HGB §§316–324a
Audit
Prüfung
The HGB provisions governing the audit of annual and consolidated accounts, including auditor appointment, independence, audit opinion, liability caps, and audit committees.
1
Conceptual Framework Linkage
A NEW ANCHOR-LEVEL SUBSECTION, SHAPED BY A REAL SCANDAL: §316a and the current version of §323 were substantially reshaped by the 2021 FISG reform (Finanzmarktintegritätsstärkungsgesetz) – Germany's direct legislative response to the 2020 Wirecard accounting fraud. The result is a genuinely distinctive, tiered auditor liability structure with NO equivalent anywhere else in this poster series.
The final external check on everything this entire poster series has documented
Every recognition rule, measurement principle, disclosure requirement, and consolidation mechanic this series has built now converges on a single question: has it ALL been done correctly? §§316–324a supply the answer – who must be audited, by whom, to what standard, with what independence safeguards, producing what opinion, and with what consequences if the auditor themselves gets it wrong.
HOW §§316–324A MAP TO GERMAN ACCOUNTING PRINCIPLES
Gläubigerschutz, externally verified – an independent audit exists specifically so creditors and investors need not rely purely on management's own self-assessment Proportionality – small corporations are exempt entirely (§316), the SAME size-based cost-benefit theme running throughout this whole series A direct legislative response to real failure – §316a and §323's CURRENT form exist specifically because the Wirecard scandal exposed genuine gaps in the PRE-2021 audit and liability regime
What §§316–324a require, at a glance
§Core requirement
316–316aWho must be audited; heightened PIE-specific rules
317What the audit must actually examine
318–319bAppointment, removal, and independence safeguards
320–321aInformation rights; the detailed internal report; special-case disclosure
322The public-facing audit opinion
323Auditor liability, with tiered statutory caps
324–324aAudit committee; cross-reference to specific §325 disclosure-filing provisions
2
Scope
Medium and large corporations, with heightened rules for PIEs
§316's basic audit obligation binds medium and large Kapitalgesellschaften (per the §267 thresholds confirmed earlier in this series) and their Konzernabschlüsse – small corporations are exempt entirely. Public-interest entities (§316a) face a further, considerably heightened layer of requirements on top of this baseline.
3
§316 – the Size-Dependent Audit Obligation, and Voidness on Failure
A genuinely severe legal consequence for skipping a mandatory audit
§316(1)–(2) requires the Jahresabschluss/Lagebericht and Konzernabschluss/Konzernlagebericht of medium and large corporations to be audited BEFORE the shareholders adopt them – small corporations are exempt. §316(3) provides that where a MANDATORY audit was not carried out, the Jahresabschluss is NICHTIG (void) – not merely deficient or subject to correction, but LEGALLY VOID from the outset, a genuinely severe consequence reflecting how fundamental the audit requirement is treated to be.
4
Worked Example – Small Exemption vs Mandatory Medium/Large Audit
The same §267 thresholds from earlier in this series, now determining audit obligation
Example 1: Two GmbHs on either side of the small/medium boundary
GmbH A meets the §267 small-company thresholds (≤€7.5M balance sheet total, ≤€15M revenue, ≤50 employees) for two consecutive years. GmbH B exceeds two of these three thresholds.
GmbH A is COMPLETELY EXEMPT from the mandatory audit requirement under §316(1) – no Abschlussprüfer need be engaged at all. GmbH B, now classified as medium-sized, MUST have its Jahresabschluss and Lagebericht audited before shareholder adoption – and if it skips this requirement, its Jahresabschluss is VOID under §316(3), regardless of whether the underlying figures are otherwise entirely accurate.
5
§316a – Public-Interest Entities, Born From the Wirecard Reform
A genuinely new provision, created in direct response to a real accounting scandal
§316a – inserted by the 2021 FISG (Finanzmarktintegritätsstärkungsgesetz), Germany's legislative response to the 2020 Wirecard accounting fraud – defines "Unternehmen von öffentlichem Interesse" (Unternehmen von öffentlichem Interesse, PIE) as companies that are (1) capital-market-oriented per §264d, (2) CRR credit institutions per the Kreditwesengesetz (with narrow exceptions for certain small institutions), or (3) insurance undertakings per the relevant EU insurance accounting directive. For PIEs, the EU Audit Regulation (537/2014) takes PRECEDENCE over this HGB subsection's own provisions wherever the two conflict – imposing mandatory audit-firm rotation, restrictions on permitted non-audit services, and enhanced audit committee oversight.
6
Worked Example – Testing Whether a Company Is a PIE
Three genuinely different routes into the same heightened category
Example 2: Three companies, three different PIE triggers
Company A is listed on a regulated German exchange. Company B is a licensed deposit-taking bank, not falling within any of the KWG's narrow small-institution exceptions. Company C is a licensed insurance undertaking. None of the three overlap in ownership.
ALL THREE qualify as PIEs, but through DIFFERENT §316a Satz 2 routes: Company A under Nr.1 (kapitalmarktorientiert), Company B under Nr.2 (CRR-Kreditinstitut), Company C under Nr.3 (Versicherungsunternehmen) – and, as Section 18 will show, these THREE categories are treated DIFFERENTLY under §323's own tiered liability structure, with Nr.1 facing the STRICTEST regime of the three.
7
§317 – Subject Matter and Scope of the Audit
Legal compliance, GoB, true-and-fair view, and Lagebericht consistency
§317(1) requires the audit to establish whether the accounting, the Jahresabschluss, and the Lagebericht comply with legal requirements and the articles of association – specifically examining whether GoB has been observed and whether the Jahresabschluss otherwise achieves the §264(2) true-and-fair view established earlier in this series, and whether the Lagebericht is CONSISTENT with the Jahresabschluss and the auditor's own understanding gained during the audit. §317(2) extends this to the Konzernabschluss/Konzernlagebericht. §317(3a) additionally requires, for capital-market-oriented corporations, examination of the internal control/risk management disclosures relating to the accounting process established under §289(4)/§315(4).
8
Worked Example – the Lighter-Touch Assurance Over Non-Financial Statements
A genuinely different, more limited assurance level than the financial statements themselves receive
Example 3: Auditing the non-financial statement's mere existence, not its substance
A capital-market-oriented corporation with over 500 employees prepares the non-financial statement required under §289b (established in the earlier Lagebericht poster), covering environmental, employee, social, human rights, and anti-corruption matters.
§317(4) requires the auditor to determine only whether the non-financial statement's CONTENT REQUIREMENTS have been FORMALLY addressed – a considerably LIGHTER assurance level than the substantive, opinion-bearing audit the financial statements themselves receive under §317(1). The auditor essentially confirms the statement EXISTS and covers the required topics, without expressing the SAME level of assurance over the accuracy of its substantive content.
9
§318 – Appointment and Removal of the Auditor
Shareholder appointment before year-end, with court intervention available if needed
§318(1) requires the auditor to be appointed by the shareholders BEFORE the end of the fiscal year to be audited – for PIEs, the audit committee is involved in PROPOSING the auditor for shareholder appointment, per the EU Audit Regulation. §318(2)–(3) provide for COURT appointment where shareholders fail to act in time, or where an appointed auditor withdraws. §318(4) permits removal (Widerruf) only for an important reason (wichtiger Grund) – such as a genuine independence concern – with court involvement where the removal is disputed.
10
§319 – Independence: the Detailed Exclusion Grounds
A detailed, technical list of disqualifying relationships
§319 lists numerous specific circumstances that DISQUALIFY a person or firm from serving as auditor, including: holding shares or a financial interest in the audited company beyond an insignificant amount; being a member of its management/supervisory board or an employee; providing certain PROHIBITED non-audit services (bookkeeping assistance, valuation services materially affecting the accounts, certain tax advisory beyond a threshold, legal or management advisory services); close family relationships with key management personnel; and receiving fees exceeding a specified proportion of total professional income from a single client over consecutive years (an "economic dependence" safeguard).
11
Worked Example – Testing an Independence-Disqualifying Relationship
A prohibited non-audit service, disqualifying the firm entirely
Example 4: An accounting firm that also performed the client's own bookkeeping
An accounting firm has, over the past year, provided ongoing bookkeeping assistance to a company – maintaining its ledgers and preparing draft financial statements – and is now approached by the same company's shareholders to serve as its statutory auditor for the SAME fiscal year.
The firm is DISQUALIFIED from serving as auditor under §319 – having prepared the very records and draft statements it would then need to audit creates an obvious, disqualifying self-review threat to independence, REGARDLESS of the firm's own genuine confidence in its objectivity.
12
§319b – Extending Exclusion Grounds Across the Auditor's Own Network
Preventing independence rules from being circumvented through network structuring
§319b extends certain §319 exclusion grounds to cover situations where a DIFFERENT firm within the SAME audit network (Netzwerk) as the appointed auditor has a disqualifying relationship with the audited company – preventing a large international network from routing a compromised advisory relationship through one member firm while presenting a technically "independent" different member firm as the statutory auditor.
13
§320 – the Auditor's Own Legal Right to Information
Mirroring the §294(3) group-level information right, now for the auditor specifically
§320 requires the audited company's legal representatives to present ALL documents and provide ALL explanations the auditor requires for a proper audit – directly paralleling the §294(3) information right established earlier in this series for a parent's own consolidation needs, now specifically protecting the AUDITOR's own ability to gather sufficient evidence.
14
§321 – the Detailed (Non-Public) Audit Report
A frank, internal document – genuinely distinct from the short public opinion
§321 requires the auditor to prepare a WRITTEN, DETAILED Prüfungsbericht – covering significant findings, risks to the company's continued existence identified during the audit (going-concern-type red flags), and material internal control weaknesses. This detailed report is GENERALLY NOT published; it goes to the company's own management and supervisory board, genuinely distinct from the SHORT, standardised, public-facing Bestätigungsvermerk covered next.
15
§321a – Disclosure of the Audit Report in Special Cases
A narrow exception opening the internal report to specified parties
§321a addresses SPECIFIC circumstances – relevant to certain regulated entities and public-interest scenarios – in which the otherwise-internal Prüfungsbericht may need to be made available to specified supervisory authorities or other designated parties, beyond its normal internal-only distribution.
16
§322 – the Bestätigungsvermerk: Four Possible Opinions
The short, standardised, public-facing audit opinion
§322 requires the auditor to issue a Bestätigungsvermerk (audit opinion) expressing whether the Jahresabschluss/Konzernabschluss gives a true and fair view – this can be UNEINGESCHRÄNKT (unqualified/clean), EINGESCHRÄNKT (qualified), VERSAGT (adverse), or the auditor may DECLINE to issue an opinion at all (Nichtabgabe eines Vermerks, a disclaimer) where sufficient audit evidence cannot be obtained – broadly analogous in overall shape to an ISA-based audit opinion internationally.
17
Worked Example – Choosing Among the Four Opinion Types
Four genuinely different messages a single short opinion can send
Example 5: Four companies, four different audit outcomes
Company A's accounts are fully compliant with no issues. Company B's accounts are compliant overall, but ONE specific inventory valuation matter could not be fully verified. Company C's accounts contain a PERVASIVE, material departure from GoB affecting multiple line items. Company D's records were so incomplete that the auditor could not gather sufficient evidence on several major balances at all.
Company A receives an uneingeschränkter (unqualified) opinion. Company B receives an eingeschränkter (qualified) opinion, specifically flagging the inventory matter. Company C receives a versagter (adverse) opinion – the accounts do NOT give a true and fair view overall. Company D receives NO opinion at all (a disclaimer) – the auditor cannot even conclude whether the accounts are fairly presented, given the fundamental evidence gap.
18
§323 – THE TIERED LIABILITY CAP, Post-FISG
A distinctive, statutory ceiling on negligence-based liability – substantially raised in 2021
§323(1) requires conscientious, impartial performance of the audit and professional secrecy; breach creates liability for resulting damage. §323(2) then supplies a GENUINELY DISTINCTIVE feature of German audit law – a STATUTORY CAP on liability for NEGLIGENT (not intentional) breaches, substantially TIGHTENED by the 2021 FISG reform following Wirecard. Unlike many jurisdictions where auditor liability is governed by ordinary, uncapped tort/contract principles, HGB fixes specific EUR ceilings, tiered by BOTH company type and degree of fault:
Company typeOrdinary negligenceGross negligence
PIE per §316a S.2 Nr.1 (capital-market-oriented)€16,000,000UNLIMITED
PIE per §316a S.2 Nr.2/3 (credit institutions/insurers)€4,000,000€32,000,000
All other companies€1,500,000€12,000,000
Intentional (vorsätzliches) breach is ALWAYS unlimited, for every company type – the caps exist only to bound NEGLIGENCE-based exposure. Note also that gross negligence for the MOST significant PIE category (Nr.1, capital-market-oriented) carries genuinely UNLIMITED liability – a considerably harsher post-2021 standard than the merely-capped (if very large) €32m figure applying to credit institutions and insurers.
19
Worked Example – Applying the Liability Cap to a PIE Audit Failure
The tier that matters most in practice for the largest, most economically significant audits
Example 6: A listed company's failed audit, causing large investor losses
An audit firm negligently fails to detect a material accounting fraud at a listed, capital-market-oriented client (a PIE per §316a S.2 Nr.1), causing investors to suffer losses of €45,000,000 once the fraud is eventually discovered. A court determines the firm's conduct amounted to ORDINARY negligence, not gross negligence or intent.
DESPITE the €45,000,000 actual loss, the firm's liability is capped at €16,000,000 under §323(2) – the ordinary-negligence cap for a Nr.1 PIE. Had the court instead found GROSS negligence, the firm's liability would have been UNLIMITED, potentially exposing it to the full €45,000,000 (or more) – illustrating just how much the degree-of-fault finding matters for this specific company category.
20
Worked Example – the Same Failure at a Non-PIE Company
A dramatically lower cap for an otherwise identical failure
Example 7: The same audit failure, at a non-listed medium-sized company
The same auditing firm makes an identical, ordinary-negligence audit error at a non-listed, non-PIE medium-sized company, causing a comparable €45,000,000 loss to the company's creditors.
Here, liability is capped at just €1,500,000 – DRAMATICALLY lower than the €16,000,000 PIE cap for an economically comparable failure, reflecting the legislature's deliberate judgement that the systemic, public-market consequences of a PIE audit failure warrant a substantially higher exposure ceiling than an equivalent failure at an ordinary private company.
21
§324 – the Audit Committee
Mandatory oversight for PIEs, implementing EU Audit Directive requirements
§324 requires PIEs specifically to maintain an audit committee (either a dedicated committee or the supervisory board itself performing this function), responsible for monitoring the accounting process, the effectiveness of internal control/risk management/internal audit systems, the statutory audit itself, and the auditor's independence – including oversight of any non-audit services the auditor is even permitted to provide under §319's own restrictions.
22
§324a – Cross-Reference to §325's Disclosure Filing Provisions
Correction: §325(2a) is a filing-mechanics provision, not an IFRS supplementary statement
§324a cross-references specific provisions within §325 (covered fully in the next poster on disclosure). On checking §325 directly, its paragraph (2a) actually governs "dauerhafte Hinterlegung" (permanent deposit) filing mechanics available to LARGE Kapitalgesellschaften for submitting the Jahresabschluss together with the Bestätigungsvermerk to the Unternehmensregister – it is NOT, as an earlier draft of this poster incorrectly stated, an IFRS-based supplementary individual financial statement. That characterisation was a genuine error, corrected here and in the following poster on §§325–329.
CORRECTED: the previous version of this section described §325(2a) as permitting an optional IFRS-based supplementary statement. That was incorrect. See the companion poster on §§325–329 for the accurate content.
23
Critical Judgments & Practical Difficulties
Where judgement matters most
SIGNIFICANT JUDGEMENTS
Distinguishing ordinary from GROSS negligence in a court proceeding – a distinction with genuinely enormous financial consequences under the current tiered cap structure Determining whether a specific non-audit service genuinely falls within §319's prohibited categories, or remains permissible
PRACTICAL DIFFICULTIES
Maintaining genuine independence across a large international network under §319b, given the practical difficulty of tracking every member firm's own client relationships Balancing the audit committee's oversight role against management's own day-to-day operational authority, particularly at PIEs with complex, fast-moving businesses
24
Relationship to International Audit Standards (ISA)
Comparison – HGB Audit Provisions vs International Standards on Auditing
FeatureHGBISA / International Practice
Audit opinion structureFour types (§322) – broadly convergedSimilar structure (unmodified, modified, adverse, disclaimer) under ISA 700/705
Statutory liability capYES – a specific, tiered EUR ceiling for negligence (§323(2))NO general international equivalent – many jurisdictions rely on ordinary tort/contract principles, often UNCAPPED
Mandatory audit-firm rotation for PIEsYES, per the EU Audit Regulation (§316a)Varies considerably by jurisdiction – not a universal ISA/international requirement
HGB's STATUTORY liability cap is arguably the single most distinctive feature covered anywhere in this poster – few other major jurisdictions fix such SPECIFIC, tiered EUR ceilings on negligence-based auditor liability directly into positive commercial law.
25
Statement Mapping
Where every §§316–324a event lands
Event / obligationDocument affectedNotes
Audit opinion issued (§322)BestätigungsvermerkShort, public-facing; attaches to the Jahresabschluss/Konzernabschluss
Detailed report (§321)PrüfungsberichtInternal, generally not published
Mandatory audit skipped–The entire Jahresabschluss becomes VOID (§316(3))
26
Related Provisions – Cross-Reference Map
How §§316–324a connect across HGB Book 3
ProvisionNature of the connection
§267, §264dSupplies the size and capital-market-oriented thresholds triggering §316/§316a
§264(2), §297The true-and-fair view standard §317(1)-(2) tests the Jahresabschluss/Konzernabschluss against
§294(3)The parallel group-level information right §320 mirrors for the auditor's own needs
§325 et seq.The NEXT Titel in this series – disclosure – governing how the audited accounts are actually filed and published
27
Quick-Reference Glossary
Abschlussprüfer
Statutory auditor – the person or firm engaged to perform the mandatory audit.
Unternehmen von öffentlichem Interesse (PIE)
Public-interest entity – capital-market-oriented companies, CRR credit institutions, and insurance undertakings, per §316a.
Bestätigungsvermerk
The short, public-facing audit opinion – unqualified, qualified, adverse, or a disclaimer.
Prüfungsbericht
The detailed, generally-internal audit report covering significant findings and risks.
FISG
The 2021 Finanzmarktintegritätsstärkungsgesetz, Germany's legislative response to the Wirecard scandal, which reshaped §316a and §323.
Haftungshöchstgrenze
Statutory liability cap – the tiered EUR ceiling on an auditor's negligence-based liability under §323(2).
Key
Bestätigungsvermerk Public audit opinion
Prüfungsbericht Internal detailed report