Home / IT audit for annual financial statements

HGB Sec. 316 · Sec. 316a

IT audit for annual financial statements

Q: Do you replace the statutory auditor?

No. In statutory audits I work as an IT expert or as part of the audit team and deliver the technical analysis that supports the audit opinion. In voluntary audits I act independently.

Q: Which standards do you audit against?

In line with IDW PS 330 and ISA [DE] 315 (revised), supplemented by ISAE 3000, IDW PS 951 and IDW PS 850 as well as GoBD.

Q: How does collaboration with audit firms work?

Through fixed allocations for the audit season and call-offs for peaks. I audit on a risk basis, on schedule and document in the format of your working papers. My profile for audit firms can be downloaded directly.

Q: How do you ensure your independence?

I do not advise any client that I audit in the same context. This avoids conflicts of interest.

Q: Is an IT audit worthwhile even without an audit obligation?

Yes. A voluntary IT audit detects IT and compliance risks early, strengthens the internal control system and provides evidence to banks, supervisors and investors.

Accounting is IT-based, so every statutory audit is also an IT audit. As a CISA-certified IT auditor, I deliver the technical analysis that supports the audit opinion.

Get in touch For audit firms

Diagram of accounting systems with upstream systems, logistics, subledgers, general ledger and reporting

AUDIT AREAS

What I audit as part of the statutory audit

ITGC

IT General Controls

Access, authorisations, changes, backup and recovery.

ERP

Application audit

Accounting and ERP systems, interfaces and upstream systems.

PROCESS

Process audit

Accounts receivable, accounts payable and payments.

GOBD

Data security

Integrity and compliance under GoBD.

BCM

IT resilience

Business continuity and recovery capability.

LEGAL BASIS

Who is subject to audit

Medium-sized and large corporations are subject to mandatory audits according to the size classes of Section 267 HGB. The decisive factor is that at least two of the three criteria are exceeded on two consecutive balance sheet dates. Smaller companies can opt for a voluntary audit and benefit just as much.

Early detection of IT and compliance risks
Proof of proper accounting to banks, supervisors and investors
Stronger internal control system and process reliability

Size classes under HGB and the EU definition – and what they mean for the IT audit
Type of company	Total assets	Revenue	Employees	Legal basis	Audit obligation	Relevance for the IT audit (CISA)
Sole trader	–	≤ €800,000 and ≤ €80,000 annual profit	–	Sec. 241a HGB	None	Exempt from bookkeeping obligations. Voluntary IT audits possible to demonstrate IT and data protection compliance.
Micro corporation	≤ €0.45 m	≤ €0.9 m	≤ 10	Sec. 267a HGB	None	No statutory audit, but recommended to prepare for growth and funding.
Small corporation	≤ €7.5 m	≤ €15 m	≤ 50	Sec. 267(1) HGB	Voluntary	IT audit supports GoBD, GDPR and DORA requirements.
Medium-sized corporation	≤ €25 m	≤ €50 m	≤ 250	Sec. 267(2) HGB Sec. 316 HGB	Required by law	IT audits form the basis of the statutory auditor’s opinion (IDW PS 951, 330, 850).
Large corporation	> €25 m	> €50 m	> 250	Sec. 267(3) HGB Sec. 316 HGB	Required by law	Comprehensive IT audit required; CISA assesses ITGC, IT security and compliance structures.
Corporation & Co. KG	according to the size class of the corporation	according to the size class of the corporation	according to the size class of the corporation	Sec. 264a in conjunction with Sec. 316 HGB	Required by law	Audit under Sec. 316 HGB as for corporations; IT system audit required.
Consolidated financial statements	> €25 m net > €30 m gross	> €50 m net > €60 m gross	> 250	Sec. 293 HGB Sec. 316a HGB	Required by law	CISA supports the group IT system audit, data aggregation and system integration.
EU SME “small”	≤ €10 m	≤ €10 m	< 50	Recommendation 2003/361/EC	None	Voluntary IT audits to strengthen security, compliance and creditworthiness.
EU SME “medium”	≤ €43 m	≤ €50 m	< 250	Recommendation 2003/361/EC	Partly / recommended	IT audit to prepare for regulatory examinations, e.g. DORA, NIS2.

Thresholds under HGB as amended since 17 April 2024, applicable to financial years beginning on or after 1 January 2024. Employees as an annual average. Group: net after consolidation, gross before consolidation. EU SMEs under Recommendation 2003/361/EC: employee headcount must be met plus either revenue or total assets.

Roles and audit structure under Sections 316 and 316a HGB: financial statement audit and IT audit by CISA

MY ROLE

IT expert in the audit team

In statutory audits I work as an IT expert or as part of the audit team, not as the statutory auditor. In voluntary audits I act independently.

IDW PS 330 IDW PS 850 IDW PS 951 ISA [DE] 315 (rev.) ISAE 3000 GoBD

FOR AUDIT FIRMS

IT audit capacity for your firm, without hiring your own specialists

I support small and medium-sized audit firms during audit season: risk-based, on schedule and documented in the format of your working papers.

Predictable

Fixed allocations for the season, on call for peaks.

Auditor-compliant

Approach in line with IDW PS 330 and ISA [DE] 315, properly documented.

Independent

No consulting for the same client, no conflicts of interest.

Enquire about collaboration Download profile for audit firms

“Heinrich Markus Schulte’s deep technical knowledge and regulatory understanding are unmatched. His insights were invaluable for our IT audit.”

Martin Otten · Lead Auditor, WPNO Cologne

Plan the next audit season

Let’s talk about scope, dates and the right model for your company or firm.

Get in touch

FREQUENTLY ASKED QUESTIONS

Good to know

Do you replace the statutory auditor?

No. In statutory audits I work as an IT expert or as part of the audit team and deliver the technical analysis that supports the audit opinion. In voluntary audits I act independently.

Which standards do you audit against?

In line with IDW PS 330 and ISA [DE] 315 (revised), supplemented by ISAE 3000, IDW PS 951 and IDW PS 850 as well as GoBD.

How does collaboration with audit firms work?

Through fixed allocations for the audit season and call-offs for peaks. I audit on a risk basis, on schedule and document in the format of your working papers. My profile for audit firms can be downloaded directly.

How do you ensure your independence?

I do not advise any client that I audit in the same context. This avoids conflicts of interest.

Is an IT audit worthwhile even without an audit obligation?

Yes. A voluntary IT audit detects IT and compliance risks early, strengthens the internal control system and provides evidence to banks, supervisors and investors.