Who sets US auditing standards and how to read an AU-C section

• Identify which standard setter governs a given audit.
• Explain how GAAS are issued as SASs and codified into AU-C sections.
• Distinguish unconditional (must) from presumptively mandatory (should) requirements.
• Read an AU-C section in the right order: objective, definitions, requirements, application material.

Three rule books, one engagement

Your client type decides which auditing standards apply.

• GAAS (AICPA). The AICPA Auditing Standards Board issues Statements on Auditing Standards (SASs). They are codified into AU-C sections (AU-C 200.02). GAAS apply to audits of private companies, nonprofits, employee benefit plans and governments.
• PCAOB standards. The Sarbanes-Oxley Act of 2002 created the Public Company Accounting Oversight Board and gave it authority to set auditing standards for audits of issuers. Its standards are numbered AS (for example AS 2110 on risk assessment). Brokers and dealers registered with the SEC are also audited under PCAOB standards.
• Government Auditing Standards (GAGAS, the Yellow Book). The Comptroller General of the United States issues GAGAS. For financial audits, GAGAS incorporate GAAS and add requirements on independence, CPE, quality management and reporting on internal control and compliance. The 2024 revision is effective for financial audits, attestation engagements and reviews of financial statements for periods beginning on or after December 15, 2025.

AU-C 200.A61 notes that you may audit under GAAS and another set at the same time, for example GAAS and GAGAS for a single audit. In that case you comply with both, which may require additional procedures. The financial audit vs Yellow Book comparison sets out the layers.

How an AU-C section is built

Each section has the same parts:

1. Introduction with scope and effective date.
2. Objective. What the auditor is trying to achieve. AU-C 200.23 requires you to use the objectives to plan and perform the audit.
3. Definitions.
4. Requirements. Numbered paragraphs such as .10 or .14.
5. Application and other explanatory material. Paragraphs prefixed with A (.A6, .A15). The "Ref: par." notes connect each requirement to its guidance.

AU-C 200.21 requires you to understand the entire text of a section, including application material. AU-C 200.A64 explains that application material does not impose a requirement itself, but it is relevant to applying the requirements properly. If a reviewer asks why you did something, the answer often lives in an A paragraph.

Must, should and should consider

AU-C 200.25 sets two categories of professional requirements:

Under AU-C 200.26, if you depart from a presumptively mandatory requirement, you perform alternative procedures to achieve the intent of the requirement. AU-C 230.13 then requires you to document the justification and how the alternative procedures achieve that intent. AU-C 200.A79 adds that "should consider" makes the consideration presumptively required, while performing the action follows your judgment.

Under AU-C 200.27 you should consider applicable interpretive publications (interpretations, exhibits, AICPA Audit and Accounting Guides, Statements of Position). Other auditing publications, such as journal articles, have no authority; under AU-C 200.28 you assess their relevance before relying on them.

Common mistakes

• Citing superseded AU sections or pre-2012 numbering in memos.
• Treating application material as optional and ignoring it when it explains what a requirement covers.
• Applying PCAOB terms (critical audit matters, AS numbers) to a private-company file, or GAAS forms to an issuer.
• Forgetting the Yellow Book layer when the client receives federal awards.

Bookmark the GAAS overview and the Yellow Book guide for quick orientation.

Matching three clients to their standards