External assurance is an independent practitioner’s evaluation of reported information, issued as a report that tells readers how much confidence they can place in what the entity has said. The practitioner, usually a CPA firm, performs procedures calibrated to one of three levels: reasonable assurance, limited assurance, or no assurance. Which level applies dictates what testing gets done, what the report actually says, and how much weight investors, lenders, and regulators will give it. External assurance is required when a law, regulation, grant agreement, loan covenant, or contract says the entity must obtain it; outside those triggers, it is optional.
The Three Levels of Assurance
Every engagement sits at one of three levels. The level is not a matter of the firm’s thoroughness or reputation. It is a defined product with defined procedures and a defined report.
Reasonable Assurance
Reasonable assurance is the highest level an independent practitioner can provide, most commonly delivered through a financial statement audit. The word “reasonable” matters: the practitioner has gathered enough evidence to conclude the information is materially correct, but it is not an absolute guarantee. The PCAOB describes reasonable assurance as reflecting only a remote likelihood that material misstatements slipped through undetected.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of the Financial Statements
The procedures are extensive. Auditors test internal controls, confirm balances directly with banks and customers, recalculate figures, inspect supporting documents, and trace transactions from start to finish. The report contains a positive opinion: the auditor states that the financial statements are presented fairly, in all material respects, according to the applicable accounting framework. That affirmative statement is what distinguishes reasonable assurance from every other level.
Limited Assurance
Limited assurance provides a moderate level of confidence, substantially less than an audit. The most familiar example is the review of interim financial statements that public companies file each quarter on Form 10-Q.2U.S. Securities and Exchange Commission. General Instructions for Form 10-Q SEC rules require an independent accountant to review those quarterly statements before filing, but a full audit is not.3eCFR. 17 CFR 210.8-03 – Interim Financial Statements
Procedures center on analytical work and inquiry rather than substantive testing. The practitioner compares reported figures to expectations based on prior periods, industry trends, and known business changes, and asks management targeted questions when something looks off. Detailed transaction testing generally does not happen.
The conclusion is expressed as negative assurance: the practitioner states that nothing came to their attention indicating the information needs material modification. Rather than affirming the statements are correct, the practitioner is saying they found no evidence suggesting they are wrong. The distinction sounds subtle. It carries real weight in regulatory and legal contexts.
No Assurance
Some engagements involve an independent practitioner but provide no assurance at all. The practitioner does not express an opinion and does not vouch for the reliability of the information. Two engagement types fall here:
- Compilations, where the practitioner helps management organize financial data into a proper statement format. No testing, no analysis, no inquiries designed to uncover problems. Very small private companies often use compilations when a bank or business partner wants formatted statements but the cost of a review or audit is not warranted.
- Agreed-upon procedures (AUP), where the engaging party picks specific procedures they want performed and the practitioner reports the factual findings. A landlord might hire a CPA to verify a tenant’s reported sales figures under a percentage-rent lease. The practitioner checks exactly what was agreed and reports what they found. No opinion on overall reliability.
Neither type provides comfort about the accuracy of the underlying information. They serve practical purposes, but a reader should not treat them as validation.
When External Assurance Is Required
Whether you have to get assurance, and at what level, depends on who is asking and why. The main triggers fall into three buckets.
Public Company Filings
Every company that files annual reports with the SEC must obtain a reasonable assurance audit of its financial statements. Those audited statements go into the Form 10-K.4Legal Information Institute. Form 10-K Larger public companies face an additional requirement: the auditor must also evaluate the effectiveness of internal controls over financial reporting as part of an integrated audit.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of the Financial Statements Smaller reporting companies with annual revenues under $100 million are exempt from the internal controls attestation, though they still need the financial statement audit itself.5U.S. Securities and Exchange Commission. SEC Adopts Amendments to Reduce Unnecessary Burdens on Smaller Issuers Quarterly Form 10-Q filings require limited assurance rather than a full audit.
Federal Grant Recipients
Nonprofits, universities, and local governments that spend $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit under the Uniform Guidance. This is a reasonable assurance engagement covering both the financial statements and compliance with federal program requirements.6eCFR. 2 CFR 200.501 – Audit Requirements Organizations spending less than that threshold are exempt from federal audit requirements for that year.
Lender and Investor Requirements
Loan agreements commonly require borrowers to deliver audited or reviewed financial statements at specified intervals. A lender extending a significant credit facility to a private company will typically require at least a review, and often a full audit. Failure to deliver the required report can trigger a covenant violation, giving the lender the right to accelerate the debt and demand immediate repayment. Even if the lender chooses not to call the loan, the borrower may have to reclassify the entire debt as a current liability on its balance sheet, which can cascade into further covenant problems. Private investors and acquirers often impose the same expectations through their own agreements.
Beyond Financial Statements
Financial statement audits get the most attention, but assurance engagements now cover a much wider range of information. Any subject matter that can be measured against objective criteria can be examined.
Service Organization Controls (SOC) Reports
Technology companies, payroll processors, data centers, and other service providers that handle sensitive information for clients regularly obtain SOC reports. A SOC 1 report covers controls relevant to the financial reporting of the service organization’s clients, which matters when a company outsources a function like payroll or transaction processing that feeds into its own financial statements.7AICPA & CIMA. System and Organization Controls – SOC Suite of Services A SOC 2 report focuses on the service organization’s own controls over security, availability, processing integrity, confidentiality, and privacy.8AICPA & CIMA. SOC 2 – SOC for Service Organizations Trust Services Criteria Both come in Type 1 (controls at a point in time) and Type 2 (controls tested over a period, typically six to twelve months). Type 2 carries more weight because it tests whether controls actually operated effectively over time.
ESG and Sustainability Reporting
Assurance over environmental, social, and governance data is growing. Companies increasingly seek independent verification of reported greenhouse gas emissions, labor practices, and governance metrics. The SEC adopted climate disclosure rules that would eventually require large accelerated filers to obtain limited assurance over their Scope 1 and Scope 2 emissions, phasing in to reasonable assurance years later, though those rules are currently stayed pending judicial review. Internationally, the new International Standard on Sustainability Assurance (ISSA 5000) takes effect for reporting periods beginning on or after December 15, 2026, establishing a global framework for sustainability assurance engagements.9International Auditing and Assurance Standards Board. The International Standard on Sustainability Assurance ISSA 5000
Compliance Assurance
Regulated industries frequently need independent verification that they are meeting specific legal or contractual requirements. A lender may require assurance that a borrower is complying with financial covenants. Hospitals, utilities, and government contractors often need compliance reports to satisfy regulatory agencies. These engagements measure performance against a defined set of rules rather than against an accounting framework.
Why Independence Matters
None of these reports mean anything if the practitioner is not independent. Independence is the entire reason external assurance has value. If the practitioner has a financial interest in the client, serves on its board, or maintains close personal relationships with management, the report loses its credibility.
For public company audits, the PCAOB enforces independence rules governing financial relationships and the non-audit services a firm can provide to audit clients.10Public Company Accounting Oversight Board. Ethics and Independence Rules For private company engagements, the AICPA’s Code of Professional Conduct sets the standards.11Public Company Accounting Oversight Board. AU Section 220 – Independence The SEC has its own requirements that can be stricter than either in certain respects. Violations can result in the firm being barred from practice, the engagement being thrown out, and in extreme cases, criminal prosecution.
What It Costs and How Long It Takes
Fees vary widely based on the engagement level, the size and complexity of the organization, and the firm performing the work. A financial statement audit for a small private company typically starts around $12,000 to $15,000 with a regional CPA firm and can reach $50,000 or more with a large national firm. Public company audits for mid-sized registrants run well into six figures, and Fortune 500 companies pay millions. Reviews cost less than audits because the procedures are narrower. Compilations are the least expensive because the practitioner does no testing at all.
SOC 2 Type 2 reports, now a standard expectation for technology service providers, generally run between $12,000 and $70,000 depending on the organization’s size and the scope of systems examined.
Timelines vary too. A first-year audit takes longer than a recurring engagement because the practitioner is building an understanding of the business from scratch. Most financial statement audits for private companies wrap up within four to eight weeks after year-end. Public company audits operate on tighter SEC filing deadlines.
The level of assurance you need depends on who is asking for it and what they plan to do with the information. Choosing a lower level than what is required can mean a rejected filing, a covenant default, or a lost deal.