Generally accepted auditing standards (GAAS) are the standards a US auditor follows when auditing the financial statements of an entity that is not an issuer under the federal securities laws. Private companies, not-for-profit organizations, employee benefit plans and many governmental entities are audited under GAAS. The auditor's report says so: it states that the audit was conducted in accordance with auditing standards generally accepted in the United States of America.
This guide explains who sets GAAS, how the standards are organized, the principles behind them, how requirements are worded and how GAAS compares with the standards of the Public Company Accounting Oversight Board (PCAOB).
Who sets GAAS?
GAAS is issued by the Auditing Standards Board (ASB) of the American Institute of CPAs (AICPA). The ASB issues Statements on Auditing Standards (SASs), which are numbered in the order issued (SAS No. 145, SAS No. 146 and so on). The SASs are then codified into sections of the AICPA Professional Standards, identified with the prefix AU-C.
Two points help when reading citations:
- A SAS is the issuing document; an AU-C section is where its requirements live after codification. SAS No. 145, for example, amended AU-C 315 on risk assessment. See SAS 145 risk assessment.
- The "C" in AU-C stands for "clarified." The ASB redrafted all of its standards in a clarity project, and the clarified standards became effective for audits of financial statements for periods ending on or after December 15, 2012. Older citations to "AU section" refer to the pre-clarity standards.
Compliance with GAAS is required by the AICPA Code of Professional Conduct (the compliance with standards rule) for AICPA members, and state boards of accountancy generally require it for licensees performing audits of nonissuers.
The objectives and principles of a GAAS audit
AU-C 200 sets the overall objectives of the auditor. In a GAAS audit, the auditor aims to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, so that the auditor can express an opinion on whether they are presented fairly, in all material respects, in accordance with the applicable financial reporting framework, and to report and communicate as GAAS requires.
The ASB also published the principles underlying an audit conducted in accordance with GAAS. They are not requirements themselves; they give a framework for the standards. They are grouped under four headings:
- Purpose of an audit and premise. The purpose is to enhance the degree of confidence intended users can place in the financial statements. The audit is conducted on the premise that management, and where appropriate those charged with governance, have acknowledged certain responsibilities: preparing the financial statements, designing and maintaining internal control, and giving the auditor access to information.
- Responsibilities. Auditors are responsible for having appropriate competence and capabilities, complying with ethical requirements including independence, and maintaining professional skepticism and exercising professional judgment throughout the audit.
- Performance. The auditor plans the work, assesses risks of material misstatement, designs and performs procedures responsive to those risks, and obtains sufficient appropriate audit evidence.
- Reporting. The auditor forms an opinion based on the evidence obtained and expresses it in a written report.
Before the clarity project, GAAS was summarized as ten standards in three groups: general standards, standards of field work and standards of reporting. That framing still appears in textbooks, but the principles replaced it.
How the AU-C sections are organized
The AU-C sections follow a numbering scheme by subject. The ranges below give the general structure; individual section titles change as standards are revised.
| Range | Subject | Examples |
|---|---|---|
| 200–299 | General principles and responsibilities | AU-C 200 overall objectives; 210 terms of engagement; 220 quality management for an engagement; 230 audit documentation; 240 fraud; 250 laws and regulations; 260 and 265 communications |
| 300–499 | Risk assessment and response to assessed risks | AU-C 300 planning; 315 risk assessment; 320 materiality; 330 responses; 402 service organizations; 450 evaluation of misstatements |
| 500–599 | Audit evidence | AU-C 500 audit evidence; 501 specific items; 505 confirmations; 510 opening balances; 520 analytical procedures; 530 audit sampling; 540 estimates; 550 related parties; 560 subsequent events; 570 going concern; 580 written representations |
| 600–699 | Using the work of others | AU-C 600 group audits; 610 internal auditors; 620 auditor's specialists |
| 700–799 | Audit conclusions and reporting | AU-C 700 forming an opinion; 701 key audit matters; 705 modifications; 706 emphasis-of-matter and other-matter paragraphs; 708 consistency of financial statements; 720 other information; 725 and 730 supplementary and required supplementary information |
| 800–899 | Special considerations | AU-C 800 special purpose frameworks; 805 single statements and elements; 810 summary financial statements |
| 900–999 | Special considerations in the United States | AU-C 920 letters for underwriters; 930 interim financial information; 935 compliance audits; 940 audits of internal control integrated with an audit of financial statements |
The structure follows the flow of an audit: accept the engagement, plan and assess risk, respond and gather evidence, then conclude and report.
How requirements are worded
AU-C 200 defines the degree of responsibility each requirement imposes, through specific words:
- Unconditional requirements use "must." The auditor must comply in all cases where the circumstances apply.
- Presumptively mandatory requirements use "should." The auditor complies in all cases where the requirement is relevant, except in rare circumstances where the auditor judges it necessary to depart from it. A departure must be documented along with how alternative procedures achieved the intent of the requirement.
Each AU-C section is laid out the same way: introduction, objective, definitions, requirements, then application and other explanatory material. The explanatory material does not add requirements, but the auditor is expected to understand it.
GAAS vs PCAOB standards
The Sarbanes-Oxley Act of 2002 created the PCAOB and gave it authority to set auditing standards for audits of issuers (public companies); the Dodd-Frank Act of 2010 extended its oversight to audits of brokers and dealers registered with the SEC. PCAOB standards are cited with the prefix AS (for example, AS 1215 on audit documentation, AS 2201 on audits of internal control over financial reporting).
| GAAS (AICPA) | PCAOB standards | |
|---|---|---|
| Applies to | Nonissuers: private companies, not-for-profits, employee benefit plans, many governments | Issuers and SEC-registered brokers and dealers |
| Standard setter | AICPA Auditing Standards Board | PCAOB, with SEC approval |
| Citation | AU-C sections, issued as SASs | AS sections |
| Oversight | AICPA peer review and state boards | PCAOB registration and inspection |
| Documentation completion | No later than 60 days after the report release date | A shorter period under PCAOB AS 1215, as amended (the earlier 45-day period was reduced; effective dates differ by firm size) |
| Retention | Ordinarily no shorter than five years from the report release date (AU-C 230) | Seven years (AS 1215) |
| Internal control opinion | Only if engaged (AU-C 940) | Integrated audit required for many issuers under SOX 404(b) |
An auditor of a nonissuer may also be engaged to perform an audit in accordance with both GAAS and PCAOB standards, for example where a private company plans to register securities. The report then refers to both.
GAAS in government and other audits
For audits of governments and entities receiving federal awards, Government Auditing Standards (the Yellow Book, issued by the US Government Accountability Office) incorporate GAAS by reference and add requirements on independence, continuing professional education and reporting. See Yellow Book (GAGAS). Single audits under the Uniform Guidance add compliance requirements on top of both.
GAAS and quality management
GAAS sits within the firm's system of quality management. The AICPA quality management standards, SQMS No. 1 and SQMS No. 2, address the firm's system, and SAS No. 146 revised AU-C 220 to address quality management at the engagement level. See SQMS 1 for small CPA firms.
Frequently asked questions
What does GAAS stand for?
GAAS stands for generally accepted auditing standards. In the US, the term refers to the auditing standards issued by the AICPA Auditing Standards Board for audits of nonissuers, codified as the AU-C sections.
Who issues GAAS?
The Auditing Standards Board of the AICPA issues GAAS through Statements on Auditing Standards. The PCAOB issues separate standards for audits of issuers and SEC-registered brokers and dealers.
What is the difference between GAAS and GAAP?
GAAP is the accounting framework that management uses to prepare the financial statements, set by the FASB for nongovernmental entities. GAAS is the set of standards the auditor follows when auditing those financial statements.
Do private company audits follow PCAOB standards?
Not usually. Audits of private companies follow GAAS. A private company audit may be performed under PCAOB standards as well, for example when the company is preparing to become an issuer or a regulator or contract requires it.
What were the ten generally accepted auditing standards?
They were the pre-clarity summary of GAAS: three general standards, three standards of field work and four standards of reporting. The clarified standards replaced them with the principles underlying an audit conducted in accordance with GAAS.
Sources
- AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards (including the principles underlying an audit and the meaning of "must" and "should")
- AICPA Code of Professional Conduct, Compliance With Standards Rule (ET 1.310.001)
- AICPA, AU-C Section 230, Audit Documentation
- PCAOB, AS 1215, Audit Documentation: https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
- Sarbanes-Oxley Act of 2002 and Dodd-Frank Wall Street Reform and Consumer Protection Act (PCAOB authority and oversight of broker-dealer audits)
- GAO, Government Auditing Standards (2024 Revision): https://www.gao.gov/yellowbook
- AICPA, SQMS No. 1 and SQMS No. 2; SAS No. 146
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Part of CORAA University · Engagement and acceptance: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error