A statutory audit is a legally required examination of an organization’s financial statements by an independent certified public accountant, who then issues a public opinion on whether those numbers are reliable and prepared under accepted accounting rules. The requirement is not universal. It comes from specific federal laws that target specific kinds of organizations: public companies, large banks, retirement plans past a certain size, and entities that spend federal grant money. If your organization sits in one of those categories, an audit is mandatory. If it doesn’t, a federal statute almost certainly isn’t forcing you to get one.
Who Is Legally Required to Get One
Four separate federal regimes create audit mandates, and each has its own trigger. Crossing any one of them independently creates the obligation.
SEC-Registered Public Companies
Any company with securities registered under Section 12 of the Securities Exchange Act of 1934 must file an annual report containing audited financial statements.1eCFR. 17 CFR 240.13a-1 – Requirements of Annual Reports The statements must follow U.S. GAAP and be examined by an independent auditor.2U.S. Securities and Exchange Commission. All About Auditors: What Investors Need to Know This covers exchange-listed companies under Section 12(b) and companies pulled in by Section 12(g) because they have more than $10 million in total assets and either 2,000 or more shareholders of record or 500 or more non-accredited shareholders.3U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 – Registrants Financial Statements
The audited annual report is filed on Form 10-K, and the deadline depends on the company’s public float:
- Large accelerated filer ($700 million or more in public float): 60 days after fiscal year-end.
- Accelerated filer ($75 million to under $700 million): 75 days after fiscal year-end.
- Non-accelerated filer (under $75 million): 90 days after fiscal year-end.
These deadlines come from the Form 10-K general instructions.4U.S. Securities and Exchange Commission. Form 10-K General Instructions Float is measured on the last business day of the company’s most recently completed second fiscal quarter.5U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions
Banks and Insured Depository Institutions
Banks, savings associations, and other insured depository institutions with $1 billion or more in consolidated total assets at the start of the fiscal year must have their financial statements audited annually by an independent public accountant under FDIC rules.6eCFR. 12 CFR Part 363 – Annual Independent Audits and Reporting Requirements The FDIC raised this threshold from $500 million to $1 billion effective January 1, 2025, with future inflation adjustments to follow.7Federal Register. Adjusting and Indexing Certain Regulatory Thresholds Institutions at or above $5 billion in assets have to go further and include a management assessment of internal controls over financial reporting in the annual report.
Employee Benefit Plans
Retirement plans governed by ERISA, including 401(k) plans, pension plans, and profit-sharing plans, must obtain an independent audit once they reach 100 or more eligible participants. The count includes everyone eligible to participate whether or not they actually contribute, former employees still holding an account balance, and beneficiaries of deceased participants.8eCFR. 29 CFR 2520.103-1 – Contents of the Annual Report
Plans hovering near the boundary can use the 80-120 rule. If a plan filed as a small plan (under 100 participants) in the prior year and its current count falls between 80 and 120, it can continue filing as a small plan and skip the audit. Once the count reaches 121, the audit is mandatory regardless of prior filing status.
The audited financial statements are submitted with the plan’s Form 5500, due by the last day of the seventh month after the plan year ends. For a calendar-year plan, that’s July 31. An extension is available using Form 5558.9Internal Revenue Service. Form 5500 Corner
Organizations Spending Federal Awards
Any non-federal entity, whether a nonprofit, state agency, or local government, that spends $1 million or more in federal awards during its fiscal year must undergo a Single Audit. This threshold was raised from $750,000 in April 2024, and the new amount applies to fiscal years ending on or after September 30, 2025.10eCFR. 2 CFR Part 200 Subpart F – Audit Requirements A Single Audit goes beyond an ordinary financial statement review. It also tests whether the organization complied with the specific terms of each federal program it participated in. For-profit subrecipients are exempt from these rules, though the entity passing federal funds through to them must set up its own compliance monitoring.
Private Companies Outside These Categories
There is no federal threshold that forces private companies to obtain an audit based on revenue or asset size alone. When a private company faces a mandatory audit, it is almost always because it lands in one of the categories above, or because a state law or contract imposes the requirement. Some states require audits for particular entities like insurance companies or licensed financial businesses. Lenders and investors sometimes demand audited financials as a condition of providing capital, but that’s contractual, not statutory.
Who Performs the Audit
The person signing the audit opinion must be a Certified Public Accountant licensed by a state board of accountancy. For audits of public companies and broker-dealers, the accounting firm itself must be registered with the Public Company Accounting Oversight Board, which reviews the firm’s application to confirm that registration is consistent with protecting investors and the public interest.11PCAOB. Section 2 Registration and Reporting
Independence is the non-negotiable principle underlying the whole process. An auditor cannot own stock in the client, have a family member in a key financial role at the company, or provide certain consulting services that would effectively mean reviewing their own work. The Sarbanes-Oxley Act also requires that the lead audit partner and the concurring review partner rotate off the engagement after five consecutive years, followed by a five-year cooling-off period before returning to that client.12U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence Familiarity breeds blind spots. A partner who has signed off on the same client’s numbers for a decade is more likely to miss something than a fresh set of eyes.
The auditor is appointed by shareholders or by an independent audit committee of the board, not by the executives whose numbers are being examined. Keeping that authority away from management is fundamental to the process working.
What the Audit Covers
The scope covers the entity’s full set of financial statements: the balance sheet, income statement, statement of cash flows, statement of stockholders’ equity, and all accompanying notes. The auditor doesn’t check every transaction. They apply professional skepticism and judgment to test samples, focusing on areas most likely to contain errors or manipulation. Revenue recognition, inventory valuation, and complex financial instruments draw the most scrutiny because they involve the most management estimates.
Testing includes confirming account balances directly with banks and customers, physically inspecting inventory or equipment, reviewing contracts and supporting documents, and evaluating whether management’s accounting estimates are reasonable. The auditor also assesses whether the statements are properly classified and contain adequate disclosures under GAAP. An error is “material” if it is large enough that a reasonable investor would factor it into their decision. A $500 misclassification at a company with $500 million in revenue won’t affect the audit opinion; a $5 million overstatement of revenue at the same company almost certainly would.
Auditors are required to plan and perform the audit to provide reasonable assurance that the financial statements are free from material misstatement, whether from honest error or deliberate fraud.13PCAOB Public Company Accounting Oversight Board. AS 2401 Consideration of Fraud in a Financial Statement Audit Reasonable assurance is a high standard, not a guarantee. A well-designed fraud carried out through collusion and forged documents can escape detection even in a properly conducted audit.
At every audit, the auditor also has to evaluate whether there is substantial doubt about the company’s ability to continue operating for at least one year beyond the date of the financial statements.14PCAOB Public Company Accounting Oversight Board. AS 2415 Consideration of an Entitys Ability to Continue as a Going Concern Warning signs include recurring operating losses, negative cash flow, loan defaults, or the loss of a principal customer. If substantial doubt remains after reviewing management’s plans to address the situation, the auditor adds an explanatory paragraph flagging the concern. The paragraph doesn’t change the audit opinion itself, but it is a serious red flag for investors and creditors.
The Four Possible Opinions
The audit produces a formal report containing the auditor’s opinion, which is the document most stakeholders actually care about. Four outcomes are possible:
- Unqualified opinion (clean opinion): the financial statements are presented fairly in all material respects. This is the result every company wants.
- Qualified opinion: the statements are fairly presented except for one specific issue. The auditor found a material misstatement or couldn’t gather enough evidence on a particular item, but the problem is isolated rather than pervasive.
- Adverse opinion: the statements are not presented fairly. This is the worst outcome and signals that the financial reporting is materially misstated in a way that affects the overall picture. Adverse opinions are rare because most companies fix identified problems before the report is issued.
- Disclaimer of opinion: the auditor was unable to gather enough evidence to form any opinion. This happens when access to records was severely restricted or when uncertainties are so profound that no conclusion is possible.
The report is addressed to shareholders, not to management, and it becomes publicly available through SEC filings or other regulatory submissions. Anything other than an unqualified opinion can trigger loan covenant violations, regulatory scrutiny, and a sharp drop in investor confidence.
What Happens If You Don’t Comply
Failing to file audited financial statements when required carries real penalties, and they compound.
For public companies, the SEC can bring enforcement actions resulting in cease-and-desist orders and civil penalties. In recent actions involving deficient late-filing disclosures, the SEC imposed penalties ranging from $35,000 to $60,000 per company.15U.S. Securities and Exchange Commission. SEC Charges Five Companies for Failure to Disclose Complete Information on Form NT The operational consequences are often worse than the dollar penalty. Stock exchanges require timely filing of audited annual reports as a condition of continued listing, and failure to comply can lead to trading suspensions and ultimately delisting.
For employee benefit plans, the Department of Labor can impose penalties of up to $2,739 per day for failure to properly file a plan’s annual report, including the required audited financial statements.16Federal Register. Federal Civil Penalties Inflation Adjustment Act Annual Adjustments for 2025 On a plan that goes unfiled for a year, that daily penalty alone can exceed $1 million. Plan fiduciaries who allow compliance to lapse also face personal liability under ERISA’s fiduciary duty provisions.
Organizations subject to the Single Audit that fail to comply risk losing eligibility for future federal funding, being placed on high-risk status by federal awarding agencies, or facing more frequent and intensive monitoring that consumes staff time and resources.