An audit readiness assessment form is a self-diagnostic checklist you complete before an external audit begins, flagging gaps in your financial records, internal controls, and regulatory documentation while you still have time to fix them. There is no single standardized version — accounting firms, audit-management platforms, and industry associations each publish their own — but the sections are consistent enough that once you have worked through one, you know what any of them will ask. Fill it in honestly, resolve what you can, and disclose what you can’t. Every item you clear on the assessment is one fewer surprise during fieldwork.
Where to Get the Form
If your external auditor hasn’t already sent one, check three places. Many CPA firms post downloadable readiness checklists on their websites. Audit-management software platforms bundle them into onboarding workflows. Industry associations — particularly in healthcare, financial services, and government contracting — maintain sector-specific versions that fold in the compliance requirements unique to that field.
Whichever version you use, expect a companion document from your auditor called a PBC list, short for “prepared by client,” roughly 30 to 60 days before fieldwork. The PBC list spells out every file, report, and schedule the audit team needs. Completing the readiness assessment first makes responding to that list much easier, because you’ll have already located most of the requested items or discovered you’re missing them.
Entity and Organizational Information
The opening section captures the basics: legal name, principal address, tax identification number, fiscal year-end, and the nature of the business. These fields have to match what appears on your articles of incorporation, state registration, and IRS filings exactly. A mismatch between the name on the form and the name on your tax return creates an unnecessary problem on day one.
You’ll also be asked about ownership structure — sole proprietorship, partnership, LLC, S-corp, or C-corp — and about any subsidiaries or related parties. Include a current organizational chart showing reporting lines and the names of key officers. If your business holds industry-specific licenses or permits, pull them and confirm they are current. Expired licenses are a common finding that auditors flag in management letters, even when the underlying operations are fully compliant.
Financial Statements and the General Ledger
This section carries most of the weight. You need a complete trial balance, year-end balance sheet, income statement, and cash flow statement for the period under review, plus the prior-year comparatives. Every figure should tie back to the general ledger without unexplained differences. If a number on the balance sheet doesn’t reconcile to its supporting schedule, stop and fix it before moving on. Auditors treat unexplained variances as a signal that the books may not be reliable.
The form will ask you to confirm that specific account groups are reconciled: bank accounts, accounts receivable, accounts payable, inventory, and intercompany balances if you have related entities. For each, keep a signed reconciliation showing the ledger balance, the supporting detail, and any reconciling items with explanations. Intercompany accounts deserve special attention. Unreconciled intercompany balances are one of the most frequently cited material weaknesses in audit reports.
Fixed Assets
Attach a fixed-asset register listing every capitalized item — description, acquisition date, cost, depreciation method, accumulated depreciation, and net book value. The register has to reconcile to the fixed-asset totals in your general ledger. If your organization acquired or disposed of significant assets during the period, keep the supporting invoices or sale documents on hand.
Auditors also look for evidence that someone physically verified the assets exist. Note the date of the last physical inventory of fixed assets, who performed it, and what discrepancies were found. Organizations that skip physical verification often discover during fieldwork that they are still depreciating equipment that was scrapped years ago.
Internal Controls and Segregation of Duties
The internal-controls section asks you to describe the safeguards your organization uses to prevent errors and fraud in financial reporting. At the core is segregation of duties: no single person should control an entire transaction from authorization through recording to custody of the resulting asset. Auditors typically look for these incompatible pairs:
- The person who deposits cash receipts should not also reconcile the bank statement.
- Whoever approves a disbursement should not also sign the check or initiate the wire.
- The employee receiving customer payments should not have authority to approve write-offs of outstanding balances.
- The person who enters hours or salary changes should not also authorize the payroll run.
For each control, the form typically asks who performs the function, how often, and what documentation is produced. If your organization is too small to fully segregate duties, describe the compensating controls, such as owner review of bank statements or an outside accountant reconciling key accounts monthly.
SOX Section 404 for Public Companies
If your organization is publicly traded, Sarbanes-Oxley Act Section 404 adds a formal layer. Section 404(a) requires management to include in the annual report an assessment of the effectiveness of internal controls over financial reporting. Section 404(b) requires the company’s registered public accounting firm to attest to that assessment. Non-accelerated filers — generally smaller reporting companies with a public float below $75 million — are exempt from the Section 404(b) auditor-attestation requirement, though they still must complete the management assessment under 404(a).1U.S. Securities and Exchange Commission. Smaller Reporting Companies Private companies are not subject to SOX, though many adopt similar frameworks voluntarily to satisfy lenders or investors.
IT General Controls
The accounting system is only as trustworthy as the technology running it, so the form will ask about user access management: who has access to financial applications, whether access levels match job responsibilities, and how often you review those permissions. A user access review at least once a year is the baseline expectation, covering employees, contractors, and any third-party vendors with system access.
Be ready to document change-management procedures for financial software (who can modify reports or configurations and how changes are approved), backup and disaster-recovery protocols, and any penetration testing or vulnerability assessments performed during the period. If you have not conducted a formal access review in the past twelve months, that gap will almost certainly appear as a finding.
Compliance and Regulatory Documentation
Gather copies of filed federal and state income tax returns, payroll tax returns, and sales tax filings for the period under review. Section 6001 of the Internal Revenue Code requires every person liable for tax to keep records sufficient to show whether or not they are liable and to support the amounts reported on their returns.2Office of the Law Revision Counsel. 26 USC 6001 – Notice or Regulations Requiring Records, Statements, and Special Returns An auditor should be able to trace any line item on the return back to the underlying records without asking you to reconstruct it.
The form also asks about non-financial compliance: employee handbooks and personnel policies, written IT security policies, workplace safety programs, and any industry-specific certifications or licenses. For each, note the date of the most recent update and whether any regulatory reviews, disputes, or incidents occurred during the period. If your business experienced a data breach, a tax dispute, or a safety citation, fill in that field honestly. Auditors will discover it anyway, and undisclosed issues erode trust fast.
Record Retention Periods to Check Against
One of the more practical sections asks whether your organization meets minimum record-retention periods. Falling short can trigger penalties from multiple agencies on top of the audit issue. The major federal requirements:
- General tax records: at least three years after filing the return. If you failed to report more than 25 percent of gross income, the IRS can look back six years. If you filed a fraudulent return or never filed at all, there is no time limit.3Internal Revenue Service. How Long Should I Keep Records?
- Employment tax records: at least four years after the date the tax becomes due or is paid, whichever is later.3Internal Revenue Service. How Long Should I Keep Records?
- Payroll records under the FLSA: at least three years for payroll records, collective bargaining agreements, and sales and purchase records.4U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
- OSHA injury and illness logs: five years following the end of the calendar year the records cover. The OSHA 300 Log must be updated during that period to reflect newly discovered injuries or reclassifications.5Occupational Safety and Health Administration. 1904.33 – Retention and Updating
- Property and fixed-asset records: keep until the statute of limitations expires for the tax year in which you dispose of the asset, because the records are needed to calculate depreciation and gain or loss on sale.3Internal Revenue Service. How Long Should I Keep Records?
Check off each category on the form and note where the records are stored, whether that’s a physical file room, cloud storage, or an accounting system archive. If you find that records have been purged too early, document the gap and raise it with your auditor before fieldwork rather than letting them find it on their own.
Findings to Fix Before You Submit
The point of the assessment is to catch problems before the auditor does. A few come up repeatedly and are worth checking against even if your form doesn’t ask about them explicitly:
- Intercompany accounts where balances between related entities don’t agree on both sides. Auditors cannot confirm consistent recording, and this is one of the most common paths to a material weakness finding.
- Sales staff modifying contract terms — unauthorized discounts, changed delivery dates, altered payment schedules — without accounting’s knowledge, which can distort revenue timing and amounts.
- Inadequate segregation of duties combined with missing reconciliations. Either alone may be a significant deficiency; together they can add up to a material weakness, even without a large individual error.
- Stale user access in financial systems: former employees or role-changed staff who still have elevated access to accounting software.
If your assessment uncovers any of these, address them before fieldwork begins. A remediated weakness is disclosed differently, and received far more favorably, than one the auditor discovers unresolved.
What’s at Stake
For public companies, the stakes are statutory. Section 13(b)(2) of the Securities Exchange Act of 1934 requires issuers to maintain books and records that accurately reflect their transactions and internal accounting controls sufficient to ensure transactions are authorized, recorded, and reconciled.6U.S. Securities and Exchange Commission. Recordkeeping and Internal Controls Provisions Falling short can prompt SEC enforcement.
On the tax side, if poor records lead to an understatement of tax liability, Section 6662 of the Internal Revenue Code imposes an accuracy-related penalty equal to 20 percent of the underpayment attributable to negligence or disregard of rules.7Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments Negligence under this section includes any failure to make a reasonable attempt to comply with the tax code, and an inability to produce supporting records fits that description.
Even for private companies outside SEC rules, a qualified audit opinion or a disclosed material weakness can carry real financial consequences. Loan covenants frequently require borrowers to deliver clean audited financial statements. A qualification or adverse finding may constitute a covenant violation, potentially allowing the lender to reclassify long-term debt as currently due or accelerate repayment.
Submitting the Completed Form
Once every section is filled in, review the form for internal consistency. Dollar amounts should tie across sections: the total assets on your entity-information page should match the balance sheet figures in the financial-statement section, for example. Flag any items you marked as incomplete or unavailable, with a brief note explaining why and when you expect to resolve them. An honest “not yet available, expected by [date]” is far more useful to the auditor than a vague checkmark.
Most firms accept the completed assessment through a secure client portal. Upload the form along with the supporting documents referenced in each section — reconciliations, policies, tax returns — organized by section number or topic so the reviewer doesn’t have to hunt. If a hard copy is required, use a delivery method that provides confirmation of receipt. Keep a copy of everything you submit, including timestamps or tracking numbers.
After submission, the audit team reviews the assessment for completeness and identifies any supplemental items needed. Ask your auditor for an expected turnaround date when you submit, so you don’t spend the next two weeks wondering. The assessment feeds directly into the PBC list and the audit plan, and the more thorough your self-evaluation, the shorter and smoother fieldwork tends to be.