US GAAS and US GAAP answer two different questions in the same financial reporting process: Generally Accepted Accounting Principles tell a company how to build its financial statements, and Generally Accepted Auditing Standards tell an independent auditor how to check whether those statements are reliable. One governs the preparer, the other governs the inspector. Confusing them leads to misplaced blame when a company’s reported numbers turn out to be wrong.
What GAAP Does
GAAP is the standardized set of rules a company applies when it records transactions and prepares financial reports. The point is comparability. If two companies in the same industry sell the same product, their statements should look similar enough that an investor can meaningfully compare them side by side. GAAP narrows the range of acceptable accounting methods so the numbers mean something to outsiders.
At its core, GAAP requires accrual-basis accounting. A company records revenue when it earns the revenue and records expenses when it incurs them, not when cash moves. A consulting firm that finishes a project in December but gets paid in February still books the revenue in December. That single rule trips up most business owners who are used to watching cash in and cash out.
From there, GAAP covers how to value inventory (companies can pick FIFO or LIFO, but they have to apply the choice consistently), how to depreciate long-lived assets, how to recognize lease obligations, and what has to appear in the footnotes. The output is a set of four primary financial statements: the balance sheet, the income statement, the statement of cash flows, and the statement of shareholders’ equity. These are the documents investors and lenders actually read.
The authoritative source is the FASB Accounting Standards Codification, the single official source of GAAP for non-governmental entities in the United States.1Financial Accounting Standards Board. FASB Standards The Codification organizes every rule into numbered topics, so an accountant looking up revenue from a long-term contract goes to the relevant topic rather than searching through decades of individual pronouncements. The Financial Accounting Standards Board, a private independent organization, issues new Accounting Standards Updates that fold into the Codification; the SEC has designated the FASB as the standard-setter for financial accounting, which is why its pronouncements carry authority.
What GAAS Does
GAAS is the quality standard that governs an independent auditor’s work when examining a company’s financial statements. It does not care how the statements were put together. It cares about how thoroughly and competently the auditor checked them. The end product of a GAAS-compliant audit is a professional opinion on whether the statements are materially accurate.
GAAS is organized into three categories. The General Standards require the auditor to have adequate technical training, maintain independence from the client in both fact and appearance, and exercise due professional care. The Standards of Fieldwork cover the mechanics of the engagement: planning the audit, understanding the company’s internal controls, and gathering enough evidence to support a conclusion. The Standards of Reporting dictate the form and content of the final opinion, including whether the statements comply with GAAP.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
In practice, that means testing samples of transactions, confirming balances directly with banks and customers, observing physical inventory counts, and evaluating whether the company’s accounting judgments were reasonable. The auditor also obtains a written representation letter in which management acknowledges responsibility for the fair presentation of the statements and confirms its belief that those statements comply with GAAP.3Public Company Accounting Oversight Board. AS 2805 Management Representations That letter matters because it puts management’s assurances in writing, giving the auditor something concrete to point to if the statements later turn out to be fraudulent.
Running through all of GAAS is the idea of professional skepticism. Auditors are not supposed to assume management is lying, but they are not supposed to assume management is telling the truth either. Every piece of evidence gets a questioning eye, especially when the stakes are high or the accounting involves significant judgment.
Auditing standards in the United States are split between two bodies depending on whether the audited company is public or private. For public company audits, the Public Company Accounting Oversight Board sets the rules. The PCAOB was created by the Sarbanes-Oxley Act of 2002 specifically to oversee auditors of public companies after the Enron and WorldCom scandals exposed how badly self-regulation had failed.4Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 For audits of private companies, the AICPA’s Auditing Standards Board issues Statements on Auditing Standards.5Association of International Certified Professional Accountants. AICPA Statements on Auditing Standards – Currently Effective A CPA firm that audits both kinds of clients ends up following two different sets of auditing standards depending on the engagement. They overlap heavily, but they are not identical, and the consequences for violating them come from different regulators.
Who Has to Follow Each One
Every company that files financial statements with the Securities and Exchange Commission must prepare them under GAAP. The SEC’s reporting manual states that financial statements not prepared under GAAP are “presumed to be inaccurate or misleading.”6U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 Private companies are not legally required to use GAAP, but most do anyway because lenders, investors, and contract counterparties demand GAAP-compliant financials as a condition of doing business.
GAAS applies to the auditors, not to the companies themselves. Public companies are required by federal securities law to have their annual financial statements audited by an independent firm registered with the PCAOB. Private companies are not federally required to have audits, though many do because bank loan covenants, state licensing rules, or ownership agreements call for audited financials. When a private company does get an audit, the auditor works under the AICPA’s Statements on Auditing Standards rather than PCAOB standards.
Why the Distinction Matters
The split between GAAP and GAAS shows up most clearly when something goes wrong. If a company’s financial statements contain errors, that is a GAAP failure by the company’s own accounting team. If the auditor missed those errors because they did not do enough testing or ignored red flags, that is a GAAS failure by the audit firm. Both can exist in the same engagement, and in major accounting scandals they usually do.
The enforcement mechanisms follow the same split. A public company that issues materially misstated financial statements faces SEC enforcement action and potential private litigation. The SEC can seek civil penalties, disgorgement of profits, injunctions against future violations, and bars preventing individual officers from serving as directors of public companies. Federal securities law also exposes companies to investor lawsuits under Section 10(b) of the Securities Exchange Act and Rule 10b-5, which make it unlawful to make an untrue statement of a material fact in connection with the purchase or sale of a security. When misstatements come to light, the company typically has to restate its prior financials, an expensive process that often triggers a stock price decline, credit rating downgrades, and a long rebuild of investor confidence.
Auditors who fail to follow auditing standards face a different set of consequences. The PCAOB can censure registered firms, impose civil money penalties, bar individual auditors from association with any registered firm, and require remedial actions like additional training or quality control reforms.7Public Company Accounting Oversight Board. Enforcement Actions The PCAOB also conducts routine inspections of registered firms and publishes the deficiencies it finds, which creates reputational pressure independent of formal enforcement. The SEC can additionally bar auditors from practicing before the Commission, effectively ending their ability to audit public companies. For auditors of private companies, state boards of accountancy can suspend or revoke CPA licenses, and malpractice lawsuits from harmed clients or third parties fill the gap.
Where the Two Frameworks Meet
GAAP and GAAS are not parallel systems that happen to share a universe. They are structurally dependent. Every GAAS audit uses GAAP as its benchmark; the auditor’s opinion explicitly states whether the financial statements conform to GAAP. Without GAAP, the auditor would have no criteria to measure the statements against. Without GAAS, the financial statements would be unverified management assertions with no independent stamp of reliability.
That dependency means changes to one framework ripple into the other. When the FASB issues a new revenue recognition standard, auditors have to update their testing procedures to evaluate whether clients are applying the new rules correctly. When the PCAOB tightens its requirements around auditor skepticism or critical audit matters, companies may need to provide more documentation to satisfy the expanded procedures. The two frameworks evolve on separate tracks under separate regulators, but they are always pulling each other forward.