Most Spanish SMEs encounter their first statutory audit as a surprise — a threshold crossed, a bank covenant triggered, or an investor demand arriving with a deadline attached. At that point, the gap between where the company is and where it needs to be for an unqualified audit opinion can look very large. Audit readiness is the discipline of closing that gap before the auditor arrives.
This guide explains what audit readiness means under Spanish law, which companies are legally required to audit, what the common gaps are, how the preparation process works, and what it realistically costs.
What Audit Readiness Means in Practice
Audit readiness is not a certification or a product. It is the condition in which a company’s financial records, internal controls, accounting policies, and disclosure documentation are sufficient for an independent auditor to conduct an efficient, limited-scope examination under Normas de Auditoría (NIA-ES, the Spanish adaptation of ISAs).
A company is audit ready when:
- The general ledger reconciles to the balance sheet without manual adjustments
- Accounting policies are documented and applied consistently
- Related-party transactions are identified, priced at arm’s length, and disclosed per PGC and article 231 LSC
- Revenue is recognised according to the applied policy and supporting documentation exists for every material item
- Tax provisions (deferred tax, current tax, contingencies) are calculated and reconciled to the tax returns
- The closing process can be completed, reviewed, and documented within the agreed audit timetable
None of this is exotic. It is standard financial governance. But the reality is that many Spanish SMEs run their accounting primarily for tax compliance purposes — satisfying the quarterly and annual obligations to the AEAT — rather than for financial reporting purposes. The two requirements overlap considerably but are not identical, and the gaps are precisely where auditors spend their time.
Who Is Required to Audit in Spain
LSC Thresholds (Article 263)
The core statutory trigger is article 263 of the Ley de Sociedades de Capital (LSC, Real Decreto Legislativo 1/2010). A company is required to submit its annual accounts to statutory audit if, for two consecutive financial years, it exceeds two of the following three thresholds:
| Threshold | Amount |
|---|---|
| Total assets | > €2,850,000 |
| Net turnover | > €5,700,000 |
| Average employees | > 50 |
The obligation applies from the financial year following the second consecutive year of breach. Conversely, the obligation ceases when a company falls below two of the three thresholds for two consecutive years.
Additional Triggers Beyond Size
Size thresholds are not the only route to a mandatory audit. Under current legislation, audit is also compulsory for:
- Listed companies: Any company with securities admitted to trading on a regulated market supervised by the CNMV must audit under Ley de Auditoría 22/2015 and comply with additional CNMV disclosure requirements.
- Public subsidies: Companies that receive public aid or subsidies exceeding €600,000 in aggregate.
- Financial institutions: Companies under the supervision of the Banco de España, the CNMV, or the Dirección General de Seguros.
- Shareholder request: Shareholders holding 5% or more of share capital may petition the Mercantile Registry (Registro Mercantil) to appoint an auditor under article 265 LSC, even where the company does not meet the size thresholds.
- Voluntary audit: Companies may also voluntarily appoint an auditor — increasingly common in pre-M&A and pre-financing situations.
Ley de Auditoría 22/2015
The current audit framework is set by Ley 22/2015 de Auditoría de Cuentas (LAC), which transposed the EU Audit Reform Directive (2014/56/EU) and Regulation (EU) No 537/2014 into Spanish law. Key requirements relevant to audit readiness include:
- Mandatory auditor rotation: Public Interest Entities (PIE — listed companies, credit institutions, insurers) must rotate the lead engagement partner every seven years and the audit firm every ten years.
- Enhanced independence requirements for PIE auditors.
- Audit committee requirements for PIE.
- Specific reporting on key audit matters (KAM) in the audit report for PIE.
For non-PIE SMEs — the majority of Spanish businesses that face statutory audit — Ley 22/2015 governs auditor appointment, independence, and reporting standards, with the audit itself conducted under NIA-ES.
The Most Common Audit Readiness Gaps
In our experience across several hundred audit readiness engagements in Spain, the same gaps recur regardless of sector:
1. Undocumented Accounting Policies
PGC (Plan General de Contabilidad, RD 1514/2007) requires disclosure of accounting policies in the notes to the annual accounts. Many SMEs apply policies that are not formally documented: revenue recognition criteria, inventory valuation method, provisions policy, lease accounting treatment. When an auditor asks for the policy, the answer “we do what our accountant does” is not sufficient.
2. Related-Party Transactions Without Arm’s-Length Documentation
Article 231 LSC and PGC note 25 require disclosure of transactions with related parties — shareholders, directors, group companies, close relatives. Spanish SMEs commonly run intercompany loans, management fees, property rentals from related entities, or director current account balances. If these are not documented at arm’s-length prices with supporting agreements, they create both audit risk and potential transfer pricing exposure.
3. Weak Month-End and Year-End Close Processes
Auditors work off a trial balance extracted at a specific date. If the close process involves significant post-period adjustments, accruals not booked until the auditor requests them, or reconciling items that take weeks to explain, the audit fieldwork expands and the timetable slips.
4. Inadequate ICFR Documentation
Even for non-PIE companies, auditors assess control risk when determining the nature and extent of their audit procedures. A company with no documented controls over order-to-cash, purchase-to-pay, or financial close will face a more extensive substantive testing programme. This increases audit hours and cost.
5. Deferred Tax Miscalculations
Deferred tax assets and liabilities — particularly those arising from timing differences under PGC — are one of the most commonly misstated items in Spanish SME accounts. Provisions for future tax losses, asset revaluations, and accelerated tax depreciation all generate deferred tax positions that must be calculated, documented, and reviewed annually.
6. PGC vs IFRS Reconciliation (for Foreign-Owned or Consolidating Entities)
Spanish companies that are subsidiaries of foreign groups may need to prepare a IFRS reconciliation package for group reporting purposes in addition to the local PGC accounts. The differences — lease accounting under IFRS 16, revenue recognition under IFRS 15, financial instrument measurement under IFRS 9 — require a formal bridge that is often poorly documented.
The Audit Readiness Process at a Glance
Closing an audit readiness gap is a four-phase process:
- Diagnostic and Gap Assessment — identify what is missing and prioritise by risk
- Remediation — fix the gaps: document policies, clean the ledger, implement controls
- Dry-Run Review — simulate the audit before the real one
- Go-Live Support — support the company during actual audit fieldwork
For full detail on each phase, timelines, and deliverables, see our dedicated article on the audit readiness process phases.
If you want to assess where your company stands right now, start with our audit readiness assessment checklist.
What Audit Readiness Costs
Cost depends entirely on the starting point:
| Scope | Typical Range |
|---|---|
| Gap assessment only (1–3 days) | €2,000 – €5,000 |
| Remediation programme (3–6 months) | €8,000 – €18,000 |
| Full programme including dry-run | €12,000 – €25,000 |
| Ongoing audit support (per year) | €3,000 – €8,000 |
These figures apply to a single-entity Spanish SME below €20M turnover with no significant complexity. Groups, listed companies, or companies with IFRS consolidation requirements will cost more.
For a full breakdown of what BMC delivers and how engagements are structured, see audit readiness services for SMEs.
For companies that need to start immediately with limited budget, the SME audit readiness quickstart provides a practical 30-60-90 day plan.
First Steps
If your company has crossed or is approaching LSC audit thresholds, the optimal moment to start is 12 months before the expected first audit. If you are already at threshold or have an audit appointment, the priority is a gap assessment followed by triage of the highest-risk items.
BMC’s audit readiness team works with Spanish SMEs at all stages — from first-time audit preparation to ongoing controller support for growing businesses. We focus specifically on the Spanish regulatory context: PGC, LSC, NIA-ES, and ICAC guidance — not generic international frameworks.
Contact BMC to discuss your situation or to request an initial gap assessment.
External references:
- ICAC — Instituto de Contabilidad y Auditoría de Cuentas — official audit standards body
- BOE — Ley 22/2015 de Auditoría de Cuentas (consolidated) — current statutory audit law
- IFRS Foundation — IFRS standards for consolidating groups
