{"id":4259,"date":"2026-09-15T19:38:44","date_gmt":"2026-09-15T16:38:44","guid":{"rendered":"https:\/\/audit-mk.com.ua\/nkcpfr-autsorsynh-vnutrishnoho-audytu\/"},"modified":"2026-09-15T19:38:44","modified_gmt":"2026-09-15T16:38:44","slug":"nkcpfr-autsorsynh-vnutrishnoho-audytu","status":"publish","type":"post","link":"https:\/\/audit-mk.com.ua\/en\/nkcpfr-autsorsynh-vnutrishnoho-audytu\/","title":{"rendered":"Ukraine allows outsourcing of internal audit and compliance: what it means for capital market firms"},"content":{"rendered":"
<\/p>\n
In September 2026 the Ukrainian securities regulator approved requirements for outsourcing part of a company’s functions. The decision covers companies and professional capital market participants, and it changes the economics of a small licensed firm more than it changes the rules: what previously had to sit on the payroll can now be bought as a service.<\/p>\n
Which functions can be outsourced<\/h2>\n
The list is short and specific:<\/p>\n
\n
compliance;<\/li>\n
risk management;<\/li>\n
internal audit;<\/li>\n
accounting;<\/li>\n
IT support;<\/li>\n
maintenance of software and information systems.<\/li>\n<\/ul>\n
For professional market participants the handling of third-party enquiries is added to that list.<\/p>\n
What does not change<\/h2>\n
The key sentence of the decision is not about the list but about responsibility: outsourcing a function does not relieve the company of responsibility towards its clients and towards the regulator for the end result. If an external provider performed the internal audit badly, it is the company that will explain that to the regulator, not the provider.<\/p>\n
The practical conclusion is simple. A contract with a provider is not a way to shed risk, it is a way to buy competence. The risk stays with you, so the contract has to state what exactly the provider does, on what dates, in what form it reports, and what happens if it misses a deadline.<\/p>\n
Requirements for the provider<\/h2>\n
The provider may be a Ukrainian or a foreign legal entity or individual. Three requirements: sufficient resources, qualified staff, and compliance with business reputation requirements.<\/p>\n
The wording looks general, but in practice it means the choice of provider has to be justified. The compliance officer or the managing director needs documents on file that support it: the entry in a professional register, the qualifications of the specific people who will do the work, experience in your segment, professional indemnity insurance.<\/p>\n
The trap the news reports leave out<\/h2>\n
A director’s most common first thought is to hand internal audit to the company’s own auditor, who already knows the business. That is not allowed.<\/p>\n
Independence rules bar an auditor from providing a client with services whose output the auditor would later examine as part of the financial statements. Internal audit and bookkeeping are exactly that: the auditor would end up reviewing its own work. The same applies to designing and implementing the information systems that produce the reporting.<\/p>\n
So the field of providers narrows: you need a firm with audit qualifications that is not your auditor. This is not a formality. It is the first thing a regulator looks at if an inspection happens.<\/p>\n
What to do now<\/h2>\n\n
Cost the function in-house. A full-time internal auditor, risk manager and compliance officer often cost a small firm more than the work itself.<\/li>\n
Split the functions into what can go out and what should stay. The compliance officer post usually belongs inside the company, while drafting policies and the annual review outsource well.<\/li>\n
Check independence. If the candidate provider is your auditor, look for another one.<\/li>\n
Assemble the justification for your choice: register entry, qualifications, experience, insurance. It should be a file, not an opinion.<\/li>\n
Put deadlines, reporting format and the provider’s liability to you in the contract. You remain liable to the regulator.<\/li>\n<\/ol>\n
What we do here<\/h2>\n
MK Audit has worked since 2000, is entered in the Ukrainian register of auditors and audit entities under No. 4624, and is a member of the DFK International network. We do not perform statutory audits of financial statements at present, while our quality control review is in progress, and for outsourcing that is an advantage: no independence conflict with your company arises.<\/p>\n
We take internal audit and accounting, and compliance and risk management in the part that covers policy design and the annual review. We do not take IT support or software maintenance, because it is not our competence. Scope and timelines in detail: outsourcing for capital market firms<\/a>.<\/p>\n