What Happens in a Financial Statement Audit

What is a financial statement audit?

A financial statement audit is an outside accountant’s test of your balance sheet, income statement, cash flows and notes, and it ends in a written opinion on whether they are fair in all material respects. The auditor does not check every transaction or promise there is no error. Instead, they gather enough evidence to be confident, though never certain, that nothing big enough to mislead a reader is wrong. If you own the company, the audit is usually something a lender, an investor, a board or a buyer has asked for, and the opinion at the end is what you hand them. This guide follows the audit in the order it happens, from the engagement letter to the signed report, with the auditing standard behind each step, so you know what is coming and what it will ask of you.

Which rules does the auditor follow?

A private company’s auditor follows the generally accepted auditing standards that the AICPA publishes as numbered AU-C sections, and the AICPA’s page of currently effective Statements on Auditing Standards says they apply to companies that are not public, while public companies are audited under PCAOB standards instead. Each AU-C section covers one part of the work, and the numbers run roughly in the order an audit runs, so they make a good map of the whole job.

The section that sets the purpose of the audit is AU-C 200, on the auditor’s overall objectives. It says the auditor’s goal is reasonable assurance that the statements as a whole are free from material misstatement, whether from fraud or error, so that the auditor can give an opinion on them. The standards define reasonable assurance as a high, but not absolute, level of assurance. That one phrase explains most of what an audit does and what it does not.

What does an audit not do?

An audit does not test every transaction, keep your books for you or certify that nothing went wrong. Under AU-C 530, on audit sampling, the auditor can test a selection of items from a population, such as the year’s supplier payments, and draw conclusions about the whole from that sample. So most of your invoices are never looked at by anyone outside the company, and a clean opinion says the statements are fair overall, not that every supplier billed what was agreed.

The auditor must also stay independent of you, so the firm will not make your management decisions for you. Your team prepares the statements and the evidence, and the auditor tests them. Many owners hire a separate accountant for help with the accounting itself, so the auditor’s independence is never in question.

It also helps to know the two lighter services, because people often mix them up with an audit. A review gives limited assurance from inquiry and analysis, and a compilation gives none, as our guide to preparing for your first financial audit explains. Before you sign anything, read the clause in your loan or investment agreement that asked for audited statements, and make sure an audit is what it requires.

What are the steps of a financial statement audit?

An audit runs in six steps: the engagement is agreed in writing, the auditor plans the work and assesses where errors are most likely, sets the size of error that matters, gathers evidence, deals with the errors found, and then finishes with the final checks, the letters and the opinion. Planning usually starts before your year end, the main evidence work happens after the books are closed, and the report arrives some weeks later. The steps overlap, because what the auditor finds in one area often changes the plan for another.

Step 1: What does the engagement letter commit you to?

The engagement letter commits you to responsibilities that last the whole audit: preparing the statements, keeping the internal controls behind them, and giving the auditor every record and person they need. AU-C 210, on the terms of engagement, says the auditor should accept an audit only when management agrees to those responsibilities and the statements use an acceptable accounting framework. The same section lists what the written agreement must include, such as the objective and scope of the audit, the responsibilities of each side, the framework the statements follow, the expected form of the report, and a statement that some material errors may go undetected even in a properly performed audit.

Read the letter as you would a contract, because it is one. It also sets the fee and what the fee assumes, such as the date your books will be ready and how many companies are in scope. If your company had an auditor before, AU-C 210 also asks the new firm to request your permission to speak to the old one before accepting, so expect that request early.

Step 2: How does the auditor plan the audit and assess risk?

The auditor plans by building a picture of your business, your systems and the people who handle money, and then deciding where the statements are most likely to be wrong. AU-C 300, on planning an audit, requires an overall strategy that sets the scope, timing and direction of the work, and a detailed plan of what will be tested and when. AU-C 315, on understanding the entity and assessing risk, sets the objective of identifying and assessing the risks of material misstatement, from fraud or error, for the statements as a whole and for each significant account.

In practice this means meetings with you and your finance lead, a walk through how a sale or a supplier bill moves through your systems, and a first look at the numbers for anything odd. Fraud is part of the risk work from the start. AU-C 240, on fraud in a financial statement audit, requires the auditor to work from a presumption that risks of fraud exist in revenue recognition, and to test the journal entries recorded in the general ledger for signs that management has overridden the controls. That is why revenue and manual journal entries get extra tests in almost every audit, however honest the company.

The planning step also covers whether the company can keep going. AU-C 570, on going concern, asks the auditor, while assessing risk, to consider whether events or conditions raise substantial doubt about the company’s ability to continue for a reasonable period, and to discuss management’s own evaluation of it. If cash is tight, have a written forecast and plan ready before the auditor asks.

Step 3: How does the auditor decide which errors matter?

The auditor decides by setting materiality, the size of error that would change the judgment of someone relying on your statements, and then a lower working figure for planning the tests. AU-C 320, on materiality, requires materiality for the statements as a whole to be set as part of the overall strategy, and explains that a percentage is often applied to a chosen benchmark, such as revenue or profit, as a starting point. It also requires performance materiality, a lower amount that leaves room for the small errors the auditor never finds.

Materiality is a judgment, and it can move during the audit if the real results are not what the auditor expected. You will rarely be told the exact figure up front, but it shapes all that follows: large or risky balances get most of the tests, and small items get little.

Step 4: What happens during fieldwork?

Fieldwork is when the auditor gathers the evidence, mostly after your year end, by asking for documents, sending letters to outside parties, testing samples and recalculating figures. AU-C 500, on audit evidence, requires the auditor to weigh each piece of information used as evidence, to decide whether there is enough good evidence for the opinion. AU-C 330, on responses to assessed risks, links the testing to the risks found in planning, so the riskier an account, the more evidence it needs. Your request list, often called a PBC list for “prepared by client,” is that evidence translated into documents, and what auditors look for walks through it balance by balance.

Some tests in fieldwork reach outside the company. AU-C 330 requires the auditor to confirm accounts receivable directly with customers unless the balance is immaterial, confirmation would not work, or the risk is low and other tests cover it, and AU-C 505, on external confirmations, sets how those requests are designed and sent. Banks and lenders get the same kind of letter, and your lawyers get one asking about claims against you. Warn your biggest customers that a letter is coming, or it may sit unopened.

Some tests reach back to before the year you are being audited. In a first audit, AU-C 510, on opening balances, requires evidence that the balances you started the year with do not contain errors that materially affect the current year. And AU-C 550, on related parties, requires the auditor to understand your related party relationships and transactions, such as a building leased from the owner’s family, and to check that they are identified, accounted for and disclosed. Make a list of these before you are asked, because an owner often forgets the deals that feel like family business.

Journal entries get their own test, under the AU-C 240 requirement described above. The auditor pulls the year’s entries and looks hardest at manual ones, those made at period end and those posted by senior people. Our guide to journal entry testing shows how to run the same test yourself before the auditor does.

Step 5: What happens to the errors the auditor finds?

The auditor keeps a list of every error found, except the clearly trivial ones, tells management about them and asks for each to be corrected. AU-C 450, on evaluating misstatements, requires that list, the request to correct, and, where management declines, an understanding of why. Before deciding whether the errors left uncorrected matter, the auditor reassesses materiality against your actual results and then judges the uncorrected errors one by one and in total, by their size and their nature.

You decide which proposed adjustments to book. Errors you leave uncorrected are usually called passed adjustments, and they are listed in the representation letter you sign at the end. Ask why each change is needed, because some are clear errors and some rest on a judgment where your own view may be fair. A long list in a first audit is normal, and it is the best guide you will get to what to fix in your monthly close.

Step 6: How does the audit end?

The audit ends with a last round of checks up to the report date, letters from you and from the auditor, and the signed opinion. AU-C 560, on subsequent events, requires procedures covering the period from your year end to the report date, to find events such as a lawsuit or a lost customer that need an adjustment or a disclosure. AU-C 580, on written representations, requires a representation letter from management to the auditor, dated as of the date of the report, in which you confirm among other things that you gave the auditor all the information you had.

The auditor also reports to you and your board. AU-C 260, on communication with those charged with governance, requires the auditor to share the planned scope and timing and the significant risks, then the significant matters that came up, including their views on your accounting practices. AU-C 265, on internal control matters, requires them to report in writing the significant deficiencies and material weaknesses in internal control they found. That letter is not part of the opinion, but your board and your bank may ask to see it.

Then comes the opinion itself. AU-C 700, on forming an opinion, requires an unmodified opinion, the clean one, when the auditor concludes the statements are presented fairly in all material respects, and it puts the opinion in the first section of the report. AU-C 705, on modified opinions, covers the others: a qualified opinion when an error is material but confined to part of the statements, an adverse opinion when errors are material and run through the statements as a whole, and a disclaimer when the auditor could not get enough evidence to give any opinion. Lenders and investors expect the clean one, so treat any threat to it as the first thing to fix.

Worked example: Ferrygate’s audit from engagement letter to opinion

Ferrygate Plumbing & Heating is an invented company, one of the Demo companies Ressura uses to show its checks, and every figure below is made up for the example. It is a plumbing and heating contractor in Tacoma with about forty staff, its owner is Marcus Oyelaran, and its year ends on 31 December. Its bank has offered a larger credit line on condition that Ferrygate sends audited statements for the year, so Marcus hires an audit firm in September.

Engagement. The engagement letter, signed in September, names the statements to be audited and the accounting framework, and sets out Marcus’s responsibilities under AU-C 210: prepare the statements, maintain the controls and give the auditor full access. The fee assumes the books will be closed and reconciled by the end of January.

Planning and materiality. In November the auditor meets Marcus and Dana Whitlock, the office manager who keeps the books, and walks through how supplier bills are entered and approved. Ferrygate’s revenue for the year is about $9,400,000. The auditor sets materiality at $47,000, half of 1% of revenue, performance materiality at $35,000, and treats anything under $2,300 as clearly trivial. Revenue and manual journal entries are flagged as risks, as AU-C 240 requires.

Fieldwork. In February the auditor tests a sample of the year’s supplier payments and confirms the largest receivable balances with customers, including Westgate Senior Living. The related party questions under AU-C 550 turn up one arrangement: Ferrygate rents its shop on Port of Tacoma Road from Ferrygate Properties LLC, which the Oyelaran family owns. The rent is recorded correctly, but the draft notes do not mention who the landlord is, so the auditor asks for the lease to be disclosed as a related party arrangement, and Dana adds it.

Errors found. The auditor’s list under AU-C 450 has three items above the $2,300 threshold.

• An annual bill paid up front. Puget Fleet Services billed $18,600 on 1 October for a year of vehicle maintenance, and the whole amount was booked as an expense. Only three months, $4,650, belong to this year; the other nine months, $13,950, are a prepaid asset at 31 December. Ferrygate corrects it.
• A December bill booked in January. A Cascade Pipe & Supply bill for $21,400 of copper delivered in December arrived in January and was recorded in the new year, so payables and expenses for the year were understated by $21,400. Ferrygate corrects it.
• An accrual estimate. The auditor thinks the year-end accrual for unpaid technician overtime is $4,100 too low. Dana’s estimate used December’s hours and is reasonable, the amount is well under materiality, and Marcus decides to leave it, a passed adjustment.

The two corrections partly offset each other in profit: the prepaid lowers expenses by $13,950 and the late bill raises them by $21,400, so profit falls by $7,450 once both are booked. The one uncorrected error, $4,100, is far below the $47,000 materiality, and its nature raises no concern, so under AU-C 450 the auditor concludes it is not material.

Completion. Before signing, the auditor reviews Ferrygate’s results for the new year and asks Marcus about events after year end under AU-C 560; nothing needs disclosing. Marcus signs the representation letter on 14 April, the same date as the report, as AU-C 580 requires, and it lists the $4,100 passed adjustment. In its letter on internal control under AU-C 265, the auditor names one deficiency to fix: two Pacific Tool & Equipment bills of $4,900 each, entered on the same day, sat just under Dana’s $5,000 approval limit, so neither reached Marcus for approval. The report, dated 14 April, gives an unmodified opinion under AU-C 700, and Ferrygate sends it to the bank.

The lesson for an owner is in the list of errors. None of the three items was fraud or a big mistake, but each took the auditor time to find and Dana time to fix, and both kinds of time end up in the fee. The prepaid bill, the late copper bill and the split under the approval limit could each have been caught that month by someone checking supplier bills against their agreements, dates and limits as they arrived.

What does the owner have to do during an audit?

The owner has to make the decisions only an owner can make, sign the letters only an owner can sign, and make sure the finance team has the time to answer requests quickly. That means reading the engagement letter before you sign it, naming one person as the auditor’s contact, deciding which proposed adjustments to book, and reading the representation letter as the commitment it is. It also means answering the related party and subsequent event questions yourself, because you are the person who knows about the family lease, the side agreement or the lawsuit.

The rest of the work falls on your finance team, and how ready they are before fieldwork sets how long the audit takes. A team that closes each month on time, reconciles every balance sheet account and keeps each invoice beside its agreement answers most requests the day they arrive. A team that has to rebuild the year in January turns a few weeks of fieldwork into months. Our month-by-month plan for preparing for your first financial audit covers that preparation in detail.

How long does an audit take, and what drives the fee?

A financial statement audit usually runs over several months from the engagement letter to the report, with most of the hours in fieldwork after the books close, and the fee follows those hours. Audit firms price by the time they expect to spend, so the things that add time add cost: records that are late, reconciliations that do not tie, missing agreements, a long list of errors and slow answers to requests. A first audit also costs more than later ones, because the opening balances and the firm’s first understanding of your business add work that a repeat audit does not need.

The fee is only part of what it costs you. Your team’s time, the delay to a loan or a funding round, and a missed reporting deadline in a credit agreement can cost more than the audit itself. For the factors behind the fee and how to lower it, see what a financial audit costs a mid-market company.

How does Ressura help you walk into an audit ready?

Ressura checks your records as they arrive, so much of the evidence an auditor asks for already exists when the request list lands. The Procure-to-Pay Module checks every supplier invoice against the agreement behind it, including amendments, fees and the arithmetic, and shows what was billed to you but not yet used up at period end as money paid ahead, invoice by invoice, which is the prepaid Ferrygate missed. The General Ledger Module checks your journal entries for who prepared and approved each one, flags entries posted after a period closed or in its last two days, and checks that your payables, receivables, cash and asset balances equal the detail behind them. The supplier audit is free to start, with one agreement and one invoice, and if every line matches, the result says what was checked, which is a record you can hand the auditor.

Sources

1. page of currently effective Statements on Auditing Standards