How to Write an Audit Report: Required Sections and Opinions

To write an audit report, you deliver the auditor’s opinion on the financial statements in a fixed structure set by the professional standards that govern your engagement, with every statement in the report traceable to evidence in your working papers. The document is short on flourish and long on discipline: a title that signals independence, an opinion stated up front, a basis for that opinion, a clear division of responsibilities between management and the auditor, and a dated signature. What varies is which standards apply, what opinion the evidence supports, and how you write up individual findings.

Start by Identifying Which Standards Apply

The framework governs the wording, the required sections, and even the title of the report, so settle this before you draft.

Private companies (nonissuers) fall under the AICPA’s Statements on Auditing Standards, specifically the AU-C 700 series on opinion formation and reporting.¹
Public companies (issuers) fall under PCAOB standards, chiefly AS 3101, which prescribes the form and content of the auditor’s report.²
Government entities and federal funding recipients follow the GAO’s Government Auditing Standards, known as the Yellow Book. The 2024 revision takes effect for financial audits of periods beginning on or after December 15, 2025.³⁴

These frameworks overlap heavily but differ on specific reporting elements. A public company report requires Critical Audit Matters; a private company report does not. Knowing the framework up front prevents restructuring after you’ve drafted.

The Required Sections, in Order

Audit reports follow a rigid structure so readers can locate what they need quickly. The exact wording differs slightly between AICPA and PCAOB frameworks, but the skeleton is the same.

Title

The title signals independence. PCAOB AS 3101 requires the specific title “Report of Independent Registered Public Accounting Firm” for public company audits.² AICPA reports use “Independent Auditor’s Report.” The word “Independent” is not optional; it tells the reader the person signing has no financial interest in the outcome.

Addressee

The addressee identifies who commissioned or will receive the report. For public companies, that is the shareholders and the board of directors. For private entities, it is usually the board, the owners, or a specific governance body. This line defines whom the auditor owes a professional duty to, so get it right.

Opinion

The opinion comes first in the body of the report under both frameworks. The reader should not have to dig through methodology to learn whether the financial statements are fairly presented. Name the entity, list every financial statement audited, state the period covered, then state your conclusion in plain terms.

Basis for Opinion

Immediately after the opinion, this section explains the foundation for it. State that the audit was conducted under the applicable standards, confirm your independence, and affirm that the evidence obtained was sufficient to support the opinion. When the opinion is anything other than unmodified, this section carries the explanation for the modification.

Responsibilities of Management and the Auditor

Two separate sections lay out who is responsible for what. Management is accountable for preparing the statements, maintaining internal controls, and evaluating whether the entity can continue as a going concern. The auditor’s job is to obtain reasonable assurance that the statements are free from material misstatement and to express an opinion based on that work. These sections exist to prevent a common misunderstanding: the audit opinion provides reasonable, not absolute, assurance.¹

Signature, Location, and Date

The report closes with the firm’s signature, the city and state where the auditor practices, and the report date. The date is the last day you performed procedures and marks the general cutoff for your responsibility to detect new information. Events between that date and issuance may still require disclosure.

Choosing the Right Opinion

Every audit report builds toward a single judgment. Which of the four opinions you issue drives how lenders, investors, and regulators read everything else.

Unmodified (or unqualified): the financial statements are fairly presented in all material respects. This is the cleanest opinion and the one most stakeholders expect. Issue it when your audit found no material misstatements and you had no scope limitations.
Qualified: the statements are fairly presented except for a specific issue. Use this when a misstatement is material but not pervasive, or when you could not obtain sufficient evidence for one area while everything else checks out.
Adverse: the statements are materially misstated, and the misstatements are both material and pervasive. This is the most severe opinion and signals that the statements should not be relied upon. It is uncommon because most entities correct material misstatements rather than accept it.
Disclaimer: you cannot form an opinion at all, usually because management restricted access or the scope limitations were so severe that no meaningful conclusion was possible. A disclaimer is a formal statement that you lack the evidence needed to opine, not a casual “no opinion.”

Anything other than an unmodified opinion raises serious concerns about the entity’s ability to secure financing. Lenders and investors treat these as warning signs, and they can trigger loan covenant violations or regulatory scrutiny.

A note on the threshold behind the opinion: materiality is what separates misstatements worth reporting from those too small to influence a reasonable reader. Quantitative benchmarks are a starting point, but the SEC has made clear that numbers alone are not enough. A misstatement below a percentage threshold can still be material if it masks a trend, turns a loss into a profit, or involves self-dealing by senior management.⁵ Set your threshold in planning, revisit it as fieldwork develops the picture, and let it decide what makes the report.

How to Write Up Individual Findings

When your audit uncovers problems, each finding needs its own structured write-up. The standard framework across financial, compliance, and performance audits breaks a finding into five elements. Skip any of them and the finding weakens.

Condition. A factual, neutral description of what you found, with no interpretation yet. Example: “The accounts payable balance included $340,000 in duplicate payments to three vendors during the fiscal year.”
Criteria. The rule, regulation, internal policy, or contractual requirement that should have been followed. Identifying the standard lets the reader see exactly where the entity fell short. For a federal tax audit, this might reference specific provisions of the Internal Revenue Code.
Cause. The reason the deviation happened: a system configuration error, a missing supervisory review, a policy that was never communicated to staff. This is where your interviews and process walkthroughs earn their keep. Diagnosing the root cause is what separates a useful finding from one that documents a symptom.
Effect. The measurable impact, quantified where possible. A dollar figure, a count of affected transactions, or a regulatory penalty exposure gives the reader a concrete sense of scale. If income was underreported, the effect covers both the tax underpayment and the accuracy-related penalties in play.
Recommendation. A specific, actionable fix. Vague language like “improve internal controls” helps no one. “Implement automated three-way matching for all purchase orders above $500 and assign a supervisor to review monthly exception reports” gives management something to act on.

Write each finding so a reader who skips every other section can still understand the problem, why it matters, and what to do. Findings that require flipping back for context are findings that get ignored.

Additional Requirements for Public Company Audits

If the engagement is a public company audit under PCAOB standards, two elements go beyond the private company framework.

Critical Audit Matters

PCAOB AS 3101 requires auditors to communicate Critical Audit Matters in the report. A CAM is any matter that was communicated to the audit committee, relates to accounts or disclosures material to the financial statements, and involved especially challenging, subjective, or complex auditor judgment.² For each CAM, the report must identify the matter, explain why it was determined to be a CAM, and describe how the audit addressed it. Common examples include revenue recognition for complex contract structures, goodwill impairment assessments, and fair value measurements involving significant estimates. If your audit identified no CAMs, the report must state that explicitly.

Not every public company audit requires CAM disclosure. Exemptions apply to audits of brokers and dealers reporting under certain SEC rules, registered investment companies other than business development companies, employee stock purchase and savings plans, and emerging growth companies.²

Internal Control Over Financial Reporting

Public company auditors also typically report on the effectiveness of internal control over financial reporting, either in the same document or as a companion report. This is a separate opinion from the financial statement opinion. You can issue an unqualified opinion on the financials and still identify a material weakness in internal controls. Both opinions go to the shareholders and the board of directors.²

Before You Sign: Exit Conference and Quality Review

A draft report is not a final report. Two steps sit between the write-up and issuance.

The exit conference is a meeting with management to walk through your findings before anything is finalized. Leadership reviews the results, corrects any factual errors, and provides context you may not have captured during fieldwork. It also produces a formal management response, typically included in the final report alongside each finding, describing what the organization plans to do, who is responsible, and by when. The conference is not a negotiation over whether findings stay or go. If your evidence supports a finding and it exceeds materiality, it belongs in the report. Management’s perspective on cause and their planned corrective action still improves the document.

Quality review comes next. Before the report is signed, a concurring partner or senior professional outside the engagement team checks that the evidence in the working papers actually supports the conclusions, that the correct professional standards were applied, and that the opinion is appropriate given the findings. This step catches errors the engagement team can miss after weeks in the same data.

Once the review clears, the engagement partner signs. For public company audits, the PCAOB requires the signature of the registered public accounting firm. Digital signatures are legally valid when they meet standard requirements for intent, attribution, and an accessible record. Reports lose relevance the longer they sit after fieldwork ends; many organizations target issuance within 30 days, and for public companies, SEC filing deadlines override any internal timeline.

Retention After Issuance

Your obligations do not end when the report goes out. Under Sarbanes-Oxley, audit and review documents, including working papers and materials forming the basis of your conclusions, must be retained for at least five years from the end of the fiscal period in which the audit was completed. Destroying these records prematurely can carry criminal penalties. Even where SOX does not apply directly, professional standards and state licensing boards impose their own retention rules. The safer practice is to keep all working papers, correspondence, and the signed report for at least seven years, in a format that remains accessible and accurately reproduces the original. A working paper you cannot open in five years is one you effectively threw away.

1
AICPA & CIMA. AICPA SASs – Currently Effective
2
PCAOB. AS 3101: The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
3
U.S. Government Accountability Office. Yellow Book: Government Auditing Standards
4
Government Accountability Office. Government Auditing Standards 2024 Revision
5
U.S. Securities and Exchange Commission. Staff Accounting Bulletin No. 99 – Materiality