An audit is required whenever an outside party with leverage over a business demands independent verification of its financial statements. For public companies, federal securities law imposes the requirement directly. For private businesses, nonprofits, and government entities, the trigger is usually a federal grant, a retirement plan crossing a participant threshold, a bank loan agreement, a pending sale, or a state charitable registration rule. The reasons a company needs an audit vary by who is asking, but the answer always comes back to the same question: can anyone rely on these numbers?
Public Companies Filing With the SEC
Every company with publicly traded securities must file audited annual financial statements with the Securities and Exchange Commission. The Sarbanes-Oxley Act adds a second layer on top of that. Section 404(a) requires management to assess the effectiveness of internal controls over financial reporting, and Section 404(b) requires an independent auditor to attest to that assessment.1U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control over Financial Reporting Requirements Only accelerated and large accelerated filers must include the auditor’s Section 404(b) attestation; smaller reporting companies are exempt from that piece but still have to file audited financials.
The penalties for getting this wrong are severe. The SEC can pursue civil monetary penalties reaching roughly $236,000 per violation for an individual and over $1.1 million for a company as of 2025.2Federal Register. Adjustments to Civil Monetary Penalty Amounts Officers who knowingly certify false financial statements under Sarbanes-Oxley face criminal exposure of up to $5 million in fines and 20 years in prison. Stock exchanges also treat a late or missing 10-K as grounds for delisting proceedings.3U.S. Securities and Exchange Commission. NYSE Listed Company Manual Section 802.01E
Federal Grant Recipients Above the Single Audit Threshold
Nonprofits, state agencies, and local governments face a separate audit trigger tied to federal funding. Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit, which goes beyond a normal financial statement audit to test compliance with the specific terms of each major federal program.4eCFR. 2 CFR Part 200 Subpart F – Audit Requirements The threshold was raised from $750,000 effective for fiscal years beginning on or after October 1, 2024, so most organizations with fiscal years ending in 2026 are now operating under the higher figure.
The auditor tests whether the entity followed federal statutes, regulations, and grant conditions that could materially affect each major program, and evaluates the internal controls over that compliance. Findings of material noncompliance get reported in the schedule of findings and questioned costs, which federal awarding agencies review closely. Serious or repeated findings can jeopardize future grant funding. Organizations that spend just below the threshold sometimes choose to be audited anyway, because grantors treat it as a marker of financial maturity.
Retirement Plans With 100 or More Participants
If your company sponsors a 401(k), pension, or profit-sharing plan with 100 or more eligible participants at the beginning of the plan year, federal law requires an independent audit of the plan’s financial statements, filed alongside the Form 5500 with the Department of Labor. The eligible-participant count is broader than it sounds. It includes employees who are eligible even if they don’t contribute, separated employees who still hold account balances, and beneficiaries of deceased participants.
There is a narrow cushion. Plans with between 80 and 120 eligible participants can continue filing as a small plan without an audit if they filed that way the prior year. Once the count reaches 121, the audit is required regardless.
The DOL treats late and incomplete Form 5500 filings seriously. Through the Delinquent Filer Voluntary Compliance Program, the penalty is $10 per day, capped at $2,000 per filing for large plans and $750 for small plans.5U.S. Department of Labor. Delinquent Filer Voluntary Compliance (DFVC) Program Those are the reduced voluntary rates. Outside the program, statutory penalties run substantially higher, and plan sponsors who ignore the requirement can face DOL enforcement actions and potential personal liability for fiduciary breaches.
Loan Covenants and Bank Requirements
Even without a government mandate, most private companies of any size are contractually required to get an audit. Commercial loan agreements routinely include covenants requiring the borrower to deliver audited financial statements within a set period after fiscal year end, often 90 to 120 days. The lender uses those statements to verify that the borrower is meeting financial benchmarks written into the loan: debt service coverage ratios, leverage limits, minimum net worth thresholds, and similar metrics.
Missing the delivery deadline, or delivering statements that show a covenant violation, can trigger a technical default. That gives the lender the right to accelerate the loan and demand full repayment. In practice, most lenders don’t pull that trigger over a late report alone, but they use it as leverage to renegotiate: a higher interest rate, additional collateral, or tighter covenants going forward. If your company has bank debt, check the loan agreement. The audit requirement is almost certainly there.
Mergers, Acquisitions, and Going Public
When a company is being bought, sold, or taken public, audited financial statements are the foundation of the transaction. A buyer needs to verify that the target’s reported assets, liabilities, and earnings are real before agreeing to a price. Undisclosed debts, overstated revenue, and phantom inventory are exactly what an audit-driven due diligence process is designed to surface.
SEC rules dictate how many years of audited financials a target must provide in connection with a registration statement or proxy filing. For most reporting companies, three years of audited statements plus interim periods are required. Smaller reporting companies may provide two years. A non-reporting private target being acquired by a public company must have at least its most recent fiscal year audited if practicable, with earlier years potentially unaudited if they were never examined.6U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 – Registrants Financial Statements
Investment banks and private equity firms typically won’t finalize a deal without reviewing multiple years of audited statements. A private company that decides to sell and doesn’t have them faces a retroactive scramble that is slower, more expensive, and more likely to surface problems than keeping up with annual audits.
State-Level Rules for Nonprofits
Many states impose their own audit mandates on charitable nonprofits, separate from the federal Single Audit rule. The trigger is usually total revenue or total contributions above a threshold that varies by state, and it ties into state charitable solicitation registration. An organization that solicits in multiple states may need to comply with the strictest applicable standard. Nonprofits below the threshold may still be required to submit reviewed or compiled financial statements, which give less assurance at lower cost.
The IRS Boundary
An IRS tax audit is not the same thing as a financial statement audit, and nothing in the tax code requires a business to have its financial statements audited by an independent CPA. What the IRS can do is examine your returns and demand supporting documentation, generally within three years of filing, extended to six years if more than 25% of gross income was omitted, and with no time limit at all when a return is fraudulent or was never filed.7Office of the Law Revision Counsel. 26 U.S. Code 6501 – Limitations on Assessment and Collection Businesses that keep audited records are better positioned to respond, but the audit itself is not something the IRS forces you to obtain.
When an Audit Is Not Required
If none of the triggers above apply, a full audit is not legally mandatory. Accountants offer two lower-cost alternatives that may satisfy less demanding stakeholders.
- A review provides limited assurance. The accountant performs analytical procedures and asks management questions but does not independently verify balances or test controls. It can catch obvious problems but is not designed to detect well-concealed errors or fraud.8AICPA and CIMA. What Is the Difference Between a Compilation, Review, and Audit
- A compilation provides no assurance at all. The accountant helps management present the financial information in proper format. It is essentially organized bookkeeping, useful for internal purposes or very small lending relationships.
Where a lender or grantor accepts a review instead of an audit, it is worth asking. But switching gives up the independent testing that catches problems you did not know you had. And for employee benefit plans specifically, the substitution isn’t available: plans above the participant threshold must get a full audit, and the DOL will not accept a review.
Consequences of Skipping a Required Audit
The cost of failing to get an audit when one is required tracks the source of the requirement. Public companies face SEC penalties, potential delisting, and criminal exposure for officers who certify false statements. Federal grant recipients risk loss of future funding and repayment demands. Retirement plan sponsors face DOL penalties and fiduciary liability. Borrowers face loan acceleration and renegotiated terms on worse conditions. A buyer in an M&A transaction may simply walk away, or extract a price cut that dwarfs what an audit would have cost.
Substantial understatements on a tax return, meanwhile, carry an accuracy-related penalty of 20% of the underpayment,9Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty on Underpayments and willful tax evasion carries criminal penalties of up to five years in prison and fines of up to $100,000 for individuals or $500,000 for corporations.10Office of the Law Revision Counsel. 26 U.S. Code 7201 – Attempt to Evade or Defeat Tax An audit is not a shield against those consequences, but organizations with clean audited records are far less likely to arrive there by accident.
Before assuming your organization does or doesn’t need an audit, work through the list: public filings, federal awards spent, plan participant count, loan documents, pending transactions, state charitable rules. If any one of those crosses the line, the requirement is live.