When people talk about statutory auditing, they often imagine a professional who, once a year, takes the financial statements, checks a few figures and signs a report. In reality, the work is far more complex. The auditor does not merely check that the totals add up: they must understand the business, assess its risks, analyse its accounting and internal control systems, obtain audit evidence, perform checks throughout the year and ultimately form a professional opinion on the financial statements.

The main legislative reference is D.Lgs. 39/2010. Article 14 states that the auditor expresses an opinion on the financial statements in a report and verifies, during the financial year, that the company's accounting records are properly maintained and that business transactions are correctly recorded. Statutory audits also apply the ISA Italia professional standards, adopted within the Italian system and published by the Italian State General Accounting Department.

The auditor does not certify that everything is perfect

Before looking at what the auditor actually does, we need to clarify what the auditor does not do.

The auditor does not guarantee that the financial statements are free of every error, recheck every single invoice or replace the directors in preparing the financial statements. Responsibility for preparing them remains with the company and its directors.

The objective of an audit is to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error, so that a professional opinion can be expressed.

The word “reasonable” is fundamental: auditing uses selective procedures, sampling, professional assessments and risk analysis. It is not an exhaustive check of every transaction.

First stage: understanding the business

The audit begins long before financial statement balances are checked.

The auditor must understand the entity being audited. They must analyse its industry, corporate structure, ownership, business model, main customers and suppliers, financing sources, administrative system, business processes and any areas particularly exposed to misstatement.

ISA Italia 315 specifically addresses identifying and assessing risks of material misstatement through understanding the entity and its environment. It is one of the standards officially applicable to Italian statutory audits.

A manufacturing company with substantial inventories presents different risks from a consultancy. A heavily indebted business faces different issues from a company with no borrowings. A company selling almost everything to a single customer requires different considerations from a business with thousands of dispersed customers.

The auditor must therefore build a proper risk map before deciding which checks to perform.

Engagement acceptance and continuance

Even before planning begins, the auditor must establish whether the engagement can be accepted or continued.

This means assessing, among other matters, auditor independence, potential conflicts of interest, available expertise and resources, management integrity and the terms of the engagement.

Independence is not a minor formality. The auditor must be independent both in fact and in appearance from the audited company. The Italian Code of Ethics and Independence, applicable since 2023, governs ethics, objectivity, confidentiality, professional secrecy and the independence of those authorised to perform statutory audits.

An auditor with economic interests incompatible with the audited company could not simply ignore the problem and continue the engagement.

Planning

After understanding the business, the auditor plans the work.

Planning determines where to focus the checks, which areas carry greater risk, which procedures to use, who should perform them and when.

Not all financial statement items are equally important. In a trading company, trade receivables and revenue may be particularly relevant. In a property company, real estate may dominate. In a business heavily financed by banks, financial liabilities and going concern may require particular attention.

Auditing is therefore a risk-based activity.

The higher the risk of a material misstatement in a particular area, the more attention the auditor generally devotes to it.

Materiality: why every euro is not checked

One of the central concepts in auditing is materiality, known in Italian as significatività.

Not all errors have the same importance to readers of financial statements. An error of 100 euros in a company with revenue of 100 million has a different significance from an error of 100,000 euros.

The auditor therefore sets a materiality threshold to assess which misstatements, individually or collectively, could influence users’ decisions.

This threshold also underpins performance materiality, normally a lower amount used to design audit procedures with a prudent margin.

This concept explains why the auditor does not check every single accounting document. The objective is to identify misstatements that could make the financial statements unreliable as a whole, not to verify that every entry is perfect to the last cent.

Internal control

The auditor must also understand how the business prevents and detects errors.

For example, they may check:

A system in which the same person can order goods, approve the invoice, make the payment and record it presents greater risks than one with appropriate segregation of duties.

The auditor does not necessarily have to design the company's internal control system, but must understand it sufficiently to assess the risk of material misstatement and design audit procedures.

Periodic checks during the year

The audit does not take place only after 31 December.

Article 14 of D.Lgs. 39/2010 requires the auditor to verify during the financial year that the company's accounting records are properly maintained and that business transactions are correctly recorded. A specific Italian professional standard, SA Italia 250B, addresses checks on the proper maintenance of company accounting records.

In practice, periodic checks may involve examining documents such as VAT settlements, tax and social security payments, accounting books, bank statements, bank reconciliations, corporate books, significant transactions during the period and other evidence useful for assessing whether the accounts are maintained properly.

The aim is not to redo the accounting department's work, but to verify that the system operates with sufficient regularity.

Banks: reconciliations and external confirmations

Cash and bank debt are classic audit areas.

The auditor compares accounting balances with bank statements and checks bank reconciliations, which explain temporary differences between the accounting records and the bank's records.

The auditor may also request confirmations directly from banks regarding:

This procedure is particularly important because the information comes from an independent external source, separate from the company.

Trade receivables

Another common check concerns trade receivables.

The auditor must first establish whether the receivables actually exist and whether they are recoverable.

They may therefore select a sample of customers and ask them directly to confirm the balance shown in the company's accounting records. This procedure is known as circularisation, or external confirmation.

If the customer does not respond, the auditor may use alternative procedures, such as checking subsequent receipts, invoices, delivery documents and orders.

But existence is not enough. A receivable of 100,000 euros from a bankrupt customer may exist in the accounts while being worth considerably less than 100,000 euros.

The auditor must therefore also assess recoverability.

Suppliers and unrecorded liabilities

For trade payables, the risk may be the opposite.

A company might have an incentive not to record certain liabilities by year-end to show a stronger financial position or lower expenses.

The auditor may therefore search for unrecorded liabilities, for example by checking invoices received after year-end, payments made in the first months of the following year and documents relating to goods or services received before 31 December.

The check therefore involves not just verifying the liabilities shown in the financial statements, but also asking whether any are missing.

Inventories

For businesses holding inventory, this can be one of the most sensitive areas.

The auditor must obtain evidence of the goods’ actual existence, correct quantities and valuation.

One of the best-known procedures is attendance at the physical inventory count. The auditor observes how the company counts its goods and performs independent sample counts.

They may then examine valuation methods and check for obsolete, damaged or hard-to-sell products requiring a write-down.

Overstated inventory artificially increases both assets and profit.

Fixed assets

For property, plant, machinery and other fixed assets, the auditor may examine purchase invoices, ownership documentation, depreciation schedules, sales and disposals.

They must also assess whether there are indicators of a lasting impairment in value.

A machine carried at 500,000 euros that is no longer used or is technologically obsolete may no longer be worth its recorded amount.

Here too, the check is not limited to asking:

“Does it exist?”

but also:

“Is it really worth the amount shown in the financial statements?”

Revenue: one of the most sensitive areas

Revenue is often a particularly significant area because it directly affects the business's results.

The auditor may examine samples of invoices, orders, contracts, delivery documents and receipts. An important aspect is cut-off, meaning checking that revenue and expenses are allocated to the correct financial year.

Suppose goods dispatched on 5 January are recorded as a sale on 30 December without meeting the conditions for recognition in the previous year. Turnover and profit could be artificially inflated.

The auditor therefore pays particular attention to transactions close to the financial year-end.

Unusual accounting entries

The audit also considers fraud risk.

ISA Italia 240 addresses the auditor's responsibilities relating to fraud in an audit of financial statements and forms part of the official ISA Italia standards system.

The auditor may analyse unusual manual journal entries, year-end postings, transactions with unusual descriptions or entries made by users with elevated privileges.

This does not mean that every unusual entry is fraudulent. It means that certain characteristics increase risk and require further investigation.

Taxes and social security contributions

Periodic checks and the financial statement audit may also cover relevant tax and social security compliance.

Documents examined may include, for example:

However, the auditor does not automatically perform a comprehensive tax inspection equivalent to one conducted by the Italian Revenue Agency. The objective remains to obtain sufficient evidence to assess the proper presentation of financial statement items and the proper maintenance of accounting records.

Employees

For personnel expenses, the auditor may compare the unified employment register (libro unico del lavoro), payslips, social security payments, general ledger and other documents.

They may check that expenses are correctly recognised and that relevant liabilities and accruals are recorded at year-end, such as accrued holiday pay, deferred salary instalments or employee severance pay (trattamento di fine rapporto), under the applicable rules.

Here too, the work often consists of connecting several independent sources and checking that they tell the same story.

Accounting estimates

A significant part of the financial statements is based on estimates, rather than certain amounts.

Examples include:

The auditor cannot simply check an invoice, because the amount is not derived from a definitive document. They must assess the assumptions used by directors, the available data, the reasonableness of those assumptions and any subsequent evidence.

These areas therefore require a greater degree of professional judgement.

Going concern

Financial statements are normally prepared on the assumption that the business will continue operating for the foreseeable future.

The auditor must assess whether events or conditions exist that may cast significant doubt on the entity's ability to continue as a going concern.

For example:

The auditor does not have to predict the future with certainty, but must assess whether the directors’ analysis is appropriate and whether the financial statements provide adequate disclosure.

Events after year-end

The work does not end on 31 December.

Between the financial year-end and the report date, significant events may occur: a customer's bankruptcy, a fire, loss of financing, an acquisition, litigation or a liquidity crisis.

The auditor must assess whether such events provide information about conditions already existing at the reporting date or otherwise require specific disclosure.

This is why audit procedures continue until shortly before the report is issued.

Directors provide representations

At the end of the work, the auditor normally also obtains a representation letter from management and the directors.

This document formalises certain statements relating, among other matters, to the completeness of information provided and the company's responsibilities for preparing the financial statements.

But the letter does not replace other procedures.

The auditor cannot simply ask the directors whether the financial statements are correct and base the opinion on their answer. Representations are only one component of the audit evidence obtained.

Working papers

All work must be documented.

The ISA Italia standards include a specific standard, ISA Italia 230, on audit documentation.

The so-called working papers contain, for example:

The documentation must make it possible to understand what was checked, by whom, when, with what results and what conclusions were reached.

In practice, an inadequately documented audit is difficult to substantiate.

The auditor uses samples

Checking every invoice of a business that issues hundreds of thousands is physically impossible and normally unnecessary.

The auditor therefore uses sampling and other selection techniques.

The sample must not be chosen haphazardly in the everyday sense. It must be designed around the procedure's objective, risk, population and materiality.

High-value items, unusual transactions or samples representative of the population may be selected.

Audit quality therefore depends far more on the ability to identify where a material misstatement might be found than on the absolute number of documents checked.

When an error is found

If the auditor identifies a misstatement, they must understand its nature and size.

They may ask the company to correct the financial statements.

If the misstatement is corrected, the problem may be resolved. If it remains uncorrected, the auditor must assess its individual and aggregate effect against materiality.

A very small difference may not affect the opinion. A material misstatement, however, may require a modification to the audit report.

This explains why discussions with directors and accounting managers are an integral part of the process.

Communicating deficiencies in internal control

During the work, the auditor may also identify problems in the internal control system.

For example:

ISA Italia 265 specifically addresses communicating deficiencies in internal control to management and those charged with governance.

The auditor does not become responsible for the system, but may communicate significant deficiencies identified during the work.

The final stage

After completing the procedures, the auditor must step back and assess the work as a whole.

Completing a checklist is not enough. The question is:

Have we obtained sufficient appropriate audit evidence to support the opinion?

Identified misstatements, estimates, going concern, subsequent events, disclosures in the notes and other relevant matters are reviewed.

Only then is the report reached.

The audit report

Article 14 of D.Lgs. 39/2010 states that the report must identify the audited financial statements, describe the scope of the work and clearly state the auditor's opinion on compliance with applicable rules and on whether the financial statements give a true and fair view of the entity's financial position and financial performance.

In general terms, the conclusion may take different forms depending on the findings.

If the auditor concludes that the financial statements are fairly presented in all material respects, they express an unmodified opinion.

If there are material but not pervasive misstatements, or significant but limited scope restrictions, a qualified opinion may be necessary.

In the most serious cases, an adverse opinion or a disclaimer of opinion may be appropriate, depending on the nature of the issue.

The report is therefore not simply a final signature. It summarises the entire preceding process.

Auditing is not accounting consultancy

Another important distinction concerns the auditor's role.

The auditor must maintain independence and objectivity. They cannot assume management responsibilities belonging to directors and then audit their own work.

The Italian Code of Ethics and Independence specifically addresses threats arising, among other things, from self-interest, self-review and excessive familiarity.

This means the auditor can certainly discuss identified errors and problems with the company, but must avoid becoming the person making the accounting and administrative decisions that they will subsequently have to audit.

Audit quality

Since 2025, the Italian system has also applied the international standards ISQM Italia 1 and ISQM Italia 2 and the new ISA Italia 220 to engagements within their respective effective dates. These standards strengthen the quality management systems of those performing audits and responsibility for quality at individual engagement level.

This matters because auditing is not only about “performing the right checks”, but also about organising work properly, assigning competent staff, conducting reviews, managing consultations and documenting conclusions.

Quality is therefore an integral part of the engagement, not an optional additional check.

A practical example of an audit year

Imagine an industrial company whose financial year coincides with the calendar year.

In the first months of the engagement, the auditor updates their understanding of the business, assesses independence, plans the work and identifies risks. During the year, they perform periodic accounting checks and analyse payments, reconciliations, corporate books and major transactions.

As year-end approaches, they may plan attendance at the inventory count and prepare confirmation requests for banks, customers, suppliers, lawyers and other external parties.

After 31 December, they receive the trial balance, analyse closing balances, test the main areas, examine estimates and provisions, check cut-off and assess subsequent events and going concern.

They then discuss any misstatements with the company, review the final financial statements, obtain management representations and complete their conclusions.

Only then do they issue the report.

The signature is the final step in work that began many months earlier.

Conclusion

A statutory auditor is not simply someone who “checks the financial statements”.

The work consists of building a structured process:

understand the business → identify risks → plan → check accounting records during the year → obtain evidence → examine material areas → assess misstatements and estimates → assess going concern and subsequent events → document → express an opinion.

Individual invoices, bank statements, external confirmations and inventory counts are tools used within this process.

The ultimate objective is to provide users of the financial statements with more reliable financial information through the opinion of an independent professional.

The more appropriate question is therefore not:

“Does the auditor check all the numbers?”

but:

“Has the auditor obtained sufficient appropriate evidence to conclude, with reasonable assurance, that the financial statements as a whole are free from material misstatement?”

That is the true purpose of statutory auditing.