An external financial statement auditor gives an independent opinion on whether a set of financial statements is presented fairly, in all material respects, in accordance with an applicable financial reporting framework. Everything else an auditor does serves that opinion. This guide follows the work in the order it happens on an audit under US generally accepted auditing standards (GAAS), and separates what the auditor does from what management does.
It paraphrases the AICPA's AU-C sections; read the standards before relying on any specific point. For audits of public companies, the PCAOB's standards apply instead. See PCAOB vs AICPA standards.
What is the auditor's overall objective?
Under AU-C 200, the auditor's overall objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, which allows the auditor to express an opinion, and to report on the financial statements and communicate as GAAS requires. Reasonable assurance is a high level of assurance, but not absolute. See what is an audit and materiality.
What does the auditor do at each phase?
1. Acceptance and engagement terms
Before work starts, the auditor decides whether to accept or continue the client, checks independence and competence, and agrees the terms in an engagement letter. Under AU-C 210, the auditor determines whether the preconditions for an audit are present, including an acceptable financial reporting framework and management's acknowledgment of its responsibilities for the financial statements, for internal control relevant to preparing them, and for providing access and information. See audit engagement letter and independence and nonattest services.
2. Planning and risk assessment
The auditor develops an overall strategy and audit plan, determines materiality, and identifies and assesses the risks of material misstatement through understanding the entity and its environment, including its internal control. AU-C 315 governs the risk assessment, and AU-C 240 adds fraud risk assessment, including a presumed risk of fraud in revenue recognition and the risk of management override of controls. See SAS 145 risk assessment, audit planning memo and audit risk model.
3. Responding to the risks
The auditor designs and performs further audit procedures that respond to the assessed risks, under AU-C 330. These are tests of controls where the auditor plans to rely on them, and substantive procedures, which are tests of details and substantive analytical procedures. Procedures that respond to the risk of management override include testing journal entries, reviewing estimates for bias and evaluating the business rationale for significant unusual transactions. See substantive testing vs tests of controls, journal entry testing and audit procedures by account.
4. Gathering evidence
The auditor obtains sufficient appropriate audit evidence to support the opinion (AU-C 500). The common techniques are inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and inquiry. Confirmations of balances such as cash and receivables are governed by AU-C 505, and sampling by AU-C 530. The auditor keeps professional skepticism throughout. See audit evidence and professional skepticism.
5. Documenting the work
The audit file has to let an experienced auditor with no prior connection to the engagement understand the procedures performed, the evidence obtained and the conclusions reached (AU-C 230). See how to document audit procedures and working papers.
6. Evaluating and completing
Near the end, the auditor:
- Evaluates identified misstatements, individually and in aggregate, against materiality (AU-C 450).
- Considers subsequent events up to the date of the auditor's report (AU-C 560).
- Evaluates whether there is substantial doubt about the entity's ability to continue as a going concern (AU-C 570).
- Performs final analytical procedures and reviews disclosures against the framework.
- Communicates with those charged with governance about the audit, significant findings and any significant deficiencies or material weaknesses in internal control (AU-C 260 and AU-C 265).
- Obtains written representations from management (AU-C 580).
See management letter.
7. Forming the opinion and reporting
The auditor concludes whether the financial statements are presented fairly in all material respects and issues the report under AU-C 700. The opinion is unmodified, qualified, adverse, or the auditor disclaims an opinion, with the modified forms covered by AU-C 705. See types of audit opinions and independent auditor's report example.
What does the auditor not do?
- Prepare the financial statements. Management is responsible for the statements and for internal control. A firm that drafts statements for an audit client performs a nonattest service that has to be evaluated under independence rules.
- Guarantee that there is no fraud or error. The auditor obtains reasonable assurance, and there is an unavoidable risk that some material misstatements are not detected even when the audit is properly planned and performed.
- Make management's decisions. The auditor communicates findings, and management decides how to respond.
- Provide an opinion on every number in the annual report. Other information outside the audited statements is read, not audited. See AU-C 720.
How is the work split on the team?
Titles vary by firm, but the pattern is consistent: staff perform procedures and document them, seniors plan and supervise fieldwork and review staff work, managers review the file and manage the client relationship and timing, and the engagement partner is responsible for the engagement and its report. Larger or higher-risk engagements may also have an engagement quality review by someone outside the team. See audit staff levels and engagement quality review.
A day-to-day sample
Illustrative. On a fieldwork day for a mid-sized private company, a senior might:
- Review the bank confirmation replies against the cash lead schedule and clear differences.
- Select a sample of ten sales invoices and vouch each to shipping documents and cash receipts.
- Update the unrecorded liabilities search with January disbursements. See search for unrecorded liabilities.
- Review a staff member's fixed asset additions testing and sign off.
- Hold a status call with the client's controller on open items from the PBC list.
Auditor, accountant and CPA: how do they differ?
An accountant prepares and maintains financial records and statements. An auditor tests them and expresses an opinion. The term CPA is a state-issued license, and a license is generally needed to sign an audit report on an attest engagement. Not every CPA performs audits, and the other levels of assurance are described in audit vs review vs compilation.
Frequently asked questions
What does an external auditor do?
Plans and performs procedures to obtain reasonable assurance that the financial statements are free of material misstatement, evaluates the evidence, communicates with those charged with governance and issues a report that expresses an opinion.
Does an auditor prepare the financial statements?
No. Management prepares them and is responsible for them. If the audit firm helps with drafting, it has to manage the independence implications of that nonattest service.
Does an audit find all fraud?
No. The auditor obtains reasonable assurance, not absolute assurance. The standards require specific fraud-risk procedures, but some material misstatements may not be detected.
What is the difference between an auditor and an internal auditor?
An external auditor is independent of the entity and reports on the financial statements. An internal auditor works for the entity and evaluates its risk management and controls. See internal audit vs external audit.
Who signs the audit report?
Under AU-C 700 the auditor's signature is the firm's name, the auditor's personal name, or both, as appropriate. The engagement partner is responsible for the engagement and its report under the firm's quality management policies. See SQMS 1 quality management.
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Sources
- AICPA, AU-C Section 200, 210, 230, 240, 260, 265, 315, 330, 450, 500, 505, 530, 560, 570, 580, 700, 705 and 720, in AICPA Professional Standards, aicpa-cima.com
- AICPA, Code of Professional Conduct, independence and nonattest services interpretations
- PCAOB, Auditing Standards, pcaobus.org
Related
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error