Internal Audit Switzerland: Requirements (2026)

Swiss law distinguishes between the statutory external audit (required by the Code of Obligations for most companies) and internal audit (an optional but recommended governance function for larger organisations). This guide covers both: who must have an external audit in Switzerland, when internal audit becomes important, and how Swiss audit requirements scale with company size.

---

The Audit Cost Reality for Swiss SMEs

Most foreign-owned Swiss GmbH and AG do not need an internal audit function. The question is whether you need the external statutory audit, and at what cost.

Practical Cost Breakdown

Company Type	Statutory Audit	Internal Audit	Annual Accounting	Total Compliance Cost
Dormant GmbH, opted out	CHF 0	Not needed	CHF 1’400	CHF 1’400
Active GmbH, <10 FTE, opted out	CHF 0	Not needed	CHF 3’800-8’000	CHF 3’800-8’000
Active AG, 10-50 FTE	CHF 3’000-15’000	Optional	CHF 8’000-20’000	CHF 11’000-35’000
SRO-licensed financial intermediary	CHF 8’000-12’000	Recommended	CHF 10’000-20’000	CHF 18’000-32’000

The SRO audit trap: Self-regulatory organisations conduct an audit within three months of granting membership. If the director or AML compliance officer demonstrates incompetence at that audit, the SRO can revoke the licence on the spot. Total advisory costs for SRO applications can reach CHF 25’000-38’000 including supplementary requests. The three-month window is an examination, not a grace period.

From practice: A company applied for VQF membership with a CHF 10’000 fixed retainer for application assistance. VQF raised supplementary requests, the business model required revision, and total costs reached CHF 38’000 before the licence was granted. The three-month post-licence audit then required additional compliance documentation at CHF 180/hour.

---

External Audit: Swiss Law Requirements

Ordinary Audit (Ordentliche Revision)

An ordinary audit (conducted by a licensed audit firm) is mandatory for companies that exceed two of the three following thresholds in two consecutive financial years:

Threshold	Amount
Total assets	CHF 20 million
Revenue	CHF 40 million
Employees (full-time equivalent)	250

Additionally, ordinary audit is always required for:

• Listed companies (shares traded on SIX or regulated market)
• Companies obligated to consolidate (parent companies of groups)
• Companies that issue bonds publicly

What ordinary audit involves: The auditor issues an opinion on whether the financial statements present a true and fair view in accordance with Swiss GAAP, OR (if applicable), or IFRS. The auditor must be registered with the Swiss Federal Audit Oversight Authority (RAB — Revisionsaufsichtsbehoerde) as a licensed audit expert (zugelassener Revisionsexperte).

---

Limited Audit (Eingeschraenkte Revision)

Companies that do not meet the ordinary audit thresholds must conduct a limited audit unless they opt out entirely.

Limited audit characteristics:

• Less thorough than ordinary audit — analytical procedures, enquiries, and targeted testing rather than full substantive testing
• Shorter auditor’s report: negative assurance (nothing came to our attention suggesting the accounts are incorrect) rather than positive opinion
• Auditor qualification: can be a RAB-registered auditor (zugelassener Revisor) rather than a full audit expert

Who qualifies for limited audit: SMEs, GmbH companies, and AG companies below the ordinary audit thresholds.

---

Audit Opting-Out (Opting-Out)

Small companies can opt out of the audit requirement entirely if:

• The company has fewer than 10 full-time employees on annual average, AND
• All shareholders unanimously agree to waive the audit

Requirements for opting-out:

• All shareholders must consent — a single dissenting shareholder prevents opting-out
• The decision is documented in the shareholder meeting minutes
• Opting-out does not eliminate bookkeeping obligations — annual accounts must still be prepared

Practical note: Banks require audited accounts for lending decisions. Companies seeking financing should consider retaining a limited audit even when legally permitted to opt out.

---

RAB: The Swiss Audit Oversight Authority

The RAB (Eidgenoessische Revisionsaufsichtsbehoerde) supervises auditors conducting statutory audits of Swiss public-interest entities (PIEs — listed companies, banks, insurance companies).

RAB registration categories:

• Zugelassener Revisionsexperte (licensed audit expert): Required for ordinary audits
• Zugelassener Revisor (licensed auditor): Sufficient for limited audits
• Staatlich beaufsichtigter Revisionsunternehmen: For PIE audit firms — additional oversight by RAB

Auditors who are not registered with RAB cannot conduct statutory audits of Swiss companies.

Major Swiss audit firms:

• Big 4: PricewaterhouseCoopers (PwC), KPMG, Deloitte, Ernst & Young (EY) — all major Swiss PIE auditors
• Mid-tier: BDO, Mazars, Grant Thornton, OBT, Treuhand Suisse network members
• Cantonal and regional fiduciaries: for SME limited audits and opting-out compilations

---

Internal Audit as a Governance Function

Internal audit (separate from the statutory external audit) is a function within the organisation that provides independent assurance on risk management, controls, and governance.

Swiss law does not mandate internal audit for most companies. However:

For banks and financial institutions: FINMA requires banks to have an independent internal audit function that reports directly to the board of directors. This is a FINMA circular requirement (FINMA Circular 2017/1). For more on FINMA regulatory requirements, see our guide to FINMA licensing in Switzerland.

For SRO-licensed financial intermediaries: This is a trap that catches unprepared companies. Self-regulatory organisations such as VQF conduct an audit within three months of granting membership. If the director or AML compliance officer demonstrates incompetence at that audit — inadequate documentation, failure to understand client due diligence requirements, missing risk assessments — the SRO can revoke the licence on the spot. The three-month window is not a grace period; it is an examination. Finding qualified AML officers and directors before the audit is one of the hardest practical challenges in obtaining and keeping an SRO licence. We have seen total advisory costs for SRO applications reach CHF 25’000-38’000 including the additional work triggered by VQF raising supplementary requests mid-process.

For listed companies: The SIX Swiss Exchange Corporate Governance Directive recommends internal audit as a best practice, though it is not legally mandatory.

For large corporations: Companies with complex operations, multiple subsidiaries, or significant regulatory exposure typically establish internal audit functions following international standards (IIA — Institute of Internal Auditors standards).

---

Internal Audit vs External Audit: Key Differences

Feature	External Audit	Internal Audit
Legal basis	Mandatory (OR Art. 727-731)	Recommended / regulatory best practice
Conducted by	Independent external firm	Employees or co-sourced with an external firm
Reports to	Board / shareholders	Audit committee / board
Scope	Financial statement fairness	Risk management, controls, compliance, operations
Output	Statutory audit opinion	Internal audit reports and recommendations
Frequency	Annual (at minimum)	Continuous / risk-based programme

---

Audit Requirements for Specific Swiss Entities

Entity Type	Audit Requirement
AG (large)	Ordinary audit (RAB audit expert)
AG (medium)	Limited audit (RAB auditor)
AG (small, <10 FTE, unanimous consent)	Can opt out
GmbH	Same as AG — ordinary, limited, or opt-out based on size
Swiss bank	Ordinary audit + FINMA-approved audit firm + internal audit function
Listed company	Ordinary audit by Big 4 or major mid-tier firm
Association (Verein)	No mandatory audit unless commercially active at scale
Foundation (Stiftung)	Ordinary audit for larger foundations; internal audit recommended

For details on forming these entity types, see our guides on AG formation in Switzerland and GmbH formation in Switzerland.

---

Cost of Swiss Statutory Audit

Limited audit (SME): CHF 3’000-15’000 per year depending on company size and complexity. For a dormant company or a holding with minimal transactions, expect the lower end. For an operating company with 50-100 transactions per year, CHF 8’000-12’000 is typical. Accounting preparation for the audit itself — ensuring the books are audit-ready — adds further cost: standard accounting hourly rates run CHF 150-180 per hour excluding VAT.

Ordinary audit (mid-size company): CHF 20’000-100’000+ per year. The range is wide because ordinary audits scale with transaction volume, number of subsidiaries, and complexity of revenue recognition.

Big 4 audit (listed company or bank): CHF 500’000-5’000’000+ per year.

SRO-related compliance audits: These are not statutory audits in the traditional sense, but SRO members must budget for the initial three-month audit and ongoing annual compliance reviews. The cost of failing the initial audit is not measured in fees — it is measured in the loss of the licence itself.

---

Frequently Asked Questions

Can the company’s own accountant conduct the statutory audit?

No. Swiss law requires the auditor to be independent from the company — the company’s internal accountant or bookkeeper cannot be the statutory auditor. The auditor must be an external, registered RAB auditor or audit expert.

What happens if a Swiss company does not have a statutory audit?

Failure to conduct the required statutory audit is a violation of Swiss company law. The board of directors can face personal liability. For company registration purposes, the Commercial Register can initiate dissolution proceedings for persistent non-compliance.

Does an audit exemption (opting-out) affect the company’s credibility?

With banks and sophisticated counterparties, opting out of audit can raise questions. Many lenders require a limited audit as a condition of financing, regardless of the legal exemption.

How do I register an auditor with the Commercial Register?

When forming or updating a Swiss company, the appointed auditor must be registered in the Commercial Register alongside the company’s other organs. The auditor must provide proof of RAB registration. If the company opts out of audit, a declaration of opting-out is filed with the Commercial Register instead. For the registration process, see our guide on the commercial register in Switzerland.

Can a foreign audit firm conduct a Swiss statutory audit?

Only audit firms and individuals registered with RAB can perform statutory audits of Swiss companies. Foreign audit firms must establish a Swiss presence and obtain RAB registration. In practice, international audit firms operate through their Swiss member firms (for example, KPMG AG in Switzerland is a separate legal entity from KPMG International).

What is the difference between ordinary and limited audit scope?

An ordinary audit requires full substantive testing — the auditor verifies account balances, samples transactions, and provides a positive opinion on the accuracy of the financial statements. A limited audit uses analytical procedures and enquiries, resulting in a negative assurance statement. The ordinary audit provides significantly greater assurance but costs substantially more.

When does a company need to switch from limited to ordinary audit?

The switch is triggered when the company exceeds two of the three thresholds (CHF 20 million total assets, CHF 40 million revenue, 250 employees) in two consecutive financial years. The company must appoint a RAB-registered audit expert and notify the Commercial Register of the change in auditor status.

Is internal audit mandatory for Swiss holding companies?

No. Swiss law does not require internal audit for holding companies purely on the basis of their holding structure. However, if the holding company is listed, subject to FINMA supervision, or exceeds the ordinary audit thresholds, additional governance expectations apply. Many groups with complex subsidiary structures establish internal audit voluntarily to manage risk across entities.

Can shareholders force a company to retain an audit even if opting-out is available?

Yes. Opting-out requires unanimous shareholder consent. A single shareholder can insist on retaining the limited audit, and the company must comply. This right exists to protect minority shareholders who may depend on audited accounts for oversight of the board’s management.

What are the penalties for an auditor who fails to detect fraud?

Under Swiss law (OR Art. 755), auditors face civil liability for damages caused by negligent or intentional breaches of duty. Shareholders, creditors, and the company itself can bring claims. RAB can also impose administrative sanctions, including revocation of the auditor’s registration. Professional indemnity insurance is mandatory for all RAB-registered audit firms.

---

Related guides: Company Formation Switzerland | Accounting in Switzerland | Start a Business in Switzerland | Doing Business in Switzerland

Sources: Swiss Code of Obligations (OR) Art. 727-731 on Fedlex | RAB Swiss Federal Audit Oversight Authority | FINMA Audit Requirements