How to Conduct a Financial Audit: Scope, Fieldwork, and Reporting

Conducting a financial audit means running an independent examination of an organization’s financial statements to determine whether they fairly represent its financial position. The work follows four phases: assembling documentation, planning the scope and setting materiality, performing field testing, and issuing a formal opinion. Public companies above certain thresholds are required by federal securities law to complete this process annually, but private companies, nonprofits, and government entities also go through it to satisfy lenders, investors, grantors, or their own boards. What follows is how the process actually runs, and what each phase demands.

Confirm Whether an Audit Is Required

The rules governing the engagement depend on why the audit is happening. That determination should come first, because a Single Audit and a private-company lender audit are not the same product.

Public Companies

Any company with equity securities listed on a national exchange must register under Section 12(b) of the Securities Exchange Act. Non-listed companies with total assets above $10 million and equity securities held by at least 2,000 people (or 500 or more non-accredited investors) must register under Section 12(g).¹ Registered companies file annual reports with audited financial statements, and federal law requires those audits to follow generally accepted auditing standards, include procedures designed to detect illegal acts, identify related-party transactions, and evaluate whether the company can continue operating for at least another year.²

Federal Grant Recipients

Nonprofits, state agencies, and local governments spending $1 million or more in federal awards during a fiscal year must undergo a Single Audit under the Uniform Guidance. That threshold rose from $750,000 for audit periods beginning on or after October 1, 2024.³ A Single Audit extends beyond standard financial statement testing. The auditor must also determine compliance with federal statutes, regulations, and the specific terms of each major grant program, and must report material weaknesses in internal controls over those programs.⁴

Private Companies and Other Entities

Private companies have no blanket federal audit requirement, but the practical pressures are constant. Banks often require audited statements before extending large credit facilities. Private equity investors, potential acquirers, and bond covenants frequently impose audit requirements. Many states require audits for insurance companies, other regulated industries, and larger charitable organizations above specific revenue thresholds.

Engage an Independent Auditor

An audit opinion is only useful if the auditor has no financial stake in the outcome. Independence rules exist for that reason, and violating them can invalidate the engagement.

Prohibited Services

Under rules implementing Title II of the Sarbanes-Oxley Act, a CPA firm auditing a public company cannot also provide that company with nine categories of non-audit services: bookkeeping, financial information systems design, appraisal or valuation services, actuarial services, internal audit outsourcing, management or human resources functions, broker-dealer or investment banking services, legal services, and expert witness services unrelated to the audit.⁵ An auditor cannot objectively evaluate work their own firm performed. Any non-audit service not on the prohibited list still requires advance approval from the company’s audit committee.

Partner Rotation

Lead audit partners and engagement quality reviewers cannot serve the same public company client for more than five consecutive years, and after reaching that limit they must step away for five full years. Other audit partners on the engagement have a seven-year limit with a two-year cooling-off period.⁶

Prepare Documentation and Records

What the organization has ready before field work starts shapes the whole engagement. Disorganized records raise questions about internal controls, which pushes the auditor toward more extensive and more expensive testing.

The core documents are the balance sheet, income statement, cash flow statement, and general ledger of every transaction recorded during the period. Auditors also request a trial balance to confirm total debits equal total credits before detailed testing begins. Supporting evidence rounds out the picture: bank statements, receipts, vendor invoices, customer contracts, and payroll records. Prior-year tax returns provide historical context and help the auditor spot unusual year-over-year changes.

These records should be organized into structured workpapers grouped by account type. Each lead schedule ties a specific account to its opening balance, period activity, and ending balance, with reference numbers connecting back to source documents. The schedules must reconcile to the trial balance so any number in the financial statements can be traced to its origin. Getting this right upfront prevents weeks of back-and-forth during field work.

Payroll records deserve extra attention. The auditor will verify tax withholdings, benefit deductions, and whether each employee receiving a paycheck actually exists. Clean folders for vendor invoices and customer contracts simplify verification of accounts payable and receivable. Every dollar on the income statement needs a corresponding source document. Organizations using accounting software should be ready to export data in whatever format the audit firm’s analytical tools require.

Plan the Scope and Set Materiality

Before any testing begins, the audit team fixes the boundaries of the engagement. Planning drives where the auditor spends the most time and which accounts receive the lightest touch.

Setting Materiality

Materiality is the dollar threshold below which an error is unlikely to change an investor’s decision. The SEC has noted that a common rule of thumb treats misstatements below 5% as immaterial absent egregious circumstances, while acknowledging that authoritative bodies have issued guidelines ranging from 1% to 10% depending on the disclosure type.⁷ Most auditors set overall materiality between 1% and 5% of revenue or pre-tax income, then set a lower “performance materiality” to catch accumulations of smaller errors that could collectively become material. The number isn’t published in the financial statements, but it drives every decision about how much testing to perform.

Risk Assessment

The auditor identifies which accounts and processes are most likely to contain misstatements. Under PCAOB standards, risk assessment procedures include understanding the company and its industry, evaluating internal controls, reviewing information from prior audits, performing preliminary analytical procedures, and holding team discussions about where the risks of material misstatement are highest.⁸ High-volume transaction areas, complex revenue recognition arrangements, and accounts involving significant management estimates typically receive the most scrutiny. Stable, predictable cost categories get less.

Risk assessment also shapes the balance between two testing approaches. When a company has strong internal controls and the auditor can verify they’re working, fewer individual transactions need testing. When controls are weak or untested, the auditor compensates with heavier substantive testing of the underlying transactions.

Execute the Field Work

Field work is where planning becomes evidence gathering. The goal is to collect enough proof to support a professional opinion on whether the financial statements are materially correct.

Substantive Testing of Transactions

Substantive tests come in two forms: tests of details and analytical procedures. Tests of details examine individual transactions and balances. The three core techniques are vouching, tracing, and confirmation.

Vouching starts with a number already recorded in the books and works backward to the source document. If the ledger shows a $50,000 equipment purchase, the auditor pulls the invoice, purchase order, and receiving report to confirm the transaction happened and was recorded at the right amount. Tracing goes the opposite direction. The auditor picks up a source document like a shipping receipt and follows it forward through the journal entries into the financial statements, looking for transactions that occurred but never got recorded.

Confirmation bypasses the company’s records entirely. The auditor sends requests directly to banks, customers, or vendors asking them to verify account balances, outstanding loans, or receivable amounts. Direct communication is one of the most powerful tools available because it eliminates the possibility that the company’s own records have been manipulated. For inventory, the auditor is ordinarily present during the physical count to observe the counting methods, run test counts, and compare quantities to what the balance sheet reports.⁹

Auditors don’t check every transaction. They use statistical sampling to select a representative group and test those in depth. If that sample reveals errors, the testing expands.

Analytical Procedures

Analytical procedures compare financial data against expectations to flag accounts that look unusual. The auditor might compare this year’s gross margin to last year’s, benchmark salary expense against headcount, or model expected interest expense based on average debt balances and prevailing rates. When actual numbers deviate significantly from the model, the auditor investigates. These procedures sometimes catch problems that would never surface from testing individual transactions. Comparing total payroll expense to employee headcount can reveal unauthorized payments that no amount of invoice-level testing would detect.¹⁰

IT General Controls

Modern financial statements flow through accounting software, ERP systems, and automated processes. If those systems can be tampered with, the data they produce is unreliable. Auditors test IT general controls to evaluate the integrity of the technology underlying financial reporting. The key areas include controls over program changes (ensuring unauthorized code modifications can’t alter financial calculations), access controls (limiting who can view or edit financial data), and computer operations (verifying that batch jobs, backups, and processing routines run as intended).¹¹ Weak IT controls undermine every other audit procedure, because if the data feeding the financial statements can be altered without detection, sampling and confirmation work means little.

Going Concern Evaluation

Every audit of a public company must include an evaluation of whether there is substantial doubt about the organization’s ability to keep operating for at least another year.² The auditor examines cash flow projections, debt maturities, recurring losses, and any other indicators the company might not survive. If substantial doubt exists, the auditor must say so in the report. A going concern disclosure can trigger loan covenant violations, drive away customers, and drop a company’s stock price. Organizations approaching financial distress should expect this evaluation to be thorough and be ready to present realistic plans for addressing the underlying problems.

Fraud-Related Procedures

Auditors investigate large or unusual transactions, particularly those near the end of the fiscal year. Late entries sometimes serve to inflate revenue or shift expenses into the next period. Payroll testing confirms that employees receiving wages actually exist, preventing the creation of fictitious employees used to siphon funds. The auditor also reviews legal expenses and pending litigation to identify contingent liabilities that should be disclosed.

Issue the Audit Report

The audit report is the deliverable stakeholders actually see. Everything before it leads to a professional opinion on whether the financial statements can be trusted.

Types of Audit Opinions

The opinion takes one of four forms:

Unqualified opinion. The financial statements present fairly, in all material respects, the company’s financial position and results of operations in conformity with GAAP. This is the clean bill of health.
Qualified opinion. The statements are fairly presented except for a specific issue the auditor identified. The qualification describes that issue, but the rest of the statements are considered reliable.¹²
Adverse opinion. The statements do not present fairly the company’s financial position. This finding typically triggers immediate legal scrutiny and can destroy investor confidence.¹²
Disclaimer of opinion. The auditor cannot express an opinion because they were unable to gather sufficient evidence. This often happens when documentation is missing or the company restricted access to certain records.¹²

For public companies, the auditor’s report must also disclose critical audit matters: the issues that required the most significant auditor judgment or involved the most complex areas of the financial statements. These disclosures give investors a window into where the audit team spent its hardest effort.

Management Representation Letter

Before issuing the report, the auditor obtains a written representation letter signed by management. The letter confirms that management has provided all relevant financial records, disclosed all known or suspected fraud, and acknowledged its responsibility for the design and operation of internal controls. It doesn’t replace audit evidence, but it documents management’s formal commitments and reduces the chance of misunderstanding about what information was shared.¹³

Audit Committee Communications

The auditor delivers findings not just in a formal report but through direct communications with the company’s audit committee or board. These communications must cover the overall audit strategy, significant risks identified during field work, critical accounting estimates, significant unusual transactions, and any disagreements with management.¹⁴ The auditor also delivers a management letter recommending improvements to internal controls and accounting procedures. That letter often contains the most operationally useful information from the entire engagement, and organizations that ignore it tend to see the same findings repeated year after year.

Meet Post-Audit Obligations

Record Retention

Workpapers don’t disappear once the report is issued. Federal regulations require accounting firms to retain all records relevant to an audit of a public company for seven years after the engagement concludes. The requirement covers workpapers, correspondence, memoranda, and any documents containing conclusions, opinions, analyses, or financial data connected to the audit, including records of consultations and resolutions of professional disagreements within the audit team.¹⁵ Destroying, altering, or falsifying these records is a federal crime carrying up to 20 years in prison.¹⁶

Internal Control Reporting Under SOX 404

Public companies must include a management report in their annual filing that assesses the effectiveness of internal controls over financial reporting. Management must identify the framework it used, state whether controls are effective, and disclose any material weaknesses. If material weaknesses exist, management cannot conclude that internal controls are effective.¹⁷

Companies classified as accelerated filers (generally those with a public float of $75 million or more) must also have their auditor independently attest to management’s internal control assessment. Smaller reporting companies with revenues below $100 million and a public float under $250 million are exempt from this auditor attestation requirement, though they still must include management’s own assessment.¹⁸

Consequences When Fraud Surfaces

When an audit uncovers evidence of fraud, the consequences reach well beyond a bad opinion letter. Federal criminal statutes target both the fraud itself and any attempt to cover it up.

Corporate officers who knowingly certify financial statements that don’t comply with SEC requirements face up to $1 million in fines and 10 years in prison. If the false certification is willful, penalties rise to $5 million and 20 years.¹⁹ Broader fraud schemes involving mail or wire communications carry penalties of up to 20 years imprisonment, rising to 30 years if the fraud affects a financial institution.²⁰ Anyone who destroys or falsifies records to obstruct a federal investigation faces up to 20 years as well.¹⁶

Auditors have a statutory obligation to report detected illegal acts. If the auditor identifies conduct that could have a material effect on the financial statements, they must inform management and the audit committee. If the company fails to take appropriate remedial action, the auditor must report directly to the SEC.²

1
Office of the Law Revision Counsel. 15 U.S. Code 78l – Registration Requirements for Securities
2
Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
3
U.S. Department of Health and Human Services Office of Inspector General. Single Audits FAQs
4
eCFR. 2 CFR Part 200, Subpart F – Audit Requirements
5
U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence
6
eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
7
U.S. Securities and Exchange Commission. SEC Staff Accounting Bulletin No. 99 – Materiality
8
PCAOB. AS 2110 – Identifying and Assessing Risks of Material Misstatement
9
PCAOB. AS 2510 – Auditing Inventories
10
PCAOB. AS 2305 – Substantive Analytical Procedures
11
PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting
12
PCAOB. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
13
PCAOB. AS 2805 – Management Representations
14
PCAOB. Audit Focus – Audit Committee Communications
15
eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records
16
Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records
17
U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting
18
U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions
19
Office of the Law Revision Counsel. 18 U.S. Code 1350 – Failure of Corporate Officers to Certify Financial Reports
20
Office of the Law Revision Counsel. 18 U.S. Code 1341 – Frauds and Swindles