Peace of Mind · Fraud Audit Turkey · Turkish Commercial Code Art. 375 · BDS 240 · Labor Law Art. 26
Fraud Audit in Turkey: Does Your Turkish Subsidiary Need One, and What Does It Test?
A fraud audit in Turkey is a targeted examination of a company’s ledgers, e-invoices, bank flows and payroll, designed to find out whether money is leaving the business through misconduct. A statutory audit does not do this job. This guide explains when a foreign parent should order a fraud audit, who can perform it, what it tests and what Turkish law requires once it finds something.
Order a fraud audit of your Turkish entity when margins, cash or supplier patterns stop making sense, when one person controls a full transaction cycle, or before you buy, sell or change local management. Do not wait for the statutory auditor to raise it: a clean audit opinion is not a statement that no fraud exists.
- No Turkish law makes a standalone fraud audit mandatory. The duty sits with the board: Turkish Commercial Code (TCC) Art. 375 makes financial control and supervision of management non-delegable.
- A statutory audit is not a fraud audit. Under Turkish Auditing Standard BDS 240, the auditor seeks reasonable assurance against material misstatement; management remains primarily responsible for preventing and detecting fraud.
- Many foreign-owned subsidiaries have no audit at all. From 1 January 2026 the general statutory audit thresholds are TRY 500 million in assets, TRY 1 billion in net sales and 150 employees (two of three, two years running).
- Turkey’s e-ledger and e-invoice data make a fraud audit unusually precise. Full-population testing is realistic because the books already exist in structured form.
- Findings start legal clocks. The six-working-day dismissal window in Labor Law Art. 26 is the shortest; plan the fraud audit so that it does not burn that window by accident.
Key facts at a glance
| Question | Answer | Legal basis or source |
|---|---|---|
| Is a fraud audit mandatory in Turkey? | No. It is a voluntary, contract-based engagement. The board’s duty to maintain financial control is mandatory. | TCC No. 6102, Arts. 369 and 375 |
| Does the statutory audit cover fraud? | Only fraud that causes a material misstatement of the financial statements, and only to a reasonable-assurance level. | BDS 240 (Turkish equivalent of ISA 240), issued by KGK |
| Which companies have a statutory audit? | General companies exceeding two of three thresholds for two consecutive periods: TRY 500 million assets, TRY 1 billion net sales, 150 employees. | Presidential Decision No. 6434 as amended by No. 11066 (Official Gazette 17 March 2026, No. 33199) |
| Who can perform a fraud audit? | There is no “fraud auditor” license. In practice a Turkish CPA (SMMM) or sworn-in CPA (YMM) leads, with counsel and IT forensics as needed. | Law No. 3568; Decree-Law No. 660 |
| Can a minority shareholder force one? | In a joint-stock company (A.Ş.), a special audit can be requested from the general assembly and, if refused, from the commercial court by holders of 10% of capital (5% if publicly held) or TRY 1 million nominal value. | TCC Arts. 438 and 439 |
| What data is tested? | E-ledger, e-invoice and e-archive records, bank statements, payroll and social security (SGK) filings, inventory and customs records. | Tax Procedure Law No. 213; Revenue Administration e-document rules |
| Shortest deadline after discovery? | Six working days to dismiss for just cause, counted from the day the employer learns of the act. | Labor Law No. 4857, Arts. 25(II) and 26 |
| How long can the company sue directors? | Two years from learning of the damage and the liable person; five years from the act in any event; longer if the act is a crime with a longer limitation period. | TCC Arts. 553 and 560 |
| Are employee e-mails reviewable? | Yes, within limits: a legal ground, prior information to employees and proportionality are required. | Personal Data Protection Law No. 6698 (KVKK), Arts. 4, 5 and 10 |
| How common is occupational fraud? | The ACFE estimates that organizations lose about 5% of revenue to fraud each year; the median loss in its 2026 study was USD 104,000 across 2,402 cases in 143 countries. | ACFE, Occupational Fraud 2026: A Report to the Nations |
What is a fraud audit in Turkey?
A fraud audit in Turkey is a voluntary, targeted examination commissioned by a company’s board or shareholder to detect misappropriation of assets, corruption or manipulated records. It tests whole populations of transactions in the e-ledger, e-invoice, bank and payroll data, looks for specific fraud schemes, and reports facts and control gaps rather than an opinion on the financial statements.
The term covers two situations. A proactive fraud audit is ordered without a named suspect, usually by a foreign parent that wants to know whether its Turkish entity is as clean as the monthly reporting pack suggests. A reactive fraud audit follows a trigger such as a whistleblower e-mail, an unexplained margin drop or a bank confirmation that does not match the books.
A fraud audit is not a criminal investigation and does not decide guilt. It establishes what happened in the accounting records, how much is involved and which controls failed. If the findings need to be used before a Turkish court or prosecutor, the work moves into a forensic accounting audit designed for Turkish court procedure, which has its own evidentiary rules.
Fraud audit vs statutory audit vs forensic accounting audit vs internal audit
A statutory audit gives an opinion on whether financial statements are free of material misstatement. A fraud audit looks for misconduct regardless of materiality. A forensic accounting audit proves a specific allegation for a court, prosecutor or regulator. An internal audit is a continuous management function. Only the fraud audit and the forensic accounting audit are designed to find concealed fraud.
| Feature | Fraud audit | Statutory audit | Forensic accounting audit | Internal audit |
|---|---|---|---|---|
| Purpose | Detect fraud schemes and control gaps | Opinion on financial statements | Prove or disprove a specific allegation | Ongoing assurance on processes |
| Trigger | Board decision, red flags, transaction or management change | Legal thresholds (TCC Arts. 397–398) | Dispute, dismissal, complaint, claim | Annual audit plan |
| Scope of testing | Full populations in risk areas, no materiality filter | Samples, driven by materiality | Everything relevant to the allegation | Risk-based samples |
| Standard | Engagement letter; professional rules of Law No. 3568 | Turkish Auditing Standards (BDS), incl. BDS 240 | Procedure of the forum (civil, criminal, labor, tax) | Internal charter; IIA standards where adopted |
| Output | Findings report, loss estimate, control recommendations | Auditor’s report | Evidence-grade report with exhibits | Internal audit reports |
| Reports to | Board or foreign shareholder | General assembly | Counsel, court, prosecutor | Board or audit committee |
Fraud audit vs tax examination (vergi incelemesi)
A tax examination is carried out by the Turkish tax inspectorate under Tax Procedure Law No. 213 and asks one question: was the correct tax paid? It protects the Treasury, not the shareholder. A fraud audit asks whether the company itself was harmed. The two overlap where fraud is hidden behind false invoices, because those invoices also create tax exposure for the company that booked them.
Does my Turkish subsidiary need a fraud audit?
A Turkish subsidiary needs a fraud audit when it shows unexplained margin or cash movements, when one person controls ordering, approval and payment, when local management is about to change, or when the entity falls below the statutory audit thresholds and nobody independent has ever tested its books. The decision belongs to the board or the foreign shareholder.
The ten red flags below are the ones that most often justify a fraud audit of a foreign-owned Turkish company:
- Gross margin falls while volumes and prices are stable.
- A supplier registered recently takes a large share of purchases within months.
- The general manager or finance manager holds sole signature authority at the bank and also approves postings.
- Month-end reporting to headquarters is repeatedly late or revised.
- Round-amount payments, payments just under approval limits, or payments on weekends and public holidays.
- Advances to personnel or “other receivables” balances that grow every quarter and are never settled.
- Inventory write-offs or scrap sales without independent count evidence.
- Payroll headcount in SGK filings that does not match the people actually on site.
- Key staff who never take leave and resist a system or bank-access change.
- The entity has no statutory audit, no internal audit and one external bookkeeper who reports to local management.
A five-question decision framework
- Is the entity subject to statutory audit? If not, no independent party has tested the books at all. Check the thresholds in our guide to statutory audit thresholds for Turkish subsidiaries.
- Are duties segregated? If one person can create a supplier, approve an invoice and release a payment, a fraud audit is justified on structure alone.
- Do two or more red flags apply? Two unrelated red flags are usually enough to scope a targeted review.
- Is there a named suspect or a specific allegation? If yes, involve Turkish counsel first, preserve evidence and plan around the Labor Law clock before any interview.
- Is a transaction coming? Before a sale, acquisition, refinancing or change of general manager, a fraud audit protects the price and the handover.
Foreign parents usually call after the damage is visible in the cash position. In my experience the cheaper moment is earlier: the first year after a subsidiary is set up or acquired, when access rights, bank mandates and supplier master data are still being formed. A short, scheduled fraud audit at that stage finds control gaps before anyone has learned how to use them.
Is a fraud audit mandatory in Turkey? The legal basis
No Turkish statute requires a standalone fraud audit. The obligation is indirect: Turkish Commercial Code Art. 375 makes the board non-delegably responsible for establishing accounting and financial control and for supervising managers, and Art. 553 makes directors personally liable for damage caused by breach of duty. A fraud audit is evidence that the duty was performed.
| Rule | What it says | Why it matters for a fraud audit |
|---|---|---|
| TCC No. 6102, Art. 369 | Directors and managers must act with the care of a prudent manager and protect the company’s interests in good faith. | Ignoring red flags is a duty-of-care problem for the directors, including those appointed by the foreign parent. |
| TCC Art. 375(1)(c) and (e) | Setting up accounting, financial audit and financial planning, and supervising those entrusted with management, are non-delegable board duties. | The board cannot hand fraud prevention to the general manager and step back. |
| TCC Arts. 397–398 and Presidential Decision No. 6434 | Companies above the thresholds must have their financial statements audited under Turkish Auditing Standards. | Below the thresholds there is no independent audit; above them, the audit is still not a fraud audit. |
| BDS 240 | The auditor obtains reasonable assurance that the statements are free of material misstatement due to fraud or error; primary responsibility for fraud prevention and detection rests with management and those charged with governance. | Explains why a clean opinion and an ongoing fraud can coexist. |
| TCC Arts. 438–439 | Shareholders of a joint-stock company may request a special audit of specific events after using their right to information; minorities may go to court if the general assembly refuses. | The minority shareholder’s route to an independent examination. |
| TCC Arts. 553 and 560 | Directors and managers are liable for damage caused by breach of duty; claims lapse two years after knowledge and five years after the act, subject to longer criminal periods. | The fraud audit report starts the knowledge clock and supports the claim. |
| Labor Law No. 4857, Arts. 25(II)(e) and 26 | An employer may dismiss without notice for acts contrary to integrity and loyalty, within six working days of learning of the act and within one year of the act; the one-year cap does not apply where the employee gained a material benefit. | Determines how and when preliminary findings are escalated. |
| Turkish Criminal Code No. 5237, Arts. 155, 157–158 and 207 | Abuse of trust, fraud and forgery of private documents are criminal offences. | Findings may support a criminal complaint drafted by counsel. |
| Tax Procedure Law No. 213, Arts. 359, 344 and 371 | Issuing or using false invoices is a tax crime; tax loss penalties are tripled for such acts; voluntary disclosure is possible before detection. | Fraud hidden in invoices creates tax exposure for the victim company too. |
| KVKK No. 6698, Arts. 4, 5, 9 and 10 | Processing personal data requires a legal ground, proportionality and information to the data subject; transfers abroad follow Art. 9. | Governs e-mail review, interviews and sending data to headquarters. |
Who can perform a fraud audit in Turkey?
Turkey has no separate license for fraud auditors. A fraud audit is typically led by a Certified Public Accountant (SMMM) or sworn-in CPA (YMM) licensed under Law No. 3568, supported by Turkish counsel for legal characterization and by IT forensic specialists for device and e-mail evidence. The Certified Fraud Examiner (CFE) title is a private credential, not a Turkish license.
| Provider | Role | Limits |
|---|---|---|
| Turkish CPA (SMMM) or sworn-in CPA (YMM) | Leads the accounting examination: ledgers, e-documents, bank, payroll, tax effects, loss quantification. | Does not give legal characterization or represent the company in court. |
| Statutory auditor (KGK-authorized) | Audits the financial statements under BDS; communicates identified fraud to those charged with governance. | Independence rules restrict additional services to audit clients; scope is the financial statements. |
| Turkish lawyer | Legal privilege strategy, dismissal, criminal complaint, civil claims, KVKK protocol. | Does not test the books. |
| IT forensic specialist | Imaging of devices, e-mail and log analysis, chain of custody. | Needs a lawful basis and scope set by counsel. |
| Group internal audit | Knows the group’s processes and systems; can co-source. | Often lacks Turkish language, Turkish chart of accounts and e-document knowledge. |
The existing bookkeeper of the subsidiary should not lead the fraud audit of books that the same firm keeps. Independence from local management and from the accounting function is the first selection criterion.
What does a fraud audit test? Seven tests on Turkish data
A fraud audit in Turkey tests seven areas: supplier master data and purchases, e-invoices and false documents, bank and cash flows, payroll against SGK filings, inventory and scrap, revenue and credit notes, and manual journal entries. Because Turkish companies keep e-ledgers and issue e-invoices in structured form, each area can be tested across the full population.
| Scheme | Turkish data source | Typical test | Red flag |
|---|---|---|---|
| Shell or related supplier | Supplier master file, trade registry gazette, e-invoice XML | Match supplier addresses, bank accounts and tax numbers to employees and to each other; test registration dates against first invoice. | Supplier founded shortly before first order; shared IBAN or address. |
| False or inflated invoices | E-invoice and e-archive records, delivery notes (e-irsaliye), warehouse receipts | Three-way match of order, receipt and invoice across the whole period. | Service invoices with no deliverable; sequential invoice numbers from one supplier. |
| Diverted payments | Bank statements, payment files, signature circular | Compare payee IBANs in bank data to approved master data; test payments outside business days. | IBAN changed shortly before payment; split payments under approval limits. |
| Ghost employees and payroll padding | Payroll, SGK declarations, bank salary files, access-card logs | Reconcile headcount across all four sources. | Employees with no access-log activity; several salaries paid to one account. |
| Inventory and scrap theft | Stock ledger, production records, scrap sales invoices, customs declarations | Yield analysis; independent count; scrap price comparison. | Scrap sold to one buyer at stable low prices; unexplained yield losses. |
| Revenue skimming and credit notes | Sales e-invoices, returns, customer statements, POS data | Analyze credit notes and write-offs by user and customer; confirm balances directly. | Credit notes issued after period end; customer balances that never reconcile. |
| Concealment in the ledger | E-ledger (journal and general ledger), user logs | Journal entry testing: manual, back-dated, round-amount and unusual account combinations. | Entries to advances, suspense or “other” accounts with no document reference. |
Two Turkish features help the fraud auditor. First, e-ledger certificates (berat) are uploaded to the Revenue Administration system on a statutory schedule, which fixes the ledger in time. Second, an e-invoice exists in the systems of both the issuer and the recipient, so a document cannot be altered quietly on one side only.
The account I open first in a Turkish subsidiary is not cash. It is the group of advance and other-receivable accounts in the uniform chart of accounts. Balances that roll forward year after year without settlement are where diverted money is most often parked, because nobody at headquarters maps those local accounts to a line they review.
How a fraud audit works in Turkey: a 6-step process
A fraud audit in Turkey runs in six steps: scoping with the board and counsel, lawful data acquisition, full-population analytics, document and third-party verification, quantification of loss and tax effect, and reporting with control recommendations. Interviews with suspected persons come last and only on counsel’s advice, because they start the Labor Law clock.
- Scope and mandate. The board or foreign shareholder signs the engagement letter, defines periods, entities and risk areas, and decides who receives the report. Counsel advises on privilege and on the KVKK protocol.
- Data acquisition. E-ledger files, e-invoice and e-archive records, bank statements obtained directly from the banks, payroll and SGK filings, and ERP user logs are collected with a documented chain of custody.
- Analytics on the full population. Supplier, payment, payroll and journal-entry tests are run on every transaction in scope, not on a sample.
- Verification. Exceptions are traced to contracts, delivery evidence, trade registry records and third-party confirmations. Site visits and counts are used where physical goods are involved.
- Quantification. The loss is calculated per scheme, together with the corporate tax, VAT and penalty effect of any false documents found in the books.
- Report and remediation. The report sets out facts, amounts, exhibits and control gaps, and recommends changes to bank mandates, approval limits and reporting lines. If legal action follows, the file is handed to counsel for the forensic stage.
What must happen after a fraud audit finds something?
Once a fraud audit in Turkey identifies a specific act and a specific person, several deadlines begin. The employer has six working days to dismiss for just cause under Labor Law Art. 26. Complaint-based offences must be reported within six months. Liability claims against directors lapse two years after knowledge. Tax corrections should be made before a tax examination begins.
| Action | Deadline | Legal basis |
|---|---|---|
| Dismissal for just cause | Six working days from learning of the act; one year from the act unless the employee gained a material benefit | Labor Law No. 4857, Art. 26 |
| Criminal complaint (complaint-based offences) | Six months from learning of the act and the perpetrator | Turkish Criminal Code No. 5237, Art. 73 |
| Liability claim against directors and managers | Two years from knowledge; five years from the act; longer criminal period if applicable | TCC Art. 560 |
| Voluntary tax disclosure | Before a denunciation or the start of a tax examination; tax and late-payment charge paid within 15 days | Tax Procedure Law No. 213, Art. 371 |
| Tax assessment period | Five years from the start of the year following the year in which the tax claim arose | Tax Procedure Law No. 213, Art. 114 |
| Retention of commercial books | Ten years | TCC Art. 82 |
The practical consequence is sequencing. Preliminary findings are reported to a small, defined group, so that the day on which “the employer learned” is documented and chosen rather than accidental. The detailed evidentiary rules are set out in our guide to the forensic accounting audit in Turkey.
What happens if…? Six situations
What happens if the statutory auditor gave a clean opinion and a fraud audit later finds fraud?
The two results are not contradictory. Under BDS 240 the statutory auditor is responsible for reasonable assurance against material misstatement, and concealment or collusion can defeat properly performed audit procedures. Auditor liability under TCC Art. 554 requires a breach of the auditor’s legal duties and fault, which must be assessed on the audit file, not assumed from the outcome.
What happens if the fraud audit finds false invoices in the subsidiary’s own books?
The company has a tax problem even though it is the victim. Input VAT and expense deductions based on false documents are exposed to reassessment, and using false documents is an offence under Tax Procedure Law Art. 359. Correcting the returns through voluntary disclosure under Art. 371 before a tax examination starts is usually the first question to put to the tax adviser.
What happens if the general manager who would commission the fraud audit is the person at risk?
The shareholder acts directly. In a limited company (Ltd. Şti.) the shareholder can rely on the information and inspection right in TCC Art. 614 and on shareholder resolutions; in a joint-stock company the board or the general assembly mandates the work. Bank mandates and system administrator rights are reviewed before the fraud audit is announced.
What happens if headquarters wants the e-mail data sent abroad?
Transfers of personal data outside Turkey follow KVKK Art. 9, as amended with effect from 1 June 2024. A transfer mechanism such as the standard contract published by the Personal Data Protection Authority is normally needed, and review inside Turkey with only findings sent abroad is often the simpler design.
What happens if the fraud audit finds nothing?
The board receives documented evidence that it performed its supervisory duty under TCC Art. 375, a list of control weaknesses ranked by risk, and a baseline for future monitoring. For a foreign parent that has never had independent eyes on the Turkish books, that result has value in itself.
What happens if you are a minority shareholder and management refuses access?
In a joint-stock company, first use the right to information at the general assembly (TCC Art. 437), then request a special audit under Art. 438. If the general assembly refuses, shareholders holding at least 10% of the capital (5% in publicly held companies) or shares with a nominal value of TRY 1 million may apply to the commercial court within three months under Art. 439.
Case analyses: three fraud audit patterns in foreign-owned Turkish companies
The cases below are anonymized composites built from recurring patterns. They are illustrative, do not describe any single client and do not predict the outcome of any other matter.
Case 1 — The distributor with no statutory audit
- Facts
- A Dutch group’s Turkish sales company (Ltd. Şti.) stayed below the statutory audit thresholds. Books were kept by an external bookkeeper chosen by the local general manager. “Advances given” grew for three years.
- The obvious answer
- Ask the bookkeeper for an explanation and wait for year-end.
- Why it would have failed
- The bookkeeper reported to the person whose transactions were in question, and no independent party had ever confirmed the balances.
- The structure adopted
- The shareholder mandated a proactive fraud audit. Bank statements were obtained directly from the banks and matched to the e-ledger. The advances were traced to payments with no supporting documents. Bank mandates were changed before findings were disclosed locally.
- Lesson
- Below the audit thresholds, the fraud audit is the only independent test the entity will ever have.
Case 2 — Clean audit opinion, inflated service invoices
- Facts
- A manufacturing subsidiary (A.Ş.) had an unqualified audit opinion. Maintenance costs rose steadily, each invoice below the local approval limit.
- The obvious answer
- Rely on the audit opinion and treat the increase as inflation.
- Why it would have failed
- Individually the invoices were immaterial and correctly booked; the audit had no reason to test whether the services were performed.
- The structure adopted
- A fraud audit tested every maintenance e-invoice against work orders and site access logs. A group of suppliers shared one bank account. The tax effect of the unsupported invoices was calculated and the returns were reviewed with the tax adviser.
- Lesson
- Materiality protects the financial statements, not the cash.
Case 3 — Pre-sale fraud audit
- Facts
- A foreign owner planned to sell its Turkish entity. The buyer’s due diligence was six months away.
- The obvious answer
- Let the buyer’s advisers find whatever there is.
- Why it would have failed
- Issues found by the buyer become price reductions and indemnities negotiated under time pressure.
- The structure adopted
- A seller-side fraud audit covered payroll, related-party suppliers and scrap sales. A payroll discrepancy against SGK filings was corrected before the data room opened.
- Lesson
- A fraud audit before a transaction converts an unknown into a disclosed, priced item. See also our due diligence guide for buying a company in Turkey.
What drives the cost of a fraud audit in Turkey?
The cost of a fraud audit in Turkey depends on the number of entities and years in scope, the quality and accessibility of e-ledger and bank data, the number of risk areas tested, whether IT forensics and interviews are needed, the reporting language, and whether the report must later support court proceedings. Fees are agreed in writing after a scoping consultation.
| Driver | Lower effort | Higher effort |
|---|---|---|
| Scope | One entity, one or two years, two risk areas | Several entities, five years, all cycles |
| Data | Complete e-ledger and bank data in structured form | Missing periods, several ERP systems, paper archives |
| Evidence standard | Board-level findings report | Report intended for court, with exhibits and Turkish translation |
| Specialists | Accounting team only | IT forensics, counsel, valuation or customs specialists |
| Cooperation | Open access and cooperative staff | Covert phase, restricted access, hostile management |
| Language | English report with Turkish exhibits | Bilingual report and sworn translations |
Fraud audit in Turkey vs Germany vs the United Kingdom
Compared with Germany and the United Kingdom, Turkey gives a fraud audit richer structured data, because e-ledgers and e-invoices are standardized, but a shorter reaction window: six working days for dismissal against two weeks in Germany and no fixed statutory period in the United Kingdom. The statutory auditor’s fraud standard is aligned with ISA 240 in all three.
| Point | Turkey | Germany | United Kingdom |
|---|---|---|---|
| Auditor’s fraud standard | BDS 240 | IDW PS 210 | ISA (UK) 240 |
| Dismissal window after discovery | Six working days (Labor Law Art. 26) | Two weeks (Civil Code § 626(2)) | No fixed statutory period; prompt action expected |
| Minority route to an independent examination | Special audit, TCC Arts. 438–439 | Special audit (Sonderprüfung), Stock Corporation Act § 142 | No direct equivalent; unfair prejudice petition, Companies Act 2006 s. 994 |
| Structured ledger data | Standard e-ledger and e-invoice formats for most companies | No general e-ledger filing; e-invoicing being phased in | No general e-ledger or e-invoice mandate |
| Corporate offence for failing to prevent fraud | No general equivalent | No general equivalent | Yes, for large organisations (Economic Crime and Corporate Transparency Act 2023) |
The foreign-law columns are a general orientation for group legal teams, not advice on German or UK law.
How to choose a fraud audit provider in Turkey
- Confirm that the lead is a licensed Turkish CPA (SMMM or YMM) and verify the license number with the professional chamber.
- Check independence from the subsidiary’s bookkeeper, statutory auditor and local management.
- Ask how e-ledger and e-invoice data will be acquired and whether full-population testing is used.
- Ask for the KVKK protocol in writing before any e-mail or device is touched.
- Check that the report can be upgraded for court use and that the provider understands Turkish court-expert practice.
- Agree who learns what and when, so that the Labor Law clock is managed.
- Require an engagement letter that fixes scope, periods, deliverables and reporting lines.
Conclusion
A fraud audit in Turkey is not a legal formality and not a substitute for the statutory audit. It is the board’s most direct tool for meeting its supervisory duty under the Turkish Commercial Code and for finding out, on the full data, whether the Turkish entity is losing money to misconduct. Order it early, keep it independent of local management, and plan it with the Turkish deadlines in view.
Fraud Audit for Turkish entities of foreign groups
Peace of Mind when you cannot see inside your Turkish entity from headquarters. A CPA-led fraud audit that tests the full e-ledger, e-invoice, bank and payroll data and reports to the shareholder, not to local management.
- Scoping memo with risk areas, periods and a deadline map
- Data acquisition under a written KVKK protocol
- Full-population tests on suppliers, payments, payroll, inventory and journal entries
- Loss quantification with corporate tax, VAT and penalty effect
- Findings report in English with Turkish exhibits, ready to hand to counsel
- Control recommendations and Always-on Compliance monitoring afterwards
We do not make legal characterizations, represent clients in court or act as your statutory auditor; we work alongside your Turkish counsel. Engagements start with a paid scoping consultation, and fees are confirmed in writing.
Request the review by emailRequest a proposal
info@ozmconsultancy.com · +90 216 352 29 61 · WhatsApp +90 506 682 96 55 · Deluxia Palace, Batı Ataşehir, Istanbul
Frequently asked questions about fraud audit in Turkey
What is a fraud audit?
A fraud audit is a targeted examination of accounting records, bank flows and supporting documents that looks for misappropriation of assets, corruption and manipulated records. Unlike a statutory audit, it applies no materiality filter, tests full populations in risk areas and reports facts, amounts and control gaps to the board or shareholder.
Is a fraud audit mandatory in Turkey?
No. Turkish law does not require a standalone fraud audit. Turkish Commercial Code Art. 375 does require the board to establish financial control and supervise management, and Art. 553 makes directors liable for breach of duty. A fraud audit is one way to perform and evidence that supervisory duty.
What is the difference between a fraud audit and a forensic audit?
A fraud audit looks for fraud that may or may not exist and reports to management or the shareholder. A forensic accounting audit starts from a specific allegation and builds evidence for a court, prosecutor or regulator. In Turkey the forensic stage must also fit court-expert procedure under Law No. 6754 and the procedural codes.
Does a statutory audit in Turkey detect fraud?
Only partly. Under Turkish Auditing Standard BDS 240 the statutory auditor obtains reasonable assurance that the financial statements are free of material misstatement caused by fraud or error. Fraud below materiality, or fraud concealed through collusion and forged documents, can remain undetected even in a properly performed audit.
Who can perform a fraud audit in Turkey?
There is no specific Turkish license for fraud auditors. Engagements are normally led by a Certified Public Accountant (SMMM) or sworn-in CPA (YMM) licensed under Law No. 3568, working with Turkish counsel and, where needed, IT forensic specialists. The Certified Fraud Examiner title is a private professional credential.
How long does a fraud audit take in Turkey?
Duration depends on scope and data quality. A targeted review of one entity and two risk areas with complete e-ledger and bank data is typically measured in weeks; a multi-entity, multi-year fraud audit with IT forensics takes longer. The timetable should be fixed in the engagement letter after scoping.
Can a foreign parent order a fraud audit without telling local management?
Yes, where the shareholder or board has authority to mandate it. Data such as bank statements and e-ledger files can often be obtained through shareholder-level access. Review of employee e-mails and devices still requires a lawful basis and prior information to employees under the Personal Data Protection Law No. 6698.
What does a fraud audit report contain?
A fraud audit report states the mandate and scope, the data examined, the tests performed, each finding with amounts and exhibits, the estimated loss and tax effect, the control weaknesses that allowed the scheme, and recommendations. It reports facts; legal characterization is left to counsel.
How much does a fraud audit cost in Turkey?
There is no standard tariff. Cost is driven by the number of entities and years, data quality, the number of risk areas, the need for IT forensics and interviews, reporting language and whether the report must support litigation. Fees are agreed in writing after a paid scoping consultation.
Can fraud audit findings be used in a Turkish court?
They can be submitted, but a court will usually appoint its own expert (bilirkişi). Findings carry more weight when the report is evidence-grade: figures tie to the statutory books, exhibits are numbered and data was lawfully obtained. Plan this from the start if litigation is likely.
Primary sources
- Turkish Commercial Code No. 6102 (TTK), Arts. 82, 369, 375, 397–398, 437–444, 553–554, 560 and 614: mevzuat.gov.tr
- Presidential Decision No. 11066 amending Decision No. 6434 on companies subject to independent audit: Official Gazette of 17 March 2026, No. 33199; consolidated text and announcement at kgk.gov.tr
- Turkish Auditing Standard BDS 240, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements: Public Oversight, Accounting and Auditing Standards Authority (KGK)
- Decree-Law No. 660 on the organization and duties of KGK: mevzuat.gov.tr
- Law No. 3568 on Certified Public Accountancy and Sworn-in Certified Public Accountancy: mevzuat.gov.tr
- Labor Law No. 4857, Arts. 25 and 26: mevzuat.gov.tr
- Turkish Criminal Code No. 5237, Arts. 73, 155, 157–158 and 207: mevzuat.gov.tr
- Tax Procedure Law No. 213 (VUK), Arts. 114, 344, 359 and 371: mevzuat.gov.tr
- Personal Data Protection Law No. 6698 (KVKK), Arts. 4, 5, 9 and 10: mevzuat.gov.tr
- Revenue Administration e-ledger and e-document rules: edefter.gov.tr and gib.gov.tr
- Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations: acfe.com (global statistics; not legal authority)
This article is provided for general informational purposes and does not constitute legal, tax, accounting or investment advice. The treatment of any matter under Turkish law depends on the specific facts, documents and procedure. Professional advice should be obtained before taking action. Thresholds and deadlines are stated as of 11 November 2026.
Turn Turkey compliance into certainty
SYSTEMS CPA supports foreign-owned companies with company formation, accounting, tax compliance and payroll in Turkey — one accountable local partner. Reviewed by Evren Özmen, SMMM (Certified Public Accountant), TÜRMOB Reg. No. 35675.
