The default rule in Cyprus is simple and often misunderstood: private and public limited companies covered by section 152A must prepare financial statements and obtain the applicable audit or review by a licensed statutory auditor. There is no turnover below which a company escapes both. What changed in 2026 is not an exemption — it is that more small companies can now use the limited-assurance review engagement under ISRE 2400 (Revised) instead of a full statutory audit, because the turnover ceiling for that option rose from €200,000 to €300,000.
This guide sets out exactly when a review can replace an audit in 2026, the difference in what you get, a worked example of who qualifies, and the traps that catch companies out. It pairs with our guide to Cyprus company annual obligations and the 2026 tax calendar.
Does every Cyprus company need an audit?
Yes — or a review. Under the Companies Law (Cap. 113), the specified companies must prepare financial statements under the applicable reporting framework and have the required engagement performed by a licensed statutory auditor or audit firm. The only relief for small companies is the type of engagement: a qualifying company can have a review rather than a full audit. Both are signed by a licensed statutory auditor; confirm the applicable filing requirements and deadlines for the entity and period.
A common myth is that the smallest companies need no accounts. That is not true for companies. The "turnover below which no audited accounts are needed" rule applies to self-employed individuals, not to limited companies — see going self-employed in Cyprus. Check any special dormant-company treatment with the statutory auditor; do not assume inactivity alone removes the obligations of section 152A.
When can a review replace the audit in 2026?
A company may opt for a review instead of a full audit only if it satisfies both of the following for two consecutive financial years:
| Test | Limit under current section 152A | Previously |
|---|---|---|
| Net turnover | Not exceeding €300,000 | Not exceeding €200,000 |
| Total gross assets | Not exceeding €500,000 | Not exceeding €500,000 (unchanged) |
| Period for which both must hold | Two consecutive financial years | |
| Who performs it | ICPAC-licensed statutory auditor / audit firm | |
If either test is failed — turnover above €300,000, or assets above €500,000 — a full statutory audit is required. The two tests are cumulative, not alternatives: passing one is not enough.
Section 5 of Law 2(I)/2026 raised the turnover ceiling and took effect on publication on 6 February 2026. It does not say “financial years beginning on or after” that date. Assess the applicable period and the two-year history with the statutory auditor. The turnover test includes rents, interest, dividends and royalties, not only sales.
Audit vs review: what's actually different?
The two engagements differ in the level of assurance the auditor gives — and therefore in how much work is done and what the report is worth to a third party.
An audit provides reasonable assurance: the auditor performs detailed testing and expresses a positive opinion that the financial statements give a true and fair view. A review (ISRE 2400) provides limited assurance: the auditor performs mainly enquiry and analytical procedures and gives a negative-form conclusion that nothing has come to their attention to suggest the statements are materially misstated.
| Statutory audit | Review (ISRE 2400) | |
|---|---|---|
| Assurance level | Reasonable (true & fair view) | Limited (nothing came to attention) |
| Standard | International Standards on Auditing (ISAs) | ISRE 2400 (Revised) |
| Work involved | Risk assessment + substantive testing of balances | Enquiry + analytical procedures |
| Typical cost & time | Depends on scope | Depends on scope |
| Signed by | ICPAC-licensed statutory auditor | ICPAC-licensed statutory auditor |
| Filing obligation | Same deadlines | Same deadlines |
Worked example: who qualifies, who doesn't
The two-test, two-year mechanic is best seen on real numbers. Take three Cyprus companies with a December year-end, looking at their FY2026 accounts:
| Company | Turnover | Total assets | Outcome (FY2026) |
|---|---|---|---|
| A — small consultancy | €250,000 | €180,000 | Review — both tests passed (assuming FY2025 also passed) |
| B — growing trader | €310,000 | €120,000 | Audit — turnover > €300,000 |
| C — asset-heavy holding | €90,000 | €640,000 | Audit — assets > €500,000, even though turnover is tiny |
Company A turned over €248,000 in FY2025 and €250,000 in FY2026, with assets of €170,000 and €180,000. Assuming the amended thresholds apply, Company A is an eligible private limited company and no group restriction applies, both limits are met for two consecutive years, so it can file FY2026 with an ISRE 2400 review rather than a full audit — a different assurance engagement under the same statutory framework. Had its FY2025 turnover been €305,000, the two-consecutive-year test would fail and FY2026 would still need a full audit.
The traps that catch companies out
- Both tests, every year. Failing either turnover or assets — in either of the two years — means a full audit.
- Group restrictions. A parent required to consolidate and its subsidiaries cannot use the review option. Where consolidation is not required, the group-level threshold provisions must still be assessed under section 152A(1)(e), including the relevant calculation rules.
- Switching back and forth. A company hovering around €300,000 should reassess the two-year test for each period and discuss continuity with its auditor.
- Third parties may require an audit. Banks, investors, acquirers and public tenders often insist on audited accounts. A review will not satisfy them even if you qualify for one.
- Self-employed individuals are different. The rules above are for companies; the assurance obligation for a sole trader follows separate turnover rules — see going self-employed in Cyprus.
Which should you choose?
If your company is clearly above either threshold, the decision is made for you — a full audit is required. If you genuinely qualify for a review, weigh three things:
- Does anyone require audited accounts? If your bank, investors or a tender do, take the audit regardless.
- Are you about to grow past €300,000? Continuity often argues for staying on audit rather than switching.
- Is cost the priority and external assurance need low? Then the review is a potentially less extensive engagement; obtain a written fee quote for your circumstances.
Whichever applies, clean bookkeeping is what keeps either engagement fast and inexpensive. The messier the records, the more the auditor has to do — and the more either a review or an audit costs. For a sense of what that looks like in practice, see the annual obligations guide for the wider reporting timetable.
How we handle audits and reviews
We keep your books audit-ready year-round through our accounting and bookkeeping service, work out whether your company qualifies for a review, and coordinate the engagement through our network of ICPAC-licensed statutory auditors — Philippou Accounting prepares and manages; the statutory opinion is signed by the licensed auditor. If you are weighing a switch of provider, our guide to changing accountant in Cyprus shows what a clean handover looks like. Talk to us about which engagement your company needs in 2026.
What counts towards the €300,000 turnover test?
The statutory test uses net turnover as defined by the Companies Law and expressly adds income from rent, interest, dividends and royalties. A business owner who reads only the sales line may therefore reach the wrong answer. A property company with modest service revenue but substantial rent, or a holding company receiving dividends and interest, needs to total the relevant streams under section 152A(1)(d). Ask the statutory auditor to reconcile the calculation to the financial statements rather than relying on a VAT return or management dashboard, which may measure a different figure.
The word “net” does not mean profit after expenses. Likewise, the asset ceiling is the total value of assets before subtracting liabilities. A company with €600,000 of property and €450,000 of borrowing does not pass an asset test of €500,000 merely because its net equity is €150,000. The amounts are tested at the balance-sheet date. Document any judgment on classification, particularly where there are investment properties, intra-group balances or several types of investment income.
How should the two-consecutive-year rule be applied?
The law requires the company not to exceed, or to cease exceeding, both limits for at least two consecutive financial years. Compare the closing balance sheets and relevant turnover figures for the current and preceding year, and retain the calculation with the engagement file. Exactly €300,000 turnover or exactly €500,000 assets does not exceed the respective limit; €300,001 or €500,001 does. If one limit is breached in one of the two years, do not assume that a favourable current year immediately restores review eligibility.
For example, suppose a private limited company reports turnover of €299,000 and assets of €490,000 in 2025, followed by €301,000 and €470,000 in 2026. It passes the asset test both years but breaches the turnover test in 2026. It cannot simply select a review because its assets are small. Reverse the years: a business with €301,000 turnover in 2025 and €280,000 in 2026 also needs the prior-year position analysed; one good year does not establish two consecutive qualifying years. These are illustrative figures, not a determination for a particular company.
Why can a small subsidiary still need an audit?
Section 152A(1)(e) imposes restrictions beyond the standalone thresholds. A parent obliged to prepare consolidated financial statements, and a subsidiary whose parent has that obligation, cannot use the review option under this provision. If a parent is not required to consolidate, the law still tests the parent and subsidiaries at group level over the relevant two-year period. Where the group exceeds the limits under that rule, the Cyprus parent and Cyprus-incorporated subsidiaries cannot choose reviews merely because their individual accounts appear small.
Prepare a current ownership chart, identify the parent and all subsidiaries, and explain whether consolidation is required. Group calculations can involve intra-group receivables, income and investments; section 152A(1)(f) contains specific rules for the amounts used in paragraph (e). A quick addition of standalone turnover is therefore a screening tool, not a final legal calculation. New acquisitions, disposals and overseas parents deserve particular attention before an engagement letter is agreed.
Which entities are outside the small-company review relief?
The alternative in section 152A(1)(d) is framed for private limited companies. It is not a general entitlement for every business or every legal form. Section 152A(1)(g) also excludes companies regulated and supervised by the Central Bank of Cyprus, the Superintendent of Insurance or the Cyprus Securities and Exchange Commission, as well as companies acquiring or holding a qualifying holding in those regulated companies. An apparently small balance sheet does not override those exclusions. Public-interest status and other statutory audit requirements must also be checked before selecting an assurance engagement.
A sole trader should not import these company thresholds into a personal filing decision. Equally, a Cyprus company should not use a sole trader threshold to dispense with accounts. The correct first question is the legal form and the applicable statutory provision; the financial thresholds come after that. If the entity operates in a licensed sector, obtain a written scope assessment from its statutory auditor and relevant specialist advisers.
What work does an ISRE 2400 review involve?
ISRE 2400 (Revised) is a limited-assurance standard for historical financial statements. The practitioner obtains an understanding of the entity and reporting framework, plans the engagement, makes inquiries of management and others, performs analytical procedures and follows up matters that indicate possible material misstatement. It is an evidence-based engagement, not a signature placed on management's numbers. Additional procedures may be needed when answers or trends are inconsistent, and a modified conclusion may be necessary if a matter remains unresolved.
An audit under the International Standards on Auditing is designed to provide reasonable assurance and leads to an audit opinion. An ISRE 2400 review provides a lower level of assurance and a different form of conclusion. Neither means every error or fraud is guaranteed to be found. The practical difference matters where a lender, shareholder agreement, buyer or grant programme calls expressly for audited statements: a review report does not become an audit report merely because it was signed by the same licensed firm.
What should you prepare, and what will it cost?
Start with a complete trial balance, bank and loan reconciliations, accounts receivable and payable listings, fixed-asset register, contracts supporting major revenue streams, investment income records and explanations of unusual year-on-year movements. For a group, add the ownership chart, intercompany ledger and prior financial statements. These records help the auditor assess both eligibility and the proposed engagement. Late reconciliations can delay a review as well as an audit; the smaller standard does not excuse unreliable books.
Ask for a written proposal that identifies whether it covers an audit or review, the accounting periods, the reporting framework, the entity or group scope, management responsibilities, deliverables and likely extra-work triggers. A review often involves less work than an audit, but no law promises a particular price or turnaround. Complex transactions, missing records, first-year balances and reporting to third parties can change the fee. Compare the total scope and whether an audit is contractually required before treating a cheaper quote as a saving.
Is the assurance choice the same as the accounting framework?
No. The choice between audit and review concerns how financial statements are independently examined. The framework used to prepare those statements is a separate question. Law 2(I)/2026 also introduced provisions for a small-entity financial reporting standard, but its commencement is expressly different from the immediate commencement of the section 152A turnover change: the relevant provisions take effect on 1 January of the year following publication of that standard in the Official Gazette. Do not infer that the standard is already available for a given year simply because the €300,000 review threshold is in force.
Before drafting the accounts, agree the applicable framework with the preparer and statutory auditor and check the current commencement position. A review does not remove the duty to prepare financial statements properly under that framework. Nor does submitting accounts without the assurance required by section 152A cure the problem: subsection (2) says statements not audited or reviewed as required are treated as not published for the specified Companies Law purpose.
A defensible decision before appointing the practitioner
First confirm that the entity is a private limited company and screen for sector regulation and qualifying holdings. Next reconcile turnover, including the specified non-sales income, and gross assets for two successive financial years. Then map the group and analyse the consolidation and group-level provisions. Finally review loan covenants, investor rights, tenders and other contracts for any independent audit requirement. Record the reasoning and have the licensed statutory auditor confirm the proposed scope in writing.
This sequence avoids a common expensive mistake: preparing for a review and discovering at sign-off that either the law or a lender requires an audit. It also keeps the decision separate from the annual-return and tax-filing timetable. For those broader obligations, use the company annual obligations guide. For this decision, the decisive source is the current text of section 152A, read with the commencement clause of Law 2(I)/2026 and the applicable ISRE 2400 standard.