A financial statement audit follows the same arc whether it covers a 20-person manufacturer or a nonprofit with a $30 million budget: accept the engagement, plan, assess risk, respond to the risks, complete the work and report. The size of the entity changes how long each phase takes, not what the phases are.
This guide walks through the phases in order, names the standard behind each one, and ends with an illustrative calendar and the factors that move cost and timing. It is written for audit teams and for the finance staff who will work with them. For the definition of an audit, see what is an audit. For fees, see how much an audit costs.
Phase 1: Acceptance and engagement terms
Before accepting, the firm considers its independence, competence and capacity, and the integrity of management. Firms with a system of quality management under SQMS No. 1 apply their client acceptance and continuance policies. See SQMS 1. For a new client, the firm also communicates with the predecessor auditor; see AU-C 510.
The engagement letter under AU-C 210 states the objective and scope of the audit, the framework, the auditor's and management's responsibilities, and the expected form of the report. Management's agreement to its responsibilities is the precondition for an audit. See audit engagement letter.
Client provides: a signed engagement letter, access to the prior-year file where permitted and a list of related parties.
Phase 2: Planning and risk assessment
Planning establishes the overall strategy and the audit plan under AU-C 300. The auditor:
- obtains an understanding of the entity, its environment, its financial reporting framework and its system of internal control, and assesses the risks of material misstatement under AU-C 315. For audits for periods ending on or after December 15, 2023, the revised requirements of SAS No. 145 apply. See SAS 145.
- holds the engagement team discussion on susceptibility to fraud and performs the procedures required by AU-C 240. See fraud risk assessment.
- sets overall, performance and specific materiality under AU-C 320. See materiality in auditing.
- identifies significant risks, such as revenue recognition and management override.
- plans the use of specialists, service organization reports and component auditors.
- documents the strategy and plan. See the audit planning memo guide.
For audits for periods beginning on or after December 15, 2025, the engagement partner's quality management responsibilities under revised AU-C 220 (SAS No. 146) also apply.
Client provides: the trial balance, prior-year statements, board minutes, contracts, organization chart, a description of systems and a list of significant changes during the year. The PBC list and the audit readiness checklist organize the requests.
Phase 3: Responding to the risks
Under AU-C 330, the auditor designs overall responses and further audit procedures whose nature, timing and extent are responsive to the assessed risks.
- Tests of controls where the auditor plans to rely on controls. See control testing.
- Substantive procedures: tests of details and substantive analytical procedures for each relevant assertion of each material class of transactions, account balance and disclosure. See substantive testing versus tests of controls.
- External confirmations for cash, receivables, debt and other items. See AU-C 505.
- Procedures specific to areas like inventory, accounting estimates, related parties and journal entries.
The work is often split. Interim fieldwork covers understanding of the process, walkthroughs, tests of controls and early substantive work on balances as of an interim date. Year-end fieldwork covers the balances at the period end, cutoff, roll-forward of interim work and subsequent events.
Client provides: reconciliations, schedules, support for samples, access to people and systems, and timely answers.
Phase 4: Completion
The completion phase brings the evidence together:
- Evaluate misstatements found, individually and in total, against materiality under AU-C 450. Management is asked to correct them; uncorrected items are summarized. The summary of uncorrected misstatements evaluator tests the aggregate.
- Going concern evaluation under AU-C 570. See going concern assessment.
- Subsequent events procedures through the report date under AU-C 560. See subsequent events.
- Written representations from management under AU-C 580, dated the report date.
- Final analytical procedures and a review of the financial statements and disclosures for GAAP compliance. See disclosure checklists.
- Review within the firm. The engagement partner and any engagement quality reviewer review the file. See engagement quality review.
- Communications with those charged with governance under AU-C 260 and written communication of significant deficiencies and material weaknesses under AU-C 265. See management letter.
Phase 5: Reporting and file assembly
The auditor forms the opinion under AU-C 700, and modifies it where required under AU-C 705. The report date is the date the auditor has obtained sufficient appropriate evidence on which to base the opinion. See independent auditor's report example and types of audit opinions.
After the report release date, the auditor assembles the final audit file no later than 60 days later under AU-C 230. See audit file assembly.
An illustrative timeline for a December 31 year-end
Illustrative; actual calendars depend on the client, the firm's capacity and the due dates set by lenders, funders and regulators.
| Period | Activity |
|---|---|
| August to October | Engagement letter signed, planning meeting, risk assessment, PBC list issued |
| October to November | Interim fieldwork: process walkthroughs, tests of controls, early substantive work |
| December | Planning updates, inventory count observation scheduled, confirmations prepared |
| January | Client closes the books, prepares the trial balance and schedules |
| February to early March | Year-end fieldwork, confirmations returned, draft adjustments, draft financial statements |
| March | Review stages, engagement quality review where required, client closing meeting, management representation letter |
| Late March to April | Report release, communication with governance, management letter |
| Within 60 days of release | Final file assembly |
Some clients have earlier deadlines, such as a lender's requirement of audited statements within 90 or 120 days of year-end. Work backward from the contract. Audits of employee benefit plans are tied to the Form 5500 date; see Form 5500 guide.
What drives time and cost
- Readiness of the books. The largest single factor is how clean the trial balance is when fieldwork begins. See QuickBooks cleanup before the audit.
- Complexity: revenue arrangements, estimates, leases, debt covenants, multiple locations.
- Controls: a client that can show controls operating allows more reliance and sometimes less testing.
- First-year status: opening balances and the predecessor's file. See first-year audits.
- Responsiveness: unanswered requests are the most common cause of delay.
- Adjustments found late, which require updating schedules, drafts and the aggregate evaluation.
Frequently asked questions
What are the main phases of an audit?
Acceptance and engagement terms, planning and risk assessment, responding to risks, completion, and reporting with file assembly.
How long does a financial statement audit take?
It ranges from a few weeks of fieldwork for a small entity to several months for a complex one. The calendar depends on the year-end, the readiness of records and the firm's capacity.
What is the difference between interim and year-end fieldwork?
Interim fieldwork occurs before year-end and focuses on processes, controls and early balance testing. Year-end fieldwork covers the final balances, cutoff and subsequent events.
When is the audit complete?
When the auditor releases the report; the final audit file is assembled within 60 days after that.
What is the client's role?
Management prepares the financial statements, maintains internal control, provides access and signs the representation letter. See what is an audit.
Sources
- AICPA, AU-C Sections 200, 210, 220, 230, 240, 260, 265, 300, 315, 320, 330, 450, 505, 560, 570, 580, 700 and 705
- AICPA, SAS No. 145 (effective for periods ending on or after December 15, 2023) and SAS No. 146 (effective for periods beginning on or after December 15, 2025)
- AICPA, SQMS No. 1, A Firm's System of Quality Management
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error