To conduct an audit, you move a financial statement engagement through three phases: planning, fieldwork, and reporting. Planning defines what will be examined, how deeply, and against which standards. Fieldwork is the hands-on testing of records, transactions, and controls. Reporting turns that work into a formal opinion on whether the statements are reliable. Legal requirements shift depending on whether the entity is publicly traded, privately held, or a nonprofit receiving federal funds, and skipping a required step can invalidate the whole engagement.
Plan the Scope and Set Materiality
Every audit starts by drawing boundaries. Identify which financial statements or internal controls need examination, the fiscal period under review, and the risk profile of the entity’s industry. A technology startup burning through cash raises different concerns than a stable manufacturer with predictable revenue. Those decisions drive staffing, testing procedures, and the length of the engagement.
Write down formal objectives. Common ones include confirming that reported assets exist, that all liabilities are recorded, and that revenue was recognized in the correct period. Without defined objectives, an audit sprawls into an open-ended investigation that misses high-risk areas and burns time on low-risk ones.
Then set materiality. Materiality is the dollar threshold below which an error is unlikely to change a reasonable investor’s decision. Auditors typically anchor the threshold to a key financial metric. For a profitable company, the starting point is often 5 to 10 percent of pre-tax income. When earnings are volatile, a percentage of total revenue or total assets can work better. These are judgment calls, and the threshold you pick shapes every testing decision that follows.
For a public company, the plan has to build in specific procedures the statute requires. Each audit of a publicly traded company must include steps designed to detect illegal activity that could materially affect the financial statements, identify related-party transactions that require disclosure, and evaluate whether serious doubt exists about the company’s ability to continue operating through the next fiscal year.1Office of the Law Revision Counsel. 15 USC 78j-1 Audit Requirements These are not optional add-ons.
Pick the Standards That Apply to the Entity
The rulebook depends on the client. Getting this wrong at the planning stage means the whole engagement can end up out of compliance.
Private company audits in the United States follow Generally Accepted Auditing Standards, which set baseline requirements for planning, fieldwork, and reporting so that audits look consistent across firms and industries.
Public company audits sit under a separate regime. The Sarbanes-Oxley Act of 2002 created the Public Company Accounting Oversight Board and directed it to set auditing standards for registered firms that audit publicly traded companies.2PCAOB. Auditing Standards PCAOB standards overlap heavily with GAAS but add public-company-specific requirements, including the integrated audit of internal controls under Section 404. Management must include a report in the annual filing taking responsibility for internal controls over financial reporting and assessing their effectiveness at year-end, and the external auditor must independently evaluate and report on that assessment.3Office of the Law Revision Counsel. 15 USC 7262 Management Assessment of Internal Controls The attestation follows a top-down, risk-based approach under PCAOB Auditing Standard AS 2201: start with the financial statements and work backward to the controls most likely to prevent or catch a material error.4PCAOB. AS 2201 An Audit of Internal Control Over Financial Reporting
A separate framework kicks in for federal award recipients. Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a single audit or a program-specific audit.5eCFR. 2 CFR Part 200 Subpart F Audit Requirements That covers state and local governments, nonprofits, and universities receiving federal grants or pass-through funding. The single audit combines a financial statement audit with additional testing of compliance with federal program requirements. Entities that spend below the $1,000,000 threshold are exempt from federal audit requirements, though records must remain available for review by the relevant federal agency or the Government Accountability Office.
Request the Documents and Evidence
Preparation starts with a document request list, sometimes called a PBC (provided by client) list, that catalogs every item the audit team needs. The list acts as the central tracking tool: staff log when each document arrives, who provided it, and whether it is complete. Missing records push the entire engagement behind schedule, so experienced teams send the PBC list well before fieldwork begins.
The foundation documents are the general ledger, trial balance, and bank statements with reconciliations, which let the auditor verify reported cash balances against independent bank records. Most entities export this data directly from their accounting software to preserve integrity. Payroll records, including quarterly tax filings and wage summaries, support labor-expense testing; federal law requires employers to retain payroll records for at least three years.6U.S. Department of Labor. Fact Sheet 21 Recordkeeping Requirements Under the Fair Labor Standards Act FLSA Physical invoices, purchase orders, and contracts provide the transaction-level evidence for fieldwork.
When the entity outsources meaningful functions like payroll processing or cloud-based financial systems, ask for Service Organization Control reports from those vendors. If the entity cannot produce them, the audit team may need extra procedures to fill the gap in control evidence.
Do the Fieldwork
Fieldwork is where the audit moves from planning into verification. The core technique is dual-directional testing. Vouching starts with an entry in the accounting records and traces it back to an original source document, like a vendor invoice, to confirm the entry is real. Tracing runs the other way: it starts from a source document and follows it forward into the accounting system to confirm it was recorded. Together, the two tests catch both fabricated entries and legitimate transactions that were left out.
Authorization testing checks whether the people who approved transactions actually had the authority to do so. A purchase order carrying a signature that does not match the internal approval hierarchy is a control failure worth investigating, regardless of whether the underlying transaction was legitimate.
Recalculation catches errors that look right on the surface. Independently recompute depreciation schedules, interest accruals, and tax provisions to see whether the entity’s software produced correct outputs. It is mechanical work, but it regularly turns up discrepancies, especially in organizations that have not updated their depreciation methods or tax rates.
Sampling and Expanding Tests
Reviewing every transaction is impractical for most organizations. Sampling lets you test a representative subset and draw conclusions about the whole population. Sample size depends on the assessed risk level and the strength of internal controls. Weak controls or a high-risk industry means a larger sample. If the initial sample turns up errors, expand the testing pool to gauge how widespread the problem is. This is where audits balloon in scope and cost, so companies with clean internal controls tend to have shorter, cheaper engagements.
Physical Inspection and Interviews
Tangible assets need physical verification. Count warehouse inventory and compare the results to records. Inspect equipment to confirm it exists and appears operational. For real estate, review title documentation or visit the property.
Interview staff at different levels to learn how transactions actually flow through the organization, not how the procedure manual says they should. Those conversations often surface informal workarounds that bypass intended controls. Interview notes and observation results go into the working papers, which serve as the primary evidence supporting every conclusion in the final report.
Handle Problems the Audit Surfaces
Most audits turn up some errors. The question is always whether they are material.
When you detect information suggesting an illegal act may have occurred, the law imposes a specific escalation sequence. First, determine whether the act likely happened and assess its potential financial impact, including fines, penalties, and damages. Then inform senior management and the audit committee as soon as practicable. If management does not take appropriate corrective action, and the failure is serious enough to affect the audit report or warrant resignation, report directly to the board of directors. The board has one business day to notify the SEC. If it fails to do so, the auditor must resign and deliver its own report to the SEC within one business day of that resignation.1Office of the Law Revision Counsel. 15 USC 78j-1 Audit Requirements
When the audit discovers a material error in previously issued financial statements, the company has to correct it and notify investors promptly. A serious error triggers a full restatement of prior-period statements, sometimes called a “Big R” restatement, and the company must file a Form 8-K disclosing that the earlier statements should no longer be relied upon.7U.S. Securities and Exchange Commission. Assessing Materiality Focusing on the Reasonable Investor When Evaluating Errors A less severe error that is immaterial to the prior period but material to the current one can be corrected through a revision of the comparative statements in the current filing.
For public companies, every audit has to evaluate whether the entity can keep operating through the next fiscal year.1Office of the Law Revision Counsel. 15 USC 78j-1 Audit Requirements Warning signs include recurring losses, negative cash flow, loan defaults, and pending litigation that could drain resources. If substantial doubt exists, the audit report must include a going concern paragraph. That disclosure does not mean the company will fail, but it is a formal warning to anyone relying on the statements.
Issue the Report and the Opinion
The report is the end product of the engagement. It contains the auditor’s opinion on whether the financial statements present a fair picture of the entity’s financial position. The opinion falls into one of four categories.
- Unmodified, or clean: the financial statements are presented fairly in all material respects. This is the outcome every entity wants and the result of most audits.
- Qualified: the statements are generally fair, but a specific issue is material without being pervasive. The auditor describes the exception in the report.
- Adverse: the misstatements are both material and pervasive. The statements as a whole cannot be relied upon. An adverse opinion can trigger regulatory action, loan covenant violations, and loss of investor confidence.
- Disclaimer of opinion: the auditor could not obtain enough evidence to form any opinion, and undetected errors could be both material and pervasive. A disclaimer often signals missing records, management obstruction, or a breakdown in the accounting system.
Alongside the opinion, most engagements produce a management letter that identifies control weaknesses and recommends improvements. For private companies, this letter is not a public document, but it usually drives remediation for the following year. A closing meeting with leadership lets management respond to findings and ask questions before the report is finalized.
Meet the Filing Deadline and Keep the Workpapers
Public companies face firm deadlines for filing audited annual reports with the SEC, and the timeline depends on size. Large accelerated filers must submit their 10-K within 60 days of fiscal year-end. Accelerated filers get 75 days. All other filers, including smaller reporting companies, have 90 days.8SEC.gov. Financial Reporting Manual Topic 1 Missing these deadlines can result in SEC enforcement action and, for exchange-listed companies, potential delisting.
Entities subject to the single audit requirement must complete the audit and submit the reporting package to the Federal Audit Clearinghouse within 30 days after receipt of the auditor’s report, or nine months after the end of the audit period, whichever comes first. Private companies without SEC or federal-funding obligations follow whatever timeline their lenders, investors, or governing board requires. Good practice is to complete the audit within 90 to 120 days of year-end, while records are fresh and the staff who handled the transactions are still available.
The signed audit opinion marks the formal conclusion. From that point, the auditor’s working papers become the permanent record of how the team reached its conclusions, and professional standards require retaining them for a minimum period, typically seven years for public company audits. For the entity, the real work often begins after the report is issued: addressing the control deficiencies the auditor identified and preparing for next year with cleaner records and stronger processes.