Audit preparation: what the auditor will ask for in your first statutory audit

A German GmbH needs a statutory audit once it exceeds two of three thresholds on two consecutive year ends: 7.5 million euros balance sheet total, 15 million euros revenue or 50 employees on average. Audit preparation then means three things: appointing an auditor before year-end, planning the inventory count with them, and having reconciliations, contracts and supporting documents ready per account before fieldwork starts.

A first audit is rarely hard because the numbers are wrong. It is hard because the evidence behind them is spread across the tax advisor's DATEV, email inboxes and spreadsheets, and has to be reassembled under time pressure. The companies that get through it calmly are the ones whose books produce the evidence as a by-product of the monthly close.

---

When does a German GmbH need its first statutory audit?

The duty comes from § 316 of the German Commercial Code (HGB). Annual accounts and the management report (Lagebericht) of every corporation that is not small under § 267 HGB must be audited by an auditor (Wirtschaftsprüfer). Without the audit, the annual accounts cannot be formally adopted.

A company is small as long as it does not exceed two of these three thresholds: 7.5 million euros balance sheet total, 15 million euros revenue in the twelve months before the year end, and 50 employees on average. Above that, up to 25 million, 50 million and 250 employees, it is medium-sized. Two details matter for planning:

• Two consecutive year ends. The new size class applies only when the thresholds are exceeded on two consecutive balance sheet dates. A company that crosses them for the first time at the end of 2026 and again at the end of 2027 is audited for 2027. You therefore usually see the audit coming a year ahead.
• New companies and restructurings. After a formation or a conversion, the first balance sheet date is enough. A new holding or a merged entity can be audit-liable in its first year.

Many scale-ups face an audit earlier for other reasons. Investors often require audited accounts in the shareholder agreement, banks ask for them for larger credit lines, and some funding programmes require an auditor's confirmation. Then the scope is contractual rather than statutory, but the preparation is largely the same.

When should you appoint the auditor, and what happens before year-end?

Under § 318 HGB, the shareholders elect the auditor, and they should do so before the end of the financial year to be audited. The managing directors then issue the engagement. In practice, start the selection in spring or summer of the audit year. Auditor capacity in January to April is limited, and a firm engaged in December has little room to plan.

One rule shapes the choice. An auditor who helped keep the books or prepare the annual accounts is excluded from auditing them (§ 319 HGB), unless that help was minor. Your tax advisor (Steuerberater) can go on preparing the accounts, but a different firm audits them.

A first audit usually runs in three phases:

1. Interim audit, in autumn. The auditor learns your processes, tests controls such as invoice approval and payment release, and reviews IT systems and access rights.
2. Inventory count, at year-end. If you hold stock, the auditor will want to observe the count. Agree the method and date in advance; the count procedure is explained in year-end close in Germany.
3. Year-end fieldwork, in the first months of the new year. Account-by-account testing, confirmations and the audit opinion.

A first audit has an additional step. Because the prior year was never audited, the auditor must also gain assurance over the opening balances, under the auditing standard ISA [DE] 510. Expect questions about the previous year's balance sheet, especially fixed assets, provisions and receivables.

What will be on the auditor's document list?

Auditors send a request list, often called the PBC list (prepared by client), before fieldwork. The exact list varies, but a first audit of a German GmbH usually asks for:

• Trial balance (Summen- und Saldenliste) and the draft annual accounts, plus the draft management report for medium-sized companies
• Bank statements and bank confirmations for every account on the balance sheet date
• Open items lists for receivables and payables, reconciled to the general ledger
• Balance confirmations (Saldenbestätigungen) from selected customers and suppliers, sent by the auditor
• Fixed asset register with additions, disposals and depreciation, and invoices for large additions
• Inventory count records and the valuation of stock
• Calculations for accruals and provisions, such as holiday, bonuses, warranties and outstanding invoices
• Significant contracts: loans, leases, large customer contracts, shareholder agreements
• Payroll reconciliation from payroll to the ledger
• Tax returns, tax assessments and correspondence with the tax office
• Minutes of shareholder meetings and managing director resolutions
• Documentation of the accounting process and IT systems, including who can book, approve and pay

None of this is unusual. The work is in producing it per account, for the balance sheet date, with every number tying back to the ledger.

Which areas cause the most findings in a first audit?

Patterns repeat. Cut-off comes first: revenue and costs in the wrong year, often because invoices are booked by invoice date rather than service date. Provisions and accruals follow: calculated once at year-end from memory rather than from data. Booking accruals every month as a fixed step of the month-end close checklist turns this into a review.

Reconciliations come third. Auditors expect each balance sheet account to be reconciled and the reconciliation to be stored with the period, as described in balance sheet reconciliation. A reconciliation done in a spreadsheet that has since been overwritten counts for little.

Controls close the list. Invoice approvals by email, the same person setting up a supplier and releasing payment, and shared logins are typical findings. The auditor reports them in a management letter, and they become the agenda for next year. Why email approval is not a control is covered in internal controls in accounting.

Should you change your finance system before the first audit?

It depends on timing. A system change during the audit year means the auditor will also look at the data migration: opening balances, mapping of accounts and the completeness of history. That is manageable if the migration is documented and the old data stays accessible. It is uncomfortable if the change happens in November.

The cleaner route is to switch at the start of a financial year, or early enough in it that several closed months exist in the new system before the interim audit. With an implementation that takes four to ten weeks instead of the twelve to eighteen months typical for legacy ERP, and a parallel run before the old setup is switched off, this is usually possible within one planning cycle. Your tax advisor should be part of the plan, because the DATEV handover continues either way.

How does Agent F keep you audit-ready?

Agent F treats audit evidence as something the close produces, not something assembled afterwards. Every booking carries its source document: the invoice, the receipt, the bank transaction. Reconciliations of bank, receivables, payables and other balance sheet accounts are stored per period, and the period is locked once closed.

During the close, Agent F suggests accruals, depreciation and prepayment entries from your data, each with a confidence score. A person approves each one, and approvals for invoices and payments follow defined rules rather than email. All of it sits in an immutable audit trail that shows who changed what and when, which is the evidence auditors test in controls work. How this fits GoBD (German digital bookkeeping rules) is explained in audit trail in accounting.

Two common objections deserve a direct answer. Your tax advisor keeps working in DATEV, with a DATEV export from the same locked periods. And the data is hosted in Germany, GDPR-compliant and encrypted with AES-256, with daily backups; ISO 27001 certification is in progress.

If an audit is coming, check your size class at the last year end and forecast it for this one, get the auditor elected before this financial year ends, agree the inventory count date, and request a sample document list now. Then test it against one closed month: if you can produce every item for that month in a day, year-end will be routine.

Learn how Agent F works, or see it on your own books at agent-f.ai/demo.