A financial audit is an independent examination of a company’s financial statements by a licensed accountant who has no stake in the outcome. The auditor gathers evidence, tests the reported numbers, and issues a written opinion that gives outside readers “reasonable assurance” that the statements fairly represent the company’s position under an accepted accounting framework such as Generally Accepted Accounting Principles (GAAP). Investors, lenders, and regulators rely on that outside verification because they cannot look at the books themselves.
The output of the process is the audit report and its opinion. Everything else — the planning, the sampling, the testing — exists to support that opinion.
Who Performs a Financial Audit
Only licensed Certified Public Accountants (CPAs) or CPA firms can perform a financial audit. Each state has a board of accountancy that handles licensing, and a CPA must meet education, examination, and experience requirements before receiving a license.
When the audit involves a publicly traded company, the firm must also register with the Public Company Accounting Oversight Board (PCAOB). The Sarbanes-Oxley Act of 2002 created the PCAOB and requires any firm that prepares audit reports for public companies to register with it.1Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002
Independence is the foundation of the entire process. Federal regulations require auditors to be free from financial, employment, and business relationships with the client that could compromise objectivity.2eCFR. 17 CFR 210.2-01 – Qualifications of Accountants An auditor who owns stock in a client, has a family member in the client’s management, or provides certain non-audit services to the client cannot serve as an independent auditor for that company. Without genuine independence, the opinion is worthless.
Public company auditors work under PCAOB standards, and their report explicitly states that the audit was performed “in accordance with the standards of the PCAOB.”3Public Company Accounting Oversight Board. AS 3101 – The Auditors Report on an Audit of Financial Statements Auditors of private companies follow Generally Accepted Auditing Standards (GAAS) issued by the American Institute of CPAs.4Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards The two frameworks overlap heavily, though PCAOB standards carry additional requirements, including mandatory reporting on internal controls and on critical audit matters.
Who Has to Get One
Federal securities laws require publicly traded companies to file financial statements examined by an independent auditor. Many of the statements filed with the SEC, including those in the annual report, must carry an independent auditor’s opinion.5U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know This is the most visible category of mandatory audits, and it is far from the only one.
Nonprofits and government entities that spend $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit under the federal Uniform Guidance. That threshold rose from $750,000 in the 2024 Uniform Guidance revision, effective for fiscal years beginning on or after October 1, 2024.6U.S. Department of Health and Human Services Office of Inspector General. Single Audits FAQs A Single Audit examines both the financial statements and the entity’s compliance with federal award requirements.
Private companies often face audit requirements too, though usually by contract rather than regulation. Banks routinely include audit requirements in loan covenants, requiring the borrower to deliver audited financial statements annually. Private equity investors, venture capital firms, and joint venture partners frequently demand the same. Some states also mandate audits for particular kinds of businesses, such as insurance companies and large charitable organizations.
What the Audit Examines
A standard audit covers the four primary financial statements that management prepares:
- The balance sheet, a snapshot of assets, liabilities, and equity at a specific date.
- The income statement, showing revenue and expenses over a reporting period.
- The statement of cash flows, tracking cash moving in and out through operations, investments, and financing.
- The statement of changes in equity, showing how ownership interests shifted during the period, including retained earnings, dividends, and share transactions.
The notes that accompany these statements matter as much as the numbers. Notes explain the accounting policies management used, break down significant transactions, and disclose contingencies like pending lawsuits. Auditors examine the notes as part of the overall financial statement package.
For public companies, the audit reaches further. Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of the company’s internal controls over financial reporting, and requires the independent auditor to evaluate that assessment and issue a separate opinion on whether those controls actually work.7U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Internal controls are the policies and procedures a company uses to make sure transactions are recorded accurately, assets are protected, and financial reports are reliable. Even in private company audits that don’t require a formal controls opinion, the auditor still evaluates internal controls during planning to decide how much substantive testing is needed.
How the Process Works
A financial audit moves through three phases: planning, fieldwork, and reporting. The whole cycle typically runs several weeks to several months, depending on the company’s size and complexity.
Planning and Risk Assessment
The auditor begins by building an understanding of the business, its industry, the regulatory environment, and the economic conditions it operates in. Context matters because the same account balance might be reasonable in one industry and a red flag in another. Using that understanding, the auditor identifies where material misstatement is most likely to appear and builds a plan that dictates which procedures the team will perform, which accounts they will focus on, and how large the testing samples will be.
A key part of planning is materiality. Auditors do not check every transaction; that would be prohibitively expensive for most companies, and the cost would far outweigh the benefit.8Public Company Accounting Oversight Board. AS 2315 – Audit Sampling Instead, the auditor sets a materiality threshold, the dollar amount above which a misstatement could influence someone relying on the financial statements, and then selects samples of transactions and balances to test, weighted toward areas with the highest risk.
Fieldwork
Fieldwork is where the auditor actually tests the numbers. The work falls into two categories.
Controls testing checks whether the company’s internal controls are operating as designed. If the company requires two signatures on checks above a certain amount, for example, the auditor pulls a sample of checks to see if that rule was consistently followed. Effective controls let the auditor reduce the scope of substantive testing, because the system generating the data is working reliably.
Substantive testing goes directly at the financial statement balances. Common procedures include sending confirmation requests to banks and customers to independently verify account balances, physically counting inventory at the warehouse, tracing journal entries back to supporting documentation, and running analytical procedures that compare reported figures to expected patterns. When the analytics produce something unexpected, such as revenue growing 30% while receivables triple, the auditor investigates.
Near the end of fieldwork, the auditor obtains a written management representation letter. In it, company executives formally acknowledge their responsibility for the financial statements and confirm specific facts: that all financial records were made available, that all related-party transactions were disclosed, and that they are not aware of any fraud affecting the company, among other representations.9Public Company Accounting Oversight Board. AS 2805 – Management Representations If management refuses to sign the letter, the auditor cannot issue an opinion.
Reporting
After fieldwork, the auditor aggregates every misstatement found during testing and evaluates whether the cumulative effect is material. Small misstatements can still matter if they add up. The auditor then forms a conclusion about whether the financial statements, taken as a whole, are presented fairly, and issues a written audit report addressed to the company’s shareholders and board of directors.3Public Company Accounting Oversight Board. AS 3101 – The Auditors Report on an Audit of Financial Statements The report identifies which statements were audited, states the respective responsibilities of management and the auditor, and delivers the opinion.
The Four Types of Audit Opinion
The opinion paragraph is the part of the report that actually matters to most readers. Four types exist, and the differences between them are significant.
- An unqualified opinion, often called a clean opinion, means the financial statements present fairly, in all material respects, the company’s financial position and results of operations in conformity with GAAP. This is what every company wants and what most audits produce.
- A qualified opinion means the statements are generally presented fairly, except for a specific issue. That issue could be a scope limitation, where the auditor was unable to verify something, or a departure from GAAP that the company refused to correct. The report spells out the exception so readers can weigh its significance.10Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
- An adverse opinion means the financial statements do not present fairly the company’s financial position. The misstatements are so material and pervasive that the statements as a whole cannot be relied upon. Adverse opinions are rare and devastating, essentially telling the market the statements are misleading.10Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
- A disclaimer of opinion means the auditor declines to express any opinion at all, typically because the scope of the audit was so severely limited that there was no way to gather enough evidence. Destroyed records, client-imposed restrictions, or extreme uncertainty can all trigger a disclaimer.10Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
Even a clean opinion may include an explanatory paragraph flagging “substantial doubt” about whether the company can continue operating for the next twelve months. The auditor is required to evaluate conditions that could threaten viability, such as recurring losses, negative cash flow, loan defaults, or the loss of a major customer, and then assess whether management has a realistic plan to address them.11Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entitys Ability to Continue as a Going Concern If substantial doubt remains after considering those plans, the report must say so. It’s a serious signal to investors and creditors, though not a prediction; the absence of a going concern paragraph does not guarantee the company will survive.
What an Audit Does Not Guarantee
One of the most common misconceptions about audits is that a clean opinion means the financial statements are perfectly accurate, or that the audit would have caught any fraud. Neither is true, and understanding the limits is as important as understanding the process.
The standard an auditor works toward is reasonable assurance, which PCAOB standards describe as a high level of assurance but not an absolute guarantee. Because auditors rely on sampling rather than examining every transaction, and because certain items involve estimates and management judgment, some material misstatement could exist and go undetected even in a properly conducted audit. The standards themselves acknowledge this: “an audit conducted in accordance with generally accepted auditing standards may not detect a material misstatement.”12Public Company Accounting Oversight Board. Reasonable Assurance
Fraud is a related but distinct point. The auditor must plan and perform the audit to obtain reasonable assurance that the financial statements are free of material misstatement “whether due to error or fraud.”13Public Company Accounting Oversight Board. Fraud Risk Resources Fraud is in the auditor’s scope, but only to the extent it would materially distort the financial statements. An employee embezzling a few thousand dollars from a billion-dollar company is unlikely to move the needle and is not what the audit is designed to catch. Sophisticated management fraud involving collusion or fabricated documentation is notoriously difficult to detect through standard audit procedures, which is one reason major accounting scandals occasionally occur even at companies with large-firm auditors.
The financial statements themselves belong to management, not the auditor. Management prepares the statements, maintains internal controls, and provides the auditor with complete and accurate information.9Public Company Accounting Oversight Board. AS 2805 – Management Representations The auditor tests and evaluates management’s work; it does not prepare the statements and is not responsible for their accuracy in the way management is.
External Audits vs. Internal Audits
The word “audit” gets used for two very different activities, and confusing them leads to misunderstandings about what protection each one offers.
An external audit is the process described throughout this article: an independent CPA firm examines the financial statements and issues a formal opinion for the benefit of outside parties, including shareholders, lenders, and regulators. External audits are mandatory for public companies under SEC rules and are frequently required by loan agreements or investor contracts.5U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know The external auditor’s loyalty runs to the investing public, not to management.
An internal audit is a voluntary function staffed by the company’s own employees or an outsourced team that reports to the board’s audit committee. Internal auditors have a broader mandate: improving operational efficiency, testing compliance with laws and company policies, evaluating risk management, and strengthening internal controls. Their reports go to management and the board, not to outside investors. Internal audit work can make the external auditor’s job easier by showing that controls are well-monitored, but it does not substitute for an independent external opinion.