A corporate audit is an independent examination of a company’s financial statements, records, and internal controls, performed by an outside accounting firm to determine whether the numbers the company reports can be trusted. The audit ends in a formal written opinion aimed at investors, lenders, and regulators. For any company with securities registered with the Securities and Exchange Commission, that annual examination is required under the Sarbanes-Oxley Act of 2002.1GovInfo. Sarbanes-Oxley Act of 2002
Auditing Is Not Accounting
Accounting is the day-to-day work of recording transactions, categorizing expenses, and assembling those records into financial statements. Auditing comes after. It’s the independent check on whether those statements are accurate and whether the systems that produced them actually work.
The goal isn’t certainty. Auditors aim for “reasonable assurance” that the statements are free from material misstatement, whether caused by error or fraud. That’s a high level of confidence, but not a guarantee. Auditors rely on sampling and professional judgment rather than reviewing every transaction, because verifying every entry would be prohibitively expensive.2Public Company Accounting Oversight Board. AU 230.10 – Due Professional Care in the Performance of Work
Throughout the work, the auditor applies professional skepticism, a questioning mindset that treats management’s explanations as claims to be tested rather than facts to be accepted. Evidence has to be sufficient in quantity and appropriate in quality. A bank statement confirming a cash balance is far more reliable than an email from the CFO saying the balance is correct.3Public Company Accounting Oversight Board. AS 1105 – Audit Evidence
What the Audit Actually Examines
A statutory financial audit covers two things. First, the financial statements themselves: do they fairly represent the company’s position under Generally Accepted Accounting Principles? Second, the internal controls over financial reporting: are the systems that produce those numbers designed well enough to catch or prevent errors before they hit the statements?4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Public companies must go through this every year. Private companies aren’t bound by Sarbanes-Oxley, but audits often come up anyway. Banks frequently require them as a lending condition, and many states require nonprofits above certain revenue thresholds to submit audited statements. Some private companies choose a less expensive “review engagement” instead, where the accountant performs limited procedures and offers only limited assurance rather than the full opinion an audit produces.
Types of Corporate Audits
The word “audit” covers several distinct exercises, each with a different audience.
Statutory Financial Audits
This is what most people mean by “corporate audit”: the annual, external examination of financial statements described above. It’s the one the SEC, shareholders, and lenders care about.
Internal Audits
Internal auditors are company employees. Their work isn’t limited to financial data; they evaluate risk management, operational efficiency, IT security, and compliance with company policies. One team might investigate whether a warehouse’s inventory controls are working; another might check whether employees are following procurement rules. To preserve some independence, internal auditors typically report to the audit committee rather than to the executives whose departments they review. Their reports stay inside the company.
Compliance Audits
Compliance audits check whether a company is following specific laws, regulations, or contractual obligations. The scope is narrow. A lender might audit a borrower to verify loan covenants are being met. A healthcare organization might face a review of its data privacy practices under HIPAA.5U.S. Department of Health and Human Services. OCR’s HIPAA Audit Program IRS audits sit here too: the agency examining a company’s return to check whether income, expenses, and credits were reported correctly under the tax code.6Internal Revenue Service. IRS Audits
How the Process Runs
A typical annual audit runs about three months from start to finish, broken into three stages.
Planning
The auditor starts by learning the company’s business, industry, and internal control environment. Strong, well-documented controls give the auditor more confidence and reduce the volume of transaction-level testing needed later. Weak controls mean more testing.
Planning also sets a materiality threshold, the dollar level above which a misstatement would matter to a reasonable investor. It isn’t a fixed formula. The auditor picks a benchmark, often net income or total assets, then adjusts for the company’s circumstances using professional judgment.7Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit The engagement partner bears ultimate responsibility for the plan and for supervising the team, even when tasks are delegated to junior staff.8Public Company Accounting Oversight Board. AS 1201 – Supervision of the Audit Engagement
Fieldwork
Fieldwork is where the plan gets executed. Two kinds of testing dominate. Tests of controls confirm that the company’s processes operated as designed throughout the year. Substantive tests examine the dollar amounts and disclosures directly.
Confirmations are among the most important procedures. The auditor writes to banks, customers, or creditors to verify balances independently. For cash and accounts receivable, PCAOB standards require confirmation directly with the third party, or equivalent evidence from an independent external source, with the auditor keeping control of the process so the company can’t intercept or alter responses.9Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation Auditors also physically inspect assets like inventory, sample transactions, and compare current figures against prior periods and industry norms. The guiding principle: evidence from independent outside sources beats anything generated internally.
Wrap-Up and Opinion
After fieldwork, the team evaluates subsequent events, meaning things that happened between the balance sheet date and the report date. Some events shed new light on conditions that existed on the balance sheet date and may require adjusting the numbers. Others are new developments that don’t change the numbers but may need disclosure.10Public Company Accounting Oversight Board. AS 2801 – Subsequent Events The team also adds up every misstatement found during fieldwork, even small ones, to see whether they collectively cross materiality. Size isn’t the only test. A small misstatement can still be material if it involves fraud, affects executive compensation triggers, or turns a reported profit into a loss.
What the Audit Report Says
The report communicates the auditor’s conclusion in a standardized format. The opinion type is what everyone reading it looks for first.11Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
An unqualified opinion, also called a clean opinion, says the financial statements present a fair picture in all material respects under GAAP. It’s the outcome every company wants.
A qualified opinion says the statements are fairly presented except for a specific issue. The auditor might issue one when a particular account is misstated, or when a scope limitation prevented testing in one area but the rest checks out. The report spells out exactly what the exception is.
An adverse opinion says the statements do not fairly present the company’s financial position. The reported numbers are fundamentally unreliable, and the market treats it that way.
A disclaimer of opinion means the auditor couldn’t form an opinion at all, usually because the company restricted access to records so severely that meaningful testing was impossible. Financial statements carrying a disclaimer are essentially unusable for lending or investment decisions.
Sitting on top of any of these, the report may include a going concern paragraph. Auditors are required on every engagement to evaluate whether substantial doubt exists about the company’s ability to continue operating for the next twelve months. Recurring losses, loan defaults, and cash shortages can trigger the analysis. If doubt remains after considering management’s plans, the report must use the phrase “substantial doubt about its ability to continue as a going concern.”12Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entitys Ability to Continue as a Going Concern A going concern warning doesn’t mean failure is certain, but it’s one of the strongest red flags a reader of financial statements can receive.
A related finding on the internal control side is a material weakness: a deficiency that creates a reasonable possibility a significant error could go undetected. Material weaknesses must be disclosed and typically force the company to spend time and money on remediation before the next audit.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Who Can Perform a Corporate Audit
Not just any accountant qualifies. The Sarbanes-Oxley Act requires the audit firm for a public company to be registered with the Public Company Accounting Oversight Board, which oversees all auditors of public companies. Registration involves an application, annual fees, and annual reporting.13Public Company Accounting Oversight Board. Registration
Independence is the quality that gives the audit its value. An external auditor must be independent both in fact and in appearance: no financial ties, no conflicts of interest, no willingness to bend findings. PCAOB rules require auditors to maintain objectivity, stay free of conflicts, and never knowingly misrepresent facts or defer to someone else’s judgment.14Public Company Accounting Oversight Board. PCAOB ET Section 102 – Integrity and Objectivity To keep auditors from getting too close to clients, Sarbanes-Oxley makes it illegal for a lead audit partner or the reviewing partner to serve the same company for more than five consecutive years, with a five-year cooling-off period before they can return.1GovInfo. Sarbanes-Oxley Act of 2002
Inside the company, the audit committee hires, pays, and oversees the auditor. Not management. Every audit committee member has to be an independent director who takes no consulting or advisory fees from the company outside the board role. The whole point of the audit is to check management’s work, so letting management control the auditor would defeat the purpose.15Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002
What It Costs
Audit fees for public companies have climbed steadily. Industry surveys put the average public company’s audit bill for fiscal year 2024 at roughly $2.7 million, about eight percent higher than the prior year. Adding audit-related fees, tax work, and other services brought total payments to the audit firm to approximately $3.3 million on average. Smaller public companies pay much less; the largest corporations can spend tens of millions annually. Cost tracks company size, complexity, industry, number of subsidiaries, and the condition of internal controls. Weak or poorly documented controls raise the bill, because the auditor has to compensate with additional testing.