Last updated
CSSF Audit Register Luxembourg: Verify Auditors Before You Rely on a Report
Use this guide when a Luxembourg audit report, engagement proposal, lender file, investor pack or procurement record depends on whether the named auditor or audit firm is actually visible in the CSSF public register of the audit profession. It explains what the register can prove, what it cannot prove, how to compare a register result with the audit report in front of you, which warning signs should stop reliance, and which official CSSF sources to preserve in your evidence file.
The search job for this page is narrow: verify the audit actor behind a report or proposed engagement. It is not a general provider-verification page and it is not a guide to judging whether an investment, company, fund, or audited set of accounts is safe. The register answers an identity-and-status question first; report quality, independence, scope, authenticity, and business risk must be checked separately.
Start from official CSSF sources: Public Oversight of the Audit Profession, the public register of the audit profession, and the CSSF page on public register data updates and annual declarations.
Direct answer
The CSSF public register can help you verify whether a Luxembourg audit professional or audit firm appears in the official public oversight framework. It can also show categories such as approved statutory auditors, approved audit firms, certain EU audit firms recognised in Luxembourg, and registered third-country audit entities. A match is useful evidence, but it does not prove that a specific report is genuine, independent, complete, current, suitable for your decision, or free from audit-quality concerns.
| Question | What the register helps answer | What still needs separate evidence |
|---|---|---|
| Does the name exist in the register? | Whether the person or firm can be matched to a CSSF public register entry. | Whether the report you received was actually issued by that person or firm. |
| What status or category is shown? | The public category or identification information shown by CSSF. | Whether the auditor was independent and properly appointed for this engagement. |
| Is an EU or third-country audit entity involved? | Whether the register shows a recognised or registered category. | Whether that status authorises the exact statutory audit work you are relying on. |
| Can the report be trusted as business evidence? | Only the official-status part of the trust check. | Opinion type, notes, going-concern wording, qualifications, scope and current business risk. |
Who should use this page
This guide is useful for investors reviewing audited accounts, lenders checking borrower statements, procurement teams onboarding a supplier, boards hiring an auditor, founders preparing their first statutory audit, group finance teams dealing with Luxembourg subsidiaries, and advisers who need a quick official-status check before deeper review.
If the named party is a bank, investment firm, payment institution, crypto-asset service provider, private bank, fund manager, insurance broker, or financial adviser, use a provider-verification route instead. The audit register is for the audit profession; stretching it to other financial services creates false comfort.
Verification workflow
- Identify the exact legal name of the audit firm and, when shown, the individual statutory auditor or signatory.
- Record the report date, audited entity, reporting period, opinion type, and whether the document is complete.
- Open the CSSF register independently rather than through a link supplied in a suspicious email or pitch deck.
- Search the exact name and compare spelling, legal form, status category and identifying details.
- Check whether the status shown fits the role claimed in the document.
- Preserve the register result, source URL and date checked.
- If authenticity matters, contact the audit firm through independently verified contact details.
- Pause reliance when the name, firm, date, status category or contact route does not match.
How to read a register match
A register match should be treated as a gate, not as the conclusion. Passing the gate means the name can be tied to a public register entry. It does not mean the audit opinion is unqualified, the financial statements are healthy, the engagement scope fits your decision, or the audit firm has no independence issue.
Read the register result together with the report. The audited entity name, reporting period, report date, signatory, audit firm name and legal form should align. If the report uses a shortened name, old brand, unusual email domain, scanned signature, or incomplete page set, ask for clarification before relying on it.
What to check inside the audit report
| Report area | Why it matters | Evidence to keep |
|---|---|---|
| Opinion type | Unqualified, qualified, adverse or disclaimer language changes how the report should be used. | Full audit opinion and basis section. |
| Going concern | Survival assumptions may matter more than headline profit. | Going-concern paragraph and related notes. |
| Scope and period | The report may cover a period that is too old for the current decision. | Financial year, report date and subsequent-event notes. |
| Related parties | Group or owner transactions can change credit and investment risk. | Notes to the accounts and management explanations. |
| Completeness | A signature page without full statements is weak evidence. | Full statements, notes, audit report and page count. |
When a register result is not enough
Escalate beyond the public register when the decision involves lending, investment, acquisition, regulated reporting, large supplier exposure, insolvency risk, suspected fraud, conflicting names, missing pages, pressure to decide quickly, or a report that arrived through an unverified channel. In those cases, verify authenticity directly with the audit firm and consider qualified professional review of the financial statements.
A current register entry also does not prove status on a past date. If you are relying on a historical audit report, preserve the date of the register check and ask whether the status was valid for the engagement period if that matters to the decision.
Fraud and mismatch signals
- The audit firm name does not match the register entry or appears with a different legal form.
- The report contains only a signature page or lacks notes to the financial statements.
- The contact route uses a free mailbox, misspelled domain or contact details supplied only by the promoter.
- The audited entity name, reporting period or report date conflicts with the transaction documents.
- The investment pitch treats the audit report as proof that returns are safe.
- The report is old but used as evidence of current liquidity or solvency.
Evidence file
For a serious decision, keep the full audited financial statements, audit report, register result, date checked, source URL, engagement letter if you are hiring the auditor, independence confirmation where relevant, verified contact note, questions asked, replies received and the decision that depended on the evidence. This file matters because names, register data, websites and provider explanations can change.
Special care for EU and third-country audit entities
The CSSF materials distinguish Luxembourg approved statutory auditors and approved audit firms from certain audit firms approved in another EU Member State and registered or recognised in Luxembourg, and from third-country audit entities. Do not reduce those categories to a single phrase such as "CSSF approved" without checking the exact category and what it supports. If a foreign audit entity is central to the report, confirm the category, engagement role and whether additional evidence is needed.
Related CSSF guides
Official sources
- CSSF: Public Oversight of the Audit Profession
- CSSF: New version of the Public Register of the Audit Profession
- CSSF: Public register data update, annual declarations and monitoring of continuing education
- CSSF: Public register of the audit profession
Bottom line
The CSSF audit register is the right first source for verifying the official audit actor. It is not a substitute for checking report authenticity, audit scope, independence, opinion wording, financial-statement notes, current business facts and the risk of relying on the document.