Audit services are independent professional examinations that give outside parties confidence in the accuracy of an organization’s financial information or the strength of its controls. The category runs from full financial statement audits, where a CPA issues a formal opinion on whether the numbers fairly represent the company’s position, down through reviews, compilations, and preparation engagements that provide less assurance or none at all. It also includes compliance audits tied to specific laws or grants, agreed-upon procedures for narrow questions, and System and Organization Controls (SOC) reports on service providers’ internal controls. Which service you need depends on who is relying on the information and how much assurance those users require.
The Levels of Assurance, from Least to Most
Not every situation calls for a full audit. Picking the right service is mostly a question of what stakeholders will accept.
Preparation of Financial Statements
The simplest service. A CPA helps management put financial data into statement format but provides no assurance whatsoever. No report is issued, and each page of the statements must carry a note stating that no assurance is being provided. The accountant doesn’t even need to be independent of the company.
Compilations
A compilation sits one step up. The CPA organizes management’s financial data into proper statement form and issues a report, but the report explicitly states that no assurance is being provided on whether the statements conform to GAAP. The accountant applies professional expertise to the presentation without verifying the underlying records.
Reviews
A review provides limited assurance. The CPA performs analytical procedures and asks management targeted questions, then issues a report stating whether the accountant became aware of any material modifications that should be made. Many lenders and some grant programs accept reviewed financial statements when a full audit isn’t required.
Agreed-Upon Procedures
In an agreed-upon procedures (AUP) engagement, the CPA performs only the specific tests the client and a designated third party have agreed on in advance. The scope might be as narrow as confirming accounts receivable balances or verifying collateral for a loan. The practitioner reports what was found but expresses no opinion and provides no overall assurance.
Compliance Audits
A compliance audit examines whether an organization is following the requirements of a particular law, regulation, contract, or grant agreement. Unlike an AUP, the auditor issues an opinion on whether the entity complied with the applicable rules.
Financial Statement Audits
The most rigorous service, and what most people mean when they say “audit.” The sections below unpack what the auditor does and what the resulting report means.
What a Financial Statement Audit Produces
An independent auditor examines the income statement, balance sheet, and cash flow statement, along with the records and processes behind those numbers, and forms an opinion on whether the statements are presented fairly in line with the applicable accounting framework, typically GAAP.1Public Company Accounting Oversight Board. PCAOB AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
The standard the auditor works toward is “reasonable assurance,” a high level of confidence but not a guarantee. Auditors use professional judgment, test samples of transactions rather than every single one, and rely in part on the company’s own internal controls. Management can sometimes override those controls in ways that are difficult to detect. That inherent gap is why audit opinions are carefully worded and why users should treat them as strong evidence of reliability rather than ironclad proof.
Materiality
Auditors don’t chase every small error. A misstatement is material if a reasonable investor would view it as significantly changing the picture presented by the financial statements.2Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit Early in the audit, the team sets a dollar threshold based on the company’s earnings and other relevant factors. Errors below that threshold are tracked but generally don’t affect the opinion. Some individual accounts or disclosures may get a lower threshold if smaller errors there could still influence an investor’s judgment.
The Four Possible Opinions
- Unqualified (clean) opinion. The financial statements present the company’s position fairly in all material respects under GAAP. The standard result, and the one every company wants.
- Qualified opinion. The statements are fair except for a specific issue, such as a departure from GAAP whose effect is material but not pervasive enough to invalidate the entire set of statements.1Public Company Accounting Oversight Board. PCAOB AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
- Adverse opinion. The financial statements do not present the company’s position fairly. Rare and damaging, essentially telling investors the numbers cannot be trusted.
- Disclaimer of opinion. The auditor was unable to gather enough evidence to form any opinion, often because of severe scope restrictions imposed by the client.
When the auditor has substantial doubt about whether the company can continue operating for the next year, the report must include an explanatory paragraph flagging that “going concern” risk, even if the opinion itself remains unqualified.3Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entity’s Ability to Continue as a Going Concern A going concern paragraph doesn’t mean the company is doomed, but it signals serious financial distress and typically triggers scrutiny from lenders and investors.
SOC Reports for Service Organizations
System and Organization Controls reports are a separate category of assurance engagement, aimed at technology and outsourcing companies rather than at verifying their own financial statements. They are performed by independent CPAs under attestation standards.
A SOC 1 report focuses on controls relevant to the financial reporting of the service organization’s clients. If your company processes payroll or handles payment transactions for other businesses, their auditors will want to see your SOC 1 report. A SOC 2 report focuses on information security, covering five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Cloud providers, data centers, and SaaS companies are the most common SOC 2 candidates.
Both come in two varieties. A Type I report evaluates whether controls are properly designed as of a specific date. A Type II report tests whether those controls actually worked effectively over a period of time, typically six months or longer, and carries more weight because it demonstrates sustained performance.
Internal Audit vs. External Audit
Internal audits serve a fundamentally different purpose. Internal auditors work for the organization itself, reporting to the audit committee or board of directors rather than to outside investors. Their job is to help the organization manage risk, strengthen governance, and improve the effectiveness of internal controls.
Their scope is typically far broader than financial reporting. An internal audit team might evaluate IT security controls one quarter, investigate a suspected fraud the next, and review a supply chain process after that. Many midsize organizations don’t maintain a full-time internal audit staff and instead fully outsource the function to an outside firm or co-source, supplementing an in-house team with outside professionals during busy periods. One limitation worth knowing: a company’s external auditor cannot also provide internal audit outsourcing services to that same company, because that would compromise independence.
Who Is Required to Get an Audit
Many organizations get audited not because they want to but because a law, regulator, lender, or contract demands it.
Public Companies
Every company that files reports with the SEC must include audited financial statements in its annual Form 10-K.4SEC.gov. Financial Reporting Manual – Topic 1 Large accelerated and accelerated filers must submit the 10-K within 75 days of fiscal year-end; non-accelerated filers get 90 days. Missing those deadlines triggers a notification filing requirement with a short grace period of 15 calendar days for the 10-K, and chronic lateness can lead to SEC enforcement, loss of eligibility to use short-form registration statements, and stock exchange scrutiny that may threaten the company’s listing.
Under Section 404 of the Sarbanes-Oxley Act, public companies must also include a management report assessing the effectiveness of their internal controls over financial reporting. For larger filers, the external auditor must separately attest to and report on that assessment, making the audit significantly more extensive and expensive.5SEC.gov. Sarbanes-Oxley Disclosure Requirements
Employee Benefit Plans
Under ERISA, the administrator of an employee benefit plan must engage an independent accountant to audit the plan’s financial statements, and that opinion becomes part of the plan’s annual report filed on Form 5500.6Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports Department of Labor regulations tie this to participant count. Plans with 100 or more eligible participants at the beginning of the plan year generally must file as a “large plan” with audited financial statements. An 80-to-120 transition rule lets plans that previously filed as small plans continue doing so until participant count exceeds 120.
Recipients of Federal Funding
Any non-federal entity that spends $1,000,000 or more in federal awards during its fiscal year must undergo a Single Audit under the Uniform Guidance (2 CFR Part 200).7eCFR. 2 CFR 200.501 – Audit Requirements This threshold was raised from $750,000 effective for fiscal years beginning on or after October 1, 2024, so the $1,000,000 figure applies to most organizations reporting in 2026. Entities below the threshold are exempt but must still keep records available for review by federal agencies.
Private Companies and Nonprofits
Private companies have no blanket legal requirement to be audited, but they frequently face audit demands from lenders, investors, or regulators. Bank loan covenants commonly require annual audited financial statements, and many states mandate audits for nonprofits whose annual revenue exceeds a certain threshold, though those thresholds vary widely. Even without a mandate, a voluntary audit can strengthen credibility with donors, grantmakers, and potential acquirers.
What Audit Services Cost
Fees vary enormously with size and complexity. A small private company or nonprofit can expect to pay roughly $12,000 to $50,000 for a standard financial statement audit, with the lower end applying to straightforward single-entity businesses and the upper end to organizations with multiple locations, complex transactions, or industry-specific accounting requirements. For public companies, the numbers are dramatically higher. The average audit fee across publicly traded U.S. companies has recently hovered around $2.4 million, with S&P 500 companies paying roughly $10.8 million on average, driven largely by the additional Sarbanes-Oxley internal controls work.
The main factors that push fees higher include multiple subsidiaries or international operations, high transaction volume, weak internal controls that force more testing, and industry complexity in areas like financial services or construction. First-year audits also tend to cost more because the firm is learning the client’s systems from scratch.
Review engagements typically cost roughly half of what a full audit runs, making them a practical alternative when stakeholders will accept limited assurance. Compilations and preparation engagements cost still less. If you’re facing an audit requirement for the first time, getting your records organized and your internal controls documented before the auditor arrives is the single most effective way to keep fees down. Auditors bill for time, and disorganized records generate more of it.
How an Audit Runs
A financial statement audit follows a structured sequence. The firm first evaluates whether it can accept the engagement, checking for independence conflicts and confirming the team has the right industry expertise. Both sides sign an engagement letter spelling out scope, timing, fees, and responsibilities. The auditor then builds an understanding of the business and designs an audit plan around where material misstatements are most likely to occur.
Fieldwork is the most labor-intensive phase. The team runs tests of controls to verify that the company’s internal controls actually operated effectively during the period, and substantive procedures that look directly for misstatements by examining transactions, confirming balances with third parties, inspecting assets, and performing analytical comparisons. Sampling drives most of this work; sample sizes are larger in higher-risk areas and smaller where controls have already tested well.
At the end, the team aggregates every misstatement found, both corrected and uncorrected, and evaluates whether the statements as a whole are materially misstated. Management provides a formal representation letter confirming the completeness and accuracy of what it provided. The auditor then issues the report. Public company reports follow PCAOB standards; private company reports follow AICPA standards.
Why Independence Matters
The entire value of an audit rests on the auditor being genuinely independent. If users suspect the auditor has a financial stake in the client’s success or is beholden to management, the opinion is worthless. Independence is impaired if the auditor or any covered member of the firm holds a direct financial interest in the client, such as owning stock, or if firm personnel serve as officers, directors, or employees of the client, and the rules extend to close family members.8Public Company Accounting Oversight Board. ET Section 101 – Independence
For public company audits, Sarbanes-Oxley also prohibits the audit firm from simultaneously providing certain non-audit services to the same client, including bookkeeping, financial information systems design, appraisal or valuation services, actuarial services, internal audit outsourcing, and management or human resources functions.9SEC.gov. Commission Adopts Rules Strengthening Auditor Independence Any permissible non-audit services must be pre-approved by the client’s audit committee. The lead audit partner on a public company engagement must rotate off the account every five years.
Two bodies oversee audit quality in the United States. The PCAOB, created by Sarbanes-Oxley, has authority over audits of SEC registrants and sets its own auditing standards, conducts inspections, and can impose sanctions for deficient work.10Public Company Accounting Oversight Board. PCAOB Posts Report Detailing Significant Improvements Across Largest Firms, Alongside Inspection Results in Record Time The AICPA’s Auditing Standards Board sets the standards for audits of private companies and nonprofits. Both are sometimes loosely called “GAAS,” but they are distinct bodies of standards, and auditors must follow the set that applies to their client.
What a Bad Opinion Costs the Company
A modified audit opinion is not an accounting technicality. Many commercial loan agreements contain covenants requiring the borrower to deliver audited financial statements with a clean opinion each year. A qualified or adverse opinion can trigger a technical default even if the company is current on its payments. Research on the lending market has found that companies receiving modified opinions face higher interest rates on subsequent loans, smaller loan sizes, more restrictive covenants, and a greater likelihood of being required to post collateral. The impact is most severe for going concern opinions, where borrowing costs can increase by more than a full percentage point.
For public companies, the stakes climb higher. Failing to file audited financial statements on time can draw SEC comment letters, enforcement actions, and loss of eligibility to use streamlined securities registration forms. Stock exchanges may issue compliance warnings, and if the situation isn’t resolved, the company risks delisting. Announcements of late filings have been associated with immediate stock price drops. The audit opinion is a gatekeeper to capital markets, lending relationships, and regulatory good standing, and that is why organizations invest the money to get it right.