Working with a Romanian component auditor under ISA 600 (Revised): what the group auditor needs to know
Updated: 4 days ago
By Dr. Maria Piroi
The short answer
Under ISA 600 (Revised), the group auditor decides which work a Romanian component auditor performs, confirms its independence, competence and time, communicates materiality and reporting requirements, and reviews its work. Separately, a Romanian subsidiary above the audit test needs its own statutory audit, signed by an active auditor in the ASPAAS public register, under the ISAs applied in Romania.
The diagram and the steps below are a working English translation of the Romanian texts of law and of ISA 600 (Revised) cited next to each element. The Romanian text of law prevails. In the diagram, L162 stands for Law no. 162/2017 on statutory audit and L82 for Accounting Law no. 82/1991.
The process, step by step
Does the Romanian subsidiary need its own statutory audit? Yes if it exceeded, in two consecutive financial years, at least two of three criteria: total assets of RON 16,000,000, net turnover of RON 32,000,000 and an average of 50 employees (Order 1802/2014, point 563 para. 2). Medium and large entities are audited in all cases (point 563 para. 1). Public interest entities, parents required to prepare consolidated statements and Romanian branches of companies resident outside the European Economic Area are also audited (Accounting Law, art. 34 paras. 1 and 2^1). If none applies, the group auditor still decides whether work is needed on the Romanian component (ISA 600 (Revised), para. 22).
The general meeting appoints the Romanian statutory auditor, and the audit contract is concluded in writing after the appointment (Law no. 162/2017, art. 62 para. 1).
Check the appointee. A statutory audit is carried out only by auditors and audit firms authorised in Romania, members of CAFR and registered in the Electronic Public Register kept by ASPAAS (art. 3 para. 1, art. 14). Carrying out a statutory audit without the annual visa is a contravention fined RON 10,000 to 100,000 (art. 44 para. 1 letter b and para. 2 letter b). The auditor who signs the report must hold active status (art. 34 para. 5).
The group auditor sets the scope and confirms the basics. It determines the components where work is performed and the resources needed (ISA 600 (Revised), para. 22), asks the component auditor to confirm that it will cooperate (para. 24), and confirms that it understands and will comply with the relevant ethical requirements, including independence (para. 25), and has the competence, capabilities and time needed (para. 26).
The group auditor communicates its requirements: the component auditor's responsibilities and the group auditor's expectations (para. 29), matters relevant to risk assessment, related parties and going concern (para. 31), and component performance materiality and the threshold for reporting misstatements (paras. 35 and 36).
The component auditor performs the work and reports back, including whether it complied with the ethical requirements, including independence, the misstatements above the threshold, control deficiencies and its overall findings (para. 45).
The group auditor directs, supervises and reviews. It determines the nature, timing and extent of direction and supervision of the component auditor and of the review of its work (para. 28), and whether to review further component audit documentation (para. 47).
In Romania, the subsidiary closes its own cycle. The statutory auditor issues and signs the Romanian audit report (Law no. 162/2017, art. 34 paras. 1 and 4), and the company files the annual financial statements, with the audit report, by 31 May of the following year for a calendar financial year (Accounting Law, art. 36 para. 1 letter a). An audited company also organises internal audit (Law no. 162/2017, art. 65 para. 7).
Options compared: advantages, disadvantages, risks
Option | Advantages | Disadvantages | Risks |
Subsidiary below the audit test, component work only | No Romanian statutory audit report to obtain and file (Order 1802/2014, point 563 para. 2) | The group auditor still decides whether and what work is needed on the component (ISA 600 (Revised), para. 22) | Once the test is met, not having the statements audited is fined RON 30,000 to 40,000 (Accounting Law, art. 41 point 7, art. 42 para. 1 letter n) |
Subsidiary below the test, shareholders decide a voluntary audit | Audited statements are filed with the audit report; a voluntary audit of a small entity, published with the report, is a statutory audit (Law no. 162/2017, art. 2 point 1 letter b) | Internal audit must then be organised, under the rules issued by CAFR (Companies Law no. 31/1990, art. 160 para. 2; for limited liability companies, art. 199 para. 1) | The contract may be ended early only on proper grounds, and both parties inform ASPAAS within 30 days (Law no. 162/2017, art. 63 paras. 1 to 3) |
Statutory audit required, the Romanian statutory auditor also performs the component work | One auditor in the ASPAAS register works on the subsidiary; the group auditor evaluates one component auditor (ISA 600 (Revised), paras. 25 and 26) | Two deliverables: the component communication to the group auditor (para. 45) and the Romanian audit report (Law no. 162/2017, art. 34) | If the component auditor does not comply with the relevant ethical requirements, including independence, the group auditor obtains evidence without it (ISA 600 (Revised), para. 27 letter a) |
Statutory audit required, another firm performs the component work | The group auditor chooses the component auditor, or performs the work itself (ISA 600 (Revised), paras. 22 and 27) | The Romanian statutory audit still requires an auditor in the ASPAAS register, so two firms work at the subsidiary (Law no. 162/2017, art. 3 para. 1) | Restrictions on access to information or people are considered by the group engagement partner and can affect the group audit (ISA 600 (Revised), paras. 19 to 21) |
Key takeaways
ISA 600 (Revised) applies to audits of group financial statements for periods beginning on or after 15 December 2023 (para. 12); in Romania, ASPAAS adopted it with the same date (Order no. 315/2026, art. 2).
The group auditor, not the component auditor, sets the scope, component performance materiality and the reporting threshold (paras. 22 and 35).
Independence and competence are confirmed for each component auditor (paras. 25 and 26).
The Romanian statutory audit is a separate obligation, with its own auditor checks, report and filing deadline (Law no. 162/2017, art. 3, art. 34; Accounting Law, art. 36).
What does ISA 600 (Revised) expect from the group auditor?
Responsibility and involvement. The group engagement partner takes overall responsibility for managing and achieving quality on the group audit, including sufficient and appropriate involvement in the work of component auditors (para. 16). Before accepting the engagement, the group engagement partner determines whether sufficient appropriate audit evidence can reasonably be expected to be obtained (para. 17), and the group auditor asks group management to acknowledge its responsibility to provide access to information and unrestricted access to people within the group (para. 19).
A component is not necessarily a company. ISA 600 (Revised) defines it as an entity, business unit, function or business activity, or a combination, determined by the group auditor for planning and performing audit procedures (para. 14 letter b). A Romanian subsidiary may therefore be one component, part of one, or covered together with other entities.
What does the standard expect from the Romanian component auditor?
Cooperation, compliance and timely reporting. The component auditor confirms that it will cooperate, including performing the work requested (para. 24), and that it understands and will comply with the relevant ethical requirements, including independence (para. 25). It reports promptly matters relevant to risk assessment, related parties not previously identified and events or conditions that may cast significant doubt on going concern (para. 32), and subsequent events (para. 50).
At the end of its work, the group auditor requests the component auditor to communicate at least the items listed in para. 45, including:
the financial information it was asked to audit and whether it performed the work requested;
whether it complied with the relevant ethical requirements, including independence;
non-compliance with laws or regulations, corrected and uncorrected misstatements above the threshold, indicators of possible management bias and control deficiencies;
other significant matters and its overall findings or conclusions.
The group auditor's report does not refer to a component auditor unless law or regulation requires it (para. 53).
Does the Romanian subsidiary need its own statutory audit?
It depends on its size and status, not on the group audit. A company that exceeds at least two of the three criteria in two consecutive financial years has its annual financial statements audited (Order 1802/2014, point 563 para. 2); medium and large entities are audited in all cases (point 563 para. 1). The test, with the figures and the counting of years, is explained in Romania's audit thresholds in 2026, and the full calendar of a first audit in First statutory audit in Romania: the timeline.
Where a component auditor is required by statute or regulation to express an opinion on the component's financial statements, the group auditor asks group management to inform component management of matters the group auditor has become aware of that may be significant to those statements (ISA 600 (Revised), para. 56).
Who may sign the Romanian statutory audit?
Only an auditor registered in Romania. A statutory audit is carried out by financial auditors or audit firms authorised in Romania under Law no. 162/2017, members of CAFR and registered in the Electronic Public Register (art. 3 para. 1). ASPAAS draws up, updates and publishes the register (art. 14 para. 1). Carrying out a statutory audit without the annual visa issued by the competent authority is a contravention, fined RON 10,000 to 100,000 (art. 44 para. 1 letter b and para. 2 letter b). The audit report is signed and dated by the financial auditor who performed the audit on behalf of the audit firm (art. 34 para. 4), who must hold the status of active financial auditor (art. 34 para. 5).
For the group team, the practical check is the ASPAAS Electronic Public Register, for both the firm and the signing auditor.
Which ISAs apply in Romania, and from when?
The statutory audit is performed under the international standards on auditing adopted by the European Commission (Law no. 162/2017, art. 32 para. 1). Until the Commission adopts a standard on the same matter, ASPAAS may decide to apply an auditing standard (art. 32 para. 3). The standards are translated into Romanian and published through ASPAAS (art. 32 para. 2). For group audits, ASPAAS adopted ISA 600 (Revised) by Order no. 315/2026, published in the Official Gazette no. 166 of 4 March 2026. The standard applies to financial auditors and audit firms authorised in Romania and registered in the Electronic Public Register, for audits of financial statements for periods beginning on or after 15 December 2023 (art. 1 and 2), the same date as in the standard itself (ISA 600 (Revised), para. 12). The Romanian translation is published on the CAFR website.
Who appoints the Romanian auditor, and what follows from the audit?
The shareholders. The statutory auditor is appointed by the general meeting of shareholders or associates, and the statutory audit is carried out under a written contract concluded after the appointment (Law no. 162/2017, art. 62 para. 1). The audited entity may end the contract early only on proper grounds; divergence of opinions on accounting treatments or audit procedures is not one, and both the entity and the auditor inform ASPAAS in writing within 30 days (art. 63 paras. 1 to 3).
An entity whose annual financial statements are subject to statutory audit under the law must organise and ensure the exercise of internal audit (art. 65 para. 7). For breaching that obligation, ASPAAS applies to the management of the entity an administrative penalty of RON 10,000 to 100,000 (art. 40 para. 7 letter a).
How do the Romanian statutory audit and the group reporting package relate?
They are two engagements on overlapping information. The Romanian statutory audit covers the subsidiary's annual financial statements, prepared under the accounting law and the applicable accounting regulations (Law no. 162/2017, art. 1 para. 1). The group reporting package carries the component financial information on which the group auditor asks the component auditor to perform work, at component performance materiality (ISA 600 (Revised), paras. 35 and 45 letter a). The group auditor determines whether the financial information identified in the component auditor's communication is the financial information incorporated in the group financial statements (para. 44).
Three Romanian rules shape the timetable and the files:
Language and currency. Accounting is kept in Romanian and in the national currency (Accounting Law, art. 3 para. 1; Order 1802/2014, point 7 para. 1).
Filing. A company files its annual financial statements by 31 May of the year following the reporting year, or the next working day (Accounting Law, art. 36 paras. 1 letter a and 1^1); the statements are accompanied by the administrators' report and the audit report (art. 28 para. 7).
Working papers abroad. Where the parent is in a third country, confidentiality rules do not prevent the Romanian auditor from sending the group auditor the relevant documentation needed for the audit of the consolidated statements (Law no. 162/2017, art. 26 para. 5), subject to the data protection rules (art. 26 para. 7).
Who is affected?
Group engagement partners and group engagement teams outside Romania whose group includes a Romanian subsidiary, and the finance teams of Romanian subsidiaries that report to a foreign parent.
For who signs payments and contracts in the subsidiary, see who approves payments and contracts in your Romanian subsidiary.
What to do next
Confirm whether the Romanian subsidiary meets the audit test for the current and the previous financial year.
Check the Romanian firm and the signing auditor in the ASPAAS Electronic Public Register.
Agree with group management the access the group auditor needs, and record its acknowledgement (ISA 600 (Revised), para. 19).
Send the group instructions early: scope, materiality and reporting threshold, ethical and independence requirements, deadlines and the reporting format (paras. 29, 31, 35 and 36).
Align the Romanian closing and the group package with the filing deadline of 31 May.
Frequently asked questions
From when does ISA 600 (Revised) apply?
For audits of group financial statements for periods beginning on or after 15 December 2023 (ISA 600 (Revised), para. 12).
Is a component the same as a subsidiary?
Not necessarily. A component is an entity, business unit, function or business activity, or a combination, determined by the group auditor (ISA 600 (Revised), para. 14 letter b).
Who sets component performance materiality?
The group auditor, below group performance materiality, and it communicates the amount to the component auditor (ISA 600 (Revised), paras. 35 and 36).
Can a non-Romanian firm sign a Romanian statutory audit?
Only if it is authorised in Romania, a member of CAFR and registered in the ASPAAS Electronic Public Register (Law no. 162/2017, art. 3 para. 1).
Who appoints the auditor of a Romanian subsidiary?
The general meeting of shareholders or associates (Law no. 162/2017, art. 62 para. 1).
Does the group auditor's report name the Romanian component auditor?
No, unless law or regulation requires it (ISA 600 (Revised), para. 53).
By when are audited statements filed in Romania?
By 31 May of the following year for a calendar financial year (Accounting Law no. 82/1991, art. 36 para. 1 letter a).
Sources
Legislation (the Romanian text prevails):
Law no. 162/2017 on statutory audit, art. 1 para. 1, art. 2 point 1, art. 3 para. 1, art. 14 para. 1, art. 26 paras. 5 and 7, art. 32, art. 34 paras. 1, 4 and 5, art. 40 para. 7 letter a, art. 44 paras. 1 and 2, art. 62 para. 1, art. 63 paras. 1 to 3, art. 65 para. 7, consolidated text published by ASPAAS (in force from 25 July 2025), on aspaas.gov.ro
Accounting Law no. 82/1991, republished: art. 3 para. 1, art. 28 para. 7, art. 34 paras. 1, 2 and 2^1, art. 36 paras. 1 letter a and 1^1 (as amended by Government Emergency Ordinance no. 138/2024), art. 41 point 7, art. 42 para. 1 letter n, consolidated form of 4 February 2025, on legislatie.just.ro
Companies Law no. 31/1990, republished: art. 160 para. 2, applied to limited liability companies by art. 199 para. 1, consolidated form of 18 December 2025, on legislatie.just.ro
Order of the Minister of Public Finance no. 1802/2014, accounting regulations: point 7 para. 1, point 563 paras. 1 and 2, consolidated form of 13 October 2026, on legislatie.just.ro
Order of the President of ASPAAS no. 315/2026 on the adoption of ISA 600 (Revised), art. 1 and 2, Official Gazette no. 166 of 4 March 2026, on legislatie.just.ro
Standards and official documents:
IAASB, International Standard on Auditing 600 (Revised), Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors), April 2022, paras. 12, 14, 16 to 19, 22 to 29, 31, 32, 35, 36, 44, 45, 47, 50, 53 and 56, on iaasb.org
CAFR, Romanian translation of ISA 600 (Revised), on cafr.ro
Related reading on piroi.com: Audit in Romania.
Last updated: 2 November 2026. This article is for information only and does not replace an analysis of your specific situation. Drafted with AI assistance; references were verified against the primary sources.
Piroi acts as statutory auditor or component auditor only for companies whose books it does not keep: for any client, Piroi provides either audit or accounting services, never both.
Questions about working with a Romanian component auditor? Primary contact: Bogdan Năstase · Managing Partner, International Lead
