AU-C 200 Overall Objectives of the Auditor: Reasonable Assurance, Skepticism and GAAS

AU-C section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards, is the foundation of the AU-C series for audits of nonissuers (private companies, not-for-profits and governmental entities). It came out of the clarified standards in SAS No. 122. It sets the goal of the audit, explains what the other AU-C sections are for, and says what it means to say an audit was performed in accordance with GAAS.

This page paraphrases the standard; the authoritative text is AU-C 200 in AICPA Professional Standards. For the wider picture of what GAAS is, see GAAS: generally accepted auditing standards.

What are the overall objectives of the auditor under AU-C 200?

The standard gives the auditor two overall objectives: to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, so the auditor can give an opinion on whether they are prepared, in all material respects, in accordance with the applicable financial reporting framework, and to report on the financial statements and communicate as GAAS requires, in line with the auditor's findings.

If the auditor cannot get reasonable assurance and a qualified opinion is not enough in the circumstances, the standard calls for disclaiming an opinion or withdrawing from the engagement where law or regulation allows. AU-C 705 covers the reporting.

What does reasonable assurance mean?

Reasonable assurance is a high level of assurance. It is not absolute assurance. The auditor reaches it by obtaining sufficient appropriate audit evidence to reduce audit risk to an acceptably low level.

Absolute assurance is out of reach because of the inherent limitations of an audit:

• The nature of financial reporting, which involves judgment and estimates
• The nature of audit procedures, including testing rather than examining every item
• The need for the audit to be done within a reasonable time and at a reasonable cost
• Most audit evidence being persuasive rather than conclusive
• The risk that fraud involving collusion or forgery is hard to detect

These limitations do not excuse a weak audit. A failure to detect a material misstatement does not by itself show the audit was not performed in accordance with GAAS. The test is whether the auditor planned and performed the work as the standards require.

Audit risk in one paragraph

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. It is a function of the risks of material misstatement (inherent risk and control risk, assessed under AU-C 315) and detection risk (the risk that the auditor's procedures do not find a misstatement that exists, which the auditor controls through the nature, timing and extent of procedures under AU-C 330). See the audit risk model for the mechanics.

Premise: management's responsibilities

An audit rests on a premise. Management acknowledges and understands that it is responsible for preparing the financial statements in accordance with the framework (including fair presentation where that applies), for the internal control it determines is necessary for statements free of material misstatement, and for giving the auditor access to information, additional information requested and unrestricted access to people in the entity. AU-C 210 requires the auditor to confirm this before accepting the engagement, and AU-C 580 requires written representations that reaffirm it at the end.

Ethics, skepticism and judgment

Three requirements run through the whole audit:

• Relevant ethical requirements. The auditor must comply with relevant ethical requirements, including those on independence. For most nonissuer audits that means the AICPA Code of Professional Conduct, plus any stricter rules of the state board of accountancy or a regulator.
• Professional skepticism. The auditor plans and performs the audit with a questioning mind, alert to conditions that may indicate misstatement and to evidence that contradicts management's assertions, and critically assesses the evidence. Skepticism does not mean assuming dishonesty, and it also does not allow accepting weak evidence because management is trusted.
• Professional judgment. The auditor uses training, knowledge and experience to make informed decisions on the audit, including materiality, risk assessment, evidence and the opinion. Judgment is not a substitute for evidence, and it must be supportable in the file.

SAS No. 142 added application material on auditor bias that can affect skepticism and judgment. Since SAS No. 146, AU-C 200 points to the list of examples in the application material of AU-C 220 (availability, confirmation, groupthink, overconfidence, anchoring and automation bias). Automation bias is the tendency to favor output from automated systems even when other information casts doubt on whether it is fit for purpose. For a reviewer, the question is whether the file shows the team challenged its first answer.

Sufficient appropriate audit evidence

Audit evidence is the information used to reach the conclusions the opinion rests on. Sufficiency is the quantity of evidence, which is driven by the assessed risks and the quality of the evidence. Appropriateness is the quality: relevance and reliability. AU-C 500 deals with evidence in detail.

How the AU-C sections fit together

AU-C 200 explains the structure that every other section follows. Each AU-C section has an objective, and the auditor must understand the objective to decide whether more procedures are needed and to evaluate whether enough evidence was obtained.

The auditor must have an understanding of the entire text of an AU-C section, including the application material, to understand its objectives and to apply its requirements properly.

Unconditional and presumptively mandatory requirements

The AU-C sections use two words for requirements. "Must" marks an unconditional requirement: the auditor has no discretion to depart from it. "Should" marks a presumptively mandatory requirement: the auditor is expected to comply unless, in rare cases, a departure is justified.

Terms such as "may", "might" and "could" describe things the auditor may consider or do, depending on judgment. Do not read them as requirements, and do not treat them as optional if the risk calls for the step.

Compliance with GAAS

The auditor must comply with all AU-C sections relevant to the audit. A section is relevant when it is in effect and the circumstances it addresses exist. A conditional requirement is not relevant if the condition does not exist, for example the group audit requirements in AU-C 600 when the audit is not an audit of group financial statements.

In practice, three things follow:

• The auditor must not say that the audit was conducted in accordance with GAAS unless the auditor has complied with all the requirements of the AU-C sections relevant to the audit.
• If an objective in a relevant section cannot be achieved, the auditor evaluates whether that stops the auditor from meeting the overall objectives. If it does, the auditor modifies the opinion or withdraws, as AU-C 705 and the law allow.
• In exceptional circumstances the auditor may judge it necessary to depart from a presumptively mandatory requirement. The auditor then performs alternative audit procedures that achieve the aim of the requirement, and documents the justification for the departure under AU-C 230. A departure is only justified when the required procedure would be ineffective in the circumstances. Inconvenience, cost or a tight deadline is not enough.

Where AU-C 200 sits in the standards

The AU-C sections are grouped by what they cover: general principles and responsibilities (200 series), risk assessment and response to assessed risks (300 series), audit evidence (500 series), using the work of others (600 series), and conclusions and reporting (700 series). The sections you apply on a given audit depend on the circumstances.

SAS No. 146 made conforming changes to AU-C 200 application material, including how the engagement partner's responsibilities for ethical requirements and the firm's system of quality management are described (amendments to application material in .A20, .A27 and .A32). Those changes apply to audits of periods beginning on or after December 15, 2025. See AU-C 220 quality management.

File checks on overall objectives

These are practice checks, not requirements of the standard. Weaknesses to look for:

• Files that state "audited in accordance with GAAS" but where required procedures such as the fraud brainstorming or the understanding of internal control are missing
• Skepticism shown only through a boilerplate sentence in the planning memo, with no challenge visible in the work on estimates or revenue
• Departures from a presumptively mandatory requirement with no documented reason or alternative procedure
• Checklists signed off as "not applicable" without a reason

Related

• AU-C 210 terms of engagement
• AU-C 315 risk assessment and SAS 145
• AU-C 500 audit evidence
• GAAS: generally accepted auditing standards

Sources

• AICPA, AU-C Section 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards (AICPA Professional Standards)
• AICPA, SAS No. 122 (clarified standards), as amended by SAS No. 142, Audit Evidence, and SAS No. 146, Quality Management for an Engagement Conducted in Accordance With GAAS (effective for audits of periods beginning on or after December 15, 2025)
• AICPA, AU-C Section 210, 220, 230, 315, 330, 500, 580, 600 and 705 (cross-referenced sections)
• AICPA Code of Professional Conduct

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error