When the 1 October SARAS filing deadline approaches, the Revenue Service opens a tax audit, or a bank or foreign partner asks for evidence of internal control, the problem is rarely a single missing document. The real question is different: can the company show that its day-to-day processes follow the law, its contractual obligations and its own internal policies? That is the question a regulatory compliance assessment answers.

This assessment is not a formality or a folder of documents assembled for the auditors. Its purpose is to reveal the gap between the rules that apply and what the company actually does, to measure the scale of the risk and to set out a realistic remediation plan. For owners, CFOs and chief accountants, it is a decision-making tool that connects financial discipline with operational management.

What a Compliance Assessment Covers

The first step is to identify the requirements that actually apply. They are not the same for every business. They depend on the enterprise category, the sector, headcount, cross-border operations, the revenue model, key contracts and whether the company belongs to a foreign group.

For a company operating in Georgia, the assessment typically covers:

▪ Tax: VAT, personal income tax and pension contributions on payroll, profit tax under the Estonian model and property tax, as well as the practice of issuing VAT invoices and waybills on rs.ge;

▪ Financial reporting: correct determination of the enterprise category, filing of annual financial statements on reportal.ge by 1 October and, for Category I-II enterprises and public interest entities, mandatory audit;

▪ Employment: Labour Code requirements, employment contracts, working-time records and occupational safety;

▪ Personal data: the legal basis for processing employee and customer data, video surveillance and direct marketing;

▪ Corporate records and the control environment: partner and director resolutions, the delegation of authority and approval rules.

Specific sectors add further requirements: licences and permits, National Bank of Georgia regulation in the financial sector, obligations for reporting entities under the anti-money laundering law, or transfer pricing rules for transactions with foreign related parties.

The assessment then tests not only whether a policy or procedure exists, but how it works in practice. For example, the VAT procedure may be documented, while the classification of transactions (taxable, exempt with or without credit), reverse-charge VAT on services from non-residents or the timely issue of VAT invoices turns out to be inadequate. Likewise, a journal entry may record a transaction correctly, while the primary document, the approval trail or the account reconciliation lags behind.

A compliance assessment answers four practical questions: which requirement applies to the company, who is responsible for meeting it, what evidence shows it has been met, and what happens when a deviation is found. If the answer to any of these is unclear, a control weakness already exists, whether or not the company has suffered a financial loss.

Why the Annual Audit Cannot Replace Ongoing Control

An annual audit is an important independent check, but it cannot replace ongoing compliance management. The audit assesses the risk of material misstatement in the financial statements and relies on sample-based evidence. A compliance assessment looks at the process more broadly: deadlines, responsibilities, data sources, system access, document retention and recurring exceptions. Moreover, Category III-IV enterprises are not subject to mandatory audit at all, so an independent assessment is often their only external perspective.

For example, a company files its financial statements on time, but its monthly bank reconciliations are superficial. In any given year this may not amount to a material misstatement, yet it creates a risk of fraud, duplicate payments or inaccurate cash flow forecasts. The same applies to the tax calendar: filing a return by the 15th does not automatically mean the data behind it is complete and correct. Georgia's general tax statute of limitations is three years, so today's gap can return years later as an assessment, a penalty and late-payment interest.

An effective approach combines ongoing internal control, periodic independent assessment and targeted tax or advisory support. The depth of the model depends on the company's size and risk profile. A small business may need little more than a clear calendar, segregated responsibilities and core reconciliations. The Georgian subsidiary of an international group, by contrast, needs a formal control matrix, alignment with group reporting rules and regular management reporting.

Practical Stages of the Assessment

1. Define the Scope

Testing every regulation at once is not always sensible. For a fast-growing company, the priorities may be payroll, revenue recognition and VAT. If the company is planning to raise investment, take on bank financing, sell the business or expand abroad, the reliability of financial data, contract documentation and group reporting requirements move to the front.

2. Map Requirements and Controls

The map links each requirement to the relevant process, the responsible person, the frequency of performance and the evidence. Its value goes beyond making the review easier. It shows where the company relies too heavily on one employee's knowledge, where work is duplicated and where there is no clear chain of approval.

3. Test How Things Work in Practice

The specialist reviews selected transactions, tax returns, VAT invoices, reconciliations, approvals and system data (for example, records in the accounting software and data from the company's rs.ge account). This is where the difference between form and substance becomes visible: a policy is not enough if its performance cannot be confirmed by consistent and timely evidence.

4. Rate Findings by Risk

Not every finding carries the same priority:

▪ High risk: may lead to sanctions, additional tax, misstated financial statements or a breach of a contractual obligation, such as a loan covenant;

▪ Medium risk: causes no direct loss yet, but increases the likelihood of error;

▪ Low risk: is often resolved by improving documentation or clarifying responsibilities.

5. Build an Action Plan

The final stage is an action plan with an owner, a deadline and a verifiable outcome. A recommendation like "improve controls" means practically nothing. An actionable plan specifies what will change in the process, who will approve the change, which document will confirm it has been done and how the result will be tested in the following period.

The Most Common Weaknesses in Georgian Companies

In practice, risk appears where the business has grown quickly and controls have lagged behind.

Insufficient segregation of duties. The same person creates suppliers in the system, approves payments, holds signing rights in internet banking and performs the bank reconciliation. Full segregation is not always possible in a small team. In that case, a periodic independent review by the owner or director becomes an essential compensating control.

Inconsistent documentation. The contract, VAT invoice, acceptance certificate and payment approval sit in different systems or only in email. Proving the economic substance of a transaction becomes slower and more expensive, especially during an audit, a tax audit or a dispute. Under the Estonian model this is also a direct tax risk: an undocumented expense, or one unrelated to economic activity, may be treated as a deemed profit distribution subject to 15% profit tax.

Misclassification of tax obligations. Operational teams often decide who is hired under an employment contract and who under a service contract, which supplies are subject to VAT and which expenses relate to the business. Without financial and tax review, this saves time in the short term but later leads to adjustments, penalties, late-payment interest and management time.

Less visible obligations. Georgia's new Law on Personal Data Protection has applied since March 2024 and sets strict rules on the legal basis for processing, consent and incident notification. Since 2 March 2026, the State Audit Office has supervised compliance with it. The Labour Inspection Service, meanwhile, can inspect workplaces without prior notice. Many companies think about these areas only after an inspection or a complaint.

What Management Should Expect

The outcome of a well-run assessment is not a list of non-compliances. Management should receive a prioritised picture: which obligations are critical, what threatens the financial statements and the tax position, which controls work and where change is needed.

This information is especially valuable during growth, reorganisation, entry into a new market, bank financing or negotiations with an investor. Orderly financial and tax processes reduce unexpected questions and strengthen management's position. AGIC's combined audit, accounting, tax and advisory perspective assesses processes not in isolation, but in the context of how reporting, taxes and management information connect.

Frequently Asked Questions

Does a company with an annual audit still need a compliance assessment?

Yes. An audit focuses on the accuracy of the financial statements and relies on sampling. A compliance assessment tests how specific tax, employment, data protection and other requirements are met in day-to-day processes. The two complement each other.

How often should the assessment be performed?

In practice, a full assessment is carried out every one to two years, with a targeted review after any significant change: a new product or market, a new accounting system, a reorganisation or a change in legislation.

What should a company prepare to get started?

A core package is enough: the organisational structure and delegation of authority, internal policies, tax returns and an rs.ge account extract, financial statements, key contracts and recent reconciliations. Further requests are tailored to the agreed scope.

Does this apply to small businesses?

Yes, at a different scale. A small company may not need a formal control matrix, but a tax calendar, segregated responsibilities and monthly reconciliations are essential for a business of any size.

Conclusion

Compliance is not a one-off project that loses its relevance once the review is over. It is a management discipline: requirements, responsibilities and evidence must evolve as the business grows. The most useful assessment is one that not only shows the company its current gaps, but also gives it a more reliable financial foundation for its next decision.

Since 2007, AGIC has served Georgian and international companies across audit, accounting, tax and advisory. In a compliance assessment, that means financial reporting, the tax position and internal control are tested in a single context.

Want to know how ready your company is for an inspection? Contact us to agree the scope of a compliance assessment - agic.ge

This article is general in nature and does not constitute specific tax or legal advice. Information is current as of November 2026.