An on-site audit is the fieldwork phase of a financial statement audit, when independent examiners come physically into your business to verify what’s on paper against what’s happening in your operations. Expect the visit to last anywhere from a few days at a small company to several weeks at a complex or multi-location organization. How smoothly it goes depends largely on how well you’ve prepared and how tightly your team manages the auditors’ time while they’re on-site.
The work breaks into three parts: preparing before they arrive, hosting the fieldwork itself, and handling the follow-up that leads to the final report and opinion. Each stage carries its own tasks, and missteps at any point can extend the engagement or shape the findings.
How to Prepare Before the Auditors Arrive
Set Up a Workspace and Pick One Point of Contact
Dedicate a secure, private workspace for the visiting team. Reliable Wi-Fi, enough power outlets, access to a printer. A functional space keeps auditors focused and signals that you take the process seriously.
Then name a single point of contact, typically the controller or a senior accounting manager. This is one of the most impactful decisions you’ll make. That person manages all information flow, tracks every request, and ensures the audit team hears one consistent voice from your organization rather than conflicting answers from different departments. Identify in advance which department heads and staff will be interviewed, especially in accounts payable, inventory management, human resources, and IT.
Work Through the Provided-By-Client List Early
Well before the visit, your audit firm will send a Provided-By-Client (PBC) list detailing every document they need. A typical PBC list runs to dozens of items organized by financial statement area: comparative trial balances, bank statements with reconciliations, accounts receivable aging schedules, fixed asset and depreciation summaries, accrued payroll schedules, copies of all grant awards or contracts, and board minutes through the date of fieldwork.
Pre-gather, index, and organize these materials by financial statement line item or control objective so retrieval is immediate once fieldwork starts. Sending a pre-submission package before the visit, including your latest general ledger, trial balance, and preliminary financial statements, lets the team run analytical procedures in advance and tailor their testing plan. Adding board minutes and current tax provisions to that package cuts down significantly on requests during the on-site period.
Document Your Internal Controls
Auditors expect ready access to process narratives, flowcharts, and evidence of review or approval for each key financial process. Prepare these in a dedicated binder or shared folder. Segregation of duties receives particular attention: you need clear documentation showing who initiates, approves, and records transactions, along with organizational charts demonstrating that no single person controls an entire process from start to finish.
Get Your Team On the Document Portal
Most engagements now use a secure digital portal for exchanging documents. These platforms provide role-based access controls, timestamped logs of every upload and download, and read-only links that prevent unauthorized changes. The portal creates a defensible audit trail showing exactly who provided what and when. If your firm uses one, train your team on it before fieldwork so the first day isn’t lost to login problems.
What Auditors Actually Do On-Site
Opening Meeting and Walkthrough
The visit formally begins with an opening meeting involving the audit engagement partner, the senior audit manager, your point of contact, and executive management. The team confirms the planned scope, finalizes the fieldwork schedule, and discusses any significant changes in business operations or accounting policies since the prior year.
Immediately after, the audit team walks through your facilities and key operational areas. For a manufacturing company, watching the production line gives auditors context for inventory valuation and cost accounting. For a service business, observing how client engagements are tracked informs revenue recognition testing. This physical observation directly shapes how the auditors assess your control environment, particularly around physical access restrictions and segregation of duties.
Testing Internal Controls
Auditors spend substantial time evaluating whether your internal controls over financial reporting are both properly designed and actually operating throughout the period under review. They want documented proof: approved purchase orders before payment release, journal entry reviews above certain dollar thresholds, reconciliations signed off on schedule.
When controls testing turns up problems, consequences cascade. A breakdown forces auditors to expand their substantive testing, which means more intrusive procedures, more document requests, and a longer engagement. For public companies, the auditor must communicate all material weaknesses in writing to both management and the audit committee before issuing the report on internal controls.
Substantive Testing of the Numbers
Substantive testing goes directly to the account balances and transaction details, looking for material misstatements. High-risk areas get priority, particularly complex revenue recognition policies that require detailed contract analysis. Auditors will pull samples of large, unusual, or related-party transactions for full documentation review.
Estimates draw intense scrutiny. The allowance for doubtful accounts, inventory obsolescence reserves, and intangible asset valuations all require management judgment, and auditors will challenge the underlying assumptions and methodologies. Expect them to compare your estimates against historical data and industry benchmarks, looking for patterns that suggest bias or unreasonable optimism.
Physical Verification of Inventory and Fixed Assets
Auditors are required to observe your physical inventory count. Under PCAOB standards, the auditor must be present during the count, test the effectiveness of counting procedures, and trace items between the physical location and your inventory records. If your company uses perpetual inventory records with periodic cycle counts rather than a single year-end count, auditors can observe during those cycles instead, but they still need to satisfy themselves that your methods produce results equivalent to a full annual count.1Public Company Accounting Oversight Board. AS 2510 – Auditing Inventories
For fixed assets, the team performs physical inspections of high-value items, matching asset tags to the detailed fixed asset ledger. This confirms that assets haven’t been disposed of without being removed from the books, a problem that directly distorts depreciation expense and balance sheet accuracy.
IT General Controls
Any IT system that handles financial transactions or feeds data into your general ledger is likely in scope. Auditors test three main areas: access controls (who can log in and what they can do), change management (how software updates and configuration changes are approved and tracked), and computer operations (backup procedures, job scheduling, and incident management). For automated controls embedded in your financial systems, such as three-way matching in accounts payable, auditors verify that program changes are properly authorized and that the controls haven’t been altered since they were last tested.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements
If your company relies on cloud-based or third-party platforms for financial processing, auditors will request the vendor’s SOC 1 Type 2 report covering the audit period. When a vendor can’t produce that report, the auditors may need to perform the control testing themselves, adding time and cost. Your team should also be prepared to demonstrate that you’ve implemented the complementary user entity controls recommended in those SOC reports, particularly around user access management.
Fraud Risk Procedures
Auditors must plan and perform the audit to obtain reasonable assurance that your financial statements are free of material misstatement, whether caused by error or fraud.3Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit In practice, they will specifically test for risks arising from management override of internal controls, the area where fraud is hardest to detect through routine testing. Expect them to examine journal entries and other adjustments for evidence of manipulation, review accounting estimates for bias, and evaluate the business rationale for any significant unusual transactions.
Fraud inquiries are woven into the interview process as well. Auditors will ask employees at various levels whether they are aware of any actual or suspected fraud, and they pay close attention to whether answers are consistent across the organization.
Employee Interviews
A significant portion of on-site time goes to interviewing employees outside the accounting department. Auditors want to understand roles from the perspective of the people performing them and confirm that procedures documented on paper are actually being followed. Consistency of responses is a key reliability indicator. When one person describes a three-step approval process and another describes two steps, that discrepancy becomes a thread the auditors will pull.
Your point of contact should coordinate interview scheduling and brief employees beforehand. The briefing doesn’t mean coaching answers; it means explaining the purpose of the interview and emphasizing that honest, direct responses are exactly what’s needed. Auditor questions focus heavily on exceptions: what happens when a transaction doesn’t follow the standard process, who approves it, and how the deviation gets documented.
Daily Check-Ins and Document Handling
During fieldwork, the audit team typically holds daily check-ins with your point of contact. These short meetings cover progress, roadblocks, and outstanding document requests. Transparent communication here prevents end-of-fieldwork surprises and lets your team prioritize urgent requests.
Document handling should follow a formal request log tracking every item the auditors ask for, when it was requested, and when it was provided. Your point of contact should review each response for completeness before handing materials over, and provide only the specific documents requested. Sharing more than what’s asked for creates unnecessary exposure and slows down both sides.
What Happens After the Auditors Leave
Closing Meeting
As fieldwork wraps up, the audit team holds a closing meeting with executive management and your point of contact. The purpose is to summarize preliminary findings, discuss any significant adjustments the auditors are proposing, and identify outstanding items still owed. This meeting gives you an early, informal read on the likely outcome before the formal report is drafted.
Follow-Up Requests
Requests will keep arriving after the auditors leave. Their detailed analysis of fieldwork data often surfaces questions about specific transactions, the need for additional support on complex estimates, or formal confirmations from your legal counsel or banks. Treat these remote requests with the same urgency as those made during the physical visit; delays at this stage hold up the entire report.
The Management Representation Letter
Before the auditors can issue their report, management must sign a formal representation letter. Under PCAOB standards, it should be signed by those members of management with overall responsibility for financial and operating matters, which normally means the chief executive officer and chief financial officer or their equivalents.4Public Company Accounting Oversight Board. AS 2805 – Management Representations The letter confirms that management is responsible for the financial statements and internal controls, that all necessary information has been provided, and it includes specific affirmations such as the absence of undisclosed fraud and the completeness of board meeting minutes. This letter is not optional. Refusing to provide it means no report gets issued.
Draft Report and Management Response
The final phase involves receiving the draft audit report, which includes the audit opinion and any management letter comments identifying internal control deficiencies. Your company gets a short window to review the draft and prepare a formal management response to any findings. After review and acceptance, the audit firm issues the final report.
What the Audit Opinion Can Say
The audit opinion is the end product of everything the team tests and observes. Four outcomes are possible:
- Unqualified (clean) opinion: The financial statements are presented fairly in all material respects. This is the outcome every company wants, and most audits end here.
- Qualified opinion: The financial statements are fairly presented except for a specific identified issue. Lenders and investors may impose stricter terms or require additional due diligence when they see this.
- Adverse opinion: The financial statements are materially misstated and do not present the company’s financial position fairly. Investors may withdraw, lenders may call loans or refuse extensions, and access to capital markets becomes severely restricted.
- Disclaimer of opinion: The auditor was unable to obtain sufficient evidence to form any opinion, often because the company restricted the scope of the audit or records were inadequate.
Separately, the auditor evaluates internal controls and classifies any problems found. A material weakness is a deficiency where there is a reasonable possibility that a material misstatement won’t be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to merit attention by those overseeing financial reporting.5Public Company Accounting Oversight Board. Auditing Standard No. 5 – Appendix A If auditors identify a material weakness, they must issue an adverse opinion on internal controls, and both material weaknesses and significant deficiencies must be communicated in writing to the audit committee.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements
If during fieldwork the auditors identify conditions that raise substantial doubt about your company’s ability to continue operating for a reasonable period, they must evaluate management’s plans. If substantial doubt remains after that evaluation, the audit report will include an explanatory paragraph using the phrase “substantial doubt about its ability to continue as a going concern.”6Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entity’s Ability to Continue as a Going Concern A going concern paragraph doesn’t change the audit opinion itself, but it signals to lenders, investors, and regulators that the company’s survival is uncertain.
What Audit Findings Can Cost You
Tax Penalties
When an audit uncovers tax reporting errors, the IRS can impose an accuracy-related penalty equal to 20% of the underpayment attributable to negligence or a substantial understatement of income tax.7Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments For individuals, a substantial understatement exists when you understate your tax liability by the greater of 10% of the tax required to be shown on the return or $5,000. For corporations other than S corporations, the threshold is the lesser of 10% of the required tax (or $10,000 if greater) and $10,000,000.8Internal Revenue Service. Accuracy-Related Penalty
Debt Covenant Violations
If an audit reveals that your company has breached financial covenants in its loan agreements, consequences can be swift and severe. Lenders may demand immediate repayment, halt additional lending, seize collateral, or initiate legal action. Even when the lender agrees to waive the violation, expect fees for the waiver itself and additional accounting costs to manage the situation. A qualified or adverse audit opinion can independently trigger covenant defaults in many loan agreements, even when the underlying financial ratios are technically met.
For companies receiving government financial assistance, audit scope can also extend to testing compliance with specific federal statutes under Government Auditing Standards.9Public Company Accounting Oversight Board. AS 6110 – Compliance Auditing Considerations in Audits of Recipients of Governmental Financial Assistance A covenant violation discovered during that work can trigger serious downstream consequences with the funding agency.
Criminal Exposure for Public Company Officers
For officers of publicly traded companies, the stakes are highest. Under federal law, a CEO or CFO who knowingly certifies a financial report that doesn’t comply with requirements faces fines up to $1,000,000 and up to 10 years in prison. If the certification is willful, the penalties jump to $5,000,000 in fines and up to 20 years.10Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Companies that fail to comply also risk sanctions and being barred from trading securities publicly. These aren’t theoretical risks. They are the reason the management representation letter carries so much weight and why auditors treat management override of controls as a presumed fraud risk in every engagement.