Auditing topics fall into four groups that together explain how an independent opinion on financial statements gets produced: the foundational concepts (materiality, risk, evidence, skepticism, and independence), the types of audit engagements, the step-by-step audit process, and the regulatory bodies that set the standards. A working understanding of any one topic depends on the others, which is why the profession teaches them as a system rather than as isolated ideas.
Foundational Concepts Every Audit Relies On
Five concepts run through every engagement, regardless of industry, size, or standard setter. They determine what the auditor examines, how much work gets done, and how much weight the final opinion carries.
Materiality
Materiality drives the scope of the entire audit. A matter is material if leaving it out or getting it wrong could change a decision someone makes based on the financial statements. Auditors use professional judgment to set a dollar threshold, often as a percentage of a benchmark like total revenue, net income, or total assets.
That overall threshold then gets reduced to a lower figure called performance materiality, which acts as a buffer. The logic is simple: if the auditor only catches misstatements at the overall materiality level, smaller errors can pile up and collectively exceed the threshold. Setting a lower working target prevents that. Even misstatements below performance materiality get tracked, because a pattern of small errors or a single qualitatively significant one (misstating executive compensation, for example) can still matter to users.
Audit Risk
Audit risk is the chance the auditor issues a clean opinion when the financial statements actually contain a material misstatement. The profession breaks it into three components that multiply together:
- Inherent risk: the likelihood that an account balance or class of transactions contains a material misstatement before you consider the company’s controls. Complex estimates like loan loss reserves carry higher inherent risk than straightforward cash balances.
- Control risk: the chance that the company’s own internal controls fail to prevent or catch a material misstatement in time.
- Detection risk: the chance the auditor’s own procedures miss a misstatement that actually exists.
Detection risk is the only component the auditor directly controls. When inherent and control risk are both high, the auditor compensates by driving detection risk down, which means more extensive and rigorous testing. A company with weak internal controls and complex accounting estimates will see its auditor doing significantly more work than a company with strong controls and simple operations.
Audit Evidence
The opinion has to rest on evidence, and that evidence needs to be both sufficient (enough of it) and appropriate (relevant and reliable). Not all evidence carries the same weight. What the auditor gathers firsthand, like physically counting inventory in a warehouse, is more persuasive than a schedule the client prepared internally. Documents obtained directly from independent third parties, such as a bank confirmation verifying a cash balance, outrank internally generated records.
This hierarchy matters in practice. For a high-risk account, relying entirely on internal spreadsheets will not do. The auditor looks for external confirmations, direct observation, or recalculation. The goal is a body of evidence persuasive enough to support whatever opinion ends up in the report.
Professional Skepticism and Fraud
Auditors are required to plan and perform every engagement with professional skepticism, which means neither assuming management is dishonest nor assuming everything is accurate. Under PCAOB standards, auditors must obtain reasonable assurance that the financial statements are free of material misstatement, whether caused by honest error or intentional fraud.1Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit
The auditor’s job is not to make a legal determination about whether fraud occurred. The focus is narrower: did intentional conduct produce a material misstatement in the financial statements? Designing and maintaining systems to prevent and detect fraud remains management’s responsibility.1Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit Revenue recognition and management override of controls are treated as presumed fraud risks on every engagement.
Auditor Independence
Independence is non-negotiable for any external auditor. It has two dimensions: independence in fact (the auditor’s actual objectivity) and independence in appearance (whether a reasonable outside observer would conclude the auditor is objective). The SEC and the PCAOB both enforce independence rules for public company engagements, and when their rules conflict, auditors follow whichever is more restrictive.2Public Company Accounting Oversight Board. Ethics and Independence Rules
The Sarbanes-Oxley Act prohibits an accounting firm from providing certain consulting services to a public company it also audits. The banned categories include bookkeeping, financial systems design and implementation, appraisal and valuation work, actuarial services, internal audit outsourcing, management functions or human resources work, broker-dealer or investment banking services, and legal or expert services unrelated to the audit.3U.S. Government Publishing Office. Sarbanes-Oxley Act of 2002 The SEC’s framework under Rule 2-01 of Regulation S-X adds that an auditor loses independence if a reasonable investor with knowledge of the facts would conclude the auditor cannot exercise objective judgment.4eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
Direct financial interests in a client, employment relationships with client management, and contingent fee arrangements are among the relationships that destroy independence. For private company audits, the AICPA Code of Professional Conduct imposes its own independence requirements, though the prohibited-services list is less sweeping than the public-company rules.
Types of Audit Engagements
Auditing extends well beyond checking whether the numbers in an annual report add up. The type of engagement determines the standards the auditor follows, the opinion issued, and the audience that receives the report.
Financial Statement Audits
The financial statement audit is the most common engagement. The objective is reasonable assurance that the financial statements, taken as a whole, are free of material misstatement and presented fairly under an applicable reporting framework. In the United States, that framework is Generally Accepted Accounting Principles, issued by the Financial Accounting Standards Board.5Financial Accounting Standards Board. The Conceptual Framework
Every company with securities registered under the Securities Exchange Act of 1934 must file audited annual financial statements with the SEC.6eCFR. 17 CFR 240.13a-1 – Requirements of Annual Reports The audit must comply with generally accepted auditing standards, and the resulting opinion letter, addressed to shareholders and the board, tells external users whether the statements can be relied on.7Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
Integrated Audits
An integrated audit combines the financial statement audit with an audit of internal control over financial reporting. Larger public companies are required to undergo this combined engagement under Section 404(b) of the Sarbanes-Oxley Act.8U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 The auditor issues two separate opinions: one on the financial statements and one on whether the company’s internal controls are effective.
Running both audits at once is efficient because findings from control testing feed directly into the financial statement work. If the auditor identifies a material weakness over revenue recognition, that discovery triggers expanded substantive testing of revenue accounts. The governing standard is PCAOB AS 2201, which requires a top-down, risk-based approach that focuses auditor attention on the controls most likely to prevent or detect material misstatement.9Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements Smaller public companies classified as non-accelerated filers are permanently exempt from the 404(b) external audit requirement and rely on management’s own assessment.
Compliance Audits
A compliance audit tests whether an organization is following specific rules, regulations, or contractual terms imposed by an outside authority. The scope is usually narrow: the auditor examines adherence to a particular law or funding requirement and reports on the degree of compliance.
The most prominent example is the single audit required under the Uniform Guidance for organizations that spend $1,000,000 or more in federal awards during a fiscal year. That threshold was raised from $750,000 in 2024 and applies to fiscal years beginning on or after October 1, 2024.10eCFR. 2 CFR Part 200 Subpart F – Audit Requirements State and local governments, universities, and nonprofits receiving federal funds are the typical entities subject to this requirement. IRS tax examinations are another common form of compliance audit. Failure to comply can lead to fines, loss of future funding, or other regulatory consequences.
Operational Audits
Operational audits evaluate the efficiency and effectiveness of internal processes rather than financial reporting. A single engagement might cover supply chain management, human resources procedures, or IT operations. Internal auditors or management consulting teams typically perform these engagements, and results go to management and the audit committee rather than external stakeholders. Criteria are set by management and can range from industry benchmarks to internal performance targets, which makes operational audits more flexible than financial statement audits.
Government Audits Under the Yellow Book
Audits of government entities and organizations that receive government funding follow Generally Accepted Government Auditing Standards, issued by the U.S. Government Accountability Office and commonly called the Yellow Book. The standards cover financial audits, attestation engagements, and performance audits. Performance audits assess whether government programs are achieving their intended results efficiently and equitably. The 2024 revision of the Yellow Book takes effect for performance audits beginning on or after December 15, 2025, with new quality management evaluation requirements for audit organizations due by December 15, 2026.11U.S. Government Accountability Office. Yellow Book – Government Auditing Standards
The Audit Process
External audits follow a structured sequence from client acceptance through the final report. Each phase builds on the last, and the documentation created along the way forms the evidentiary backbone of the engagement.
Planning and Risk Assessment
Before any testing begins, the auditor decides whether to accept or continue with the client. That step includes confirming independence and confirming that the firm has the competence and resources for the engagement. Once accepted, the auditor examines the client’s business, its industry, and its regulatory environment to identify where material misstatement is most likely.
Preliminary analytical procedures compare current-year data against prior periods and industry benchmarks to flag unusual fluctuations. The auditor evaluates the design and implementation of the client’s internal controls. When controls appear effective, the auditor can plan to rely on them and reduce direct transaction testing. When controls are weak or nonexistent, the auditor shifts to a purely substantive approach that requires more hands-on evidence gathering. This work produces two planning documents: an overall audit strategy that sets scope, timing, and direction, and a detailed audit plan that specifies each procedure the team will perform.
Fieldwork and Evidence Gathering
Fieldwork is where the auditor collects the evidence needed to support the opinion. The work divides into tests of controls and substantive procedures.
Tests of controls verify that internal controls are operating effectively. If the auditor planned to rely on a control over cash disbursements, for example, the team selects a sample of transactions and checks whether each one passed through the required approval process. When controls test well, less substantive work is needed on the related accounts. When controls fail, the plan shifts to heavier direct testing.
Substantive procedures target financial statement balances and transactions directly. Common examples include external confirmations sent to banks, customers, or vendors; inventory observation at the client’s physical count; vouching recorded transactions back to invoices, contracts, or shipping records; cutoff testing to verify that transactions near the end of the period land in the correct accounting period; and analytical procedures that develop an independent expectation for an account balance and investigate significant deviations.
All of this work goes into the audit working papers, which serve as the permanent record of what was tested, what was found, and what conclusions were reached. Working papers are subject to PCAOB inspection for public company audits.
Forming an Opinion and Reporting
After fieldwork wraps up, the auditor reviews all evidence, performs a final round of analytical procedures, and evaluates any events that occurred after the balance sheet date but before the report is issued. Management must provide a written representation letter confirming that the financial statements are their responsibility, that all relevant information has been disclosed, and that financial records were made available.12Public Company Accounting Oversight Board. AS 2805 – Management Representations
The auditor then issues one of four opinions. An unqualified (clean) opinion says the financial statements are presented fairly in all material respects. A qualified opinion says they are fairly presented except for a specific issue, such as a misstatement in one account or a scope limitation. An adverse opinion says the statements are materially misstated and should not be relied on. A disclaimer of opinion says the auditor could not obtain enough evidence to form any opinion at all, usually because of major scope restrictions. An unqualified opinion may still include an emphasis-of-matter paragraph drawing attention to something significant, such as substantial doubt about the company’s ability to continue as a going concern.
Critical Audit Matters
For public company audits that result in an unqualified opinion, PCAOB standards require the auditor to identify and communicate critical audit matters in the audit report. A CAM is any matter arising from the audit that involved especially challenging, subjective, or complex auditor judgment. Common examples include fair value measurements for hard-to-value assets, revenue recognition for complex arrangements, and the evaluation of goodwill for impairment. CAM reporting gives investors a window into where the auditor spent the most effort and faced the most uncertainty. Audits of broker-dealers, registered investment companies, employee stock purchase plans, and emerging growth companies are exempt from the CAM requirement.13Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
Who Sets the Standards
The profession operates under a layered structure where different bodies govern different engagements. Which standards apply depends on whether the entity is a public company, a private company, or a government-funded organization.
Public Company Accounting Oversight Board
The PCAOB was created by the Sarbanes-Oxley Act of 2002 to oversee audits of public companies and broker-dealers. It registers accounting firms, sets the auditing standards (designated “AS”) that govern public company engagements, inspects firm audit practices, and has authority to investigate and discipline firms and individuals who violate its rules.14U.S. Securities and Exchange Commission. Order Regarding Section 101(d) of the Sarbanes-Oxley Act of 2002 Sanctions range from monetary penalties (recent cases have reached into the millions of dollars) to permanent revocation of a firm’s registration and permanent bars on individual practitioners.15Public Company Accounting Oversight Board. All Enforcement Updates
A major development is QC 1000, the PCAOB’s new quality control standard, effective December 15, 2026. It replaces the existing framework with a risk-based system requiring firms to establish quality objectives, identify and assess quality risks, design responses, and monitor the entire system annually.16Public Company Accounting Oversight Board. QC 1000 – A Firm’s System of Quality Control The standard organizes a firm’s quality control system around eight integrated components, including governance and leadership, ethics and independence, engagement performance, and monitoring and remediation.
American Institute of Certified Public Accountants
The AICPA is the professional organization for CPAs and governs audits of private companies and other non-public entities. Its Auditing Standards Board issues Statements on Auditing Standards, the authoritative guidance for engagements outside the PCAOB’s jurisdiction.17AICPA & CIMA. AICPA Auditing Standards Board The board frequently aligns its standards with international standards to maintain global consistency. The AICPA also develops the Uniform CPA Examination and publishes the Code of Professional Conduct, which sets ethical and independence requirements for members. The Code includes detailed rules on non-audit services an auditor can provide to a private audit client, though these restrictions are less extensive than the public-company prohibitions under Sarbanes-Oxley.
International Auditing and Assurance Standards Board
The IAASB develops International Standards on Auditing, used globally to promote consistent audit quality across jurisdictions. Most countries outside the U.S. apply ISAs to both public and private company audits. The IAASB works closely with national standard setters, including the AICPA, to keep international and domestic standards broadly aligned. For multinational corporations, this alignment reduces the complexity of coordinating audits across countries with different regulatory regimes.