Outsourced internal audit for regulated financial firms in Austria

Q: How many audits does a small financial firm need per year?

That depends on the audit universe and the risk analysis. In our approach, in line with the IIA Standards and planning practice rather than a statutory duty, the plan covers all material areas over a multi-year cycle, and high-risk areas such as anti-money-laundering controls, ICT or safeguarding of client assets are audited more often. In an annual contract with us, the number of audits is as set in the audit plan.

Q: Does OptiRisk Consulting also work with firms that have their own internal audit?

Yes, as a complement to your own function. For firms with an audit department, we offer co-sourcing for individual audit areas such as ICT, special audits and an interim head of internal audit during a vacancy, with an orderly handover to the successor. An external quality assessment under Standard 8.4 of the Global Internal Audit Standards we carry out only for functions we neither run nor set up.

We are OptiRisk Consulting in Vienna. We provide internal audit for regulated financial firms in Austria and the DACH region, as the whole function or in co-sourcing alongside your own team: crypto-asset service providers (CASPs), payment and e-money institutions, management companies and alternative investment fund managers (AIFMs), and small investment firms. You get a risk-based audit plan, audits under the approved plan, reports that your management board, supervisory board and the FMA can use directly, follow-up of agreed actions and an annual report. We work to the IIA Global Internal Audit Standards.

Author: Thomas Michalik, internal auditor · 10+ years in internal audit at bank and insurance groups · currently head of internal audit at a bank subsidiary · fit-and-proper trained · updated 1 October 2026

Can a regulated firm outsource its internal audit function in Austria?

In our reading, yes. Outsourcing is permissible where responsibility stays with the management, a written contract regulates audit, information and access rights, and the FMA can supervise the outsourced function. Payment institutions above the size thresholds of Sec. 42(6) Banking Act (balance sheet total over EUR 300 million and more than 50 full-time employees on annual average), which applies via Sec. 20(4) ZaDiG 2018, need a dedicated organisational unit for internal audit. Below the thresholds, in our reading, the function can also be staffed externally.

The relevant framework depends on the type of firm: Art. 73 MiCAR for CASPs, Sec. 21 ZaDiG 2018 and the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) for payment institutions, and InvFG 2011, AIFMG and Delegated Regulation (EU) No 231/2013 for management companies and AIFMs.

What is the difference between outsourcing and co-sourcing?

Own audit department: sensible for larger institutions with a broad audit universe. The firm carries the staff, training and tooling itself.
Co-sourcing: you keep your own function and we add capacity for audits in your plan or specialist know-how, for example ICT under Art. 6(6) DORA, MiCAR or AML. If the head of internal audit leaves, we run the function on an interim basis until the post is filled.
Outsourcing: we deliver the whole function under an annual contract. In our reading, this is the usual route for small and mid-sized institutions without their own department.

Which rules apply to internal audit at a regulated firm?

Payment Services Act (ZaDiG 2018), Securities Supervision Act (WAG 2018), AIFM Regulation, MiCAR and DORA.

Sec. 20(4) ZaDiG 2018 (Payment Services Act): the adequacy and application of the organisational arrangements under Sec. 20(1) and (3), including governance, control procedures, data security and contingency planning, and AML/CFT risk management, must be reviewed at least once a year within the internal audit function pursuant to Sec. 42 Austrian Banking Act. Audit areas and results must be documented.
Art. 24 Delegated Regulation (EU) 2017/565 (MiFID II organisational requirements): a separate and independent internal audit function where appropriate and proportionate. Sec. 26(2)(3) WAG 2018 (Securities Supervision Act) exempts investment service companies (Wertpapierdienstleistungsunternehmen) from the requirement of a separate and independent internal audit function under Art. 24. Internal control mechanisms under Sec. 32 WAG 2018 still apply.
Art. 62 Delegated Regulation (EU) No 231/2013 (AIFM Regulation): a separate and independent internal audit function where appropriate and proportionate. Management companies must maintain a permanent internal audit function under Sec. 16(1) InvFG 2011.
MiCAR (Regulation (EU) 2023/1114): it contains no explicit internal audit requirement. Art. 62(2)(i) requires internal control mechanisms in the authorisation application. Art. 68(6) obliges the management body to assess regularly the effectiveness of the policies and procedures adopted to comply with Chapters 2 and 3 of Title V. Art. 73 governs outsourcing.
DORA (Regulation (EU) 2022/2554), Art. 6(6): the ICT risk management framework is subject to internal audit by auditors with sufficient ICT knowledge and appropriate independence. Microenterprises are exempt. Art. 6(10): the verification of compliance with the ICT risk management requirements may be outsourced, and the firm remains fully responsible. Under Art. 16(1) DORA, small and non-interconnected investment firms and payment institutions exempted under PSD2, among others, fall under a simplified framework instead. There, Art. 28(5) Delegated Regulation (EU) 2024/1774 requires an internal audit by independent auditors with ICT expertise.

In our reading, a firm that has to demonstrate the effectiveness of its internal controls needs an independent review of them. That is the role of internal audit, even where, as under MiCAR, no explicit requirement exists.

How does an annual internal audit engagement work?

Kick-off and risk analysis: we record business model, organisation, outsourcing arrangements and earlier audit results. Then we build the audit universe (all auditable areas of the firm) and a risk assessment.
Audit plan with the management board: we propose a multi-year and an annual plan and agree them with the management board and the supervisory body. The management board then adopts them formally.
Audits under the plan: we audit on a standard audit programme, on site or remotely, and document the audit procedures. Number and rhythm of audits follow the risk analysis and are set in the audit plan.
Report and closing meeting: we discuss findings with the business area and agree actions, owners and deadlines. The report goes to the management board.
Follow-up: we track implementation and re-test it. Open points appear in the annual report to the management board and supervisory board.

Who is responsible when the function is outsourced?

Management stays responsible. Outsourcing the function does not transfer responsibility for it, and DORA Art. 6(10) says so expressly where the verification of compliance with ICT risk management requirements is outsourced.
The firm names one person who commissions and oversees the internal audit.
A written contract regulates audit, information and access rights, and the FMA must be able to supervise the outsourced function. In our reading, an outsourced control function will usually be treated as material. Whether and how you must notify it depends on the respective act.
Independence: for one firm, OptiRisk Consulting provides either internal audit or risk management, never both, and we do not audit what we built.
A specialised compliance partner delivers compliance and AML/CFT and contracts directly with the firm.

Frequently asked questions

What should an outsourced internal audit function deliver?

Independence from the audited areas, a risk-based multi-year plan covering all material activities, documented audit procedures, traceable findings with actions, deadlines and owners, and regular reporting to the management and supervisory bodies. A named contact person in the firm is part of it. In our reading, these are the points a firm should be able to evidence to its supervisor.

How does internal audit differ from the statutory audit?

The statutory auditor assesses the annual accounts and reports under legal requirements. Internal audit reviews on an ongoing, risk-based basis whether processes, the internal control system, compliance and risk management work effectively, and it reports to the management and supervisory bodies. The two complement each other. The statutory auditor can take results of internal audit into account.

How many audits does a small financial firm need per year?

That depends on the audit universe and the risk analysis. In our approach, in line with the IIA Standards and planning practice rather than a statutory duty, the plan covers all material areas over a multi-year cycle, and high-risk areas such as anti-money-laundering controls, ICT or safeguarding of client assets are audited more often. In an annual contract with us, the number of audits is as set in the audit plan.

What happens when internal audit finds deficiencies?

We rate each finding by severity, discuss it with the business area and agree an action, an owner and a deadline. Then we track the implementation, re-test it and report open or overdue actions to the management and supervisory bodies. We report serious findings to the management immediately.

Does OptiRisk Consulting also work with firms that have their own internal audit?

Yes, as a complement to your own function. For firms with an audit department, we offer co-sourcing for individual audit areas such as ICT, special audits and an interim head of internal audit during a vacancy, with an orderly handover to the successor. An external quality assessment under Standard 8.4 of the Global Internal Audit Standards we carry out only for functions we neither run nor set up.

Sources

Consolidated texts on RIS and EUR-Lex.

Contact

The first call takes 30 minutes and is confidential and without obligation. We clarify your regulatory position, the scope and the contract model. We hold consultations in English or German. The contact page is in German.

Contact OptiRisk Consulting (Kontakt)German version: Interne Revision auslagern

OptiRisk Consulting · Impressum · Datenschutz