To audit a business, you engage an independent CPA who plans the work around your company’s risks, tests your financial records against outside evidence like bank statements and invoices, evaluates your internal controls, and then issues a written opinion on whether your financial statements are fairly presented under Generally Accepted Accounting Principles. The engagement is governed by Generally Accepted Auditing Standards, usually runs several weeks to a few months, and typically costs a small business $200 to $400 per hour in CPA fees. What follows walks through when an audit is actually required, what you need to hand the auditor, what the auditor does with it, and what the final report means.
Do You Actually Need a Full Audit
Most private companies are not legally required to have an audit at all. The requirement usually comes from one of three places: securities law, a federal award, or a contract you signed.
Publicly traded companies with securities registered under Section 12 of the Securities Exchange Act of 1934 must file annual reports containing audited financial statements.1eCFR. 17 CFR 240.13a-1 – Requirements of Annual Reports Organizations that spend $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit under the Uniform Guidance; that threshold rose from $750,000 for fiscal years beginning on or after October 1, 2024.2eCFR. 2 CFR 200.501 – Audit Requirements For most private companies, though, the trigger is a bank loan covenant, a minority shareholder, a buyer conducting due diligence, or a state licensing board.
If no rule or contract demands a full audit, a lighter engagement may satisfy the requirement at a fraction of the cost. CPAs offer three levels:
- A compilation assembles financial statements from information management provides, with no testing and no assurance.3AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit
- A review adds analytical procedures and inquiries of management, giving limited assurance that no material modifications are needed, but does not test individual transactions or evaluate internal controls.3AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit
- An audit tests supporting documents, evaluates controls, and issues an opinion providing high (though not absolute) assurance.3AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit
A compilation for a small business might run a few thousand dollars; a full audit of the same company can cost five to ten times as much. Read the exact language in your loan agreement or grant terms before you commission anything. If the covenant says “audited,” a review will not satisfy it, and falling out of compliance can trigger a default. If it says “reviewed,” paying for a full audit is money you did not need to spend.
Who Can Perform the Audit
A financial statement audit must be performed by an independent CPA or CPA firm. Independent means the auditor has no financial interest in the company, no management role, and no relationship that could compromise objectivity. Public company audits must be conducted by a firm registered with the Public Company Accounting Oversight Board, which sets the applicable standards.4PCAOB. Standards Private company audits follow the AICPA’s standards.
Internal auditors, who work for the company and focus on operations, compliance, and risk, do valuable work but cannot issue the independent opinion that a lender, regulator, or shareholder is looking for. When people say “business audit” in a regulatory or financing context, they mean the external variety.
Documents to Have Ready Before the Auditor Arrives
The single biggest factor in how long an audit takes and what it costs is how organized your records are when fieldwork starts. Scrambling for documents mid-engagement drives fees up and pushes deadlines out.
Financial Statements and General Ledger
Have the balance sheet, income statement, and cash flow statement pulled from your accounting software, along with the general ledger showing every transaction categorized by account. Export the ledger in a format the auditor can sort and filter.
Bank and Credit Card Statements
Download statements for every account the business used during the audit period. These third-party records sit outside your accounting system and are among the auditor’s most important tools for confirming that ledger entries reflect real activity.
Receipts, Invoices, and Contracts
Every significant expense should have a source document behind it. The auditor will pick specific transactions and ask to see the receipt, invoice, or contract. If you cannot produce it, that transaction becomes a finding. On the revenue side, keep customer invoices, sales contracts, and shipping documents accessible.5Internal Revenue Service. What Kind of Records Should I Keep Digital copies organized by date or vendor work; loose paper does not.
Payroll Records
Payroll is one of the largest expense categories for most businesses, and auditors scrutinize it closely. Pull records from your payroll processor showing wages paid, hours worked, tax withholdings, and benefit contributions. Federal law already requires you to maintain accurate data on employee pay rates, hours, and deductions.6U.S. Department of Labor. Recordkeeping and Reporting
Tax Returns
Auditors use filed tax returns as a benchmark against internal records. Corporations should have Form 1120 available.7Internal Revenue Service. About Form 1120, U.S. Corporation Income Tax Return Sole proprietors report profit or loss on Schedule C with their Form 1040.8Internal Revenue Service. About Schedule C (Form 1040), Profit or Loss from Business (Sole Proprietorship) Partnerships and S corporations use their own forms.
Asset and Governance Records
Depreciation schedules, vehicle titles, equipment purchase invoices, and property records support the asset values on your balance sheet. Articles of incorporation, operating agreements, board minutes, and any prior audit reports establish structure and history. Having these in one place eliminates a common source of delay.
How Long to Keep the Records Afterward
Retention rules vary with the situation:
- Three years is the standard period for records supporting income, deductions, and credits on a tax return.
- Six years applies if you omitted income exceeding 25% of the gross income reported.
- Seven years applies if you claimed a deduction for worthless securities or bad debts.
- Employment tax records must be kept at least four years from when the tax was due or paid, whichever is later.
- Records must be kept indefinitely if you never filed a return or filed a fraudulent one.
Property records deserve separate handling. Keep documentation for any asset until the statute of limitations expires for the year you sell or dispose of it, because the IRS needs cost basis to calculate gain or loss.9Internal Revenue Service. How Long Should I Keep Records
Planning and Risk Assessment
Before testing any transaction, the auditor spends time understanding your business: how revenue flows in, where cash goes, who approves payments, and what controls catch errors. If one person handles both billing and bank deposits with no oversight, cash accounts get flagged for more extensive testing. The auditor also reads prior-year statements, reviews industry benchmarks, and runs preliminary analytics. Revenue up 40% with no change in headcount is the kind of anomaly that prompts questions before the numbers are accepted.
At the outset, you and the auditor sign an engagement letter defining scope, responsibilities, timeline, and fees. Read it carefully. If the scope is too narrow, the resulting opinion may not satisfy whoever required the audit.
The Testing Procedures
Testing is where the auditor verifies that the numbers reflect reality. A few standard techniques do most of the work.
Vouching and Tracing
Vouching starts with a ledger entry and works backward to the source document; tracing starts with a source document and follows it forward to the ledger. Vouching tests for overstatement, tracing tests for understatement, and together they cover both directions of potential error.
Bank Reconciliation
The auditor compares each ending bank statement balance to the corresponding cash account in the ledger. Differences should be explainable by outstanding checks, deposits in transit, or unrecorded fees. Unexplained gaps are red flags for unauthorized transactions or recording errors.
Physical Inventory Verification
If you hold inventory, the auditor will observe or perform a count, then compare it to the accounting system. Overstating inventory inflates assets and understates cost of goods sold, which makes profit look better than it is, so this is one of the areas auditors probe hardest.
Sampling
No auditor reviews every transaction. Samples are selected by risk, dollar amount, or randomization, and tested in depth. If errors show up in the sample, the auditor expands the scope to determine whether the problem is isolated or widespread.
Asset Valuation and Depreciation
Auditors verify that equipment, vehicles, and buildings are depreciated using appropriate methods and recovery periods. Under the Modified Accelerated Cost Recovery System, automobiles use a five-year life, office furniture seven years, residential rental property 27.5 years, and commercial buildings 39 years, among others.10Internal Revenue Service. Publication 946, How To Depreciate Property The auditor checks original purchase documentation, confirms the asset exists, and recalculates depreciation.
Internal Controls
Beyond the numbers, the auditor evaluates whether the systems that produce those numbers are designed to prevent and detect errors. Does someone independent review bank reconciliations? Are purchase orders approved before payment? Can one person create a vendor and authorize a payment to that vendor? Control weaknesses do not automatically mean the statements are wrong, but they change how much substantive testing the auditor performs.
The Management Representation Letter
Near the end of the audit, before the opinion is issued, the auditor asks company leadership to sign a written representation letter confirming that they have provided all relevant records, disclosed known liabilities and contingencies, disclosed any known or suspected fraud, and accept responsibility for the financial statements.11PCAOB. AS 2805: Management Representations This is not a formality. If management refuses to sign or carves out significant exceptions, the auditor may be unable to issue an opinion. If material misstatements later surface that management knew about, the letter becomes evidence of that failure.
The Four Possible Opinions
The opinion is the deliverable everyone else relies on, and there are four:
- An unmodified opinion says the financial statements are fairly presented in all material respects under GAAP. This is the clean result every company wants; older references may call it “unqualified.”12AICPA & CIMA. Avoiding Compliance Issues With Auditor Reports
- A qualified opinion says the statements are fair except for a specific, material but not pervasive issue.
- An adverse opinion says the statements are materially misstated and do not fairly represent the company’s financial position.
- A disclaimer of opinion means the auditor could not obtain enough evidence to form any opinion, often because management restricted access or uncertainty was too severe.
Lenders and investors read anything other than an unmodified opinion carefully. A qualified opinion can violate a loan covenant. An adverse opinion or disclaimer can scare off buyers and investors entirely. When the auditor flags issues during fieldwork, correcting the underlying financial statements before the opinion is signed is almost always better than accepting a modified opinion.
Findings and the Final Report
Throughout the audit, the auditor keeps working papers documenting every test, sample, and conclusion. Issues are logged with a description, a financial impact, and whether management corrected them. Findings are categorized by severity. A material weakness means the controls are flawed enough that a material misstatement could occur and go undetected. A significant deficiency is less severe but still reportable. Minor items may be communicated informally. Material weaknesses and significant deficiencies must be communicated in writing to those charged with governance, typically the board or audit committee.
The formal audit report identifies the statements audited, states management’s responsibility for them, describes the auditor’s responsibility, and presents the opinion. If the opinion is anything other than unmodified, the report explains why, and it usually includes recommendations for strengthening controls. For public companies, the audited statements and report are filed with the SEC as part of the annual Form 10-K.13SEC.gov. Form 10-K Annual Report For private companies, it goes to whoever required it. Keep digital and physical copies permanently; future auditors will need them, and so may buyers, lenders, or regulators.
What Happens If the Audit Uncovers Tax Errors
Audits sometimes surface reporting errors with tax consequences. If the IRS later determines that inaccurate records led to an underpayment, the accuracy-related penalty under Section 6662 adds 20% of the underpaid amount to your tax bill. It applies when the underpayment results from negligence, disregard of tax rules, or a substantial understatement of income. For individuals, “substantial understatement” means the amount exceeds the greater of 10% of the tax that should have been reported or $5,000. Gross valuation misstatements carry a 40% penalty.14Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments
If your audit reveals discrepancies between your books and your filed returns, work with your CPA to amend the affected returns before the IRS identifies the problem on its own. Catching and correcting errors is dramatically cheaper than defending them later.