US GAAP and US GAAS are two different rulebooks for two different jobs in the same financial reporting process. Generally Accepted Accounting Principles govern how a company prepares its financial statements. Generally Accepted Auditing Standards govern how an independent auditor examines those statements and reports on their reliability. GAAP is for the people writing the numbers. GAAS is for the people checking them.
Confusing the two is common, and it matters, because when something goes wrong with reported financials the failure usually belongs to one side or the other, and sometimes to both. Knowing which framework does what tells you where to look.
What GAAP Does
GAAP is the set of standardized rules companies follow when they record transactions and produce financial reports. The goal is comparability: if two companies in the same industry sell the same product, an investor should be able to read their financial statements side by side and draw meaningful conclusions. GAAP narrows the range of acceptable accounting choices so the numbers mean something to outsiders.
The most fundamental GAAP requirement is accrual accounting. A company records revenue when it earns it and expenses when it incurs them, not when cash moves. A consulting firm that finishes a project in December but doesn’t get paid until February still books the revenue in December. This is where many business owners, used to tracking cash in and cash out, get tripped up.
Beyond accrual, GAAP covers how to value inventory (FIFO, LIFO, and other methods are allowed, but a company has to apply its choice consistently), how to depreciate long-lived assets, how to account for leases, and what must appear in the footnotes. The output is a set of four primary statements: the balance sheet, income statement, statement of cash flows, and statement of shareholders’ equity. Those are the documents investors and lenders read.
The single official source of authoritative GAAP for non-governmental entities in the United States is the FASB Accounting Standards Codification.1Financial Accounting Standards Board. FASB Standards Every rule sits inside a numbered topic, so an accountant handling revenue from a long-term contract can look up the relevant topic instead of sorting through decades of separate pronouncements.
What GAAS Does
GAAS is the set of quality standards that govern an independent auditor’s work when examining a company’s financial statements. GAAS doesn’t dictate how the statements were prepared. It dictates how the audit is conducted, and the end product is a professional opinion on whether the statements are materially accurate.
GAAS is organized into three categories. The General Standards require the auditor to have adequate technical training, remain independent of the client in both fact and appearance, and exercise due professional care. The Standards of Fieldwork cover planning the audit, understanding the company’s internal controls, and gathering enough evidence to support a conclusion. The Standards of Reporting dictate the form and content of the auditor’s final opinion, including a statement of whether the financial statements comply with GAAP.2Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
In practice, that means testing samples of transactions, confirming balances directly with banks and customers, observing physical inventory counts, and evaluating whether management’s accounting judgments are reasonable. The auditor also obtains a written representation letter from management, in which company leadership acknowledges responsibility for the fair presentation of the financial statements and confirms they believe the statements comply with GAAP.3Public Company Accounting Oversight Board. AS 2805 Management Representations That letter matters because it puts management’s assurances in writing.
Woven through all of GAAS is professional skepticism. Auditors aren’t supposed to assume management is lying, and they aren’t supposed to assume management is telling the truth. They approach evidence with a questioning mind, especially when accounting involves significant judgment.
Who Has to Follow Which
GAAP applies to companies. Every company that files financial statements with the SEC must prepare them under GAAP. The SEC’s reporting manual states that financial statements not prepared under GAAP are “presumed to be inaccurate or misleading.”4U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 Private companies aren’t legally required to use GAAP, but most do, because lenders, investors, and contract counterparties demand GAAP-compliant financials as a condition of doing business.
GAAS applies to auditors, not companies. Public companies are required by federal securities law to have their annual financial statements audited by an independent firm registered with the PCAOB. Private companies face no federal audit requirement, though many still get audits because bank loan covenants, state licensing rules, or ownership agreements call for them. When a private company is audited, the auditor follows the AICPA’s Statements on Auditing Standards rather than PCAOB standards.
This split matters when something goes wrong. If a company’s financial statements contain errors, that’s a GAAP failure by the company’s accounting team. If the auditor missed those errors because testing was insufficient or red flags were ignored, that’s a GAAS failure by the audit firm. Both failures can exist in the same case, and in major accounting scandals they usually do.
Who Sets Each Set of Standards
GAAP and GAAS come from separate organizations with separate oversight.
The Financial Accounting Standards Board sets GAAP. FASB is a private, independent body whose pronouncements carry authority because the SEC has designated it as the standard-setter for financial accounting. When FASB issues an Accounting Standards Update, it becomes part of the Codification and companies must apply it by the effective date.1Financial Accounting Standards Board. FASB Standards
Auditing standards are split between two bodies depending on the type of company being audited. For public company audits, the Public Company Accounting Oversight Board sets the rules. The PCAOB was created by the Sarbanes-Oxley Act of 2002 to oversee auditors of public companies after Enron and WorldCom exposed the failures of self-regulation.5Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 For audits of private companies, the AICPA’s Auditing Standards Board issues Statements on Auditing Standards, which serve as the governing framework.6Association of International Certified Professional Accountants. AICPA Statements on Auditing Standards – Currently Effective
A practical quirk falls out of that split. A CPA firm that audits both public and private clients has to follow two different sets of auditing standards depending on the engagement. The standards overlap significantly, but they aren’t identical, and the consequences for violating them come from different regulators.
What the Auditor Actually Reports
The visible output of a GAAS audit is the auditor’s report, and its opinion type is what a reader of financial statements first looks for. There are four possibilities.
- Unqualified, or clean, opinion. The financial statements present fairly, in all material respects, the company’s financial position in conformity with GAAP. This is what companies want and what most receive. The auditor found no material problems.
- Qualified opinion. The financial statements are fairly presented except for a specific issue that the auditor identifies. A yellow flag rather than a red one, but something is off.7Public Company Accounting Oversight Board. AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances
- Adverse opinion. The financial statements do not present fairly the company’s financial position. The auditor concluded the statements taken as a whole are materially misstated. This is the worst outcome.7Public Company Accounting Oversight Board. AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances
- Disclaimer of opinion. The auditor declines to express an opinion, typically because they couldn’t gather enough evidence to form one. A disclaimer signals the audit was too limited in scope for any conclusion.7Public Company Accounting Oversight Board. AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances
An auditor may also add explanatory language to an otherwise clean opinion. The most common addition is a going concern paragraph, which appears when the auditor has substantial doubt about the company’s ability to continue operating for the next twelve months. The going concern flag doesn’t change the opinion type, but it tells investors the company may be in serious financial trouble.8Public Company Accounting Oversight Board. Consideration of an Entitys Ability to Continue as a Going Concern The PCAOB has noted the reverse does not hold: the absence of a going concern paragraph is not a guarantee the company will survive.
What Happens When Each Is Violated
Because GAAP and GAAS apply to different parties, violations trigger different enforcement mechanisms.
GAAP Violations by Companies
A public company that issues materially misstated financial statements faces SEC enforcement and private litigation. The SEC can seek civil penalties, disgorgement of profits, injunctions against future violations, and bars preventing officers from serving as directors of public companies. These are not theoretical risks; the SEC has imposed nine-figure penalties, required independent compliance monitors, and mandated retraining of accounting staff. Federal securities law also exposes companies to investor lawsuits under Section 10(b) of the Securities Exchange Act and Rule 10b-5, which make it unlawful to make an untrue statement of a material fact in connection with the purchase or sale of a security.
When misstatements surface, the company usually has to restate its prior financial statements. Restatements are expensive, they tend to trigger stock price declines and credit rating downgrades, and the loss of investor confidence can take years to rebuild.
GAAS Violations by Auditors
Auditors who fail to follow auditing standards face discipline from their regulator. The PCAOB can censure registered firms, impose civil money penalties, bar individual auditors from associating with any registered firm, and require remedial measures such as additional training or quality control reforms.9Public Company Accounting Oversight Board. Enforcement Actions The PCAOB also inspects registered firms routinely, and inspection deficiencies are published, creating reputational pressure independent of formal enforcement. The SEC can additionally bar auditors from practicing before the Commission, effectively ending their ability to audit public companies.
For auditors of private companies, AICPA enforcement is less aggressive, but state boards of accountancy can suspend or revoke CPA licenses, and malpractice lawsuits from harmed clients or third parties fill the gap. An auditor who signs off on misleading financials because they skipped required procedures has personal liability exposure regardless of which set of auditing standards governed the engagement.
How the Two Frameworks Fit Together
GAAP and GAAS aren’t parallel systems that happen to occupy the same territory. They’re structurally dependent. Every GAAS audit uses GAAP as its benchmark, because the auditor’s opinion explicitly states whether the financial statements conform to GAAP. Without GAAP, the auditor would have no criteria against which to measure the statements. Without GAAS, financial statements would be unverified management assertions with no independent stamp of reliability.
Changes to one framework ripple into the other. When FASB issues a new revenue recognition standard, auditors update their testing procedures to evaluate whether clients are applying it correctly. When the PCAOB tightens its expectations around auditor skepticism or critical audit matters, companies often have to produce more documentation to satisfy the expanded procedures. The two frameworks evolve on separate tracks and keep pulling each other forward.