What Is an Audit Process: Planning, Fieldwork, and Reporting

A financial audit moves through five audit process steps: accepting the engagement, planning the work and assessing risk, performing fieldwork to gather evidence, evaluating the results through quality review, and issuing a formal report that carries the auditor’s opinion on the financial statements. Each step builds on the one before it, and the whole sequence exists to give investors, lenders, and regulators an independent read on whether a company’s numbers can be trusted. Here is what actually happens at each stage.

Step 1: Accepting the Engagement

Before any testing begins, the audit firm has to decide whether to take the client. That means running background checks on management, looking at the company’s financial stability, confirming the firm has the right industry expertise, and screening for anything that would compromise the firm’s ability to do the work honestly.

Independence sits at the center of this screening. Under auditing standards, the auditor must maintain “an independence in mental attitude” throughout the engagement, which rules out financial ties to the client, personal relationships with management that could create bias, and prior involvement in preparing the financial statements being examined.¹ The AICPA Code of Professional Conduct names specific situations that impair independence, including holding a financial interest in the client or serving as a trustee for an estate with significant client holdings.²

Once the firm decides to move forward, both sides sign an engagement letter. This is the contract governing the audit. It names the financial periods covered, the standards the auditor will follow (typically PCAOB standards for public companies, GAAS for private ones), and what each party is responsible for. One point here matters more than people often realize: the company’s management, not the auditor, is responsible for the accuracy of the financial statements. The auditor’s job is to test whether those statements hold up under scrutiny.³

For public companies, the engagement letter must be provided to the audit committee annually. It states the objective of the audit, the auditor’s responsibility to plan and perform the work to obtain reasonable assurance about material misstatements, and management’s responsibility for preparing accurate statements and maintaining effective internal controls. If the auditor and audit committee cannot agree on terms, the auditor must decline the engagement.³

Step 2: Planning and Assessing Risk

Planning is where the audit team maps out its strategy. The auditors learn how the client makes money, who its major customers and suppliers are, what its key performance metrics look like, and which regulators it answers to. The goal is to figure out where problems are most likely to hide. A manufacturer with complex inventory raises different red flags than a software company recognizing subscription revenue.

Setting Materiality

One of the first quantitative decisions is setting a materiality threshold: the dollar amount above which a misstatement could change the decisions investors or lenders make based on the financial statements. Auditors calculate it using a benchmark tied to the company’s financials. Common approaches include 5% to 10% of pre-tax income, 0.5% to 1% of total revenue, or 1% to 2% of total assets. The choice depends on which metric is most stable and meaningful for the particular company. That threshold then drives how much testing follows.

The Audit Risk Model

Planning also includes a formal risk assessment. Audit risk is the chance that the auditor issues an incorrect opinion when the financial statements actually contain a material error. Auditors break this risk into three components to manage it systematically.⁴

Inherent risk asks how likely an account balance is to contain a material error before you even consider the company’s controls. Estimates like bad debt allowances or fair value measurements involve judgment calls that create more room for error than straightforward cash balances.

Control risk asks how likely the company’s own internal controls would fail to catch or prevent a material error. A company with strong segregation of duties and automated reconciliation has lower control risk than one where a single person handles both invoicing and collections.

Detection risk asks how likely the auditor’s own testing procedures would miss a material error that exists. This is the only component the auditor directly controls.

These components work inversely. When inherent and control risk are high, detection risk has to be driven lower, which means more extensive and more targeted testing.⁴ The audit plan gets calibrated to the actual risk profile of the client rather than following a one-size-fits-all checklist.

Step 3: Fieldwork and Evidence Gathering

Fieldwork is the most labor-intensive phase. Auditors are on-site or accessing the client’s systems remotely, pulling samples, confirming balances, and testing whether the numbers hold up against the underlying records. The work splits into two broad categories: testing the company’s internal controls and performing substantive procedures that test the dollar amounts directly.⁵

Testing Internal Controls

Tests of controls evaluate whether the company’s safeguards actually work as designed. If the client says every payment over $10,000 requires two signatures, the auditor pulls a sample of payments and checks. When controls test well, the auditor can reduce the volume of transaction-level testing that follows. When controls are weak, more individual transactions have to be tested to reach the same level of confidence.

For public companies, this testing carries extra weight. Under Sarbanes-Oxley Section 404(b), the external auditor must separately attest to the effectiveness of internal controls over financial reporting. A company with one or more material weaknesses cannot receive a clean opinion on its controls, and the auditor must issue an adverse internal control opinion regardless of whether the financial statements themselves are fairly stated.⁶

Substantive Procedures

Substantive procedures go directly at the numbers. The auditor picks specific assertions to test for each major account. For accounts receivable, that might mean sending confirmation letters to customers asking them to verify what they owe. For inventory, it might mean attending a physical count. For revenue, it might focus on whether transactions were recorded in the correct period.

The common evidence-gathering techniques include:

Confirmation: Contacting third parties like banks, customers, or vendors to independently verify balances the company has recorded.
Inspection: Examining physical assets or original documents such as invoices, contracts, and bank statements.
Observation: Watching a process in action, such as attending a physical inventory count.
Inquiry: Asking management and staff about processes, unusual transactions, or known issues.
Analytical procedures: Comparing financial data against expected patterns. If revenue grew 30% while the industry was flat, the auditor investigates why.

Auditors use statistical sampling to keep the work manageable. Instead of reviewing every transaction, they select a representative sample and extrapolate. Sample size grows when assessed risk is higher or the materiality threshold is lower.

For a mid-sized organization, the complete audit typically runs about three months from start to finish, with roughly four weeks each for planning, fieldwork, and compiling the final report. Audit teams juggle multiple engagements at once, so calendar time is usually longer than the actual hours on any single audit. Larger or more complex companies run considerably longer.

Step 4: Evaluation and Quality Review

Once fieldwork wraps up, senior audit staff, managers, and partners go through the working papers in detail. They check whether the evidence is sufficient to support the conclusions, whether the team addressed every significant risk identified during planning, and whether the work complies with applicable standards.

The auditor aggregates all identified misstatements and evaluates their combined effect. Some errors individually fall below materiality but, taken together, push the total past it. The team then decides whether to ask management to correct the errors or to evaluate whether the uncorrected misstatements, in the aggregate, are material to the financial statements as a whole.

Engagement Quality Review

For audits of public companies, PCAOB standards require an engagement quality review before the report can be issued. The reviewer must be a partner (or equivalent) who was not part of the engagement team but has the knowledge and competence to have served as the engagement partner. The reviewer evaluates the significant judgments the team made during planning, the response to identified risks including fraud risks, and the treatment of corrected and uncorrected misstatements. The reviewer also independently confirms the firm’s independence in relation to the engagement. No audit report can be released until this reviewer gives concurring approval.⁷

Material Weakness Versus Significant Deficiency

During evaluation, auditors categorize any internal control problems they found. A material weakness is a control failure serious enough that there is a reasonable possibility a material misstatement would not be caught or prevented in time.⁶ A significant deficiency is less severe but still important enough to warrant the attention of those overseeing financial reporting. The distinction has public consequences: material weaknesses must be disclosed in a public company’s filings, while significant deficiencies are communicated in writing to the audit committee and don’t appear in the public report.

Step 5: Forming the Opinion and Issuing the Report

The final step is the signed report. The auditor’s report follows a structured format that includes an opinion on the financial statements, a basis-for-opinion section explaining the auditor’s responsibility and how the audit was conducted, and for public companies, a discussion of critical audit matters that required especially significant judgment.⁸

The Four Types of Opinions

Every audit report carries one of four opinions, and the differences matter to the company:⁹

Unqualified (clean) opinion: The financial statements present fairly, in all material respects, the company’s financial position. This is what every company wants.
Qualified opinion: The statements are fairly presented except for a specific issue that is material but not pervasive enough to undermine the whole. This might happen when the company uses an accounting method the auditor disagrees with for one particular line item.
Adverse opinion: The financial statements do not present the company’s financial position fairly. The statements as a whole cannot be relied upon.
Disclaimer of opinion: The auditor was unable to obtain enough evidence to form any opinion, often because the company restricted access to records or the scope was so limited no meaningful work could be done.

Going Concern Warnings

Separately from the opinion, the auditor must evaluate whether there is substantial doubt about the company’s ability to continue operating for at least one year beyond the date of the financial statements. Signs that trigger this evaluation include recurring operating losses, defaulting on loans, or being unable to pay obligations as they come due. If the auditor concludes that substantial doubt remains after considering management’s plans, the report must include an explanatory paragraph using the specific phrase “substantial doubt about its ability to continue as a going concern.”¹⁰ A going concern paragraph can appear even alongside an otherwise unqualified opinion. For the company receiving one, the consequences can be severe: lenders may call loans, investors may flee, and the cost of capital can spike.

The Management Letter

Alongside the formal report, auditors typically issue a management letter (sometimes called an internal control letter) that communicates deficiencies and weaknesses in operations and controls. This letter is not part of the public audit opinion. It goes to management and the board, identifies areas where misstatements are likely to occur, flags problems like inadequate segregation of duties, and often includes recommendations. Management usually provides a written response outlining how it plans to address each finding.

Workpaper Retention

After the report is issued, the audit firm must retain all workpapers and supporting documentation. Federal law requires audit records for public companies to be kept for at least five years from the end of the fiscal period in which the audit concluded. PCAOB standards extend the requirement to seven years. Anyone who knowingly destroys audit records to obstruct an investigation faces criminal penalties of up to 20 years in prison.¹¹

What an Audit Does Not Guarantee

Public perception often outruns what the audit actually promises. An audit provides reasonable assurance, not absolute assurance, that the financial statements are free of material misstatement whether caused by error or fraud.¹²

Auditors are required to exercise professional skepticism throughout the engagement, which means maintaining a questioning attitude and critically evaluating evidence rather than taking management at its word.¹² But fraud involves concealment, forged documents, and collusion that can fool even well-designed procedures. A properly planned and executed audit can still miss a material fraud. The auditor’s interest relates specifically to fraud that would cause a material misstatement in the financial statements, not to fraud more broadly as a legal concept. A clean opinion means the auditor found no evidence of material misstatement after applying professional standards. It does not mean the company’s finances are perfect or that fraud could never exist.

1
Public Company Accounting Oversight Board. PCAOB AU Section 220 – Independence
2
Public Company Accounting Oversight Board. ET Section 101 – Independence
3
Public Company Accounting Oversight Board. AS 1301 – Communications with Audit Committees
4
Public Company Accounting Oversight Board. AS 1101 – Audit Risk
5
Public Company Accounting Oversight Board. Auditing Standard No. 13 – The Auditor’s Responses to the Risks of Material Misstatement
6
Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
7
Public Company Accounting Oversight Board. AS 1220 – Engagement Quality Review
8
Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion
9
Public Company Accounting Oversight Board. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
10
Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entity’s Ability to Continue as a Going Concern
11
U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews
12
Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit