Most private-company CECL allowances are built in a spreadsheet: an aging report, a table of loss rates, a few qualitative adjustments and a total that flows to a journal entry. The accounting is covered in CECL for private companies. This guide covers the audit side: what to test in the data, how to validate a spreadsheet model that nobody has ever validated, and how to evaluate qualitative adjustments without either rubber-stamping them or rebuilding the estimate yourself.
The allowance is an accounting estimate, so AU-C 540 (SAS 143) governs. See auditing accounting estimates for the standard itself.
Start with the risk assessment, not the spreadsheet
SAS 143 requires inherent risk and control risk to be assessed separately for each relevant assertion. It was effective for audits of financial statements for periods ending on or after December 15, 2023, so every current engagement is under it. The inherent risk factors that matter for a credit loss estimate are estimation uncertainty, complexity, subjectivity and susceptibility to management bias.
Rate the allowance on that spectrum before choosing procedures:
- Low end: short-term trade receivables from a diversified customer base, an aging-based matrix, stable collection history, no qualitative adjustments.
- High end: long-dated notes receivable, concentrated exposures, a lessor's net investment in leases, a model with multiple judgmental overlays, or a client under liquidity pressure that has an incentive to understate the allowance.
Any risk of material misstatement assessed near the high end of the spectrum is a significant risk, and the auditor must evaluate the design and implementation of the related controls. If the client has no review control over the allowance calculation, document that and respond with more substantive work.
Test the data first
Every CECL method rests on two data sets: the population being reserved and the history used to derive loss rates. Errors here flow straight into the allowance, and entity-produced data needs the same scrutiny as any other evidence.
The population. Tie the aging report to the general ledger control account. Recompute the aging buckets for a sample of invoices using invoice date or due date as the client's policy states. Confirm that credits and unapplied payments are placed in the correct buckets; an unapplied cash receipt that sits unmatched in a "current" bucket can hide a delinquent balance. Confirm that contract assets, notes and other in-scope assets are in the population and not only trade invoices.
The history. Obtain the write-off, recovery and balance history behind each loss rate and trace a sample to source records. Test completeness: are all write-offs in the lookback period included, including those booked directly to expense or netted against revenue as credit memos? A loss rate computed from a write-off list that omits credit memos issued to settle disputes is understated before any judgment is applied.
Consistency. Compare the lookback period, pooling and bucket definitions with prior years. A change in method needs a documented reason, and a lookback period that happens to drop a bad year deserves a question.
Validate the model
Bank regulators spell out what model validation means in their Interagency Policy Statement on Allowances for Credit Losses (issued June 2020, revised April 2023). It is written for banks and does not bind a private operating company, but it is the clearest published description of the elements a reviewer looks for, and it scales down well. It says management should evaluate models before use, periodically validate the loss estimation process including any changes, and have that validation performed by a party with appropriate expertise who is independent of credit approval and of the estimate itself. It describes validation as including an evaluation of the model's conceptual soundness and ongoing monitoring.
For a spreadsheet at a private company, translate that into audit work:
- Conceptual soundness. Does the method fit the asset? An aging matrix suits trade receivables; applying it to a five-year note does not.
- Process verification. Recalculate the allowance independently. Test formulas for range errors, hard-coded overrides, links to stale tabs and totals that skip rows. Recalculation is a standard SAS 143 procedure for confirming that the method was applied as intended and that the arithmetic is accurate.
- Change control. Who can edit the workbook? Is there a prior-year copy to compare against? Were rates changed during the year, and by whom?
- Benchmarking and output analysis. Compare the allowance as a percentage of receivables, and the bucket-level rates, with prior periods and with actual write-offs over the following year. A rate that has never produced a loss in any bucket needs support for a zero-loss assertion.
- Retrospective review. Compare last year's allowance with what actually happened. A consistent pattern of over- or under-reserving is an indicator of management bias that SAS 143 requires the auditor to evaluate.
A word on independence: the same policy statement notes that using the external financial statement auditor to perform the model validation can impair independence. The principle carries over. Do not build or tune the client's loss model; evaluate it. If management has not appropriately addressed estimation uncertainty, SAS 143 permits the auditor to develop an independent point estimate or range, but without assuming management's responsibilities. See independence and nonattest services before offering to "help set up the CECL spreadsheet."
Evaluate qualitative factors
Historical loss rates describe the past. ASC 326 requires the estimate to reflect current conditions and reasonable and supportable forecasts, and qualitative adjustments are where that gets done. The interagency statement lists the factors institutions are expected to consider. The following adapt to a private operating company:
- the nature and volume of the receivables
- concentrations of credit, their growth and effect
- levels and severity of past-due balances and disputed or specifically reserved accounts
- credit and collection policies, including changes in terms, underwriting of new customers and write-off practices
- the experience and depth of credit and collections staff
- external factors: legal, regulatory and technological environment, competition, natural disasters
- actual and expected changes in economic and business conditions that affect collectibility in the customers' markets
The statement makes two points that translate directly into audit tests.
Relevance. Economic indicators count only if they bear on the client's customers. A national unemployment rate matters less than conditions in the industry or region the receivables come from.
No double counting. Adjustments should not duplicate information already captured in the loss estimation process. If the aging rates were refreshed last month using recent write-offs, adding a separate "recent deterioration" overlay may count the same deterioration twice.
For each adjustment, ask for three things: what changed, how the amount was derived, and why the base rates do not already reflect it. An adjustment expressed as "add 0.5% for economic uncertainty" with no derivation is an assertion, not evidence. The statement also says historical losses or recent loss trends alone are generally not a sufficient basis for the allowance level, which cuts against the opposite error of relying on the lookback and adjusting nothing.
Where the ASU 2025-05 expedient changes the work
If the client elected the practical expedient for current trade receivables and contract assets, the forecasting piece is simplified: conditions at the balance sheet date are assumed to persist. Historical loss experience must still be adjusted for differences between current conditions and those in the historical period, and for asset-specific differences. Qualitative factors about the customer base remain in play. The election is covered in ASU 2025-05.
Evaluate the result and document it
Compare management's allowance with the evidence: subsequent collections through the report date, specific reviews of large past-due accounts, and any auditor range. If management's estimate falls outside a range the auditor has developed, the misstatement is the difference between management's estimate and the nearest end of that range. Communicate significant control deficiencies over the estimate to those charged with governance, and evaluate the allowance disclosures, including the policy, the rollforward where presented and any estimation uncertainty.
The file should show, in order: risk assessment and inherent risk rating, data tests, model recalculation and change-control review, qualitative factor evaluation with a conclusion on each adjustment, retrospective review, the approach used under AU-C 540, and the final evaluation against materiality. See how to document audit procedures.
Frequently asked questions
Do private companies have to validate their CECL model?
ASC 326 does not prescribe a validation process for private companies. The auditor's job is to obtain evidence that the method, data and assumptions are appropriate, which in practice means testing the spreadsheet, the data and the adjustments in the manner described above.
Sources
- AICPA, SAS No. 143, Auditing Accounting Estimates and Related Disclosures (AU-C 540); effective for audits of financial statements for periods ending on or after December 15, 2023. Summary: https://www.tx.cpa/news/todays-cpa-magazine/current-issue/article/may-june-2024/2024/05/10/cpe--sas-143---new-guidance-on-auditor-s-responsibilities-relating-to-accounting-estimates
- Federal Reserve, FDIC, OCC and NCUA, Interagency Policy Statement on Allowances for Credit Losses (June 1, 2020; revised April 27, 2023), SR 20-12: https://www.federalreserve.gov/frrs/guidance/interagency-policy-statement-on-allowances-for-credit-losses.htm
- FASB ASU 2016-13, Measurement of Credit Losses on Financial Instruments (ASC 326), and ASU 2025-05, Measurement of Credit Losses for Accounts Receivable and Contract Assets (issued July 2025). ASU 2025-05 summary: https://www.grantthornton.com/insights/articles/audit/2025/snapshot/august/measuring-credit-losses
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · US GAAP for private companies: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error