Audit requirements in Cyprus: which companies need one and when

Yes, every Cyprus limited company needs one: the accounts of every company end up in front of a licensed statutory auditor. Cyprus has no small-company exemption of the kind the UK or Ireland offer, so size never removes the obligation. What size decides is the form of the engagement, and since February 2026 more of the smallest private companies qualify for a lighter review engagement instead of a full audit.

Does every Cyprus company need an audit?

Yes. Under the Companies Law, every Cyprus company must prepare IFRS financial statements and submit them for audit by a statutory auditor licensed under the Auditors Law. The only relief the law offers is the review engagement option for the smallest private companies, and a review still ends with a licensed auditor's signed report.

That baseline catches every structure founders assume is outside it. The single-shareholder consultancy with one client needs sign-off. So does the holding vehicle with three transactions a year. So does a company that traded nothing at all: dormant companies still prepare financial statements and still file them with the annual return, because no dormancy exemption exists. The expensive version of this mistake is discovering it a year late, with penalties already running.

Which companies qualify for a review engagement instead?

A private company qualifies when its net turnover is at most €300,000 and its gross assets at most €500,000, both met for at least two consecutive financial years. The turnover limit was €200,000 until Law 2(I)/2026 raised it, in force from 6 February 2026, so a band of companies that needed a full audit last year can take the review this year.

Read the test slowly, because each condition disqualifies people who skim it. Both limits must be met, so a company invoicing €150,000 while sitting on €800,000 of assets stays in the full audit. They must be met for two consecutive years, so one quiet year changes nothing. And net turnover counts rental income, interest, dividends and royalties, which is why holding companies that look tiny on trading revenue often fail it anyway.

The option is for private companies only. Public companies are outside it whatever their size, and so are companies in consolidated groups, along with subsidiaries of a non-consolidating parent whose group exceeds the limits. If your company sits in a group of any shape, plan for the full audit until your auditor confirms otherwise. One more boundary worth knowing: the raise to €300,000 applies to companies only. A self-employed individual's review band still tops out at €200,000 of turnover, so the two regimes now diverge.

What is the difference between a review and an audit?

The depth of the evidence. A review gives limited assurance, built mainly on inquiry and analytical procedures: the auditor asks questions, compares the numbers against expectations, and reports whether anything came to their attention suggesting the statements are wrong. An audit gathers substantive evidence, tests balances against bank statements, invoices, contracts and third-party confirmations, and gives positive assurance that the statements show a true and fair view under IFRS.

Everything around the engagement stays the same. A licensed auditor performs the review, the financial statements still get signed, and the HE32 and the corporate tax return are identical either way. What changes for you is time and cost, which is why the thresholds are worth checking every year.

In an owner-managed company, both engagements concentrate on the same few places: revenue cut-off around the year end, whether every expense has a document behind it, anything that moved between the company and its owner, including the director's loan account, and VAT balances reconciled against what was actually filed. Knowing the list in August makes the December close cheap.

When do the audited accounts have to be ready?

They have to be ready in time for the two filings that carry them. The annual return (HE32) is filed within 28 days of its made-up date, once per calendar year, and it must be accompanied by the previous financial year's financial statements. Since the statements have to be signed before they can be attached, the real planning date sits months before the filing date. Our full HE32 guide walks through how the made-up date is set.

The corporate tax return has its own timetable, and the accounts gate it too. The TY2025 return is due by 31 March 2027, and from TY2026 the return and the self-assessed tax are due by 31 January of the second year after the tax year, so the 2026 return and balance are due by 31 January 2028. All the company deadlines in one place are in our Cyprus tax deadlines guide.

Who is allowed to audit a Cyprus company?

Only a statutory auditor or audit firm licensed under the Auditors Law. That licence is why the audit cannot be absorbed by software or by whoever keeps your books: the report has value because the person signing it did not prepare the numbers.

This is also why "my accountant does everything" deserves a second look. One firm can keep your books, and a licensed auditor can sign your accounts, but not the same person for the same company. If you are still deciding how to split that work, do I need an accountant for my Cyprus company covers where the line usually falls.

How do you prepare for an audit?

Keep the books in a state where every figure traces back to a document all year, instead of assembling a folder in the last week. The biggest driver of audit cost is how long the auditor spends connecting entries to evidence, so a company that closes each month clean pays for a shorter engagement than one that reconstructs the year in January.

Before the auditor starts, check five things:

• Every bank account reconciled to its closing statement, with no unexplained differences.
• Every sales invoice and every expense attached to the entry it created, searchable rather than in a drawer.
• Director's loan and other owner-related balances agreed and explainable.
• VAT and VIES returns reconciled to the ledger for the whole period.
• Opening balances agreed to last year's signed statements.

For a first-year company that last point becomes: gather the costs from before the company legally existed, because they belong in the first period's books. Our guide to pre-establishment expenses in Cyprus covers how.

Can Sumly do the audit?

No, and it never will. Sumly is not an audit firm, and no assurance work happens inside the software. What you can do is order the audit or the review from your Sumly dashboard: an independent partner auditor accepts the engagement, performs it and signs it in their own name.

What Sumly removes is the reason audits run long. Every entry in your books stays linked to the document that created it, so when the auditor wants the evidence behind a March expense, it is one click away instead of an email thread. Bank transactions match against invoices as they arrive, so the reconciliations the auditor tests already exist. And the auditor gets their own Sumly login, works through the books directly, and can put questions to Ask Sumly AI and get answers with the figures behind them. If we also formed the company and ran its payroll, the whole trail from incorporation to year end sits in one place waiting for them.

Questions founders actually ask

Frequently asked

Does every Cyprus limited company need an audit?

Yes. Every Cyprus company must prepare IFRS financial statements and have them signed off by a statutory auditor licensed under the Auditors Law. There is no size-based exemption. The smallest private companies can have a review engagement instead of a full audit, which is a lighter procedure performed by the same kind of licensed auditor with the same filings afterwards.

What are the audit exemption thresholds in Cyprus?

Cyprus has no full audit exemption. A private company qualifies for a review engagement instead of an audit when its net turnover is at most €300,000 and its gross assets at most €500,000, with both conditions met for at least two consecutive financial years. The turnover limit rose from €200,000 to €300,000 on 6 February 2026 under Law 2(I)/2026.

Can a dormant company skip the audit?

No. A dormant Cyprus company still prepares financial statements, still files its HE32 annual return with those statements attached, and still needs sign-off from a licensed auditor. A quiet year usually fits the review engagement thresholds, which keeps the cost down, but the obligation itself only ends when the company is struck off or liquidated.

Does a company need an audit in its very first year?

Yes, plan for one from the start. A company's first financial statements cover a period ending no later than 18 months after incorporation, and they need a licensed auditor's sign-off before they can accompany the annual return. First periods take the most audit time because they contain everything that happened before the bank account existed, so keep every document from day one.

Who is allowed to audit a Cyprus company?

Only a statutory auditor or audit firm licensed under the Auditors Law. The person or firm that keeps your books cannot sign off the same company's accounts, and software cannot sign anything. The report is worth something precisely because the person giving it did not prepare the numbers.

Does Sumly perform the audit?

No. Sumly is not an audit firm and never signs assurance work. You order the audit or the review in your Sumly dashboard, and an independent partner auditor performs the engagement and signs it in their own name. The auditor gets their own Sumly login and works through books where every entry is linked to its source document.