An integrated audit and a non-integrated audit differ in what the auditor opines on. A non-integrated audit produces one opinion, on whether the financial statements are fairly presented. An integrated audit produces two opinions in a single engagement: the same financial statement opinion, plus a separate opinion on whether the company’s internal control over financial reporting works. Federal securities law decides which companies get which: public companies classified as accelerated or large accelerated filers must undergo an integrated audit under Section 404(b) of the Sarbanes-Oxley Act, while private companies and several categories of exempt public filers get a non-integrated audit.
What Each Audit Type Covers
A non-integrated audit is the traditional financial statement engagement. The auditor’s job is to determine whether the financial statements are free from material misstatement under the applicable accounting framework, usually U.S. GAAP. The auditor still has to understand the company’s controls, but only as a planning tool. PCAOB Auditing Standard 2110 requires enough knowledge of the control environment to identify where misstatements could occur and design substantive procedures in response.1Public Company Accounting Oversight Board. AS 2110 – Identifying and Assessing Risks of Material Misstatement That understanding shapes the testing that follows, but the auditor never formally concludes on whether the controls are operating effectively.
Because there is no opinion on controls, the engagement leans on substantive testing: tracing transactions to source documents, confirming balances with third parties, recalculating figures directly. Private companies use this model almost universally.
An integrated audit is a single engagement that reaches two conclusions. The first is the familiar financial statement opinion. The second is a separate opinion on internal control over financial reporting, commonly called ICFR. PCAOB Auditing Standard 2201 governs how the two objectives interconnect inside one engagement.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements The two opinions feed each other. If key controls are working, less can slip through undetected, and the auditor can scale back some substantive testing. If control testing surfaces problems, direct testing has to expand to compensate. That interplay is what makes the audit integrated rather than two engagements stapled together.
Which Companies Are Required to Have an Integrated Audit
Sarbanes-Oxley Section 404 sits at the center of this. The statute has two subsections, and the difference between them clears up most of the confusion.
Section 404(a) requires every public company’s annual report to include an internal control report acknowledging management’s responsibility for controls and containing management’s own assessment of whether those controls were effective at year-end.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls All SEC-reporting companies comply with 404(a), regardless of size.
Section 404(b) is what triggers the integrated audit. It requires the external auditor to attest to and report on management’s ICFR assessment.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls That attestation cannot be performed as a standalone engagement; it must run alongside the financial statement audit under AS 2201. The SEC defines a large accelerated filer as a company with public float of $700 million or more, and an accelerated filer as a company with public float between $75 million and $700 million.4U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions Both categories undergo integrated audits.
Several public company categories are exempt from 404(b) even though they still comply with 404(a):
- Non-accelerated filers, meaning companies with public float below $75 million, have never been subject to the auditor attestation requirement.5U.S. Securities and Exchange Commission. Smaller Reporting Companies
- Smaller reporting companies with annual revenues below $100 million were removed from accelerated filer status by a 2020 SEC rule amendment, which pulled them out of the 404(b) requirement.6U.S. Securities and Exchange Commission. Final Rule – Accelerated Filer and Large Accelerated Filer Definitions
- Emerging growth companies are carved out of Section 404(b) by the statute itself, until they hit one of the disqualifying events set out in the law.3Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls
Companies in these exempt categories still file audited financials, but the audit is non-integrated. Private companies fall outside the SOX regime entirely.
How the Procedures Actually Differ
The practical gap between the two audit types is the depth of control testing. In a non-integrated audit, the auditor maps out the control environment enough to understand where things could go wrong, then designs substantive tests around those risks. The controls themselves are not the subject of formal testing beyond what risk assessment requires.
An integrated audit adds a substantial layer of work on top of that baseline. The auditor must test controls across every significant financial statement cycle. AS 2201 requires walkthroughs for each major class of transactions, meaning the auditor follows a transaction from start to finish through the company’s systems using the same documents and technology employees use.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements These walkthroughs combine interviews, observation, document inspection, and re-performance of the controls.
Beyond walkthroughs, the auditor samples individual controls for operating effectiveness. Are approvals happening as designed? Do reconciliations catch discrepancies? Is access to the accounting system restricted to authorized personnel? Much of this testing involves IT audit specialists, because so many controls live inside information systems rather than on paper.
Fees reflect the extra work. Research on ICFR audit requirements has found that the additional control work accounts for roughly 30 percent or more of the variation in total audit fees.7European Financial Management Association. Audit Fee Levels and the Impact of Tighter Regulations on Internal Control Audit Over Financial Reporting Strong control test results let the auditor cut back on substantive testing; weak results push in the opposite direction.
What the Auditor’s Report Looks Like
A non-integrated audit produces one report with one opinion: whether the financial statements are fairly presented.
An integrated audit produces a combined report containing two opinions. The financial statement opinion works the way it always has. The ICFR opinion is either unqualified, meaning controls are effective, or adverse, meaning at least one material weakness exists. AS 2201 is explicit: the presence of one or more material weaknesses requires an adverse opinion on internal controls.2Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements There is no qualified middle ground for ICFR.
A company can receive an adverse ICFR opinion and still get an unqualified opinion on its financial statements. The financial statement opinion reflects whether the numbers are right after all the auditor’s substantive work. The ICFR opinion reflects whether the system that produces those numbers is reliable. An adverse ICFR opinion paired with clean financials tells investors the numbers came out correct this time but the controls are not strong enough to ensure they will next time. That signal carries weight, and the company faces immediate pressure to disclose and remediate.
Material Weakness vs. Significant Deficiency
Not every control problem triggers an adverse opinion. The PCAOB draws a line between two severity levels.
A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement in the annual or interim financial statements would not be caught or corrected in time.8Public Company Accounting Oversight Board. Auditing Standard No 5 Appendix A – Definitions A material weakness must be publicly disclosed and produces an adverse ICFR opinion.9Public Company Accounting Oversight Board. A Laypersons Guide to Internal Control Over Financial Reporting
A significant deficiency is less severe. It’s a control problem important enough to deserve the attention of those overseeing financial reporting, but it doesn’t reach the level where a material misstatement is reasonably possible.8Public Company Accounting Oversight Board. Auditing Standard No 5 Appendix A – Definitions Significant deficiencies are communicated to the audit committee but don’t require public disclosure or an adverse opinion.
Deficiencies found during the year can be remediated before the year-end assessment date. If remediation is successful before that date, the deficiency doesn’t appear in the final ICFR opinion, which is why many companies run internal control testing throughout the year rather than waiting for the external auditor to surface problems in Q4.
When a Voluntary Integrated Audit Makes Sense
Private companies and exempt public filers sometimes elect an integrated audit even when they don’t have to. The decision usually comes down to a few scenarios.
Companies planning an IPO typically start integrated audit-style procedures two to three years before going public. Waiting compresses the timeline, and scrambling to document and test controls under deadline pressure almost always costs more than building the process gradually. Companies seeking significant credit facilities or outside investment find that audited financials with an ICFR opinion smooth due diligence and signal financial discipline.
Companies anticipating a sale benefit similarly. Buyers pay more for businesses with clean, verifiable financials and documented controls because they’re assuming less risk. Three years of integrated audit reports at the negotiation table puts the seller in a fundamentally different position than one producing reviewed financials for the first time under buyer pressure.
The cost gap is real. For a company that doesn’t need the ICFR opinion, the expense isn’t trivial. For a company approaching a regulatory threshold or a capital event, the integrated audit tends to pay for itself in credibility and in problems that get found early rather than under pressure.