The external audit process is the sequence an outside CPA firm follows to examine a company’s financial statements and issue an independent opinion on them, and from planning through the final report it typically runs about three months, longer for complex organizations. The work moves through defined stages: selecting a firm and signing an engagement letter, confirming independence, assessing risk and planning, performing fieldwork, evaluating internal controls where required, resolving findings, and delivering a formal opinion. Understanding what happens at each stage is the difference between a smooth engagement and one that drags on while fees climb.
Who Needs an External Audit and Which Rules Apply
Publicly traded companies have no discretion. Federal law requires every company with securities registered under the Securities Exchange Act of 1934 to file audited financial statements with the SEC.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements Those audits follow standards set by the Public Company Accounting Oversight Board, created by the Sarbanes-Oxley Act of 2002, and PCAOB standards carry regulatory weight backed by the SEC.
Private companies operate under Generally Accepted Auditing Standards issued by the AICPA. The substance overlaps heavily with PCAOB rules, but GAAS gives auditors more room for professional judgment. Private companies commonly pursue an audit because a lender requires it before extending credit, because a nonprofit’s federal funding triggers single audit rules, or because investors want audited numbers before committing capital.
The biggest practical difference between the two tracks is internal control testing. Public companies get an integrated audit of both financial statements and internal controls under Sarbanes-Oxley Section 404. Private companies typically receive a financial statement audit only, unless their lender or board asks for control testing on top.
Selecting a Firm and Signing the Engagement Letter
Most organizations pick their auditor through a request-for-proposal process, inviting several CPA firms to bid on the basis of industry expertise, team availability, and fee structure. Fees vary widely. A small private company might pay $15,000 to $50,000; mid-sized public companies commonly spend several hundred thousand dollars. Hourly rates for audit partners and managers at mid-sized firms generally fall between $170 and $500.
Once the firm is chosen, both sides sign an engagement letter. It functions as the contract: it defines what will be examined, sets the timeline, confirms that management remains responsible for the accuracy of the financial statements, and establishes the auditor’s obligation to provide reasonable assurance that the statements are free from material misstatement. Fee arrangements and any scope limitations are spelled out here too.
A pre-audit meeting follows. The engagement team is introduced, the timeline is walked through, and both sides flag scheduling conflicts, complex accounting areas, or organizational changes that could affect the work. Setting expectations here prevents the last-minute scrambling that inflates fees.
Auditor Independence
The value of the audit collapses if the auditor is not independent. Both the AICPA Code of Professional Conduct and PCAOB rules restrict what relationships are permissible between the firm and its client. Independence has two components: independence of mind (the auditor actually is unbiased) and independence in appearance (a reasonable observer would believe so).
Several categories of relationships disqualify a firm. An auditor who holds stock in a client, directly or indirectly, cannot perform that client’s audit; if a firm partner, professional employee, or their immediate family collectively owns more than 5% of a client’s equity, independence is impaired. An auditor whose spouse or immediate family member holds a key position at the client is disqualified, as is anyone on the audit team who worked for the client during the period being audited. Loans between the auditor and client generally destroy independence, with narrow exceptions for standard consumer products like mortgages obtained on normal terms. Finally, an auditor who makes management decisions, designs the client’s internal controls, or takes custody of client assets is no longer independent.
For public companies, the SEC requires the lead audit partner to rotate off every five years, followed by a five-year cooling-off period.2Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence Other significant partners rotate every seven years with a two-year timeout. The firm itself does not have to rotate under current U.S. rules.
Risk Assessment and Planning
Before any testing begins, auditors decide where the financial statements are most likely to contain errors or fraud. This drives every subsequent decision about what to test, how much to test, and how deeply to dig. Auditors who skip the assessment and test everything at the same intensity waste time on low-risk areas and miss the spots that matter.
Audit risk breaks into three components:3Public Company Accounting Oversight Board. Auditing Standard No 8 – Audit Risk
- Inherent risk is how likely an account or transaction type is to contain a misstatement before any controls are considered. Revenue recognition tends to carry high inherent risk because management has incentives to overstate it.
- Control risk is the chance the company’s own internal controls fail to catch or prevent a misstatement. Weak controls over cash disbursements raise control risk for expense accounts.
- Detection risk is the chance the auditor’s own procedures miss a misstatement that exists. It is the only piece the auditor directly controls, by adjusting testing.
The logic is simple: when inherent and control risk run high, the auditor drives detection risk low through more extensive testing. When controls are strong and the account carries low inherent risk, smaller samples and lighter procedures suffice. This is why two similar-sized companies can have very different audit experiences.
Preparing Your Records Before Fieldwork
The fastest way to run up the bill is to hand auditors incomplete records. Every hour they spend chasing missing documents is an hour you pay for. A well-organized preparation usually includes:
- A final trial balance exported from the accounting system, with lead schedules that break down each balance sheet and income statement line item.
- Monthly bank reconciliations for every account throughout the fiscal year, plus direct portal access so auditors can independently verify balances.
- Physical inventory count sheets, fixed asset registers with purchase dates and depreciation schedules, and documentation for any disposals or write-offs.
- Accounts payable and receivable aging reports, with vendor files supporting current liability balances.
- Complete payroll registers, including tax withholdings and benefit deductions.
- Copies of significant contracts and leases, especially any new or modified agreements that create long-term obligations.
- Prior year tax returns; for corporations, IRS Form 1120 provides a baseline for tax liabilities, net operating loss carryforwards, and other items that carry across years.4Internal Revenue Service. Instructions for Form 1120
Organizing these items into a secure shared folder before the auditors arrive signals a strong control environment and keeps the engagement on schedule. Many firms now use data analytics tools that can ingest an entire general ledger and flag unusual entries automatically, so auditors expect clean, exportable data rather than paper files.
Fieldwork and Substantive Testing
Fieldwork is where the numbers go under the microscope. The goal is gathering enough evidence to conclude whether the financial statements are materially correct. Auditors rely on several core techniques, and the choice of technique depends on the risk assessment.
Vouching starts with an entry in the general ledger and works backward to the supporting document. An auditor might pick a sample of recorded expenses and inspect the corresponding invoices, purchase orders, and receiving reports to confirm the transactions happened. Tracing runs the other direction: the auditor starts with a source document, like a shipping receipt, and follows it into the ledger to verify it was properly recorded. Vouching tests whether recorded transactions are real; tracing tests whether real transactions were recorded. Both are needed because the risks run in opposite directions.
The procedures must produce enough relevant evidence to support the auditor’s conclusions, a requirement embedded in Generally Accepted Auditing Standards.5American Institute of Certified Public Accountants. AU Section 150 – Generally Accepted Auditing Standards
Physical Inspections and Third-Party Confirmations
Some accounts can’t be verified from documents alone. Auditors may visit a warehouse to observe a physical inventory count, check serial numbers on equipment, or inspect property to confirm the assets exist. Firms increasingly accept remote observation through video conferencing or drones when in-person attendance isn’t practical, though remote methods carry limitations around video manipulation and the ability to assess asset condition.
Third-party confirmations are among the most reliable evidence an auditor collects. The auditor contacts banks, customers, vendors, or legal counsel directly to verify account balances, outstanding receivables, or pending litigation. The critical feature is that management never handles these communications. The auditor sends the request and receives the response without any intermediary, so the company cannot filter or alter the information.6Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation When a request goes unanswered, auditors perform alternative procedures, such as examining subsequent cash receipts or reviewing contracts directly.
Analytical Procedures
Auditors also step back and look at the big picture. Analytical procedures compare current-year figures against prior years, industry benchmarks, or expected results to surface anomalies. If revenue jumped 30% while the industry was flat, the auditor wants to know why. If cost of goods sold as a percentage of revenue shifted significantly without a clear operational reason, that signals an area for deeper testing. These procedures often catch misstatements that transaction-level testing would miss.
When any procedure uncovers an entry that lacks documentation or a balance that doesn’t reconcile, the auditor expands the sample size to determine whether the problem is isolated or part of a pattern. A single missing invoice is an annoyance. A dozen missing invoices in the same account is a red flag that changes the trajectory of the engagement.
Internal Control Evaluation for Public Companies
Public company auditors don’t just opine on the numbers. Under Section 404 of the Sarbanes-Oxley Act, they must also evaluate whether the company’s internal controls over financial reporting are effective.7U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control over Financial Reporting Requirements The integrated audit produces two opinions: one on the financial statements and one on internal controls.
The auditor works top down, starting with entity-level controls like leadership tone, the competence of accounting staff, and the oversight provided by the audit committee. From there, the auditor identifies significant accounts and the specific controls that prevent or detect material misstatements in those accounts.8Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Testing asks two questions: is the control designed properly, and is it actually operating as designed?
Control deficiencies fall into three tiers. A deficiency exists when a control doesn’t work well enough to prevent or detect misstatements on a timely basis. A significant deficiency is serious enough to merit attention from the audit committee. A material weakness means there’s a reasonable possibility that a material misstatement could slip through undetected. Find a material weakness and the company cannot receive a clean opinion on its internal controls, and management must disclose the weakness publicly.
A public company’s CEO and CFO must personally certify in every annual and quarterly report that they have evaluated internal controls, disclosed any significant deficiencies or material weaknesses to the auditors and audit committee, and reported any fraud involving employees with a role in internal controls.9Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
Materiality
Not every mistake in the financial statements triggers a correction. Auditors focus on misstatements that are material, meaning a reasonable investor would consider the error significant enough to change a decision about the company.10Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit A $500 rounding difference in a billion-dollar company’s revenue is immaterial. A $5 million overstatement of net income at the same company probably is material.
Materiality thresholds get set during planning using quantitative benchmarks. Common starting points include 5% of pre-tax income, 0.5% of total revenue, or 1% of total assets, though the final number depends on professional judgment and specific circumstances. For sensitive accounts like related-party transactions or executive compensation, auditors often set a lower threshold because investors watch those disclosures closely.
Materiality isn’t purely about dollar amounts. A small error that turns a reported profit into a loss, masks a trend reversal, or triggers a loan covenant violation can be material even at a modest dollar figure. Auditors also consider whether individually small misstatements accumulate into a material amount when combined.
Findings, Adjustments, and Closing
After fieldwork, auditors compile every identified misstatement and present proposed adjusting entries to management. These entries correct how the company recorded revenue, classified expenses, or valued assets and liabilities. Management can accept the adjustments, push back with additional evidence, or decline the correction. Any uncorrected misstatements get documented and evaluated in the aggregate to determine whether they tip the statements into material misstatement.
A closing meeting brings auditors and management together to discuss findings, resolve open items, and let management provide any late-arriving documentation. Most disputes get worked out here. If an auditor flagged an expense accrual as unsupported, management has one last chance to produce the invoice or contract.
Management Representation Letter
Before issuing the final report, auditors require the CEO and CFO (or equivalents) to sign a management representation letter. The document confirms that management has provided all financial records, disclosed all related-party relationships, and reported any known or suspected fraud. It also affirms that management takes responsibility for the fair presentation of the financial statements.11Public Company Accounting Oversight Board. AS 2805 – Management Representations If management refuses to sign, or refuses to accept significant adjustments, the auditor may be unable to issue an opinion at all.
Audit Committee Communications
For public companies, auditors must communicate specific matters to the audit committee before issuing the report. Required topics include the auditor’s assessment of significant accounting policies, any identified bias in management’s estimates, conclusions about critical accounting estimates, and any significant unusual transactions.12Public Company Accounting Oversight Board. AS 1301 – Communications with Audit Committees The auditor must also communicate all material weaknesses and significant deficiencies in writing.13Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
These communications serve as a check on management. The audit committee hears directly from the auditors about areas where management’s judgment was aggressive, where accounting policies differ from industry norms, or where the auditors and management disagreed.
The Four Possible Opinions
Everything culminates in a formal report containing the auditor’s opinion on the financial statements. Four outcomes are possible:14Public Company Accounting Oversight Board. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
- An unqualified opinion says the financial statements present the company’s financial position fairly in all material respects. This is what every company wants and what most receive. Lenders, investors, and regulators treat it as confirmation that the numbers can be trusted.
- A qualified opinion says the statements are fairly presented except for a specific issue. The auditor identifies the problem area and explains why the qualification is necessary, but confirms the rest is reliable.
- An adverse opinion says the statements do not present the company’s financial position fairly. It signals fundamental problems, not isolated errors. Stock prices drop, lenders may accelerate loan repayments, and regulatory scrutiny intensifies.
- A disclaimer of opinion means the auditor could not obtain enough evidence to form any opinion. This can happen when management restricts the scope or when accounting records are so inadequate the work cannot be completed. The practical consequences track those of an adverse opinion.
The final report goes to the board of directors. For public companies, it becomes part of the annual Form 10-K filing with the SEC.15U.S. Securities and Exchange Commission. How to Read a 10-K A clean opinion is often a prerequisite for maintaining bank credit lines, securing government contracts, or completing mergers and acquisitions.
Going Concern Warnings
Even when the statements are fairly presented, the auditor may add a going concern paragraph if there is substantial doubt about the company’s ability to survive the next twelve months.16Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entitys Ability to Continue as a Going Concern Conditions that trigger the evaluation include recurring operating losses, negative cash flow, loan defaults, or loss of a major customer.
Management gets to explain its survival plan, whether that involves securing new financing, cutting costs, or selling assets. The auditor evaluates whether the plan is realistic. If substantial doubt remains, the going concern paragraph appears right after the opinion paragraph. It doesn’t change the opinion itself (a company can receive an unqualified opinion with a going concern paragraph), but it serves as a prominent warning to anyone reading the financials. The standard requires the auditor to state directly that substantial doubt exists, not soften the language with conditional phrasing.
Federal Certification Penalties
The audit carries real teeth when fraud is involved. Under 18 U.S.C. ยง 1350, the CEO and CFO of a public company must certify that each periodic financial report fully complies with SEC requirements and fairly presents the company’s financial condition. Knowingly certifying a false report carries a fine of up to $1 million and up to 10 years in prison. Willfully certifying a false report pushes the maximum penalties to a $5 million fine and 20 years in prison.17Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
The gap between “knowingly” and “willfully” matters. A CEO who signs off without reading the financials may face the lower tier. A CEO who actively participates in cooking the books faces the higher one. Separate statutes covering wire fraud, mail fraud, and obstruction also carry up to 20 years in prison, giving federal prosecutors multiple avenues to pursue executives who manipulate financial statements. The audit itself often becomes the mechanism that exposes that conduct, which is why companies under investigation sometimes try to limit the scope of the engagement or withhold documents.