What are the audit requirements in Portugal?

Audit requirements in Portugal are governed primarily by the Portuguese Companies Code (Código das Sociedades Comerciais) and the legal framework administered by the Ordem dos Revisores Oficiais de Contas (OROC), the national body that licenses statutory auditors. Most private limited companies (sociedades por quotas, or Lda) and public limited companies (sociedades anónimas, or SA) are subject to mandatory audit once they cross certain size thresholds, and listed entities face additional obligations under EU regulation. Understanding these rules is essential for foreign founders and investors operating in Portugal, because non-compliance carries financial penalties and can block access to public contracts, EU funding and bank financing. This guide covers who must be audited, the applicable thresholds, the role of the Revisor Oficial de Contas (ROC), the audit process itself, ongoing compliance obligations, and the consequences of failing to meet statutory requirements.

The obligation to appoint a statutory auditor in Portugal depends on the legal form of the entity and whether it meets size criteria set out in the Companies Code and the Portuguese Accounting Standards System (Sistema de Normalização Contabilística, or SNC).

Sociedades anónimas (SA) are always required to have a statutory audit body, regardless of size. The law requires an SA to establish either a Conselho Fiscal (supervisory board) with an ROC, or a single Fiscal Único who must be a qualified ROC. This obligation applies from incorporation and does not depend on turnover or headcount.

Sociedades por quotas (Lda) are subject to a different rule. They must appoint a statutory auditor when they exceed two of the following three thresholds in two consecutive financial years:

• Total assets exceeding EUR 1.5 million
• Net turnover exceeding EUR 3 million
• Average number of employees exceeding 50

When a Lda crosses two of these thresholds for two consecutive years, it must appoint an ROC for the following financial year. Conversely, if it falls below two thresholds for two consecutive years, the obligation ceases.

Branches of foreign companies registered in Portugal are generally not subject to the same statutory audit obligation as Portuguese entities, but the parent company';s audited accounts must be filed with the Commercial Registry (Conservatória do Registo Comercial) in accordance with EU transparency requirements.

Entities receiving public funding, operating in regulated sectors such as banking, insurance or investment services, or holding concessions from the Portuguese state face additional audit obligations imposed by sector-specific legislation and by the Tribunal de Contas (Court of Auditors) for public-interest entities.

The ROC is the only professional authorised to conduct statutory audits in Portugal. The OROC maintains the register of qualified ROCs and is responsible for their licensing, continuing education and disciplinary oversight. Appointing an unqualified person to perform a statutory audit renders the audit legally void.

An ROC must be independent of the audited entity. The Companies Code and the OROC';s ethical code prohibit an ROC from auditing a company in which they hold a financial interest, in which a close family member is a director, or with which they have a significant commercial relationship. These independence rules align with EU Directive 2006/43/EC on statutory audits, as transposed into Portuguese law.

For public-interest entities (entidades de interesse público, or EIP) - which include listed companies, credit institutions, insurance companies and certain other regulated entities - the rules are stricter. The ROC must rotate after a maximum engagement period set by Regulation (EU) No 537/2014, which Portugal has implemented. The audit committee of an EIP must approve the appointment and monitor the ROC';s independence throughout the engagement.

In practice, foreign founders often underestimate the lead time required to appoint an ROC. Qualified ROCs with capacity for new mandates can be in short supply, particularly for smaller engagements. Founders should begin the selection process well before the financial year end to avoid a gap in statutory coverage.

If you need guidance on selecting and appointing a compliant ROC for your Portuguese entity, contact us at info@vlolawfirm.com. We can help structure the setup correctly the first time.

Portugal';s audit framework distinguishes between three tiers of entity: micro-entities, small entities, and medium and large entities. The SNC defines these tiers and determines which accounting and audit rules apply.

Micro-entities (microentidades) are exempt from the statutory audit obligation provided they do not exceed two of the following: total assets of EUR 350,000, net turnover of EUR 700,000, or an average of 10 employees. Micro-entities may prepare simplified financial statements and are not required to appoint an ROC unless their legal form (SA) requires it.

Small entities (pequenas entidades) fall between the micro threshold and the Lda trigger thresholds described above. They may apply a simplified version of the SNC standards but are not automatically exempt from audit if their legal form demands it.

Medium and large entities must apply full SNC standards, prepare consolidated accounts where applicable, and submit to statutory audit. The obligation to prepare consolidated accounts arises when a parent company controls one or more subsidiaries and the group as a whole exceeds the thresholds set out in the Companies Code.

A common mistake made by foreign groups is to assume that a Portuguese subsidiary below the Lda thresholds is entirely free of audit obligations. If the subsidiary is an SA, the audit obligation applies regardless of size. Similarly, if the subsidiary is part of a group that prepares consolidated accounts, the subsidiary';s figures feed into the group audit and must be prepared to an auditable standard.

Entities operating under investment incentive regimes, such as those approved under the Investment Tax Code (Código Fiscal do Investimento), may face additional audit requirements as a condition of receiving tax benefits. The Portuguese Tax and Customs Authority (Autoridade Tributária e Aduaneira, or AT) may require audited accounts to verify eligibility for deductions or credits.

A statutory audit in Portugal follows a structured process that typically runs alongside the financial year and concludes within a few months of the year end.

The ROC is appointed by the shareholders at a general meeting, usually for a mandate of four years (renewable). The appointment must be registered with the Commercial Registry. Once appointed, the ROC begins planning work, which involves understanding the entity';s business, assessing internal controls and identifying areas of audit risk.

During the financial year, the ROC may conduct interim audit procedures, reviewing transactions, testing controls and requesting documentation. This interim work reduces the volume of year-end testing and allows the ROC to flag issues early.

After the financial year closes, the entity';s management prepares the annual accounts, including the balance sheet, income statement, statement of changes in equity, cash flow statement and notes. These must be prepared in accordance with SNC standards and submitted to the ROC for review. The ROC then issues a Legal Certification of Accounts (Certificação Legal das Contas, or CLC), which is the Portuguese equivalent of an audit opinion.

The CLC may be unqualified (clean), qualified, adverse or a disclaimer of opinion, depending on the ROC';s findings. An unqualified CLC is required for the accounts to be approved at the annual general meeting and filed with the Commercial Registry.

The annual accounts and the CLC must be filed with the Commercial Registry within a legally prescribed period after the financial year end. For most entities, the annual general meeting must be held within three months of the year end, and accounts must be filed within a further period set by the Companies Code. Delays in filing attract administrative fines.

In practice, the most common cause of delay is late delivery of accounting records to the ROC. Founders should ensure that their bookkeeping is current and that the accounting team delivers a complete trial balance to the ROC promptly after year end.

Beyond the annual statutory audit, Portuguese entities face a range of ongoing compliance obligations that intersect with the audit process.

The Informação Empresarial Simplificada (IES) is an annual electronic filing submitted to the AT, the Commercial Registry and the Instituto Nacional de Estatística (INE). The IES combines the annual accounts, the tax return and statistical data into a single submission. The ROC';s CLC is a prerequisite for the IES filing. Missing the IES deadline triggers automatic penalties from the AT.

Entities subject to VAT must file periodic VAT returns (declarações periódicas de IVA) and reconcile these with the annual accounts. The ROC will review VAT compliance as part of the audit, and discrepancies between VAT returns and the accounts are a common source of audit findings.

Corporate income tax (Imposto sobre o Rendimento das Pessoas Coletivas, or IRC) returns must be filed annually. The audited accounts form the basis of the IRC computation, and the AT may use the CLC as a starting point for tax inspections. Entities with significant related-party transactions must maintain transfer pricing documentation in accordance with the Transfer Pricing Regime (Portaria n.º 1446-C/2001 and subsequent updates), and the ROC will assess whether this documentation is adequate.

Listed companies and EIPs must also comply with the Securities Market Commission (Comissão do Mercado de Valores Mobiliários, or CMVM) reporting requirements, which include half-yearly financial reports and annual reports containing the audited accounts. The CMVM monitors compliance and can impose sanctions for late or deficient filings.

Many foreign-owned entities underestimate the interaction between the audit cycle and the tax compliance calendar. A practical scenario: a foreign group with a Portuguese SA subsidiary that closes its books in December must ensure that the ROC has completed the CLC in time for the IES filing deadline, which typically falls in the first half of the following year. Missing this deadline can trigger cascading penalties across multiple filings.

Failure to comply with audit requirements in Portugal carries a range of consequences, from administrative fines to reputational damage and loss of access to financing.

The Companies Code imposes administrative fines (coimas) on entities that fail to appoint a statutory auditor when required, fail to hold the annual general meeting within the prescribed period, or fail to file accounts with the Commercial Registry on time. These fines are assessed by the Instituto dos Registos e do Notariado (IRN) and can be applied to both the entity and its directors personally.

Entities with outstanding audit obligations or unfiled accounts are flagged in the Commercial Registry as non-compliant. This status is publicly visible and can prevent the entity from obtaining certificates of good standing (certidões de não dívida), which are required for public procurement, EU funding applications and certain banking transactions.

The AT may also impose penalties for late or incorrect IES filings, and may initiate tax inspections of entities whose accounts are not audited when required. In serious cases, the AT can apply estimated assessments (avaliação indireta) to determine taxable income, which typically results in a higher tax liability than a properly audited return.

Directors of Portuguese companies have personal liability for ensuring that audit obligations are met. A common mistake among foreign directors is to assume that the obligation rests solely with the local accounting team. In practice, the legal responsibility lies with the board, and directors can be held personally liable for fines arising from non-compliance.

For entities in regulated sectors, non-compliance with audit requirements can trigger supervisory action by the Banco de Portugal, the Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) or the CMVM, potentially leading to licence suspension or revocation.

To discuss your entity';s specific compliance position and avoid these risks, reach out to info@vlolawfirm.com. We can assist with documents and filings across the full audit compliance cycle.

What happens if a Portuguese Lda grows above the audit thresholds mid-year?

The obligation to appoint an ROC does not arise immediately when the thresholds are crossed. Under the Companies Code, a Lda must exceed two of the three size thresholds for two consecutive financial years before the audit obligation is triggered. This means that a company crossing the thresholds for the first time in a given year has one further year before it must appoint an ROC. However, prudent management will begin the selection process early, because finding a qualified ROC and completing the appointment formalities takes time. Waiting until the obligation is legally confirmed before acting can result in a gap in statutory coverage.

How long does a statutory audit typically take in Portugal, and what does it cost?

The duration of a statutory audit in Portugal depends on the size and complexity of the entity. For a straightforward small SA or Lda, the ROC';s year-end work typically takes between four and eight weeks after the accounts are delivered. For medium-sized entities with multiple business lines or significant related-party transactions, the process can extend to three months or more. Professional fees for ROC services vary considerably. For smaller entities, fees generally start in the low thousands of EUR annually. For medium and large entities, or those with complex group structures, fees can reach the mid-to-high tens of thousands of EUR. State registration charges for the ROC appointment are modest by comparison.

Can a foreign auditor conduct the statutory audit of a Portuguese company?

No. Only an ROC registered with the OROC is authorised to issue a CLC for a Portuguese entity. A foreign auditor from another EU member state may apply for recognition under the EU Statutory Audit Directive, but must be registered with the OROC before conducting statutory audits in Portugal. In practice, multinational groups often use a Portuguese member firm of their global audit network to satisfy both the local statutory requirement and the group reporting obligation. The key point is that the CLC must be signed by a person or firm on the OROC register, regardless of who performs the underlying audit work.

Audit requirements in Portugal are structured around entity type, size and sector. SAs face an unconditional obligation; Ldas are drawn in once they cross the size thresholds for two consecutive years; and regulated entities face additional rules under sector-specific law. The ROC is the central figure in the process, and their appointment, independence and rotation must comply with both the Companies Code and EU audit regulation. Non-compliance carries real financial and reputational consequences for both the entity and its directors.

VLO Law Firms advises international clients on audit requirements in Portugal. We can assist with ROC appointment, compliance calendar management, IES filings and coordination with Portuguese accounting teams. To request a consultation, contact: info@vlolawfirm.com