A financial statement review is a CPA engagement in which the accountant applies inquiry and analytical procedures to your company’s financial statements and then issues a report expressing limited assurance that no material changes are needed. It sits between a compilation and an audit: more credibility than internally prepared numbers, far less work and cost than an audit. The governing standard is AR-C Section 90 of the Statements on Standards for Accounting and Review Services (SSARS), and for private companies that need outside assurance without paying audit fees, the review is the workhorse engagement.
Review, Compilation, or Audit
CPAs offer three tiers of financial statement services, and the differences drive both cost and credibility.
A compilation is the lightest engagement. The CPA helps management present financial data in proper statement format but performs no procedures to verify anything, and the compilation report explicitly disclaims any assurance. The CPA doesn’t need to be independent, and no management representation letter is required. It’s mainly useful internally, or for readers already close to the business.
A review adds two things: inquiry of management and analytical procedures. The CPA must be independent, a signed management representation letter is required before the report can be released, and the report provides limited assurance. Limited assurance means the CPA states whether they became aware of any material modifications needed for the statements to conform with the applicable reporting framework.
An audit is a different animal. The CPA gathers external, verifiable evidence, tests internal controls, and issues a report providing reasonable assurance that the statements are free from material misstatement. Audits are governed by the Statements on Auditing Standards rather than SSARS, and the fee and timeline reflect the broader scope.
The sharpest line runs between review and audit, and it’s a line searchers often blur. AR-C Section 90 explicitly states that a review does not contemplate obtaining an understanding of the entity’s internal control, assessing fraud risk, or testing accounting records through inspection, observation, confirmation, or examination of source documents. Those are audit procedures. A review relies on internal representations and analytical comparisons, which is why it produces limited rather than reasonable assurance.
When You’ll Be Asked for One
The most common trigger is a lender requirement. Banks and commercial lenders frequently require reviewed financial statements when extending credit lines or term loans, particularly when debt covenants include specific financial ratios the borrower must maintain. A review gives the lender enough comfort that the numbers are plausible without forcing the borrower to absorb audit-level fees.
Prospective investors doing due diligence are the other big driver. A CPA’s limited assurance carries more weight than management-prepared statements alone. Some franchise agreements, bonding requirements, and regulatory filings for private companies also specify reviewed financials, and boards and ownership groups sometimes commission a review as an internal governance check on management’s reporting.
Independence Is Required
A CPA must be independent of the company to perform a review. This is one of the sharpest differences from a compilation, where independence is not required. Under the AICPA Code of Professional Conduct, a CPA performing an attest engagement must be independent in both fact and appearance.
Independence is impaired when the CPA or anyone at their firm has a direct financial interest in the client, serves as an officer or director, or has a close family member in a key management role. Even less obvious relationships can create problems. If the firm also prepares the financial statements it’s reviewing, that creates a self-review threat that must be managed with safeguards or may disqualify the firm entirely. Long-standing client relationships can create familiarity threats. If your CPA firm flags an independence concern, take it seriously; a review report issued by a CPA who wasn’t independent is worthless.
What Actually Happens in the Engagement
Planning and the Engagement Letter
Before work begins, the CPA firm and your company must agree to the terms in writing. AR-C Section 90 requires the understanding to be documented, and an oral agreement is insufficient. The engagement letter covers the scope of the review, which statements are covered, the applicable reporting framework (usually GAAP, though tax-basis and other special-purpose frameworks are common), each party’s responsibilities, and the format of the final report. It also confirms that a review will not provide the positive assurance of an audit and is not designed to detect all misstatements or fraud.
What You Provide
Management is responsible for preparing the financial statements in accordance with the specified framework and giving the CPA unrestricted access to relevant information, records, and personnel. Expect a document request list early in the engagement. Typical items include:
- Trial balance, general ledger, year-end financial statements, and supporting schedules for major account balances
- Bank statements, bank reconciliations, and outstanding check listings
- Aged accounts receivable and payable, major contracts, and customer and vendor listings
- Payroll summaries, bonus or commission schedules, and benefit plan documentation
- Board meeting minutes, tax filings, debt agreements, and any pending litigation correspondence
The condition of these records drives both timeline and cost. Clean, reconciled books make the review efficient. If your general ledger doesn’t tie to your bank statements or you can’t produce an aged receivables report, the CPA will spend time sorting that out before the real review work even starts, and those hours land in the bill.
Inquiry Procedures
The CPA directs specific inquiries to management and other personnel responsible for financial and accounting matters. AR-C Section 90 lays out a detailed list of required topics, but the practical themes are: whether the statements comply with the reporting framework, any unusual or complex transactions, significant transactions near period-end (where earnings manipulation most commonly hides), the status of prior-period misstatements, subsequent events, any known or suspected fraud, and related-party dealings. The CPA will also ask about the collectability of receivables, whether inventory is obsolete, whether all liabilities have been recorded, and whether the company is complying with its debt covenants. These inquiries rely on management’s honesty, which is why the representation letter carries so much weight.
Analytical Procedures
Analytical procedures compare recorded amounts to expectations and to prior-period data to surface relationships that don’t look right. AR-C Section 90 requires four specific types of analysis: comparing the statements with comparable prior-period information, considering plausible relationships among financial and nonfinancial data, comparing recorded amounts or ratios to expectations the CPA develops based on their understanding of the business and industry, and comparing disaggregated revenue data where applicable.
The CPA sets an acceptable threshold for fluctuation. Variations within it don’t require further work; variations outside it trigger follow-up inquiry. If gross margin drops three percentage points with no obvious operational explanation, the CPA will press management for the reason and evaluate whether the explanation is consistent with other information gathered during the review.
If the CPA becomes aware of information suggesting the statements may be materially misstated, AR-C Section 90 requires them to design and perform additional procedures as necessary to reach a conclusion. The review isn’t a rubber stamp. A CPA who stumbles onto a potential problem can’t ignore it because “it’s only a review.”
Going Concern
When the reporting framework requires management to evaluate the company’s ability to continue operating (as GAAP does), the CPA performs review procedures related to going concern. That means evaluating whether the going concern basis is appropriate, inquiring about management’s assessment of conditions that raise substantial doubt about viability, reviewing management’s plans to address those conditions, and assessing whether the related disclosures are adequate. A profitable company with solid financing might require only a brief inquiry. A company burning cash with debt maturities approaching gets much more scrutiny. If the CPA concludes there is substantial doubt about the company’s ability to continue as a going concern, that finding appears in the review report as an emphasis-of-matter paragraph, and any lender or investor reading it will notice immediately.
The Management Representation Letter
Before the CPA can release the report, management must provide a signed representation letter dated as of the report date. This isn’t optional; AR-C Section 90 requires the signed letter in hand. In it, management formally confirms that the statements are fairly presented and complete, that all material matters have been disclosed (including fraud, subsequent events, and related-party transactions), and that all financial records and related data were made available to the CPA. If management refuses to sign, the CPA cannot issue a review report. Reviews occasionally stall here, because management balks at putting certain representations in writing, which itself tells the CPA something about the reliability of what they’ve been told.
What the Review Report Says
The report is the deliverable your lender, investor, or board will actually read. It has distinct sections addressing management’s responsibilities, the CPA’s responsibilities, and the CPA’s conclusion. Management is responsible for preparing and fairly presenting the statements and for maintaining internal control relevant to that preparation. The CPA states that the review was conducted in accordance with SSARS, that it is substantially less in scope than an audit, and that no audit opinion is expressed.
The conclusion is what matters. In a standard unmodified report, the CPA is “not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in accordance with accounting principles generally accepted in the United States of America.” That phrasing is deliberately negative. The CPA isn’t saying the statements are right; they’re saying nothing came to their attention suggesting they’re materially wrong. Sophisticated readers understand the distinction between that negative assurance and the positive assurance of an audit opinion.
When the Report Is Modified
When the CPA identifies problems, the report changes. A qualified conclusion is issued when the CPA finds a material departure from the reporting framework confined to specific accounts or disclosures rather than affecting the statements as a whole. The report includes a basis-for-qualified-conclusion paragraph describing the departure, along with the dollar effects if determinable. An adverse conclusion is issued when the departure is both material and pervasive, meaning it affects the statements so broadly that a qualified conclusion wouldn’t adequately communicate the problem.
A separate situation arises when management limits the CPA’s ability to perform necessary procedures. If the limitation is severe enough that the CPA can’t obtain sufficient evidence to form any conclusion, they may need to withdraw from the engagement entirely. And even an unmodified review report provides less confidence than an audit opinion. The report confirms that the statements appear plausible based on limited procedures, not that they’ve been verified.
What a Review Costs
There’s no standard fee range because the variables are too numerous: company size, condition of the books, complexity of operations, industry, number of related entities, reporting framework, and time of year all affect pricing. A straightforward review for a small single-entity business with clean records costs substantially less than a review for a mid-size company with consolidated subsidiaries, complex revenue recognition, and significant related-party transactions.
Most firms price reviews as a fixed fee built on an internal estimate of hours. Reviews generally cost significantly less than audits for the same company because the scope is narrower, though the gap varies. First-year reviews cost more because the CPA needs to establish baseline expectations and may need to evaluate opening balances; subsequent years become more efficient as the CPA develops familiarity with the business. The single biggest factor in keeping costs down is delivering clean, organized records on time.