An audit is an independent examination of an organization's financial statements, ending in a written opinion on whether they are presented fairly. The people who rely on the statements, such as lenders, investors, donors, grantors and regulators, use the opinion to decide how much to trust the numbers.
This guide is for the owner or finance lead who has just been told "you need an audit." It explains what the audit is, what it is not, who requires one, and what your team does during it. CPA firms can send it to clients to set expectations.
What does an audit actually deliver?
The product is the auditor's report, which gives an opinion on the financial statements. In a standard audit of a US private company under generally accepted auditing standards, the auditor expresses an opinion on whether the statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework, usually US GAAP. See the independent auditor's report example and types of audit opinions.
The purpose, as AU-C 200 states it, is to increase the degree of confidence that intended users can place in the financial statements. The auditor reaches that conclusion by obtaining reasonable assurance about whether the statements as a whole are free of material misstatement, whether from fraud or error. See AU-C 200.
What is "reasonable assurance"?
Reasonable assurance is a high level of assurance, not a guarantee. An audit cannot be absolute because it tests samples, relies on judgment and management estimates, and faces fraud that is concealed. "Material" means that a misstatement could reasonably influence the decisions users make based on the statements. See materiality in auditing.
What an audit is not:
- Not a check of every transaction. Auditors test selected items and use analytics.
- Not a fraud investigation. Auditors plan to detect material fraud but an audit is not designed to find all fraud. See fraud risk assessment.
- Not a tax audit. An IRS or state examination checks tax returns. A financial statement audit checks the financial statements.
- Not a guarantee of the company's health. A clean opinion says the statements are fairly presented, not that the business will survive. See going concern assessment.
- Not a substitute for internal control. The auditor evaluates controls to plan the audit, but designing and maintaining them is management's job.
Who needs an audit?
An audit is required when a law, regulation, contract or other party demands it. Common sources:
- SEC registrants (public companies) must file audited financial statements, audited by firms registered with the PCAOB.
- Lenders and investors often require audited statements in loan covenants or investment agreements.
- Employee benefit plans that file as large plans on Form 5500, generally those with 100 or more participants, need an audit. See 401(k) audit requirements.
- Federal award recipients that expend $1,000,000 or more of federal awards in a fiscal year beginning on or after October 1, 2024 need a single audit under 2 CFR 200.501. See the single audit walkthrough.
- Nonprofits may need an audit under state charitable solicitation laws or funder terms. Thresholds vary by state. See nonprofit audit requirements.
- Regulated and franchised businesses, such as some insurers, broker-dealers, franchisors and homeowners associations, depending on regulation or governing documents.
If nobody requires an audit, a business may still choose one to raise capital, prepare for a sale or give owners comfort.
What does the auditor check?
The auditor assesses where the statements could be materially wrong, then designs procedures to respond. Typical work covers:
- Cash: bank confirmations and reconciliations.
- Receivables and revenue: confirmations, cutoff and agreement to contracts. See revenue recognition audit procedures.
- Inventory: observation of the count and costing tests. See inventory observation.
- Fixed assets: additions, disposals and depreciation.
- Payables and accruals: a search for unrecorded liabilities. See search for unrecorded liabilities.
- Debt and equity: agreements, balances and covenant compliance.
- Payroll: a test of payroll records.
- Journal entries and estimates: especially unusual entries and management's judgments.
- Subsequent events and legal matters, including inquiries of attorneys.
The auditor also communicates with those charged with governance about the audit, significant findings and any control deficiencies. See audit assertions for the framework behind these tests.
What is management responsible for?
Before the audit begins, management agrees in the engagement letter that it is responsible for:
- preparing and fairly presenting the financial statements in accordance with the framework
- designing, implementing and maintaining internal control relevant to preparing statements free of material misstatement
- giving the auditor access to all information relevant to the statements, additional information the auditor requests, and unrestricted access to the people in the entity from whom the auditor needs evidence
The auditor cannot do management's job. If a client expects the auditor to prepare the statements and also express an opinion on them, the firm has to evaluate independence and may only provide the service under strict conditions. See audit engagement letter and nonattest services.
Management also signs a representation letter at the end of the audit, confirming what it has told the auditor. See management representation letter.
Audit versus review versus compilation
| Audit | Review | Compilation | |
|---|---|---|---|
| Assurance | Reasonable assurance | Limited assurance | None |
| Auditor or accountant's report | Opinion | Report stating limited assurance | No assurance statement |
| Main procedures | Risk assessment, tests of controls where relied on, substantive tests, confirmations | Inquiry and analytical procedures | Reading the statements for obvious errors |
| Independence | Required | Required | Not required, but disclosed if lacking |
| Governing standards | AU-C (GAAS) | AR-C 90 | AR-C 80 |
See compilation, review and audit compared, the review engagement guide and the compilation guide.
How can a company get ready?
Close the books on time, reconcile bank accounts and subledgers to the general ledger, assemble the schedules the auditor will request and name one contact who can answer questions. See the audit readiness checklist for clients, the PBC list and, for QuickBooks users, QuickBooks cleanup before the audit. For fees, see how much an audit costs. For the timeline from planning to report, see the financial statement audit process.
Frequently asked questions
What is the purpose of an audit?
To give users of the financial statements confidence that they are presented fairly, in all material respects, in accordance with the applicable framework.
Will an auditor find fraud?
An audit is designed to give reasonable assurance of detecting material misstatement, including material fraud, but it cannot guarantee that all fraud is found.
Is an audit the same as an IRS audit?
No. An audit of financial statements is performed by an independent CPA firm for the benefit of financial statement users. An IRS audit is an examination of a tax return by the government.
How long does an audit take?
It depends on size, complexity and how ready the records are. See the audit process and timeline.
Who can perform an audit?
In the US, financial statement audits are signed by a licensed CPA firm. Audits of SEC registrants must be performed by firms registered with the PCAOB.
Sources
- AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards
- AICPA, AU-C Section 210, Terms of Engagement
- 2 CFR 200.501, Audit requirements, ecfr.gov
- US Department of Labor, EBSA, Form 5500 Series, dol.gov
- PCAOB, About the PCAOB, pcaobus.org
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error