Glossary/Engagements and reports

Nonissuer

A nonissuer is an entity that is not an issuer under the Sarbanes-Oxley Act, so its audit follows AICPA standards (AU-C) rather than PCAOB standards, and AICPA independence rules apply.

CORAA TeamUpdated November 5, 2026

Definition

In AICPA literature, a nonissuer is an entity that is not an issuer. Under the Sarbanes-Oxley Act, an issuer is a company whose securities are registered under section 12 of the Securities Exchange Act, that must file reports under section 15(d), or that has filed a registration statement under the Securities Act that has not yet become effective or been withdrawn. Most private companies, nonprofits, governments and benefit plans are nonissuers. Their audits follow the AICPA's Statements on Auditing Standards, codified as AU-C, while PCAOB standards govern audits of issuers and, by statute, broker-dealers.

Why it matters in an audit or review

The label sets which standards, independence rules, inspection regime and report form apply. A nonissuer that plans to go public may need a later reaudit under PCAOB standards, so firms ask about it at acceptance.

Example

Illustrative: a privately held manufacturer files no reports with the SEC, so its auditor follows AU-C and AICPA independence rules. If it files a registration statement for an initial public offering, a PCAOB-registered firm must audit under PCAOB standards for the periods in the filing.

Common mistakes

  • Citing PCAOB rules for a private company engagement.
  • Assuming a company that is public in name is always an issuer.

Sources

  • Sarbanes-Oxley Act of 2002, section 2(a)(7), 15 U.S.C. 7201(7): https://www.law.cornell.edu/uscode/text/15/7201
  • Dodd-Frank Act, section 982 (PCAOB oversight of broker-dealer audits)
  • AICPA, AU-C section 200 and the preface to the AICPA Professional Standards

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 20015 U.S.C. 7201(7)

Related terms

  • PCAOB vs AICPA standards (issuer vs nonissuer)
    Auditors of SEC issuers follow PCAOB standards and must be PCAOB-registered, while auditors of nonissuers, such as private companies and most nonprofits, follow AICPA standards and AU-C sections.
  • GAAS (generally accepted auditing standards)
    GAAS are the AICPA standards for audits of nonissuers, issued as Statements on Auditing Standards and codified in AU-C sections, covering general responsibilities, evidence, and reporting.
  • Independence
    Independence for an auditor means independence of mind and independence in appearance. It is required for audits and reviews, and under the AICPA Code it is judged using a conceptual framework.
  • SEC (Securities and Exchange Commission)
    The SEC is the federal regulator that requires public companies to file audited financial statements, sets auditor independence rules for issuers, and oversees the PCAOB.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required