Accounting and Auditing Standards: GAAP, IFRS, and Yellow Book

Accounting and auditing standards are two connected rulebooks: one tells companies how to record and report their finances, and the other tells independent auditors how to test those reports. In the United States, most businesses keep their books under Generally Accepted Accounting Principles (GAAP), while multinational companies often report under International Financial Reporting Standards (IFRS). The audits that verify those statements follow AICPA standards for private companies, PCAOB standards for public companies, and Government Auditing Standards — the Yellow Book — for entities that receive or spend federal money.

GAAP: The U.S. Accounting Rulebook

Every non-governmental business in the United States prepares its financial statements under GAAP. The Financial Accounting Standards Board, a private nonprofit, writes and maintains those rules for public companies, private companies, and nonprofits.¹ All authoritative guidance lives in one online research system, the Accounting Standards Codification, which became the sole source of authoritative nongovernmental U.S. GAAP in 2009.²

Two ideas do most of the heavy lifting inside GAAP. The first is accrual accounting: transactions are recorded when they happen, not when cash changes hands. A business that delivers goods in December but is paid in January books the revenue in December. The second is revenue recognition, which says a sale only counts once control of the product or service has actually transferred to the buyer and the amount the company expects to collect is reasonably certain. Premature revenue recognition is one of the oldest tricks in financial fraud, and this rule is the direct answer to it.

Materiality

Not every accounting error requires correction. Under GAAP, information is material if omitting or misstating it could influence the decisions of someone relying on the financial statements. The FASB deliberately refuses to set a fixed percentage or dollar threshold, because what matters for a small manufacturer looks nothing like what matters for a multinational bank. Materiality judgments turn on both the size and the nature of an error in the context of that specific company.³

IFRS: The International Framework

Companies that operate across borders often report under International Financial Reporting Standards, developed by the International Accounting Standards Board. IFRS is now required in more than 140 jurisdictions, and the IFRS Foundation tracks adoption profiles for 169.⁴⁵ A German company can list on a Japanese exchange without rebuilding its statements from scratch, because both countries recognize the same framework.

The philosophical split between the two systems matters in practice. GAAP tends to be rules-based, with specific instructions for narrow situations. IFRS leans on broad principles: a standard is more likely to describe the economic substance a transaction should reflect and then leave professional judgment to fill in details. That flexibility handles unusual deals well, but it also means two companies in similar situations can reach different accounting conclusions and both remain compliant.

Sustainability Disclosures

The IFRS Foundation has expanded into sustainability reporting. IFRS S1 requires companies to disclose sustainability-related risks and opportunities that could reasonably affect their cash flows, access to financing, or cost of capital.⁶ IFRS S2 narrows to climate specifically, covering greenhouse gas emissions and the governance processes used to monitor climate-related risks.⁷ Both took effect for annual reporting periods beginning on or after January 1, 2024, and jurisdictions are in various stages of building them into local requirements.

Auditing Standards for Private Companies

When an independent auditor examines a private company’s books, the rulebook comes from the American Institute of Certified Public Accountants. The AICPA issues Statements on Auditing Standards for entities that are not publicly traded and whose audits are not conducted under PCAOB rules.⁸ Together these statements form Generally Accepted Auditing Standards, organized into three categories.

General standards. The auditor must have adequate technical training, remain independent of the company being audited, and exercise professional care throughout the engagement.
Fieldwork standards. The auditor must plan the work, supervise the team, and understand the company’s internal environment well enough to see where errors or fraud might sit. Gathering sufficient evidence through inspection, inquiry, and testing is the core of this phase.
Reporting standards. The auditor must state clearly whether the financial statements conform to the applicable accounting framework and flag any areas where they do not.

Firms that perform accounting or auditing work are generally required to undergo a peer review every three years — an outside reviewer either evaluates the firm’s quality management system and samples its audit engagements, or examines its non-audit work such as compilations and reviews. Auditors check other companies’ numbers, and peer review checks the auditors. Nearly every licensing jurisdiction in the country now makes participation mandatory.

Auditing Standards for Public Companies

Auditors of publicly traded companies operate under a separate regime. The Public Company Accounting Oversight Board was created by the Sarbanes-Oxley Act of 2002 to oversee audits of companies subject to federal securities laws and protect investors through accurate, independent audit reports.⁹ The PCAOB writes its own auditing standards, inspects registered firms, and enforces compliance through investigative and disciplinary proceedings that private-company auditing does not have.

The Internal Control Audit

The biggest difference between a public and private company audit is the internal control requirement. Under PCAOB Auditing Standard 2201, the auditor of a public company must issue a separate opinion on whether the company’s internal controls over financial reporting are effective. The internal control audit is integrated with the financial statement audit, so tests serve both purposes at once. If the auditor finds even one material weakness, the internal control opinion must state that the controls are not effective.¹⁰ Financial statements are only as trustworthy as the systems that produce them.

Inspections and Penalties

Every firm that audits public companies must register with the PCAOB and submit to regular inspections. Firms auditing more than 100 public companies are inspected annually; smaller firms at least every three years.¹¹ The PCAOB can censure firms, temporarily or permanently revoke registration, bar individual auditors from the profession, or impose civil penalties of up to $2 million per violation for a firm and $100,000 for an individual. For intentional or reckless misconduct, those caps rise to $15 million and $750,000.¹² The Securities and Exchange Commission retains ultimate authority over the PCAOB.

The Four Audit Opinions

The audit opinion is the bottom line of every engagement. It tells readers whether they can rely on the financial statements and, if not, how serious the problem is. Four types exist, and the distinctions turn on whether misstatements are material and how widespread they are.

Unqualified opinion. Often called “clean,” this means the auditor concluded that the statements are presented fairly in all material respects under the applicable framework. This is what every company wants.¹³
Qualified opinion. The statements are fairly presented except for one or more specific issues. The auditor found a material departure from accounting standards or hit a scope limitation, but the problem is contained.¹⁴
Adverse opinion. The financial statements do not fairly present the company’s position. Misstatements are both material and pervasive enough that the statements as a whole cannot be relied upon.¹⁴
Disclaimer of opinion. The auditor could not gather enough evidence to form any opinion at all, usually because records were restricted or accounting was too incomplete to test.¹⁴

Anything other than an unqualified opinion is a warning sign for investors and lenders. A qualified opinion signals a contained problem; an adverse opinion or disclaimer signals something far worse. Companies that receive an adverse opinion often see immediate stock price drops and may struggle to secure financing.

Auditor Independence

An audit is only useful if the auditor has no financial stake in the outcome. Both the AICPA and the PCAOB enforce independence requirements, but the public company rules are considerably stricter.

The Sarbanes-Oxley Act flatly prohibits a registered audit firm from providing certain non-audit services to a public company client at the same time it performs the audit. The banned services include bookkeeping, financial system design, appraisal or valuation, actuarial services, internal audit outsourcing, management functions, broker-dealer or investment banking services, legal services unrelated to the audit, and any other service the PCAOB designates by regulation.¹⁵ The PCAOB adds more restrictions: a firm loses its independence if it accepts contingent fees from an audit client or provides certain tax services to people in financial reporting oversight roles at the client.¹⁶ Where SEC and PCAOB independence rules conflict, the more restrictive version controls.

These prohibitions grew out of the Enron and WorldCom scandals, where audit firms were earning enormous consulting fees from the same companies whose books they were supposed to be scrutinizing. Congress eliminated that conflict by statute.

Government Accounting and the Yellow Book

State and local governments do not operate like businesses. The Governmental Accounting Standards Board sets the rules for government financial reporting through fund accounting, which segregates resources by legally designated purpose. A city’s general fund, water utility fund, and restricted grant fund each keep separate accounts, so money earmarked for one purpose cannot quietly subsidize another. Taxpayers and bond investors need that structure to verify that restricted dollars went where the law required.

Auditors examining government entities and organizations receiving government funds follow Generally Accepted Government Auditing Standards, widely known as the Yellow Book. The Government Accountability Office issues these standards, which layer additional requirements on top of GAAS or PCAOB standards depending on the engagement.¹⁷ The 2024 revision took effect for financial audits and performance audits beginning on or after December 15, 2025, making it the governing version for most 2026 engagements. It shifts emphasis from quality control to quality management, requiring audit organizations to design proactive, risk-based systems for managing engagement quality rather than relying on after-the-fact reviews.¹⁸

The Single Audit Threshold

Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a single audit — one comprehensive engagement covering both the entity’s financial statements and its compliance with the specific requirements of each federal program it administers. The threshold was raised from $750,000 as part of Uniform Guidance revisions that took effect in late 2024, relieving smaller grant recipients of the burden. Organizations spending below $1,000,000 are exempt from federal audit requirements, though they must still keep records sufficient for review if questions arise.¹⁹ The Single Audit Act at 31 U.S.C. §§ 7501–7507 provides the statutory foundation; the OMB’s Uniform Guidance sets the operational details.²⁰

Audit Record Retention

Audit documentation does not disappear once the opinion is issued. For private company audits, AICPA standards require firms to keep workpapers for at least five years after the audit report release date. For public company audits, the stakes climb sharply. Under 18 U.S.C. § 1520, anyone who knowingly destroys, alters, or falsifies audit records faces up to 10 years in federal prison.²¹ Congress added this provision through Sarbanes-Oxley after the Arthur Andersen shredding scandal, and the criminal penalty reaches any records connected to a federal investigation or bankruptcy proceeding, not just formal workpapers.

Companies subject to audit should treat retention as a compliance obligation rather than a storage problem. The documents supporting an audit opinion may be the only evidence available if regulators, investors, or courts later question the accuracy of the financial statements.

1
Financial Accounting Standards Board. About the FASB
2
Financial Accounting Standards Board. Summary of Statement No. 168
3
Financial Accounting Standards Board. Conceptual Framework for Financial Reporting Chapter 3, Qualitative Characteristics of Useful Financial Information
4
IFRS Foundation. Who We Are
5
IFRS. Who Uses IFRS Accounting Standards?
6
IFRS. IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information
7
IFRS. IFRS S2 Climate-related Disclosures
8
AICPA & CIMA. AICPA SASs – Currently Effective
9
Office of the Law Revision Counsel. 15 U.S.C. 7211 – Establishment; Administrative Provisions
10
Public Company Accounting Oversight Board. AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
11
PCAOB. Firm Inspection Reports
12
Office of the Law Revision Counsel. 15 U.S. Code 7215 – Investigations and Disciplinary Proceedings
13
PCAOB. AS 3101: The Auditor’s Report on an Audit of Financial Statements
14
PCAOB. Departures from Unqualified Opinions and Other Reporting Circumstances
15
Office of the Law Revision Counsel. 15 U.S. Code 78j-1 – Audit Requirements
16
PCAOB. Ethics and Independence
17
U.S. Government Accountability Office. Yellow Book Government Auditing Standards
18
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
19
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
20
Office of the Law Revision Counsel. 31 U.S.C. Chapter 75 – Requirements for Single Audits
21
Office of the Law Revision Counsel. 18 U.S.C. 1520 – Destruction of Corporate Audit Records