A statutory audit is an independent examination of an organization’s financial statements that federal law requires certain entities to obtain each year. The rules are not universal. Separate federal regimes impose the requirement on SEC-registered public companies, larger insured banks, ERISA-covered retirement plans that cross a participant threshold, and organizations that spend federal award money above a set amount. If your organization falls into one of those categories, an outside Certified Public Accountant must review your books and issue a formal opinion that becomes part of the public record.
The point of the exercise is credibility. Investors, regulators, lenders, and plan participants rely on the auditor’s opinion as an independent check on the numbers management is reporting. That is why the auditor cannot be an insider, and why the opinion follows a standardized form that stakeholders know how to read.
Who Is Required to Get One
Four federal triggers matter. Each is independent: cross any one and the audit obligation attaches, regardless of the others.
SEC-Registered Public Companies
Any company with securities registered under Section 12 of the Securities Exchange Act of 1934 must file an annual report containing audited financial statements.1eCFR. 17 CFR 240.13a-1 – Requirements of Annual Reports The statements must follow U.S. Generally Accepted Accounting Principles and be examined by an independent auditor.2U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know The requirement reaches companies listed on an exchange under Section 12(b) and companies that trip Section 12(g) by holding more than $10 million in total assets combined with either 2,000 or more shareholders of record or 500 or more non-accredited shareholders.3U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 – Registrants Financial Statements
The Form 10-K deadline depends on public float:
- Large accelerated filers, with $700 million or more in public float, file within 60 days of fiscal year-end.
- Accelerated filers, between $75 million and under $700 million, file within 75 days.
- Non-accelerated filers, under $75 million, file within 90 days.
Those deadlines come from the Form 10-K general instructions.4U.S. Securities and Exchange Commission. Form 10-K General Instructions Filer tier is measured by public float on the last business day of the company’s most recently completed second fiscal quarter.5U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions
Sarbanes-Oxley layers additional work onto the basic financial statement audit. Section 404(a) requires management to assess the effectiveness of internal controls over financial reporting. Section 404(b) requires the outside auditor to attest to that assessment.6U.S. Government Accountability Office. Sarbanes-Oxley Act Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones Non-accelerated filers are permanently exempt from the 404(b) auditor attestation but still owe the management assessment under 404(a).
Banks and Insured Depository Institutions
Banks, savings associations, and other insured depository institutions with $1 billion or more in consolidated total assets at the start of the fiscal year must obtain an annual independent audit under FDIC rules.7eCFR. 12 CFR Part 363 – Annual Independent Audits and Reporting Requirements The FDIC raised this threshold from $500 million to $1 billion effective January 1, 2025, and it is subject to future inflation adjustments.8Federal Register. Adjusting and Indexing Certain Regulatory Thresholds Institutions at or above $5 billion in assets must also include a management assessment of internal controls in the annual report.
Employee Benefit Plans
Retirement plans governed by ERISA, including 401(k) plans, pension plans, and profit-sharing plans, must obtain an independent audit once they reach 100 or more eligible participants. The count includes anyone eligible whether or not they contribute, former employees who still hold an account balance, and beneficiaries of deceased participants.9eCFR. 29 CFR 2520.103-1 – Contents of the Annual Report
Plans that hover near the boundary can use the 80-120 rule. A plan that filed as a small plan (under 100 participants) in the prior year and whose current count sits between 80 and 120 may continue filing as a small plan and skip the audit. Once the count hits 121, the audit becomes mandatory regardless of prior filing status.
The audited statements are submitted with Form 5500, due by the last day of the seventh month after the plan year ends. For a calendar-year plan, that is July 31. An extension can be requested using Form 5558.10Internal Revenue Service. Form 5500 Corner
Organizations Spending Federal Award Money
Any non-federal entity, whether a nonprofit, state agency, or local government, that spends $1 million or more in federal awards during its fiscal year must undergo a Single Audit. The threshold was raised from $750,000 in April 2024, and the new amount applies to fiscal years ending on or after September 30, 2025.11eCFR. 2 CFR Part 200 Subpart F – Audit Requirements A Single Audit goes beyond ordinary financial statement review because it also tests whether the organization complied with the specific terms of each federal program it participated in. For-profit subrecipients are exempt, though the entity passing federal funds through to them must run its own compliance monitoring.
Private Companies
There is no general federal statutory audit requirement based on revenue or asset size alone for private companies. When a private company faces a mandatory audit, it is almost always because it falls into one of the categories above or because a state law or contract imposes the requirement. Some states require audits for insurance companies or licensed financial businesses. Lenders and investors often demand audited financials as a condition of providing capital, but that is contractual, not statutory.
Who Can Perform the Audit
The person signing the audit opinion must be a Certified Public Accountant licensed by a state board of accountancy. For audits of public companies and broker-dealers, the firm itself must be registered with the Public Company Accounting Oversight Board, which reviews the firm’s application to confirm that registration is consistent with protecting investors.12PCAOB. Section 2 Registration and Reporting
Independence is the principle that holds the process together. An auditor cannot own stock in the client, have a family member in a key financial role at the company, or provide certain consulting services that would amount to reviewing their own work. Sarbanes-Oxley requires that the lead audit partner and the concurring review partner rotate off the engagement after five consecutive years, with a five-year cooling-off period before returning.13U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence The company’s shareholders or an independent audit committee appoints the auditor, deliberately keeping that authority away from the executives whose numbers are being examined.
What the Audit Covers
The scope reaches the full set of financial statements: the balance sheet, income statement, statement of cash flows, statement of stockholders’ equity, and all accompanying notes. The auditor does not check every transaction. They apply professional judgment to test samples, concentrating on areas most likely to contain errors or manipulation. Revenue recognition, inventory valuation, and complex financial instruments draw the most scrutiny because they involve the most management estimates.
Testing typically means confirming account balances directly with banks and customers, inspecting inventory or equipment, reviewing contracts and supporting documents, and evaluating whether management’s accounting estimates are reasonable. An error is “material” if it is large enough that a reasonable investor would factor it into their decision. A $500 misclassification at a $500 million company will not affect the opinion; a $5 million overstatement of revenue at the same company almost certainly would.
Fraud
Auditors must plan and perform the audit to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by error or fraud.14PCAOB Public Company Accounting Oversight Board. AS 2401 Consideration of Fraud in a Financial Statement Audit Reasonable assurance is a high bar but not a guarantee. Well-designed fraud carried out through collusion and forged documents can escape detection even in a properly conducted audit. Auditing standards explicitly acknowledge that absolute assurance is not attainable.
Going Concern
At every audit the auditor must evaluate whether there is substantial doubt about the company’s ability to continue operating for at least one year beyond the date of the financial statements.15PCAOB Public Company Accounting Oversight Board. AS 2415 Consideration of an Entitys Ability to Continue as a Going Concern Warning signs include recurring operating losses, negative cash flow, loan defaults, or the loss of a principal customer. If substantial doubt remains after the auditor reviews management’s plans, the audit report carries an explanatory paragraph flagging the concern. That paragraph does not change the opinion itself, but it is a serious signal to investors and creditors.
The Four Possible Opinions
The audit ends in a formal report addressed to shareholders, not management, and it becomes public through SEC filings or other regulatory submissions. Four outcomes are possible:
- An unqualified opinion, often called a clean opinion, means the financial statements are presented fairly in all material respects. This is what companies want and what investors expect.
- A qualified opinion means the statements are fairly presented except for one specific issue, either a material misstatement or missing evidence, but the problem is isolated rather than pervasive.
- An adverse opinion means the statements are not presented fairly. It is rare, because most companies fix identified problems before the report is issued.
- A disclaimer of opinion means the auditor could not gather enough evidence to form any opinion at all, usually because access was restricted or the uncertainties were too deep.
Anything other than an unqualified opinion can trigger loan covenant violations, regulatory scrutiny, and a sharp drop in investor confidence.
What Happens If You Skip It
The penalties are real and they compound.
For public companies, the SEC can bring enforcement actions leading to cease-and-desist orders and civil penalties. In recent actions involving deficient late-filing disclosures, the SEC imposed penalties ranging from $35,000 to $60,000 per company.16U.S. Securities and Exchange Commission. SEC Charges Five Companies for Failure to Disclose Complete Information on Form NT The operational fallout is usually worse than the fine. Stock exchanges require timely filing of audited annual reports as a condition of continued listing, and failure to comply can lead to trading suspensions and ultimately delisting.
For employee benefit plans, the Department of Labor can impose penalties of up to $2,739 per day for failure to properly file a plan’s annual report, including the required audited financial statements.17Federal Register. Federal Civil Penalties Inflation Adjustment Act Annual Adjustments for 2025 On a plan that goes unfiled for a year, that daily penalty alone can exceed $1 million. Plan fiduciaries who let compliance lapse also face personal liability under ERISA’s fiduciary duty provisions.
Organizations subject to the Single Audit that fail to comply risk losing eligibility for future federal funding, being placed on high-risk status by federal awarding agencies, or facing more frequent and intensive monitoring.