A financial audit is an independent examination of a company’s financial statements by a licensed accountant who has no stake in the outcome. The auditor gathers evidence, tests the reported numbers, and issues a formal opinion on whether the statements fairly represent the company’s position under an accepted accounting framework such as Generally Accepted Accounting Principles (GAAP). Investors, lenders, and regulators rely on that outside verification because they cannot examine the books themselves.
The output of the audit is not the financial statements. Management prepares those. The output is the auditor’s opinion about them, and that opinion is what gives the numbers credibility with anyone outside the company.
Who Performs a Financial Audit
Only licensed Certified Public Accountants (CPAs) or CPA firms can perform a financial audit. Each state’s board of accountancy handles licensing, and a CPA must meet education, examination, and experience requirements before receiving a license.
When the client is a publicly traded company, the CPA firm must also register with the Public Company Accounting Oversight Board (PCAOB). The Sarbanes-Oxley Act of 2002 created the PCAOB and requires any firm that prepares audit reports for public companies to register with it.1Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002
Independence is the foundation of everything else. Federal regulations require auditors to be free of financial, employment, and business relationships with the client that could compromise objectivity.2eCFR. 17 CFR 210.2-01 – Qualifications of Accountants An auditor who owns stock in the client, has a family member in management, or provides certain non-audit services to the client cannot serve as its independent auditor. Without genuine independence, the opinion is worthless.
The standards the auditor follows depend on the client. Auditors of public companies work under PCAOB auditing standards, and the report explicitly states that the audit was performed “in accordance with the standards of the PCAOB.”3Public Company Accounting Oversight Board. AS 3101 – The Auditors Report on an Audit of Financial Statements Auditors of private companies follow Generally Accepted Auditing Standards (GAAS) issued by the American Institute of CPAs. The two frameworks overlap, but PCAOB standards impose additional public-company requirements, including reporting on critical audit matters and internal controls.4Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
Who Needs a Financial Audit
Federal securities laws require publicly traded companies to file financial statements examined by an independent auditor. Most of the statements a public company submits to the SEC, including those in its annual report, must carry an independent auditor’s opinion.5U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know
Nonprofits and government entities that spend $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit under the federal Uniform Guidance. That threshold rose from $750,000 in the 2024 Uniform Guidance revision, effective for fiscal years beginning on or after October 1, 2024.6U.S. Department of Health and Human Services Office of Inspector General. Single Audits FAQs A Single Audit examines both the financial statements and the entity’s compliance with federal award requirements.
Private companies often face audit requirements too, though these come from contracts rather than regulation. Banks routinely write audit clauses into loan covenants. Private equity investors, venture capital firms, and joint venture partners frequently demand audited statements. Some states also require audits for particular businesses, such as insurance companies and large charities.
What the Audit Covers
A standard financial audit examines the four primary financial statements management prepares:
- The balance sheet, a snapshot of assets, liabilities, and equity at a specific date.
- The income statement, revenue and expenses over a reporting period.
- The statement of cash flows, cash moving in and out through operations, investments, and financing.
- The statement of changes in equity, showing how ownership interests shifted during the period.
The notes accompanying these statements matter as much as the numbers. Notes explain the accounting policies management used, break down significant transactions, and disclose contingencies like pending lawsuits. The auditor examines the notes as part of the overall package.
For public companies, the audit scope extends further. Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of the company’s internal controls over financial reporting, and it requires the independent auditor to evaluate that assessment and issue a separate opinion on whether those controls actually work.7U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Internal controls are the policies and procedures a company uses to keep transactions recorded accurately, assets protected, and reports reliable. Even for private company audits with no formal controls opinion, auditors still evaluate internal controls during planning to decide how much substantive testing to do. Weak controls mean the auditor has to dig deeper.
Auditors do not check every transaction. That would be prohibitively expensive, and the cost would outweigh the benefit.8Public Company Accounting Oversight Board. AS 2315 – Audit Sampling The auditor sets a materiality threshold, the dollar amount above which a misstatement could influence the decisions of someone relying on the statements, and tests samples of transactions and balances focused on the areas with the highest risk of a material misstatement. Large or unusual items may be tested individually.
How the Process Works
A financial audit moves through three phases: planning, fieldwork, and reporting. Start to finish, it typically takes several weeks to several months.
In planning, the auditor builds an understanding of the company’s business, industry, and regulatory environment, then identifies where a material misstatement is most likely to appear. Inherent risk (how susceptible an account is by nature) and control risk (how likely controls are to fail) both feed into the plan. An account with high inherent risk and weak controls gets the most attention.
Fieldwork is where the auditor tests. Controls testing checks whether the company’s internal controls actually operate as designed. Substantive testing goes directly at the balances: sending confirmation requests to banks and customers, physically counting inventory at the warehouse, tracing journal entries back to supporting documentation, and running analytical procedures that compare reported figures to expected patterns. When something unexpected shows up, the auditor investigates.
Near the end of fieldwork, the auditor obtains a written management representation letter in which the company’s executives formally acknowledge their responsibility for the financial statements and confirm specific facts, including that all records were made available and that they are not aware of any fraud affecting the company.9Public Company Accounting Oversight Board. AS 2805 – Management Representations If management refuses to sign, the auditor cannot issue an opinion.
The reporting phase produces the written audit report, addressed to the company’s shareholders and board of directors. The report identifies the financial statements audited, states the respective responsibilities of management and the auditor, and delivers the opinion.3Public Company Accounting Oversight Board. AS 3101 – The Auditors Report on an Audit of Financial Statements
The Four Types of Audit Opinions
The opinion paragraph is what most readers of the report actually care about. Four possibilities exist.
An unqualified opinion, often called a clean opinion, means the financial statements present fairly, in all material respects, the company’s financial position and results in conformity with GAAP. This is what companies want and what most audits produce.
A qualified opinion means the statements are generally presented fairly except for a specific issue. The issue could be a scope limitation, where the auditor was unable to verify something, or a GAAP departure the company refused to correct. The report describes the exception so readers can weigh it.10Public Company Accounting Oversight Board. AS 3105 – Departures From Unqualified Opinions and Other Reporting Circumstances
An adverse opinion means the financial statements do not present fairly the company’s financial position. The misstatements are so material and pervasive that the statements as a whole cannot be relied on. Adverse opinions are rare and severe.
A disclaimer of opinion means the auditor declines to express any opinion at all, typically because the audit’s scope was so severely limited that there was no way to gather enough evidence. Destroyed records, client-imposed restrictions, or extreme uncertainty can all lead to a disclaimer.
Even inside a clean opinion, the report may include an explanatory paragraph flagging “substantial doubt” about whether the company can continue operating for the next twelve months. The auditor evaluates conditions like recurring losses, negative cash flow, loan defaults, or the loss of a major customer, and considers whether management has a realistic plan to address them.11Public Company Accounting Oversight Board. AS 2415 – Consideration of an Entitys Ability to Continue as a Going Concern If substantial doubt remains after weighing those plans, the report must say so. The absence of a going concern paragraph is not a guarantee the company will survive.
What an Audit Does Not Guarantee
A clean opinion does not mean the financial statements are perfect, and it does not mean the auditor would have caught every fraud. Both misconceptions are common.
The auditor’s standard is “reasonable assurance,” which PCAOB standards describe as a high level of assurance but not an absolute guarantee. Because auditors sample rather than examine every transaction, and because many financial statement items involve estimates and management judgment, a material misstatement could exist and go undetected even in a properly conducted audit. The standards themselves acknowledge that “an audit conducted in accordance with generally accepted auditing standards may not detect a material misstatement.”12Public Company Accounting Oversight Board. Reasonable Assurance
Fraud is within the auditor’s scope, but only insofar as it would materially distort the financial statements. The auditor is required to plan and perform the audit to obtain reasonable assurance the statements are free of material misstatement “whether due to error or fraud.”13Public Company Accounting Oversight Board. Fraud Risk Resources An employee embezzling a few thousand dollars from a billion-dollar company is unlikely to move the numbers and is not what the audit is designed to catch. Sophisticated management fraud involving collusion or fabricated documentation is notoriously hard to detect through standard procedures, which is why major accounting scandals occasionally surface even at companies with Big Four auditors.
The financial statements themselves belong to management, not the auditor. Management prepares them, maintains the controls behind them, and provides the auditor with information. The auditor tests and evaluates that work but is not responsible for the statements the way management is.
External Audit vs. Internal Audit
The word “audit” gets used for two very different things. An external audit is what this article describes: an independent CPA firm examines the financial statements and issues a formal opinion for the benefit of outside parties like shareholders, lenders, and regulators. The external auditor’s loyalty runs to the investing public, not to management.
An internal audit is a voluntary function staffed by the company’s own employees or an outsourced team that reports to the board’s audit committee. Internal auditors have a broader mandate: operational efficiency, compliance with laws and company policies, risk management, and strengthening internal controls. Their reports go to management and the board, not to outside investors. Good internal audit work can make an external audit easier, but it does not substitute for an independent external opinion.