Auditing and assurance services are independent reviews in which a qualified practitioner, usually a CPA or an accounting firm, examines financial or operational information a company has produced and reports whether it meets a recognized standard. The classic example is the annual financial statement audit, but the same basic model covers reviews of internal controls, cybersecurity, retirement plan finances, service organizations, and operational efficiency. Users of the information — investors, lenders, regulators, business partners — rely on the practitioner’s conclusion because the person preparing the numbers cannot credibly vouch for them alone.
Who Is Required to Have an Audit
Federal law mandates audits in two major situations. Publicly traded companies that file reports with the SEC must submit financial statements examined by an independent auditor and prepared under Generally Accepted Accounting Principles.1U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know Employee benefit plans covered by ERISA — including 401(k) and 403(b) plans with 100 or more participants — must include audited financial statements with the annual Form 5500 filing.2U.S. Department of Labor. Selecting an Auditor for Your Employee Benefit Plan
Plenty of private companies get audited without any legal requirement. Banks and investors routinely condition loans and funding rounds on audited statements. Grant-making agencies do the same. And some businesses commission audits simply to surface control weaknesses or accounting problems before those problems get expensive.
How an Assurance Engagement Is Structured
Every assurance engagement has three parties. The practitioner performs the review. The responsible party, usually company management, prepares the information and remains legally accountable for it regardless of what the practitioner finds. The intended users — shareholders, lenders, regulators — rely on the practitioner’s conclusion. That split prevents anyone from controlling both the information and its verification.
The engagement also needs an identifiable subject matter and criteria to evaluate it against. In a financial statement audit, the subject is the company’s records and the criteria are GAAP. In other engagements the criteria might be regulatory rules, industry frameworks, or contract terms. The practitioner gathers evidence, evaluates it against the criteria, and issues a formal report. The International Framework for Assurance Engagements sets out the principles that apply across engagement types.3ICAEW. International Framework for Assurance Engagements
For public company audits, standards are set and enforced by the Public Company Accounting Oversight Board, created by the Sarbanes-Oxley Act of 2002 to register accounting firms, issue auditing standards, and inspect audit work.4Office of the Law Revision Counsel. 15 USC 7211 – Establishment; Administrative Provisions
Types of Auditing and Assurance Engagements
External Financial Statement Audits
The most familiar engagement. An independent firm examines the company’s financial records under Generally Accepted Auditing Standards to determine whether the records fairly represent the company’s financial position.5Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards The output is a formal opinion, discussed below.
Internal Audits
Internal audits are for the company itself, not outside users. Internal audit teams evaluate controls, identify gaps where assets could be lost or fraud could go undetected, and report to the board’s audit committee rather than to the executives whose operations they review.
Compliance Audits
These check whether the organization follows specific laws or regulations. A public company, for instance, must test and report on the effectiveness of its internal controls over financial reporting under Section 404 of the Sarbanes-Oxley Act.6U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Tax, environmental, and healthcare privacy rules are other common compliance targets.
Forensic and Operational Audits
Forensic audits are investigations aimed at uncovering fraud or other financial crimes, and their evidence often ends up in court. Operational audits are different work entirely: they measure whether a process or department is using resources efficiently to meet organizational goals.
SOC Reports
System and Organization Controls reports cover service providers. A SOC 1 report addresses controls at a service organization that could affect its clients’ financial reporting. If your company uses an outside payroll processor, your own auditor will want to see the processor’s SOC 1.
SOC 2 reports address controls related to security, availability, processing integrity, confidentiality, and privacy — the five trust services criteria published by the AICPA.7American Institute of Certified Public Accountants. 2017 Trust Services Criteria (With Revised Points of Focus – 2022) They come in two flavors. A Type I report evaluates whether the controls are properly designed at one point in time. A Type II report tests whether those controls actually operated as intended over a period, usually several months. Sophisticated customers generally expect Type II because it shows sustained performance rather than a snapshot.
How Auditor Independence Is Protected
An audit opinion means nothing if the auditor has a stake in the outcome. Federal law and professional standards address this from several directions.
The Sarbanes-Oxley Act bars audit firms from providing certain non-audit services to the companies they audit. The prohibited list includes bookkeeping, financial systems design, appraisal and valuation, actuarial services, internal audit outsourcing, management functions, broker-dealer services, and legal services unrelated to the audit.8Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 The reasoning is simple: an auditor cannot objectively review financial statements the same firm helped prepare.
Partner rotation is another safeguard. The lead audit partner and the reviewing partner cannot serve the same client for more than five consecutive years.9Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements The AICPA’s Code of Professional Conduct also requires CPAs to maintain independence of mind and independence in appearance. The second half matters: technical independence isn’t enough if a reasonable outside observer would still question the auditor’s objectivity.
How Auditors Decide What to Check
Auditors don’t examine every transaction. They set a materiality threshold — a dollar amount below which errors are unlikely to change a reasonable investor’s decision. The Supreme Court has defined a fact as material if there is “a substantial likelihood that the fact would have been viewed by the reasonable investor as having significantly altered the total mix of information available.”10Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit
In practice the auditor sets a materiality level for the financial statements as a whole, based on earnings and other relevant factors, and expresses it as a specific dollar figure. For particular accounts or disclosures where smaller errors could still matter to investors, the auditor sets separate, lower materiality levels. The auditor also determines “tolerable misstatement” at the account level: an amount low enough to keep the probability of undetected material errors acceptably small. Materiality drives virtually every decision about where to test and how much.
The Audit Process
Planning and Risk Assessment
An audit begins with planning, not fieldwork. Before any testing, the firm confirms it meets independence requirements, establishes engagement terms with the audit committee, and builds an overall audit strategy that identifies the areas most likely to contain material misstatement.11Public Company Accounting Oversight Board. AS 2101 – Audit Planning Risk assessment continues throughout the engagement; a control weakness surfaced during fieldwork can trigger expanded testing in related areas.
Fieldwork and Testing
During fieldwork, auditors examine records and select samples of transactions to verify that recorded events occurred, are supported by documentation, and are recorded in the correct amounts and periods. If a sample turns up errors, testing expands to determine whether the problem is isolated or systemic. Fieldwork also evaluates the design and operating effectiveness of the company’s internal controls. It closes with an exit conference between the auditor and management to discuss preliminary findings and proposed adjustments.
Management Representation Letter
Before issuing the final report, the auditor requires management to sign a written representation letter. The CEO and CFO confirm they are responsible for the financial statements, that they have provided access to all financial records, and that they have disclosed any known or suspected fraud. The letter also addresses related-party transactions, contingent liabilities, and subsequent events. If management refuses to sign, the auditor cannot issue an unqualified opinion and may have to withdraw.12Public Company Accounting Oversight Board. AS 2805 – Management Representations
Records to Have Ready
The more organized the records, the faster and cheaper the audit. Auditors typically expect access to:
- General ledger and trial balance — the complete transaction record and pre-adjustment account balances.
- Bank statements and monthly reconciliations for every account.
- Payroll records and tax filings, including Form 941, which reports federal income tax, Social Security, and Medicare withholdings.13Internal Revenue Service. About Form 941, Employers Quarterly Federal Tax Return
- Internal control documentation — policies describing how assets are safeguarded and reporting is verified.
- Account lead sheets summarizing how individual balances roll into final account totals.
- Subsidiary ledger reconciliations proving that accounts receivable and payable sub-ledgers match the general ledger.
- Contracts and board minutes providing context for major transactions and decisions during the year.
Public companies file annual 10-K and quarterly 10-Q reports with the SEC, and those filings incorporate the audited statements.14Investor.gov. How to Read a 10-K/10-Q
The Auditor’s Opinion
The report is the point of the whole engagement. It tells users how much confidence to place in the financial statements. Four outcomes are possible:
- Unqualified (clean) opinion. The financial statements present fairly, in all material respects, the company’s financial position and results. This is the outcome every company wants.
- Qualified opinion. The statements are fairly presented except for one or more specific issues, which the auditor spells out. The rest of the numbers pass.
- Adverse opinion. The statements do not present fairly the company’s financial position. Lenders and investors treat this as a red flag.
- Disclaimer of opinion. The auditor was unable to obtain enough evidence to form any opinion, typically because management restricted access or uncertainty was too pervasive.15Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
The report goes to the board or audit committee, and for public companies it becomes part of the SEC filing. Anything other than an unqualified opinion has immediate practical consequences: loan covenant violations, regulatory inquiries, and a hit to investor confidence.
Criminal Exposure for False Financial Reporting
Federal law imposes steep penalties on executives who deliberately mislead investors. Under 18 U.S.C. § 1350, the CEO and CFO of a public company must personally certify that each periodic SEC report fully complies with securities law and fairly presents the company’s financial condition. An officer who knowingly certifies a false report faces up to $1,000,000 in fines and 10 years in prison. If the certification was willful, the maximum jumps to $5,000,000 and 20 years.16Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
These penalties are aimed at the executives who sign the numbers, not the auditor. Auditors face their own consequences through PCAOB disciplinary proceedings, SEC enforcement actions, and civil liability to harmed investors. The split reflects the basic logic of the whole system: management owns the financial statements, and the auditor’s role is to provide an independent check on management’s claims.