed under the Auditors Law. That licence is why software, or whoever keeps your books, can't take over the audit. The report has value because the person signing it didn't prepare the numbers.

It's also why "my accountant does everything" deserves a second look. One firm can keep your books and a licensed auditor can sign your accounts, but not the same person for the same company. If you're still deciding how to split that work, do I need an accountant for my Cyprus company covers where the line usually falls.

How do you prepare for an audit?

Keep the books so that every figure traces back to a document all year, instead of building a folder in the last week. The biggest driver of audit cost is how long the auditor spends connecting entries to evidence. A company that closes each month clean pays for a shorter engagement than one that rebuilds the year in January.

Before the auditor starts, check five things:

• Every bank account reconciled to its closing statement, with no unexplained differences.
• Every sales invoice and expense attached to the entry it created, and searchable, not sitting in a drawer.
• The director's loan and any other balances with the owner agreed and explainable.
• VAT and VIES returns reconciled to the ledger for the whole period.
• Opening balances agreed to last year's signed statements.

For a first-year company, that last point changes. Gather the costs from before the company legally existed, because they belong in the first period's books. Our guide to pre-establishment expenses in Cyprus shows how.

Can Sumly do the audit?

No, and it never will. Sumly isn't an audit firm, and no assurance work happens inside the software. What you can do is order the audit or the review from your Sumly dashboard. An independent partner auditor accepts the engagement, does the work and signs it in their own name.

What Sumly removes is the reason audits run long. Every entry in your books stays linked to the document that created it. When the auditor wants the evidence behind a March expense, it's one click away, not an email thread. Bank transactions match against invoices as they arrive, so the reconciliations the auditor tests already exist. The auditor gets their own Sumly login and works through the books directly. They can put questions to Ask Sumly AI and get answers with the figures behind them. If we also formed the company and ran its payroll, the whole trail from incorporation to year end is in one place, waiting for them.

Questions founders actually ask