Obligation to implement the internal audit function and the controls initiated by ASPAAS for companies that are subject to this requirement

According to the provisions of Law no. 162/2017, as subsequently amended and supplemented, the implementation of an internal audit function is mandatory for all companies that meet the size criteria for statutory audit (i.e., exceeding at least two of the following thresholds: total assets over 16 million lei, net turnover over 32 million lei, and an average number of employees exceeding 50). This obligation also applies to public-interest entities, regardless of whether these thresholds are met.

Failure to comply with the legal provisions regarding the organization of the internal audit function may result in administrative sanctions, including fines ranging from RON 50,000 to RON 100,000.

As of 2024, the Authority for the Public Oversight of the Statutory Audit Activity (ASPAAS), under the Ministry of Finance, has requested statutory auditors to indicate in their annual reports the cases in which audit clients have not implemented the mandatory internal audit function.

Currently, ASPAAS has begun sending notifications to the companies concerned, requesting supporting documentation to prove compliance with the legal obligation to organize internal audit. These actions are part of an initiative to ensure compliance with applicable legal requirements in the field.