In accounting, the levels of assurance describe how much work a CPA has done to stand behind a set of financial statements. There are four service levels, ranked from most to least rigorous: an audit provides reasonable assurance, a review provides limited assurance, a compilation provides no assurance but comes with a formal report, and a preparation engagement produces formatted statements with no report and no assurance at all. A fifth service, agreed-upon procedures, sits outside this ladder because it reports factual findings on specific items rather than evaluating financial statements as a whole. The level your business needs depends almost entirely on who will rely on the statements and what those users demand.
Audit: Reasonable Assurance
An audit is the most rigorous examination a CPA can perform. The goal is reasonable assurance, meaning a high but not absolute level of confidence that the financial statements, taken as a whole, are free of material misstatement due to error or fraud.1Public Company Accounting Oversight Board. Reasonable Assurance No audit guarantees perfection. What it does guarantee is that the CPA dug deep enough to catch anything that would change a reasonable person’s decision.
That work involves several layers. The CPA tests internal controls to evaluate whether the business has safeguards against errors and theft. Physical inspections verify that inventory and equipment actually exist and match what the books say. Confirmation letters go directly to banks, customers, and vendors asking them to independently verify account balances. The auditor also reviews contracts, recalculates figures, and traces transactions from source documents through to the financial statements.
At the end of the engagement, the CPA issues a formal opinion stating whether the financial statements conform to Generally Accepted Accounting Principles.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards This positive expression of assurance is what distinguishes an audit from every other service level.
The Four Audit Opinions
Not every audit ends with a clean bill of health. The CPA’s opinion falls into one of four categories:
- Unqualified (clean): the financial statements are fairly presented in all material respects. This is what every business wants.
- Qualified: the statements are fairly presented except for a specific issue. The misstatement is material but not so pervasive that it undermines the statements as a whole.
- Adverse: the financial statements do not fairly present the company’s financial position. The auditor found misstatements that are both material and pervasive.3Public Company Accounting Oversight Board. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
- Disclaimer: the auditor could not obtain enough evidence to form any opinion. This typically happens when the company restricted access to records, or when uncertainty is so severe that no conclusion is possible.
An adverse opinion or a disclaimer is a serious red flag. Lenders, investors, and regulators treat either one as a sign that the reported numbers cannot be trusted.
Review: Limited Assurance
A review sits below an audit but well above the lower service levels. The CPA performs analytical procedures and makes inquiries of management, but does not test internal controls, inspect physical assets, or send confirmation letters to third parties. The result is limited assurance: enough work to flag potential problems, not enough to say the financial statements are fairly presented.
Analytical procedures are the backbone of a review. The CPA compares current-year figures to prior periods, calculates financial ratios, and looks for fluctuations that don’t make sense given what the business does. If revenue jumped 40% but the company didn’t add customers or raise prices, that gets investigated. The CPA also asks management directly about accounting policies, unusual transactions, and subsequent events that might affect the numbers.
The review report uses what accountants call negative assurance: the CPA states that nothing came to their attention indicating the financial statements need material modification to conform with the applicable reporting framework. That phrasing sounds cautious because it is. The CPA is saying “I looked and didn’t find problems,” not “the statements are correct.”
Unlike a compilation or preparation, the CPA performing a review must be independent of the client. If the accountant has a financial interest in the business or a close relationship with its owners, they cannot issue a review report. The engagement falls under the Statements on Standards for Accounting and Review Services issued by the AICPA.4AICPA & CIMA. AICPA SSARSs – Currently Effective
Compilation: No Assurance, Formal Report
A compilation is a step below a review. The CPA takes management’s financial data and presents it in proper financial statement format, but performs no testing, analytical procedures, or inquiries designed to verify accuracy. The service is about presentation, not verification.5AICPA & CIMA. What Is the Difference Between a Compilation, Review, and Audit
The CPA does issue a formal report alongside the financial statements, but that report explicitly states that no audit or review was performed and no assurance is provided. Readers should understand that the numbers are management’s representations, organized by a professional but not independently checked. The CPA must read the completed statements and consider whether they appear appropriate in form and free from obvious material errors, but that is a far cry from the testing involved in an audit or review.
The CPA does not need to be independent of the client to perform a compilation. An accountant with a financial interest in the business can compile its statements. If independence is impaired, however, the CPA must disclose that fact in the compilation report. And even without assurance obligations, the CPA must withdraw from the engagement if they become aware the financial information is materially misleading.
Compilations are common among smaller businesses that need formatted financial statements for a bank, a bonding company, or internal management purposes but don’t need or can’t justify the cost of a review or audit.
Preparation: No Assurance, No Report
Preparation is the most basic service a CPA can provide in connection with financial statements. The accountant takes the client’s data and organizes it into financial statement format. No report is issued, no analytical procedures are performed, and no inquiries are made to verify the underlying information. The CPA does not need to be independent.
Because no report accompanies the statements, the standards require a different safeguard: every page of the prepared financial statements must include a legend clearly stating that no assurance is provided. This prevents anyone who later receives a copy from assuming a CPA verified the numbers. If the accountant cannot include that legend on each page, they must either issue a separate disclaimer or convert the engagement to a compilation and issue a compilation report instead.
Preparation services are governed by Section 70 of the AICPA’s Statements on Standards for Accounting and Review Services.4AICPA & CIMA. AICPA SSARSs – Currently Effective One common point of confusion: routine bookkeeping that happens to produce a financial statement through accounting software does not automatically trigger SSARS preparation requirements. The standard applies only when the accountant is specifically engaged to prepare financial statements. If the understanding with the client is that the CPA provides bookkeeping services and the software generates statements as a byproduct, SSARS does not apply. The distinction turns on the engagement agreement, not on what the software outputs.
Agreed-Upon Procedures
Agreed-upon procedures don’t fit neatly into the assurance spectrum because they aren’t designed to evaluate financial statements as a whole. Instead, the CPA and the client agree on specific procedures to perform on a specific subject, and the CPA reports the factual findings without expressing any opinion or conclusion. The work might involve verifying the balance of a single account, confirming a specific number of inventory items, or testing whether payroll disbursements match approved rates.
The report reads like a checklist of results. If the CPA was asked to verify 500 units of machinery, the report states whether those 500 units were found and in what condition. It does not extrapolate to the rest of the inventory or opine on whether the financial statements are fairly presented. Users draw their own conclusions from the factual findings.
These engagements show up frequently in acquisitions, where a buyer wants to verify specific asset values or liabilities before closing. They also appear in contractual compliance situations, such as confirming that a franchisee’s reported sales match the documentation. Under the current standards, only the engaging party needs to agree that the procedures are appropriate. The resulting report can be shared with a broader audience, though it includes a caution that the procedures and findings may not suit every reader’s purpose.
When an Audit Is Legally Required
Many businesses assume audits are optional until a lender asks for one. Several federal rules can make an audit mandatory regardless of what a bank wants.
Publicly Traded Companies
Any company with securities registered under the Securities Exchange Act of 1934 must file annual reports on Form 10-K that include audited financial statements.6U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1: Registrants Financial Statements The statements must comply with Regulation S-X, and the balance sheet in an initial registration statement generally cannot be more than 134 days old. Audited statements also must accompany or precede proxy statements sent to shareholders before annual meetings where directors will be elected.
Employee Benefit Plans
Under ERISA, an employee benefit plan with 100 or more participants at the beginning of the plan year must file as a large plan and include audited financial statements from an independent qualified public accountant. Plans that previously filed as small plans get a buffer: they can continue filing as a small plan until the count exceeds 120 participants, but once they cross into large-plan territory, audits are generally required going forward.
Recipients of Federal Awards
Non-federal entities that spend $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit or program-specific audit.7eCFR. 2 CFR 200.501 – Audit Requirements This threshold was raised from $750,000 in the 2024 revisions to the Uniform Guidance, and it applies to fiscal years beginning on or after October 1, 2024.8Office of Inspector General. Single Audits Frequently Asked Questions Federal expenditures for this purpose include direct grants, pass-through funds from state or local governments, and cooperative agreements. Entities spending less than $1,000,000 in federal awards are exempt from federal audit requirements, though they must still keep records available for review.
Nonprofits
Many states impose separate audit requirements on charitable nonprofits, usually triggered by total annual revenue or total contributions exceeding a threshold that varies by state. These requirements exist independently of the federal Single Audit rules, so a nonprofit receiving state funding or large donations may need an audit even if its federal expenditures fall below $1,000,000.
Matching the Service Level to Your Needs
The price gap between service levels is substantial. A basic preparation or compilation might cost anywhere from a few hundred to a few thousand dollars. A review runs meaningfully higher because of the analytical work involved. Audits are the most expensive by a wide margin, with fees for even relatively straightforward private-company audits typically starting around $10,000 and climbing quickly from there. Complexity drives the number up: multiple subsidiaries, foreign operations, inventory spread across locations, high leverage, specialized industries, and a December 31 fiscal year-end that falls during peak season all add hours.
The practical takeaway is to match the service level to what external users actually require. Paying for an audit when a lender only needs a review wastes money. Choosing a compilation when a lender requires a review just delays the process while you engage a CPA for the higher-level service anyway. Before hiring an accountant, ask whoever will rely on the financial statements exactly what level of service they need.