Not every business in Vietnam must maintain internal audit. Under Decree 05/2019/ND-CP, only three groups of enterprises are required to perform internal audit work; all others are merely encouraged to do so voluntarily. This article helps you check whether your company falls under the mandate, plus the two most common misconceptions.
1. The three mandatory groups
Clause 1, Article 10 of Decree 05/2019/ND-CP (issued 22/01/2019, effective 01/4/2019, still in force at the time of writing) requires internal audit work from:
- (a) Listed companies;
- (b) Enterprises over 50% state-owned that are parent companies in a parent–subsidiary model;
- (c) State-owned enterprises acting as parent companies in a parent–subsidiary model.
2. Quick self-check
- Is your company listed on a stock exchange? → Mandatory (group a).
- Is your company a parent company in a parent–subsidiary model with the State holding over 50% of charter capital? → Mandatory (group b).
- Is your company a state-owned enterprise acting as parent in a parent–subsidiary model? → Mandatory (group c).
- An ordinary private LLC/JSC, a subsidiary, or an unlisted company? → Not mandatory — only encouraged (Clause 2, Article 10).
3. Common confusion 1: “listed company” is not “public company”
Many articles claim every public company must have internal audit — that misreads Decree 05/2019. Point a, Clause 1, Article 10 mandates only “listed companies”. A public company merely registered for trading (e.g., on UPCoM) without listing is not covered by the letter of the decree.
4. Common confusion 2: “must perform internal audit work” is not “must set up a separate internal audit department”
Mandated enterprises may hire a qualified independent audit firm to provide internal audit services (Clause 3, Article 10). In other words, the duty is to perform the work — not necessarily to maintain a dedicated in-house internal audit unit. This gives smaller mandated companies a flexible compliance path.
5. How internal audit differs from independent audit and internal control
- Internal audit: performed by the unit own people (or a hired firm), reporting directly to the Board of Directors/management to assess and improve governance and controls.
- Independent audit: performed by an external audit firm, opining on the financial statements.
- Internal control: the system of processes and policies the enterprise sets up; internal audit is the independent assessment of that system.
6. Practical implementation: who issues the charter, where does the unit sit?
- The internal audit charter is issued by the Board of Directors for listed companies (Clause 4, Article 12 of Decree 05/2019).
- The internal audit unit is typically placed directly under the Board of Directors to safeguard independence from executive management.
- Guidance in force: Circular 66/2020/TT-BTC (model internal audit charter for enterprises, effective 01/9/2020) and Circular 08/2021/TT-BTC (Vietnamese internal audit standards and code of ethics, effective 01/4/2021).
- Banks and insurers follow separate internal audit rules under sector-specific laws.
7. Outside the mandate — should you still set up internal audit?
The law encourages voluntary adoption (Clause 2, Article 10). Practical benefits: better governance quality, greater transparency toward investors, and readiness for future listing or M&A plans. Companies can use the model charter in Circular 66/2020/TT-BTC as a framework scaled to their size.
Frequently asked questions
Is a subsidiary of a listed company subject to mandatory internal audit? By the letter of Clause 1, Article 10, the duty sits with the listed company and qualifying parent companies in groups b and c. An ordinary subsidiary is not mandated unless it is itself listed.
What is the penalty for not performing internal audit when mandated? No direct sanction provision has been identified in the reviewed instruments; this article states no penalty absent a verified basis.
Which firm can be hired for outsourced internal audit? It must be an independent audit organization qualified to provide internal audit services (Clause 3, Article 10, linked to the principles in Articles 5 and 6 of Decree 05/2019).
Conclusion
Remember the three mandatory groups: listed companies, over-50% state-owned parents in a parent–subsidiary model, and state-owned parents in a parent–subsidiary model. Companies outside these groups are not required but encouraged — and even mandated companies may outsource instead of building an in-house unit. Start by matching your company against the self-check in section 2.
Legal basis
- Decree 05/2019/ND-CP on internal audit (effective 01/4/2019) — Articles 10, 12
- Circular 66/2020/TT-BTC — model internal audit charter for enterprises (effective 01/9/2020)
- Circular 08/2021/TT-BTC — Vietnamese internal audit standards and code of ethics (effective 01/4/2021)
This article is for general reference only and does not constitute legal advice for any specific case.
Transparency note: This content was prepared with AI assistance and will undergo quality review by the FLAW AI Legal Council before publication approval; it is not legal advice from a human lawyer.
Read more: Contact FLAT Law Firm
