Auditing standards are the enforceable professional rules that govern how an auditor examines an organization’s financial records and reports what they find. Which rulebook applies depends on who is being audited: private companies in the United States follow the AICPA’s Generally Accepted Auditing Standards (GAAS), public companies follow standards issued by the Public Company Accounting Oversight Board (PCAOB), government agencies and recipients of federal funding follow the Government Accountability Office’s Generally Accepted Government Auditing Standards (GAGAS, the Yellow Book), and audits in roughly 130 other jurisdictions follow the International Standards on Auditing (ISA). All four frameworks share one goal: giving the people who rely on financial statements a defensible reason to trust them.
GAAS for Private Companies
The American Institute of Certified Public Accountants sets the rules for nonissuers, meaning any entity that isn’t a publicly traded company under PCAOB oversight. Its Auditing Standards Board issues the Statements on Auditing Standards that make up GAAS.1AICPA & CIMA. AICPA Auditing Standards Board The traditional framework groups the audit into ten standards under three headings.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
The three general standards address who is qualified to do the work. The auditor must have adequate technical training and proficiency, maintain independence in mental attitude throughout the engagement, and exercise due professional care in performing the audit and preparing the report. These are enforceable requirements, not aspirations. An auditor with a financial interest in the client fails the independence standard regardless of how competent the rest of the work is.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
The three fieldwork standards govern the examination itself. The auditor must adequately plan the work and supervise any assistants, obtain a sufficient understanding of the entity’s internal controls to design appropriate tests, and gather enough evidence through inspection, observation, inquiries, and confirmations to support a reasonable opinion.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
The four reporting standards control how the results are communicated. The report must state whether the statements follow generally accepted accounting principles, flag any inconsistency in how those principles were applied compared to the prior period, evaluate the adequacy of disclosures, and either express an opinion on the statements as a whole or explain why an opinion cannot be given.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
PCAOB Standards for Public Companies
Publicly traded companies must follow standards issued by the PCAOB, which was created by the Sarbanes-Oxley Act of 2002.3Office of the Law Revision Counsel. 15 U.S.C. Ch. 98 – Public Company Accounting Reform and Corporate Responsibility The PCAOB initially adopted existing professional rules wholesale, but it now develops its own, and those rules impose obligations that go beyond what private-company auditors face. Two areas draw the sharpest line: internal controls attestation and critical audit matters.
Internal Controls Over Financial Reporting
Under 15 U.S.C. § 7262, every public company’s annual report must include an internal control report in which management takes responsibility for maintaining adequate controls over financial reporting and assesses their effectiveness at year-end.4Office of the Law Revision Counsel. 15 U.S.C. 7262 – Management Assessment of Internal Controls For larger companies, the auditor must independently evaluate management’s assessment and issue a separate opinion on those controls, producing an integrated audit that tests both the numbers and the systems that produced them.5Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Smaller filers get some relief. Non-accelerated filers, generally companies with a public float below $75 million, are exempt from the auditor attestation requirement, though management must still perform and report its own assessment.4Office of the Law Revision Counsel. 15 U.S.C. 7262 – Management Assessment of Internal Controls Emerging growth companies are also exempt from the attestation requirement.
Executives who certify false financial reports face criminal exposure under 18 U.S.C. § 1350. A knowing certification that a periodic report does not meet the law’s requirements carries a fine of up to $1,000,000, imprisonment for up to 10 years, or both. If the certification is willful, the penalty rises to a fine of up to $5,000,000, imprisonment for up to 20 years, or both.6Office of the Law Revision Counsel. 18 U.S.C. 1350 – Failure of Corporate Officers to Certify Financial Reports
Critical Audit Matters
For most public company audits, the auditor’s report must identify and discuss any critical audit matters: issues communicated to the audit committee that relate to material accounts or disclosures and involved especially challenging or subjective auditor judgment. For each one, the auditor must describe why it qualifies, explain how it was addressed, and reference the relevant financial statement items. If none exist, the report must say so explicitly.7Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
The rule doesn’t apply across the board. Audits of emerging growth companies, registered investment companies, broker-dealers reporting under SEC rules, and employee stock purchase plans are exempt, though auditors in those engagements may include critical audit matters voluntarily.7Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
GAGAS (The Yellow Book) for Government and Federally Funded Entities
Audits of government agencies and organizations receiving federal funding follow the GAO’s framework, formally called Generally Accepted Government Auditing Standards and universally known as the Yellow Book.8U.S. GAO. Yellow Book: Government Auditing Standards It covers both financial audits and performance audits, and its scope extends past whether the numbers are right to whether the entity followed the laws and regulations governing its use of public funds.
The independence rules are stricter than in the other frameworks. Auditors must demonstrate freedom from personal, external, and organizational impairments. Certain non-audit services are prohibited outright. An auditor who prepares a client’s full financial statements from the underlying records creates what the Yellow Book treats as an automatic threat to independence, regardless of any safeguards in place.
Single Audit Threshold
Organizations that spend $1,000,000 or more in federal awards during a fiscal year must undergo a single audit, a combined review that tests both the financial statements and compliance with federal program requirements. Entities spending less than $1,000,000 are exempt from federal audit requirements, though their records must still be available for review by federal agencies and the GAO.9eCFR. 2 CFR 200.501 – Audit Requirements The threshold was raised from $750,000 effective for awards made on or after October 1, 2024. The completed audit package must be submitted to the Federal Audit Clearinghouse within 30 days of receiving the auditor’s report, and no later than nine months after the end of the fiscal period.10Federal Audit Clearinghouse. Archived OMB Announcements
International Standards on Auditing
The International Auditing and Assurance Standards Board sets the ISAs used in approximately 130 jurisdictions.11International Auditing and Assurance Standards Board. About the International Auditing and Assurance Standards Board They serve the same basic purpose as their U.S. counterparts, but they’re designed to work across different legal systems and accounting traditions, giving investors some comparability when they look at audit conclusions from companies in different countries.
The United States has not adopted ISAs for domestic audits. U.S. companies encounter them primarily when their foreign subsidiaries are audited under local standards.
The Four Audit Opinions the Standards Produce
Every audit under any of these frameworks ends in one of four opinions, and the type of opinion has real consequences for how investors, lenders, and regulators view the company.
- Unqualified (clean) opinion: The financial statements present fairly, in all material respects, the entity’s financial position under the applicable accounting framework. Most audits end here.
- Qualified opinion: The statements are fairly presented except for one or more specific issues that the auditor identifies but concludes are not severe enough to undermine the statements overall.
- Adverse opinion: The statements as a whole do not fairly present the entity’s financial position. Rare and serious.
- Disclaimer of opinion: The auditor could not form an opinion, typically because access to records was restricted or sufficient evidence could not be gathered. The report must explain why.
The line between a qualified opinion and an adverse opinion is pervasiveness. A single misstatement affecting one line item might warrant a qualification. Systematic misstatements affecting the statements as a whole call for an adverse opinion.12Public Company Accounting Oversight Board. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
Materiality: The Judgment Behind Every Opinion
Every opinion hinges on materiality. An omission or misstatement is material if it’s large or significant enough that a reasonable person relying on the statements would change a decision based on knowing about it. There is no fixed dollar threshold. Auditors set materiality using professional judgment, weighing the size of the entity, its industry, the quality of its internal controls, and its overall financial performance.
This is where audits get misunderstood. An unqualified opinion doesn’t mean the financial statements are perfect. It means any remaining errors fall below the materiality threshold. Two auditors examining the same company can set slightly different materiality levels and both stay within professional standards, provided the level chosen is defensible: low enough to catch mistakes that would influence a reasonable investor, practical enough to complete the audit within a reasonable scope.
Penalties for Violating Auditing Standards
The rules have teeth. The specific penalties vary by regulator.
PCAOB Sanctions
The PCAOB can impose censure, require additional training, place temporary or permanent limits on a firm’s activities, suspend or revoke registration, and levy civil monetary penalties. For negligent violations, penalties cap at $100,000 for an individual and $2,000,000 for a firm. For intentional, knowing, or reckless conduct, those caps rise to $750,000 per individual and $15,000,000 per firm.13GovInfo. 15 U.S.C. 7215 – Investigations and Disciplinary Proceedings The PCAOB can also permanently bar an individual from associating with any registered public accounting firm.14Public Company Accounting Oversight Board. Enforcement Actions
SEC Rule of Practice 102(e)
The SEC can censure an accountant or deny them the privilege of appearing or practicing before the Commission. The grounds include intentional or knowing violations of professional standards, reckless conduct that results in a violation, a single instance of highly unreasonable conduct where heightened scrutiny was warranted, or repeated instances of unreasonable conduct showing a lack of competence.15eCFR. 17 CFR 201.102 – Appearance and Practice Before the Commission An SEC bar effectively blocks the individual or firm from any work related to public company financial reporting, including non-audit work such as helping draft SEC filings.
An accountant whose professional license has been revoked or suspended by a state, or who has been convicted of a felony or a misdemeanor involving moral turpitude, faces automatic suspension from practice before the SEC.15eCFR. 17 CFR 201.102 – Appearance and Practice Before the Commission If the suspension isn’t permanent, the auditor can apply for reinstatement after the period expires.