The generally accepted auditing standards, known as GAAS, are ten standards issued by the American Institute of Certified Public Accountants that govern how an independent auditor examines the financial statements of a non-public company in the United States. They fall into three groups: three general standards about the auditor’s qualifications, three fieldwork standards about how the audit is performed, and four reporting standards about how the auditor communicates the results.1Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards Every modern piece of AICPA audit guidance, codified in the AU-C sections, traces back to these ten principles.
The AICPA’s Auditing Standards Board writes and updates these standards through Statements on Auditing Standards.2AICPA & CIMA. AICPA Auditing Standards Board If you have heard about auditing standards from the Public Company Accounting Oversight Board, those are a separate framework for audits of public companies and broker-dealers under Sarbanes-Oxley.3Public Company Accounting Oversight Board. Auditing Standards When someone says “GAAS” without qualification, they almost always mean the AICPA standards for non-public audits.
The Three General Standards
The general standards describe who is qualified to run an audit. A good audit plan is worthless if the person executing it lacks the training or objectivity to carry it out.
Technical Training and Proficiency
The audit must be performed by someone with adequate training and experience as an auditor. In practice that means a thorough understanding of the financial reporting framework the client uses (usually GAAP), knowledge of the client’s industry, and command of audit procedures themselves. Proficiency is built through formal education, hands-on engagement experience, and continuing professional education. Most state boards of accountancy require CPAs to complete between 24 and 40 hours of continuing education each year, with a portion specifically devoted to accounting and auditing topics.
Independence
The auditor must maintain an independent mental attitude throughout the engagement. Independence has two dimensions. Independence in fact means the auditor is genuinely objective when forming conclusions. Independence in appearance means a reasonable outside observer would see no relationship or circumstance that could compromise that objectivity. Both matter, because even a truly objective auditor undermines public confidence if the relationship looks compromised.
AICPA rules identify specific situations that impair independence, including any direct financial interest in the client, making investment decisions on the client’s behalf, or having custody of client assets.4AICPA & CIMA. Independence and Conflicts of Interest An immediate family member in a key management role at the client also creates an independence problem.5Public Company Accounting Oversight Board. ET Section 101 – Independence
Due Professional Care
Due professional care means exercising the skill and diligence that a competent auditor would bring to the same engagement, from client acceptance through signing the report. The practical engine behind it is professional skepticism: a questioning mind that challenges what management says even when prior audits went smoothly. The auditor is expected to evaluate whether audit evidence is consistent and reliable, and not to dismiss contradictory information because it is inconvenient. Most audit failures trace back to this standard. Not a lack of technical skill, but a willingness to accept comfortable explanations at face value.
The Three Fieldwork Standards
The fieldwork standards govern what happens once the auditor begins examining the records. They set up a risk-based approach in which planning drives everything that follows.
Adequate Planning and Supervision
The audit must be adequately planned and any assistants properly supervised. Planning begins with an overall audit strategy and a detailed audit plan, built around risk assessment: identifying where material misstatements are most likely to appear, whether from error or from fraud. SAS No. 145, effective for audits of calendar year 2023 and after, expanded those risk assessment requirements, asking auditors to look more carefully at the entity’s business environment and the inherent risks tied to specific account balances and transaction types.6AICPA & CIMA. Inherent Risk and SAS No 145 – New Concepts and Requirements
Risk assessment then dictates the nature, timing, and extent of later procedures. A company with weak controls over cash receipts gets more testing in that area than one with robust, well-monitored processes. Supervision requires that assistants on the engagement team receive proper instruction, that their work is reviewed, and that significant questions are resolved before the report is issued.
Understanding Internal Control
The auditor must gain enough knowledge of the entity’s internal controls to plan the audit and decide what testing is needed. Internal controls are the processes management puts in place to produce reliable financial reporting, run operations effectively, and comply with laws. The auditor is not required to test every control, but must understand the control environment well enough to see where errors or fraud could slip through.
When the auditor identifies control weaknesses during this work, the standards require written communication to management and those charged with governance. A significant deficiency is a weakness important enough to warrant attention from the board or audit committee. A material weakness is more severe: a gap where there is a reasonable possibility that a material misstatement would not be prevented or caught and corrected in time. Material weaknesses must be reported in writing.
Sufficient Appropriate Audit Evidence
The auditor must gather enough relevant evidence through inspection, observation, inquiries, and confirmations to support the opinion. “Sufficient” refers to quantity. “Appropriate” refers to quality, which means both relevance to the assertion being tested and reliability. Evidence from independent outside sources is generally more trustworthy than evidence generated inside the client.
The amount of evidence needed is not fixed. Higher-risk areas require more. Lower-quality evidence, such as a verbal explanation from management, has to be supplemented with more corroborating support than higher-quality evidence like a bank confirmation sent directly to the auditor.
Fraud detection sits inside this standard. AU-C Section 240 requires the auditor to identify and assess fraud risks, design procedures that respond to them, and react appropriately to any fraud discovered. One requirement applies to every audit no matter the assessed risk: the auditor must address the possibility that management has overridden its own controls. That means testing journal entries recorded in the general ledger (particularly entries made at period-end or posted directly to financial statement drafts), reviewing accounting estimates for bias, and evaluating the business rationale for unusual transactions. Those procedures are mandatory even when no specific red flags appear.
The Four Reporting Standards
The reporting standards govern the audit report, which is the only part of the audit most financial statement users ever see. They cover four things: whether the statements follow GAAP, whether accounting principles were applied consistently with the prior period, whether disclosures are adequate, and the expression of an opinion on the statements as a whole (or an explanation of why no opinion can be given).
What the Report Contains
SAS No. 134, effective for audits of periods ending after December 15, 2021, restructured the audit report so the most important information appears first. The opinion paragraph now sits at the top rather than being buried at the end. A standard unmodified report includes these sections in order:
- Opinion, stating whether the financial statements are presented fairly in all material respects.
- Basis for Opinion, explaining the auditor’s independence, ethical responsibilities, and that the audit was conducted in accordance with GAAS.
- Responsibilities of Management, describing management’s responsibility for preparing the statements, maintaining internal controls, and evaluating the entity’s ability to continue as a going concern.
- Auditor’s Responsibilities, explaining what reasonable assurance means and emphasizing professional judgment, professional skepticism, and the auditor’s own going concern evaluation.
- Communication with Those Charged with Governance, stating that the auditor communicated with the board or audit committee about the scope and timing of the audit, significant findings, and internal control matters.
Under AU-C Section 701 a non-public auditor can also be engaged to communicate key audit matters in the report. That is optional for non-public audits; it is required in a similar form for public company audits. When included, the key audit matters section highlights the issues that required the most significant judgment or attention during the engagement.
The Four Audit Opinions
The opinion standard produces one of four results, depending on what the auditor found.
- An unmodified, or clean, opinion means the financial statements are presented fairly in all material respects in accordance with the applicable framework. This is the outcome every client wants.
- A qualified opinion means the statements are generally fair, but a specific material departure from the framework or a scope limitation exists that is not pervasive enough to warrant a worse opinion. The qualification tells readers the statements are reliable except for the identified issue.
- An adverse opinion means the statements are materially misstated and the problem is pervasive enough that the statements as a whole cannot be relied upon. It is rare and damaging for the entity.
- A disclaimer of opinion means the auditor could not gather enough evidence to form any opinion, typically because of a severe scope restriction, and explicitly states that no opinion is being expressed.
Consistency, Disclosures, and Going Concern
The report must identify the financial reporting framework used and flag any change in accounting principles from the prior period. A properly accounted for and disclosed change may result in an emphasis-of-matter paragraph rather than a qualification, alerting readers without implying a problem.
If the notes omit information that should be there, the auditor must say so in the report. Auditors cannot fill in the gaps themselves; their role is to flag the omission so readers know the disclosures are incomplete. SAS No. 134 also expanded the going concern language in the report. Both management and the auditor evaluate whether conditions or events raise substantial doubt about the entity’s ability to continue operating for a reasonable period. If substantial doubt exists and management’s plans do not adequately address it, the auditor modifies the report accordingly.
How Materiality Runs Through Everything
Materiality is the threshold at which a misstatement becomes large enough to influence a reasonable financial statement user’s decisions. The auditor sets a materiality level during planning, and that number drives which accounts get tested, how large the sample sizes are, and whether discovered misstatements require adjustment. Auditors also set a lower performance materiality to keep the total of individually small, undetected misstatements from exceeding overall materiality. The opinion addresses whether the statements are fairly presented in all material respects, not whether they are accurate down to the penny.
GAAS vs. GAAP
These two acronyms get confused constantly, and they govern completely different activities. GAAP, generally accepted accounting principles, tells a company how to record and present its financial transactions: when to recognize revenue, how to value inventory, how to account for leases. GAAP is the rulebook for the company preparing the statements.
GAAS tells the auditor how to examine those statements. It governs qualifications, planning, evidence gathering, and reporting. The auditor’s job under GAAS is to determine whether the company followed GAAP. A company can follow GAAP perfectly and still receive a qualified opinion if the auditor was unable to gather enough evidence on a particular account. A company can also have GAAP violations that the auditor identifies and the company corrects before the report is issued, resulting in a clean opinion.
What GAAS Does Not Cover
GAAS does not apply to audits of public companies or SEC-registered broker-dealers. Those audits follow PCAOB standards, which the Sarbanes-Oxley Act directs the board to set.3Public Company Accounting Oversight Board. Auditing Standards One substantive difference matters for anyone comparing the two: PCAOB standards require an integrated audit of internal control over financial reporting for large public companies. GAAS does not mandate that.
GAAS also governs individual engagements rather than the firm performing them. Firm-level quality is addressed separately by the AICPA’s Statement on Quality Management Standards No. 1, effective December 15, 2025, which requires firms to design, implement, and operate a system of quality management covering leadership, ethics, client acceptance, engagement performance, resources, and monitoring.7AICPA & CIMA. Practice Aid – Quality Management
Consequences When an Auditor Departs From GAAS
Failing to follow GAAS carries real consequences. State boards of accountancy can suspend or revoke a CPA license. The AICPA can impose sanctions through its professional ethics division. For firms that also audit public companies, the PCAOB conducts inspections and can impose fines or bar individuals from practicing before the board.8Public Company Accounting Oversight Board. Standards
On the civil side, investors and creditors who relied on a deficient audit report can sue the auditor for professional negligence. A successful claim typically requires showing that the auditor owed a duty to the plaintiff, breached it by departing from GAAS, and caused a financial loss. Courts routinely treat compliance with GAAS as the benchmark for the standard of care. Departing from the standards does not automatically establish liability, but it leaves the auditor in a difficult position to defend.