Auditing investments means testing whether the financial assets on the balance sheet actually exist, are owned by the entity, are measured at the right amount, and appear in the correct place in the financial statements. The work is organized around five management assertions, and it gets harder as the investments become less liquid and their values depend more on judgment than on a market quote. Public equities held at a major brokerage can often be verified with a single confirmation and a pricing feed. A private equity stake or a complex derivative can absorb weeks of specialist work.
The Five Assertions That Drive the Work
Every procedure an auditor performs on an investment balance ties back to one of five assertions embedded in the financial statements. If the auditor can gather sufficient evidence for each, the balances are likely free of material misstatement.
- Existence: the investments recorded were real and held at the reporting date.
- Rights and obligations: the entity owns the investments or holds enforceable rights to their economic benefits, free of undisclosed liens.
- Valuation and allocation: investments are recorded at the correct amount under the applicable basis, whether fair value, amortized cost, or something else.
- Completeness: every investment and related transaction that belongs in the statements is there.
- Classification and presentation: investments sit in the right balance sheet category, and value changes flow to the right line in net income or other comprehensive income.
A weak spot in any single assertion can ripple through the statements, so the audit plan covers all five for every material class of investment.
Confirming Existence and Ownership
The most direct evidence of existence comes from someone other than the client. Auditors send confirmation requests to custodians, brokers, and transfer agents asking them to independently verify holdings and balances as of the balance sheet date. A response from an independent third party is strong evidence because the client can’t easily manipulate it.
Ownership is a separate question. The auditor reviews custodial agreements, trade confirmations, and partnership documents to confirm the entity’s legal claim to each investment. This matters most when assets sit in nominee or omnibus accounts where the client’s name doesn’t appear on the face of the instrument. The auditor also checks for pledges, liens, or other restrictions that would limit the entity’s ability to sell or benefit from the holding.
For investments not held by a third-party custodian, such as private placement notes or physical certificates, the auditor inspects the original title documents directly. When bearer instruments exist, inspection happens under controlled conditions with at least two people present to prevent substitution or removal. Every detail on the instrument gets compared to the subsidiary ledger record.
Relying on the Custodian’s Own Auditor
When investments are held through an intermediary like a trust company or brokerage platform, the auditor often can’t test the custodian’s internal controls directly. Instead, the auditor reviews a Service Organization Control (SOC) 1 report issued by the custodian’s own auditor. The Type 2 version covers the operating effectiveness of the custodian’s controls over a specified period, not just their design at a single point in time. The auditor evaluates whether the report covers the right time frame, addresses relevant control objectives, and notes any exceptions that could affect the reliability of the custodian’s records.
Cutoff Around Period End
Trades executed near the balance sheet date get special attention. A trade executed on December 30 but not recorded until January 3 creates a cutoff error that can misstate both the investment balance and any related income. The auditor typically pulls a sample of trade confirmations from the days immediately before and after period end and traces each one to the accounting records.
Digital Assets
Cryptocurrency and other blockchain-based assets present a unique existence problem. Traditional confirmation procedures don’t work when there’s no bank or custodian to write back. For self-custodied holdings, the auditor verifies control over the private cryptographic keys, typically by having the entity sign a test transaction from the wallet address, confirming the on-chain balance through an independent blockchain explorer, and reviewing the key management architecture. For assets held with a third-party custodian, the approach resembles a traditional confirmation, but the auditor still needs to understand whether the custodian holds segregated assets or simply owes the client a contractual right to withdraw.
Testing Fair Value and Other Valuations
Valuation is where investment audits get complicated. Many instruments must be measured at fair value, and the reliability of that measurement varies enormously depending on the inputs available. Under ASC 820, fair value inputs fall into three levels, and the auditor’s work escalates in both difficulty and skepticism as the inputs become less observable.
Level 1 Prices
Level 1 valuations use unadjusted quoted prices for identical assets in active markets. Publicly traded stocks and Treasury bonds with real-time exchange pricing are the standard examples. The auditor verifies the recorded value by independently accessing an external pricing service or published exchange data for the measurement date. This is the most reliable evidence of fair value, and the audit work is correspondingly straightforward.
Level 2 Inputs
Level 2 inputs are observable but require some adjustment. They include quoted prices for similar (not identical) assets, quoted prices in markets that aren’t active, and market-corroborated data like interest rate yield curves and credit spreads. The auditor tests the reasonableness of the adjustments by comparing the pricing model’s inputs against independent market data and, in many cases, requesting valuations from multiple pricing services to see whether they produce a consistent range.
Level 3 Estimates
Level 3 is where the real audit risk concentrates. These valuations rely on the entity’s own assumptions because no meaningful market data exists. Private equity stakes, illiquid structured products, and complex derivatives typically fall here. The entity builds a discounted cash flow model or uses another methodology that requires selecting discount rates, growth assumptions, and other inputs that can’t be verified against a market quote.
The auditor works through these models layer by layer: evaluating whether the methodology conforms to the accounting framework, testing the mathematical accuracy of the calculations, and challenging each significant assumption. Discount rates get benchmarked against comparable transactions and industry data. Revenue projections get compared to historical results and economic forecasts. The auditor is specifically looking for management bias in the direction that flatters the financial statements. PCAOB Auditing Standard 2501 requires the auditor to evaluate whether each significant assumption is reasonable both individually and in combination, and for critical estimates, to understand how sensitive the result is to changes in those assumptions.1PCAOB. AS 2501 Auditing Accounting Estimates, Including Fair Value Measurements
Sensitivity analysis is standard for Level 3 instruments. The auditor changes one significant assumption at a time within a reasonable range and recalculates the fair value to see how much it moves. If a 50-basis-point shift in the discount rate swings the value by a material amount, the estimate sits in a zone where small judgment calls have big consequences. The resulting range helps the auditor decide whether the recorded amount is materially misstated or simply on the aggressive end of acceptable.
When a Valuation Specialist Is Needed
When Level 3 valuations involve modeling techniques beyond the audit team’s expertise, the auditor engages a valuation specialist. PCAOB AS 1210 requires the engagement partner to assess the specialist’s professional qualifications, relevant experience, and objectivity before relying on the work.2PCAOB. AS 1210 Using the Work of an Auditor-Engaged Specialist The objectivity assessment covers whether the specialist or the specialist’s employer has any financial, employment, or other relationship with the client that could compromise impartial judgment. If objectivity is impaired, the auditor must either perform additional procedures to evaluate the specialist’s data and methods or engage a different specialist.
The specialist’s findings don’t replace the auditor’s judgment. The auditor still reviews the specialist’s report, evaluates whether the methods used are appropriate, and confirms that the conclusions are consistent with other audit evidence. Engaging a specialist helps test the model; it doesn’t transfer responsibility for the valuation conclusion.
Held-to-Maturity Debt
Debt securities classified as held-to-maturity follow a different path. Instead of fair value, they’re carried at amortized cost. The auditor recalculates the amortization of any premium or discount using the effective interest method, confirms the accuracy of the carrying amount, and verifies that management has both the intent and the ability to hold the security until maturity. The auditor also evaluates the issuer’s creditworthiness by reviewing credit ratings, recent financial statements, and any publicly available information about the issuer’s financial health.
CECL Allowances
The current expected credit loss model under ASC 326 changed how entities measure impairment on debt securities. Rather than waiting for a loss to become probable or other-than-temporary, entities estimate expected credit losses over the life of the instrument based on historical data, current conditions, and reasonable forecasts. For available-for-sale debt securities, credit losses are recognized through an allowance account rather than a permanent write-down of the cost basis.3NCUA. CECL Accounting Standards
Auditing the CECL allowance requires evaluating management’s methodology, testing whether the data inputs are accurate and complete, challenging forward-looking assumptions, and checking whether management appropriately grouped instruments with similar risk characteristics for collective measurement. Historical loss rates used as a starting point must be adjusted when current conditions or supportable forecasts differ from the historical period. The subjective nature of the estimate makes CECL allowances a natural focal point for management bias, and auditors typically apply the same skepticism they use for Level 3 valuations.
Disclosure Review
The valuation work finishes with the financial statement disclosures. The entity must disclose the fair value hierarchy classification for each class of investment, including the distribution of assets across Levels 1, 2, and 3. Recurring Level 3 measurements require a rollforward showing beginning balances, gains and losses, purchases, sales, transfers in and out of Level 3, and ending balances. The auditor confirms these disclosures are accurate, internally consistent, and complete.
Investment Income, Gains, and Losses
Income testing focuses on completeness and accuracy. The auditor independently recalculates expected interest income by applying the stated coupon rate to the principal balance for the period the entity held each debt security. Material variances between the recalculated figure and what the client recorded get investigated. Dividend income is verified against published dividend records, and the auditor confirms that every expected payment was recognized in the right period.
For equity investments, the auditor watches for stock splits and stock dividends, which change the number of shares held but don’t produce income. Recording a stock split as income is a straightforward error that happens often enough that auditors check for it routinely.
When the entity sells an investment, the auditor tests the reported gain or loss by selecting a sample of sales, verifying the trade date, confirming the net proceeds against broker statements, and recalculating the gain or loss by comparing proceeds to the security’s adjusted cost basis. If the entity uses the specific identification method to determine which lot was sold, the auditor traces that election back to documentation created at the time of the trade, not after the fact.
Wash Sales
When an entity sells a security at a loss and acquires a substantially identical security within 30 days before or after the sale, the Internal Revenue Code disallows the loss deduction. The disallowed loss gets added to the cost basis of the replacement security, and the holding period of the original security carries over.4Office of the Law Revision Counsel. 26 USC 1091 – Loss From Wash Sales of Stock or Securities The auditor reviews sales activity around the balance sheet date and cross-references purchases of the same or similar securities within the 61-day window. Brokers track wash sales within a single account automatically, but entities with multiple accounts or related-party transactions can easily miss one. For tax-sensitive entities, an undetected wash sale misstates both the current-year tax provision and the cost basis of the replacement security going forward.
Classification
Getting classification right determines where value changes show up. For debt securities, trading securities carry unrealized gains and losses through net income, available-for-sale securities record unrealized value changes in other comprehensive income, and held-to-maturity securities avoid fair value fluctuations because they’re measured at amortized cost.
Equity securities follow different rules. Since the adoption of ASU 2016-01, most equity securities are measured at fair value with all changes flowing through net income; the old available-for-sale category no longer exists for equities. The only alternative is the measurement exception for equity securities without a readily determinable fair value, which allows the entity to record the investment at cost minus impairment, adjusted for observable price changes. The auditor confirms the entity is applying the correct framework and hasn’t parked equity securities in an available-for-sale bucket that no longer exists.
For held-to-maturity debt securities, the auditor evaluates whether management has both positive intent and the demonstrated ability to hold the security until maturity. Evidence includes board minutes, investment policy documentation, and historical practice. A pattern of selling securities classified as held-to-maturity before they mature makes the classification suspect for the entire portfolio.
Equity Method Investments
When an entity holds a significant stake in another company, generally 20% or more of voting stock, it typically accounts for the investment using the equity method. The investor records its proportional share of the investee’s income or loss rather than waiting for dividends and adjusts the carrying amount of the investment accordingly.
The audit challenge is that the auditor needs reliable financial information about the investee, not just the investor. If the investee is a public company with audited financial statements, the auditor can review those statements and evaluate whether the investor’s share of income was correctly calculated. If the investee is private, the auditor may need to perform procedures on the investee’s financial data or evaluate the work of the investee’s auditor.
Key procedures include recalculating the investor’s share of the investee’s income, verifying that intra-entity profits have been properly eliminated, testing the amortization of any basis differences between the investment’s cost and the investor’s share of the investee’s net assets, and confirming that the investor’s share of the investee’s other comprehensive income flows to the right place. The auditor also evaluates whether the equity method remains appropriate, since a change in ownership percentage or influence can trigger a switch to consolidation or a different measurement basis.
Fraud Risk and Management Bias
Investments are a high-risk area for fraud because valuations often depend on management’s judgment, and that judgment is hard to independently verify. PCAOB AS 2401 requires auditors to maintain professional skepticism throughout the engagement and specifically address the risk of management override of controls.5PCAOB. AS 2401 Consideration of Fraud in a Financial Statement Audit
Three procedures are mandatory regardless of the auditor’s fraud risk assessment. The auditor examines journal entries and other adjustments for evidence of manipulation, paying particular attention to entries that affect investment valuations near period end. The auditor performs a retrospective review of significant accounting estimates, comparing prior-year fair value estimates to actual results to look for a consistent pattern of bias in one direction. And the auditor evaluates the business rationale for any significant unusual transactions, such as complex structured investments entered into near year end with no clear economic purpose.
Fraud risk is highest where valuation subjectivity is greatest. Private equity holdings, illiquid debt, and complex derivatives all give management room to select assumptions that inflate reported values. The auditor’s response to elevated fraud risk typically includes expanding the sample of transactions tested, engaging an independent valuation specialist, and performing more granular sensitivity analysis on management’s key assumptions.
Internal Controls Over Investments
Before diving into substantive testing, the auditor evaluates the design and operating effectiveness of the entity’s internal controls over its investment activities. Strong controls reduce the risk of material misstatement and can allow the auditor to narrow the scope of detailed testing. Weak controls do the opposite.
Segregation of duties is the foundational control. The person who authorizes investment trades should not be the same person who executes them or records them in the accounting system. When one individual can initiate, execute, and record a transaction without independent review, the opportunity for both error and fraud increases dramatically. The auditor maps out who performs each function in the investment lifecycle and tests whether the separation holds in practice, not just on paper.
A written investment policy approved by the board or an investment committee sets the boundaries: permissible instrument types, concentration limits, credit quality requirements, and approval thresholds for individual transactions. The auditor tests compliance by selecting a sample of trades and checking whether each one falls within the policy’s parameters. Exceptions should have documented approvals, and those approvals get reviewed for authenticity.
Independent reconciliation is another focus. Someone not involved in executing trades should regularly reconcile the investment subsidiary ledger to external custodian statements and the general ledger. The auditor typically re-performs a sample of these reconciliations to confirm the control is working as designed, checking that discrepancies were identified and resolved promptly.
The effectiveness of these controls directly shapes the audit plan. When controls are operating effectively, the auditor can rely on them and reduce the volume of substantive testing. When controls have gaps or exceptions, the auditor compensates by expanding sample sizes, performing more procedures at year end rather than at an interim date, and applying greater skepticism to management’s representations.1PCAOB. AS 2501 Auditing Accounting Estimates, Including Fair Value Measurements