How to Do an Audit Report: Standards, Sections, and Opinion

To produce an audit report, you identify which standards govern the engagement, gather sufficient and appropriate evidence, confirm your independence, draft the report’s required sections in the prescribed order, select the opinion that matches your findings, then sign, date, deliver, and retain the file. That is the whole arc of how to do an audit report, and each step below explains what the step requires and where public and private company work diverges.

Pick the Governing Standards First

Two frameworks operate in the United States, and they produce meaningfully different reports. Public companies and broker-dealers follow the auditing standards issued by the Public Company Accounting Oversight Board (PCAOB), with AS 3101 governing the auditor’s report when expressing an unqualified opinion. Private companies, nonprofits, and governmental entities follow the AICPA’s Clarified Statements on Auditing Standards. Statement on Auditing Standards (SAS) No. 134 reshaped the private-company report format, replacing AU-C Sections 700, 705, and 706 and moving the opinion paragraph to the top of the report.¹ Mixing the two frameworks can invalidate the report. Confirm which set applies before drafting anything.

Build the Evidence File

You cannot draft a defensible report without a body of evidence sufficient to support the opinion you plan to issue. Start with the complete financial statements: balance sheet, income statement, statement of cash flows, and notes. Add internal control documentation showing how the company prevents errors and fraud on its own. Obtain a management representation letter confirming in writing that the company has disclosed all relevant financial data, related-party transactions, and unrecorded items.²

External verification fills in the rest. Contact banks, vendors, and customers directly to confirm account balances. AU-C Section 500 and the corresponding PCAOB standards require evidence that is both sufficient in quantity and appropriate in quality. Sampling lets you test thousands of transactions without reviewing every entry. Inventory observations and physical asset inspections prove the items on the balance sheet actually exist. Any significant variance between physical evidence and the general ledger must be investigated and resolved before you move into drafting. Most audit failures trace back to a discrepancy that seemed small and went unchased.

Confirm Your Independence Before You Start

An audit report is worthless if the auditor is not independent, and independence rules can disqualify you before the engagement begins. For public company work, SEC Regulation S-X, Rule 2-01, sets the standard: a reasonable investor who knew all the facts would have to conclude the auditor can exercise objective and impartial judgment. An auditor cannot hold any direct financial interest in the client, and several non-audit services are outright prohibited, including management functions, human resources consulting, legal services, and investment banking services. Bookkeeping and financial information systems design are conditionally prohibited, permitted only if the results will not be subject to audit procedures during the engagement.³

Private company auditors follow the AICPA Code of Professional Conduct, which similarly requires independence in both fact and appearance. The report must include a statement confirming independence, and the basis for opinion section references compliance with the applicable ethical requirements. If independence is compromised at any point during the engagement, you cannot issue a valid report.

Draft the Required Sections in Order

The report follows a rigid structure. Under both SAS 134 and PCAOB AS 3101, the opinion now sits near the top so readers get the conclusion immediately.⁴

Title, Addressee, and Scope

The title must identify the report as the work of an independent auditor. The addressee is typically the board of directors or shareholders. Name the entity audited and specify the exact dates or periods the financial statements cover.¹

Opinion and Basis for Opinion

State whether the financial statements are presented fairly in all material respects in accordance with the applicable financial reporting framework. Directly below the opinion, the basis for opinion section explains the rationale, confirms independence, and identifies the specific auditing standards followed during the engagement.¹

Responsibilities of Management and the Auditor

Describe management’s responsibility for preparing the financial statements and maintaining internal controls. Then describe the auditor’s responsibility: the scope of work performed and the objective of obtaining reasonable assurance that the records are free from material misstatement, whether caused by error or fraud. Reasonable assurance is not a guarantee. It means enough work was done that a material error would likely have been caught, not that perfection is promised.¹

Other Information

When the report accompanies a larger document such as an annual report, include an Other Information section addressing the non-audited narrative portions. Flag any material inconsistencies between the audited financials and the other content management has published. You do not opine on this information, but you cannot ignore it either.

Handle the Going Concern Question

Evaluate whether the company can stay in business. Under PCAOB AS 2415, you must assess whether there is substantial doubt about the entity’s ability to continue as a going concern for a reasonable period, meaning up to one year beyond the date of the financial statements.⁵ Warning signs include recurring operating losses, negative cash flows, loan defaults, loss of a principal customer or supplier, and pending litigation that could jeopardize operations. When these conditions exist, ask management what it plans to do and assess whether those plans are realistic. If substantial doubt remains, the report must include an explanatory paragraph immediately after the opinion paragraph disclosing the concern. The going concern paragraph does not change the opinion itself, but it can trigger covenant violations on existing loans and make raising new capital difficult.

Add Critical Audit Matters for Public Companies

Public company reports must include a section titled Critical Audit Matters (CAMs) under PCAOB AS 3101. A CAM is any matter communicated to the audit committee that relates to accounts or disclosures material to the financial statements and that involved especially challenging, subjective, or complex auditor judgment.

For each CAM, the report must include four elements:

Identification: a clear label for the matter.
Principal considerations: why the matter required especially difficult judgment, tailored to the specific circumstances rather than boilerplate.
Audit response: how you addressed the matter, including relevant procedures and key observations.
Financial statement reference: which accounts or disclosures relate to the CAM.

Introductory language for the section must state that communicating CAMs does not alter the overall opinion and does not constitute a separate opinion on the individual matters. Factors that help identify a CAM include the auditor’s risk assessment, the degree of management estimation involved, the nature of any unusual transactions, and the extent of specialized skill needed to evaluate the area. Private company reports do not include a CAM section.

Add the Internal Control Opinion if SOX 404(b) Applies

For public companies, Sarbanes-Oxley Section 404(a) requires management to include an internal control report in the annual filing, assessing the effectiveness of its own controls over financial reporting. Section 404(b) then requires the auditor to attest to and report on that management assessment.⁶ The audit of internal controls can be combined with or issued separately from the financial statement audit report, but it must include the opinion on whether internal controls are effective, the city and state where the report was issued, and the report date.⁷ Private companies are not subject to Section 404(b), one of the main practical differences between public and private audits.

Select the Opinion

The opinion is the heart of the report. Choosing correctly means mapping your findings against two dimensions: materiality and pervasiveness.

Unqualified (unmodified) opinion: the financial statements are presented fairly in all material respects. This is the standard outcome when no significant issues surface.⁴
Qualified opinion: misstatements are material but not pervasive. The error is confined to a specific area, and the rest of the statements are reliable. The opinion typically uses “except for” language to isolate the problem.
Adverse opinion: misstatements are both material and pervasive, affecting the financial statements as a whole. Readers should understand the records are fundamentally unreliable.
Disclaimer of opinion: you could not obtain enough evidence to form any conclusion. This happens when a company restricts access to records or critical data is missing.

Materiality is typically calculated as a percentage of a benchmark such as total assets, revenue, or pre-tax income. No single formula is mandated, but common ranges run from one to five percent of pre-tax income depending on the entity’s size and circumstances. Pervasiveness is a more subjective call: does the error stay in one account, or does it ripple across the statements and make the overall picture misleading? A six-figure error confined to inventory can be clearly material but warrant a qualified rather than an adverse opinion. Separating the two dimensions correctly is what keeps the opinion defensible.

Sign, Date, and Deliver the Report

Sign the report with the firm’s name. For public companies, the electronic signature must comply with SEC Regulation S-T. The report must include the city and state from which it was issued.⁴

The report date carries real legal weight. It must correspond to the date you completed sufficient procedures to support the opinion. After that date, you are generally not responsible for discovering new information, though certain subsequent events between the balance sheet date and the report date must still be evaluated. Under PCAOB AS 2801, perform procedures near the report date to identify events requiring adjustment or disclosure, including reading the latest interim financial statements and inquiring about new litigation, claims, or unusual transactions.⁸

Public companies file the audit report as part of the annual 10-K through the SEC’s EDGAR system.⁹ The auditor must also file Form AP with the PCAOB, disclosing the name of the engagement partner and a unique 10-digit Partner ID.¹⁰ Private entities typically deliver the report directly to the board of directors or the audit committee, often with a formal presentation explaining the findings and any internal control weaknesses discovered. The signed document serves as the legal record of the audit’s completion and results.

Retain the File for Seven Years

The audit does not end at delivery. For public company audits, PCAOB AS 1215 requires that workpapers, memoranda, correspondence, and any other records forming the basis of the audit be kept for seven years after the report release date.¹¹ The SEC’s retention rule under Regulation S-X Section 2-06 independently requires the same seven-year period for records containing conclusions, opinions, analyses, or financial data related to the engagement.¹² If no report was ultimately issued, the clock still runs for seven years from the date fieldwork was substantially completed.

The penalties are severe. Under 18 U.S.C. § 1520, created by Section 802 of Sarbanes-Oxley, knowingly and willfully failing to maintain audit workpapers carries a maximum sentence of ten years in prison, a fine, or both.¹³ The related obstruction statute, 18 U.S.C. § 1519, carries up to twenty years for knowingly destroying any record with intent to obstruct a federal investigation. Keep both digital and physical archives of the signed report, workpapers, and supporting correspondence for the full retention period.

1
AICPA & CIMA. AICPA Statement on Auditing Standards No. 134
2
PCAOB. AS 2805 Management Representations
3
eCFR. 17 CFR 210.2-01 Qualifications of Accountants
4
PCAOB. AS 3101 The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
5
PCAOB. AS 2415 Consideration of an Entity’s Ability to Continue as a Going Concern
6
U.S. Securities and Exchange Commission. Sarbanes-Oxley Disclosure Requirements
7
U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 4 – Independent Accountants’ Involvement
8
PCAOB. AS 2801 Subsequent Events
9
U.S. Securities and Exchange Commission. Submit Filings
10
PCAOB. Form AP – Auditor Reporting of Certain Audit Participants
11
PCAOB. AS 1215 Audit Documentation
12
U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews – Final Rule
13
Office of the Law Revision Counsel. 18 U.S. Code 1520 – Destruction of Corporate Audit Records