Accounting and auditing firms do two related but separate jobs: they prepare financial information for clients, and they independently verify financial information that someone else prepared. A single firm often offers both services, plus tax and advisory work, but independence rules keep it from preparing and auditing the same client’s numbers. That preparer-and-verifier split is the whole reason the profession exists, and it shapes everything else these firms do.
The practical menu is broader than most people expect. On the preparer side, firms handle bookkeeping, payroll, tax returns, international disclosures, cybersecurity examinations, fraud investigations, and strategic consulting. On the verifier side, they issue formal opinions on financial statements, test internal controls, and provide the assurance that lenders, investors, and regulators rely on to trust a company’s reported numbers.
What Accounting Firms Do on the Preparer Side
Accounting is the day-to-day work of recording transactions, classifying them correctly, and turning them into financial statements. That means bookkeeping, payroll processing, bank reconciliations, and producing the balance sheet, income statement, and cash flow statement that describe a company’s financial position. The audience is both internal management and outside stakeholders like investors and creditors.
All of this work happens inside a shared rulebook. In the United States, that rulebook is Generally Accepted Accounting Principles (GAAP), set by the Financial Accounting Standards Board and recognized by the SEC as the designated private-sector standard setter for public companies.1U.S. Securities and Exchange Commission. Reaffirming the Status of the FASB as a Designated Private-Sector Standard Setter The FASB’s Accounting Standards Codification is the single authoritative source of nongovernmental U.S. GAAP.2Financial Accounting Standards Board. Accounting Standards Codification When two companies in the same industry both follow GAAP, an investor can compare them on relatively equal footing.
Tax Compliance and Planning
For most individuals and smaller businesses, tax work is the most visible thing an accounting firm does. It splits into two pieces. Compliance is the preparation and filing side, running from individual returns up through complex corporate filings. For businesses with employees, this also covers the quarterly filing of Form 941, which reports federal income tax, Social Security, and Medicare taxes withheld from paychecks.3Internal Revenue Service. About Form 941 Employers Quarterly Federal Tax Return Planning is the forward-looking side: structuring mergers, acquisitions, and capital expenditures to minimize tax exposure within the law. Compliance reports what happened; planning shapes what happens next.
International tax adds another layer. U.S. citizens and residents with foreign financial assets above certain thresholds face two separate federal reporting obligations. Under the Foreign Account Tax Compliance Act, taxpayers with specified foreign financial assets exceeding $50,000 at year-end (or $75,000 at any point during the year, for unmarried filers living in the U.S.) must report those assets on Form 8938 with their annual return. Married couples filing jointly have a $100,000 year-end threshold, and taxpayers living abroad face higher thresholds.4Internal Revenue Service. Summary of FATCA Reporting for US Taxpayers Separately, any U.S. person with foreign bank accounts exceeding $10,000 in aggregate at any time during the year must file FinCEN Form 114, the FBAR. Different forms, different thresholds, different filing destinations, and steep penalties for missing either one.
Advisory, Cybersecurity, and Forensic Work
Advisory engagements move firms past historical numbers into forward-looking strategy: operational improvement, technology implementation, risk management, and transaction support. Risk advisory identifies operational, financial, and regulatory vulnerabilities before they turn into crises.
Cybersecurity has become a major growth area inside this practice. A SOC 2 report, developed by the AICPA and issued by an independent CPA firm, evaluates a service organization’s controls against five Trust Services Criteria: security (always required), availability, processing integrity, confidentiality, and privacy.5AICPA & CIMA. SOC 2 – SOC for Service Organizations Trust Services Criteria The company chooses which criteria beyond security to include based on what its clients care about. Enterprise buyers routinely demand a SOC 2 report before signing with a cloud provider or payroll processor, which is why this work sits so squarely inside accounting firms.
Forensic accounting applies investigative technique to suspected fraud and financial disputes. Forensic accountants trace money through complex transactions, reconstruct manipulated records, and quantify losses. When the matter goes to court, they serve as expert witnesses: quantifying damages in breach-of-contract cases, calculating lost profits after a business interruption, valuing assets in divorce proceedings. The analysis has to survive cross-examination, so the underlying work has to be airtight.
What Auditing Firms Do on the Verifier Side
Auditing is the independent examination of financial statements after someone else has prepared them. The auditor reviews records, tests internal controls, and issues a formal opinion on whether the statements fairly represent the company’s financial position. The point is to give outsiders a reason to trust the numbers, because someone with no stake in the outcome has checked them. If the same people who built the numbers also signed off on them, the assurance would be meaningless.
The output of an audit is one of four opinions, and knowing what each one means is the fastest way to understand what an audit actually tells you.
- Unqualified (clean) opinion: The statements present fairly, in all material respects, the company’s financial position in conformity with GAAP. This is what companies want and what most receive.
- Qualified opinion: The statements are fairly presented except for a specific issue. The auditor found a GAAP departure or a scope limitation, but not one severe enough to make the whole set of financials unreliable.
- Adverse opinion: The financial statements do not present the company’s position fairly. This is the worst outcome and signals serious reporting problems.
- Disclaimer of opinion: The auditor could not form an opinion at all, typically because the scope was too restricted to reach any conclusion.
These categories come from PCAOB auditing standards that govern how auditors report findings.6Public Company Accounting Oversight Board. AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances Anything short of clean tends to alarm lenders and investors, which is exactly why the audit has teeth.
Internal Controls Audits for Public Companies
Public companies get a second layer of auditor scrutiny. Section 404(a) of the Sarbanes-Oxley Act requires management to assess the effectiveness of its internal controls over financial reporting and include that assessment in the annual SEC filing. Section 404(b) requires the company’s independent auditor to separately evaluate and attest to management’s assessment.7U.S. Government Accountability Office. Sarbanes-Oxley Act Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones PCAOB Auditing Standard 2201 governs how auditors run these integrated audits, requiring them to obtain reasonable assurance about whether any material weaknesses exist in the company’s controls.8Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Firms often help clients design, document, and test controls on the consulting side, while separate teams (or an entirely different firm, to preserve independence) perform the attestation.
Why Independence Keeps the Two Sides Apart
An audit opinion is worthless if the auditor has a financial interest in the outcome or a close relationship with client management. Federal law and SEC regulations put hard walls around this principle.
The Sarbanes-Oxley Act flatly bars a firm auditing a public company from providing that same client with certain non-audit services: bookkeeping, financial information systems design, appraisal or valuation services, actuarial services, internal audit outsourcing, management functions, broker-dealer or investment advisory services, legal services unrelated to the audit, and anything else the PCAOB designates.9Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002 An auditor cannot objectively evaluate financial statements it helped create.
SEC rules push further. An auditor is not independent if anyone at the firm, or their immediate family, holds a direct financial interest in the audit client, such as stocks, bonds, or options. Loans between the audit firm and the client are also restricted.10eCFR. 17 CFR 210.2-01 Qualifications of Accountants Cooling-off periods apply too: a former audit team member generally cannot step into a financial reporting oversight role at the audit client without a waiting period after leaving the firm. That is why the largest firms keep tight personal investment policies for their employees. A single partner buying stock in a client can compromise the entire engagement.
Who Regulates the Firms
The profession operates under a layered oversight system: a federal board for public company auditors, a national professional organization for private company work, and state boards that license individual CPAs.
The Public Company Accounting Oversight Board, created by Sarbanes-Oxley, registers audit firms, sets auditing standards, conducts inspections, and runs enforcement proceedings.11Investor.gov. Public Company Accounting Oversight Board Registered firms are inspected on a schedule set by statute, with annual inspections for firms that regularly audit more than 100 issuers and triennial inspections for the rest.12Office of the Law Revision Counsel. 15 USC 7214 Inspections of Registered Public Accounting Firms Results are published in public reports.
Those reports are worth reading before hiring a firm. In 2024, PCAOB inspections found deficiencies in 39% of audit engagements examined across all firm sizes. The Big Four rate was 20%. Smaller, triennially inspected firms exceeded 60%.13Public Company Accounting Oversight Board. PCAOB Posts Report Detailing Significant Improvements Across Largest Firms A deficiency means the auditor did not obtain sufficient evidence to support its opinion in a particular area; it does not automatically mean the financial statements were wrong. The rates still explain why the oversight system exists.
The American Institute of Certified Public Accountants sets auditing standards for engagements involving private companies and other non-issuers outside PCAOB jurisdiction.14AICPA & CIMA. Standards and Statements It also runs the Peer Review Program, which requires firms performing audits or reviews of non-public entities to undergo a quality control review by another CPA firm.15American Institute of Certified Public Accountants. AICPA Peer Review Peer review is the private-company counterpart to PCAOB inspection.
Individual CPAs are licensed by state Boards of Accountancy. Each state sets its own education, experience, and continuing professional education requirements, typically between 24 and 40 CPE hours annually, and has the authority to grant, suspend, or revoke licenses. Firms register with the state board to practice public accounting. Requirements vary by state, so CPAs who move may need to meet new standards.
Choosing a Firm: Size, Structure, and Fees
Firms range from four-person local shops to global networks with hundreds of thousands of employees. Size matters less than fit for the client’s complexity, industry, and regulatory profile.
The Big Four (Deloitte, EY, KPMG, and PwC) dominate the market for the largest public companies. As of 2024, they collectively audit approximately 80% of the market capitalization of companies listed on U.S. exchanges.13Public Company Accounting Oversight Board. PCAOB Posts Report Detailing Significant Improvements Across Largest Firms Their typical U.S. structure is the Limited Liability Partnership, which shields individual partners from personal liability for other partners’ malpractice while keeping each partner responsible for their own errors.
National and regional firms serve mid-sized public companies and large private businesses with the full audit, tax, and advisory menu. They compete directly with the Big Four in the mid-market and often lead in specific industries or regions. Local firms serve small businesses and high-net-worth individuals in a limited geography, offering personalized attention and lower overhead. Boutique firms specialize deeply in one niche such as nonprofit audits, restaurant accounting, or real estate.
Fee arrangements come in three common forms. Hourly billing is standard for audit and advisory work where the scope is not fully predictable. Fixed fees are common for recurring compliance work like tax return preparation. Value-based pricing ties the fee to the outcome the client receives rather than hours worked and is gaining ground in consulting engagements. Audit fees for public companies are publicly disclosed in annual proxy statements, so prospective clients can benchmark what similar companies pay. Private company audit and tax fees are negotiated directly and vary widely by size, industry, and number of locations.