You have realised your company is heading towards its first statutory audit — or has just been told it needs one. The audit is in nine months, or six months, or three. The accounts are broadly correct but nothing is documented, the related-party loans have no paperwork, and no one is quite sure what PGC note 25 requires. Where do you start?
This guide is for Spanish SMEs that need to get audit ready as efficiently as possible. It focuses on the highest-impact actions, the minimum viable budget, and the decision points that determine whether you can proceed internally or need professional support.
For the full regulatory background and legal thresholds, see the complete audit readiness guide. For the full four-phase programme, see audit readiness process phases.
Before You Start: Confirm the Trigger
Before spending any time on preparation, confirm exactly why you need an audit:
-
Size threshold trigger (art. 263 LSC): Have you exceeded 2 of 3 thresholds (total assets >€2.85M, turnover >€5.7M, employees >50) for two consecutive financial years? If yes, the obligation applies from the following year.
-
Shareholder request (art. 265 LSC): Has a shareholder holding ≥5% of capital requested appointment of an auditor via the Mercantile Registry? This can happen regardless of size.
-
Bank or investor covenant: Is the audit required contractually by a bank, private equity firm, or grant body? If so, what is the deadline?
-
Voluntary decision: Is this a strategic choice — for example, to prepare for a sale process, a due diligence, or to improve financial governance?
The trigger determines the urgency and, in the case of a statutory trigger, the legal deadline for auditor appointment.
Auditor appointment deadline: Under article 264 LSC, the auditor must be appointed by resolution of the general meeting for a term of three to nine years, or — if the meeting fails to appoint — by the Mercantile Registry, which can be requested by administrators or any shareholder. Do not miss this step: engaging the auditor late compresses preparation time.
Day 1–30: The Minimum Viable Assessment
The goal of the first 30 days is to understand exactly where you stand. Do not start remediating anything until you know what needs fixing.
Week 1: Gather and Review What Exists
Collect the following documents. They represent the baseline from which every audit starts:
- Last three years of annual accounts (if available) — deposited at the Mercantile Registry
- Last year’s corporate tax return (Modelo 200)
- Current trial balance (exported from your accounting software)
- Fixed asset register
- List of related parties: directors, shareholders >5%, family members in the business, group companies
- List of intercompany loans or transactions with related entities
- Any existing written accounting policies
Do not worry if some of these do not exist in a formal form — that is precisely what the assessment surfaces.
Week 2–3: Self-Assessment Against the Checklist
Work through the audit readiness assessment checklist. Assign RAG status to each item. Be honest — Amber is not Green.
Focus particular attention on:
- Related-party register: Every transaction with a related party that lacks written documentation is a Red. This is the single most common audit finding in Spanish SMEs.
- Revenue recognition: Can you explain in one paragraph how you decide when revenue is recognised? If not, that is an Amber at minimum.
- Deferred tax: Does your accountant calculate deferred tax? If you are not certain, it is likely an Amber or Red.
Week 4: Count the Reds
Tally the results:
- 0–3 Reds: You are in reasonable shape. You need focused remediation, not a full programme. Internal resources plus advisory support for the high-risk items is a viable approach.
- 4–8 Reds: You have a material audit risk. A professional gap assessment is recommended before proceeding with remediation to avoid fixing the wrong things first.
- 9+ Reds: You need a full audit readiness programme. Internal-only remediation carries a high risk of leaving material gaps. Commission professional support and start immediately.
When 9 months or more remain before the audit year-end, you have time to proceed through all four phases. When six months or fewer remain, the process must be accelerated and professional support becomes non-optional for a company with 9+ Reds.
Day 31–60: High-Impact Remediation
The items that matter most for a first audit are not the hardest to fix. They are the ones where no documentation currently exists.
Priority 1: Related-Party Documentation (Impact: High / Effort: Medium)
For every intercompany loan, management fee, rental agreement, or current account with a related party:
- Draft a written agreement (even backdated to the transaction start date — the key requirement is that it exists and reflects the actual terms)
- Confirm the interest rate on loans is at least the EURIBOR-referenced market rate
- Calculate and book any underpaid interest
- Prepare the PGC note 25 disclosure for the current year
This can be done internally or with minimal external legal/accounting cost. The agreements do not need to be complex — a simple bilateral contract of two to three pages per transaction is sufficient.
Priority 2: Accounting Policy Documentation (Impact: High / Effort: Low-Medium)
Start with the four policies that auditors focus on most:
- Revenue recognition: When does revenue transfer? For services, at completion or over time? For goods, on delivery? Write this down in one paragraph.
- Provisions: What threshold does the company use for recognising a provision? What types of provisions are maintained?
- Fixed asset capitalisation: What is the minimum amount to capitalise vs. expense? What depreciation rates are applied?
- Inventory valuation: FIFO or weighted average? How is obsolescence assessed?
Use ICAC’s published PGC as your primary reference (icac.gob.es). Many ICAC consultation resolutions (consultas) answer specific policy questions — these are freely available and authoritative.
Priority 3: General Ledger Tidy-Up (Impact: Medium-High / Effort: Variable)
Identify the top 10 balance sheet accounts by materiality. For each:
- Can you prepare a reconciliation from the account balance to supporting documentation within one day?
- Are there any aged items without explanation?
Items that cannot be reconciled within one day are risks. Make a list. Do not try to fix everything at once — prioritise by materiality.
Day 61–90: Controls and Dry-Run Preparation
Controls: Document What You Already Do
Most Spanish SMEs have informal controls that work — the owner signs off on payments, the accountant reviews the payroll, invoices are matched before payment. The problem is that none of this is written down.
In weeks 7 through 9, document existing controls for the four core cycles: order-to-cash, purchase-to-pay, payroll, and financial close. For each control:
- What is the risk it addresses?
- Who performs it?
- How often?
- What evidence is left (signature, email, system log)?
This documentation does not need to be a formal control framework. A two-page narrative per cycle is sufficient for a first audit of a small SME.
Free Tools and Templates
- ICAC PGC text: icac.gob.es — free, authoritative source for all PGC accounting policy reference
- BOE Ley 22/2015: boe.es — consolidated audit law
- CNMV: cnmv.es — relevant only for listed companies or those approaching listing
- Your accounting software: Most Spanish accounting software (Sage, Contasol, A3, Holded) can produce trial balance exports, aged receivables, and fixed asset registers. Use these before commissioning any bespoke analysis.
When to Bring In an Advisor
For most SMEs with 4+ Red items from the self-assessment, professional input is warranted no later than day 30. The items that most require professional judgement are:
- Deferred tax calculation — requires accounting expertise and knowledge of the tax return
- Related-party arm’s-length pricing — requires knowledge of transfer pricing rules and Modelo 232 obligations
- ICFR design for compensating controls — requires understanding of what auditors actually test
- Any IFRS reconciliation — requires IFRS technical knowledge
A gap assessment from BMC can confirm which of these apply to your situation and what it will cost to address them. See audit readiness services for SMEs for scope and fee ranges.
The 90-Day Checkpoint
At the end of 90 days, you should have:
- A complete gap register (even if many items are still Amber)
- Written accounting policies for the four core areas
- Related-party agreements in place for all material transactions
- A documented control for each of the four core cycles
- A timetable for the remaining remediation before the audit year-end
If you have a full programme under way with professional support, the dry-run should be scheduled for approximately 6 weeks before audit fieldwork begins.
The Cost of Not Preparing
Extended audit fieldwork costs. For a Spanish auditor billing at standard rates, each additional day of fieldwork costs approximately €800–€1,500 depending on firm size. A company that enters audit with a disorganised close, undocumented policies, and unexplained balance sheet items can easily generate an additional 5–15 days of fieldwork compared to a prepared company — a cost of €4,000–€22,500 in additional audit fees on top of the initial audit fee, not counting the internal management time consumed responding to queries.
A qualified audit opinion — the consequence of an unresolved material misstatement — has further consequences: bank covenant reviews, reduced acquisition multiples in any future M&A process (see EBITDA multiples by sector in Spain), and increased scrutiny in future audit years.
The investment in audit readiness preparation is not optional — it is timing. The question is whether you incur the cost before or during the audit.
External references:
