An integrated audit vs. a non-integrated audit comes down to how many opinions the auditor issues and whether internal controls get formally tested. A non-integrated audit produces one opinion on whether the financial statements are fairly presented. An integrated audit produces that same opinion plus a second one on whether the company’s internal control over financial reporting (ICFR) is effective, delivered in a single engagement. Which type you get isn’t usually a choice: federal securities law requires an integrated audit for public companies above specific size thresholds and permits a financial-statement-only audit for everyone else.
What a Non-Integrated Audit Covers
A non-integrated audit is the traditional financial statement engagement. The auditor’s objective is to determine whether the statements are free from material misstatement and fairly presented under the applicable accounting framework, typically U.S. GAAP.
Controls still come into the picture, but only as a planning tool. PCAOB Auditing Standard 2110 requires the auditor to understand the control environment well enough to identify where misstatements could occur and design the right substantive procedures in response.1Public Company Accounting Oversight Board. AS 2110 – Identifying and Assessing Risks of Material Misstatement That understanding shapes the testing plan. It stops short of formally concluding whether controls are operating effectively.
Because there’s no opinion on controls, the engagement leans heavily on substantive testing: tracing transactions to source documents, confirming balances with third parties, recalculating figures directly. Private companies use this model almost universally, and public companies that qualify for an exemption from the ICFR attestation requirement file with only a financial statement audit.
What an Integrated Audit Adds
An integrated audit is a single engagement that produces two distinct opinions. The first is the financial statement opinion. The second is a separate opinion on ICFR effectiveness. PCAOB Auditing Standard 2201 governs how the two objectives interconnect within one engagement.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
The two opinions feed off each other. If the auditor concludes that key controls are working, there’s less risk that errors slip through undetected, and some substantive testing on affected account balances can be scaled back. If control testing reveals problems, direct testing has to ramp up to compensate. That interplay is what makes the audit integrated rather than two parallel engagements stapled together.
Which Companies Must Have an Integrated Audit
The Sarbanes-Oxley Act of 2002 created the integrated audit requirement through Section 404, codified at 15 U.S.C. ยง 7262. Section 404(a) requires every SEC-reporting company to include a management assessment of internal controls in its annual report. Section 404(b) is the provision that triggers the integrated audit: it requires the external auditor to attest to and report on management’s ICFR assessment.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls That attestation can’t be done as a standalone engagement; it must happen alongside the financial statement audit under AS 2201.
Section 404(b) applies to public companies classified as accelerated filers or large accelerated filers. A large accelerated filer has a public float of $700 million or more. An accelerated filer has a public float between $75 million and $700 million.4U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions Both categories undergo integrated audits.
Several categories of public companies are exempt from 404(b), even though they still comply with 404(a)’s management self-assessment:
- Non-accelerated filers, meaning companies with a public float below $75 million, have never been subject to the auditor attestation requirement.5U.S. Securities and Exchange Commission. Smaller Reporting Companies
- Smaller reporting companies with annual revenues below $100 million are excluded from the accelerated filer definitions under 2020 SEC amendments, removing them from the 404(b) requirement even if their public float would otherwise qualify them.6U.S. Securities and Exchange Commission. Final Rule – Accelerated Filer and Large Accelerated Filer Definitions
- Emerging growth companies are carved out by the statute itself. A company keeps EGC status until the earliest of: annual gross revenues exceeding $1.235 billion, issuing more than $1 billion in nonconvertible debt in a three-year period, becoming a large accelerated filer, or reaching the last day of the fiscal year following the fifth anniversary of its IPO.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls
Private companies are outside the SOX regime entirely and never face a mandatory integrated audit, though some choose one voluntarily.
How the Procedures Differ in Practice
The depth of control work is where the two audit types visibly diverge. In a non-integrated audit, the auditor maps the control environment enough to understand where things could go wrong, then designs substantive tests around those risks. Controls aren’t the subject of formal testing beyond what’s needed for risk assessment.
An integrated audit adds a substantial layer on top. The auditor must test controls across every significant financial statement cycle. AS 2201 requires walkthroughs for each major class of transactions, meaning the auditor follows a transaction from start to finish through the company’s systems using the same documents and technology that employees use.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Walkthroughs combine interviews with staff, observation, document inspection, and re-performance of the controls themselves.
Beyond walkthroughs, the auditor samples and tests individual controls for operating effectiveness. Are approvals happening as designed? Do reconciliations catch discrepancies? Is access to the accounting system restricted to authorized personnel? Much of this testing requires IT audit specialists, since so many controls live inside the company’s information systems rather than on paper.
That extra work costs money. Research on ICFR audit requirements has found that the additional control work accounts for roughly 30 percent or more of the variation in total audit fees.7European Financial Management Association. Audit Fee Levels and the Impact of Tighter Regulations on Internal Control Audit Over Financial Reporting Strong control results can reduce the volume of substantive testing on account balances; weak results force the opposite, driving fees higher.
What the Reports Look Like
The deliverable looks quite different depending on the audit type. A non-integrated audit produces a single report with one opinion on whether the financial statements are fairly presented. No conclusion about controls is offered.
An integrated audit produces a combined report with two opinions. One addresses fair presentation of the financial statements. The other addresses ICFR effectiveness and is either unqualified, meaning controls are effective, or adverse, meaning at least one material weakness exists. AS 2201 is explicit on this: if one or more material weaknesses are present, the auditor must issue an adverse ICFR opinion.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements There is no qualified middle ground for ICFR.
A company can receive an adverse ICFR opinion and still get an unqualified opinion on its financial statements. The financial statement opinion reflects whether the numbers are right after all the auditor’s substantive work. The ICFR opinion reflects whether the system producing those numbers is reliable. An adverse ICFR opinion with clean financials essentially tells investors that the numbers happened to be correct this time but the controls aren’t strong enough to ensure they’ll be correct next time. Markets treat that signal seriously, and the company faces immediate pressure to disclose and remediate.
When Companies Choose an Integrated Audit Voluntarily
Private companies and exempt public filers sometimes elect an integrated audit even when they aren’t required to have one. The decision usually tracks one of a few scenarios.
Companies planning an IPO typically begin integrated audit-style procedures two to three years before going public. Waiting until the IPO process forces it creates a compressed timeline, and scrambling to document and test controls under deadline pressure generally costs more than building the process gradually. Companies seeking significant credit facilities or outside investment find that audited financials with an ICFR opinion smooth due diligence and signal financial discipline to lenders and investors.
Companies anticipating a sale benefit similarly. Buyers tend to pay more for businesses with clean, verifiable financials and documented controls because they’re assuming less risk. A seller who can hand over three years of integrated audit reports during an acquisition negotiation is in a different position than one producing reviewed financials for the first time under buyer pressure.
The cost gap is real, and for a company that doesn’t need the ICFR opinion, the expense isn’t trivial. For companies approaching a regulatory threshold or planning a capital event, the integrated audit buys credibility and preparation time that would otherwise be spent reacting to problems under pressure.