Internal Audit in Cyprus

Mandatory requirements for regulated entities

Internal audit is a statutory requirement for CySEC-regulated investment firms and for institutions regulated by the Central Bank of Cyprus, including Electronic Money Institutions and Payment Institutions. Regulators actively verify compliance with this obligation. Failure to maintain a functioning internal audit function, with proper documentation and reporting to the Board or Audit Committee, carries serious regulatory consequences.
Beyond the regulatory minimum, a well-run audit function demonstrably improves how inspectors assess an organisation. Evidence of proactive internal oversight changes the tone of a regulatory interaction in ways that reactive compliance rarely achieves.

Best practice for non-regulated businesses

For companies not subject to a regulatory mandate, internal audit is increasingly recognised as a mark of strong governance. Businesses with complex operations, international structures, multiple stakeholders, or significant assets benefit from structured internal oversight, even in the absence of a regulatory trigger. The right time to implement it is typically earlier than most organisations expect.

Fully outsourced Internal Audit function

This model suits organisations without a Chief Audit Executive in-house, or regulated entities that need to meet their compliance obligations without the overhead of a dedicated internal team. SPL Audit provides the complete service: risk assessment, audit planning, fieldwork, and formal reporting to the Board of Directors or Audit Committee, on a recurring basis.

The result is a fully functioning internal audit capability, without the cost or complexity of building one from scratch.

Co-sourcing and specialist support

Some organisations already have internal audit staff but require additional expertise in specific areas, such as technology controls, regulatory compliance reviews, or specialist sector knowledge. SPL Audit’s co-sourcing model is designed for precisely this situation.

We work alongside your existing team, taking on agreed elements of the audit plan, while your internal auditor or Chief Audit Executive retains overall direction. The arrangement provides access to deeper expertise without restructuring what already works.

Building the Internal Audit function from scratch

Some organisations need to set up an internal audit function for the first time, whether driven by regulatory requirements or by the scale and complexity the business has reached.

SPL Audit designs and implements the entire function: defining scope, drafting the audit charter, developing risk-based audit plans, creating documentation frameworks, and producing reporting templates that meet the expectations of your Board and regulator.

Internal Controls Review and Assessment

SPL Audit conducts standalone internal controls reviews as an independent assessment of your existing control environment: how it is designed, whether it operates as intended, and where the gaps are.

The output is a clear, prioritised set of findings and recommendations, specific and actionable rather than abstract. Coverage includes:

• Control design and operating effectiveness across key business processes
• Segregation of duties and authorisation structures
• Financial reporting controls and accounting system integrity
• IT general controls and information security governance
• Compliance with applicable regulatory frameworks

Procedures Manual Development

Undocumented procedures represent a governance risk, a training challenge, and an audit exposure simultaneously. SPL Audit drafts and reviews internal audit and procedures manuals, ensuring they are practical, proportionate, and aligned with current regulatory expectations.

Technology and IT controls Audit

Regulated entities in Cyprus face specific internal audit obligations related to technology, including verifying audit trail capabilities and assessing electronic systems and platforms in line with CySEC requirements.

SPL Audit covers IT governance and technology controls within our internal audit scope. This includes assessing the suitability and security of your systems, reviewing information security arrangements, and confirming that your technology infrastructure meets the expectations of your applicable regulator. Regulatory expectations in this area continue to increase, and the exposure for entities that fall short is material.

Risk-based, not tick-box

SPL Audit begins every internal audit engagement with a proper risk assessment. The audit plan reflects where the actual risks sit in your specific business, not a generic template applied uniformly across clients. We review your processes, policies, and existing documentation before any fieldwork begins, so the work is proportionate, focused, and directed at what actually matters.

Reporting that management can use

Every internal audit engagement concludes with a clear written report. Findings are graded by risk, explained in plain language, and accompanied by specific recommendations. Where control weaknesses are identified, a management action plan is included: who should act, by when, and what the expected outcome is.

Reports are directed to the appropriate audience, whether that is the Board of Directors, the Audit Committee, senior management, or the relevant regulator, at the right level of detail for each.

Minimal Disruption to Daily Operations

SPL Audit plans each engagement carefully, shares document requests in advance, and agrees on realistic timelines with your team from the outset. Most fieldwork can be handled remotely; on-site visits are kept focused and brief, when needed at all.