An audited profit and loss statement is an income statement that an independent CPA firm has examined and issued a formal opinion on, confirming that the reported revenue, expenses, and net income are free from material misstatement. That opinion is the highest level of assurance available in financial reporting, and it’s what lenders, investors, and regulators rely on when they need to trust the numbers. If a CPA’s name appears on a P&L without that opinion, it hasn’t been audited, no matter how official the document looks.
What Makes a P&L Audited Rather Than Reviewed or Compiled
CPA firms offer three levels of service on financial statements, and only one of them is an audit. The differences are substantial, and confusing them is a common and expensive mistake.
An audit provides reasonable assurance. The CPA firm performs extensive testing of transactions, examines supporting documents, evaluates internal controls, and issues a formal opinion on whether the statements are fairly presented. This is the top tier.
A review provides limited assurance. The CPA performs analytical procedures and asks management questions but doesn’t dig into individual transactions or test controls. The output is a conclusion that nothing came to the CPA’s attention suggesting the statements need material correction. That’s a much lower bar than an audit opinion.
A compilation provides no assurance at all. The CPA helps management format the numbers into proper financial statements but performs no testing and expresses no opinion on accuracy. A compiled P&L carries the CPA’s name and none of their professional judgment about whether the figures are right.
The cost drops steeply at each level. When someone specifies an “audited” P&L, they mean the top tier. A review or compilation will not satisfy a requirement for audited statements.
Who Actually Needs an Audited P&L
Public Companies
Every company registered with the SEC must file audited financial statements. Most public companies include three years of audited income statements in their annual 10-K filing; smaller reporting companies only need two. The audit must follow the standards of the Public Company Accounting Oversight Board, and the auditor has to be a registered public accounting firm that’s independent of the company.
Nonprofits With Federal Awards
Any organization that spends $1,000,000 or more in federal awards during a fiscal year must undergo a “single audit,” which covers both the financial statements and compliance with federal program requirements. Organizations spending less than that threshold are exempt from the federal audit requirement for that year.
Private Companies Meeting Lender or Investor Requirements
No federal law forces privately held companies to get audited. In practice, though, audits are often unavoidable. Banks routinely require audited statements before approving commercial loans, particularly credit lines above a certain size. Private equity investors, potential acquirers, and bonding companies commonly demand them too. Most private company audits happen because a loan covenant or an investor requires one, not because a regulator does.
How the Auditor Tests the Numbers
Auditing an income statement comes down to answering the same questions for every significant account: Did this transaction actually happen? Is the amount correct? Is it recorded in the right period? Is anything missing?
To verify revenue, auditors pull a sample of sales and trace each one back to the customer’s purchase order, the shipping documentation, and the invoice. If the company booked $2 million in December sales, the auditor wants proof that goods shipped or services were delivered before December 31, not January 3. Recording a January sale in December inflates the current period’s net income, and that kind of misclassification is exactly what auditors are trained to find.
Expense testing follows the same logic. The auditor samples recorded costs, from payroll to rent to vendor payments, and matches each one against supporting documents like timecards, lease agreements, and invoices.
Analytical procedures fill in around the transaction testing. The auditor develops an independent expectation of what a number should look like, based on prior years and industry trends, then investigates significant gaps. If gross margin was 42% last year, 41% the year before, and then jumps to 55% with no obvious business reason, that gap gets scrutinized.
Cutoff testing gets particular attention because it’s where manipulation most often hides. Auditors examine transactions recorded in the final days before and the first days after the reporting period ends, looking for revenue pulled forward or expenses pushed back.
The whole process is calibrated to materiality: the threshold at which a misstatement would change a reasonable investor’s or lender’s decision. Auditors set that threshold early in the engagement, and it shapes which accounts get tested and how many transactions get sampled. Errors below the threshold aren’t ignored; they get accumulated, and if enough small ones add up to a material total, the auditor requires correction before signing off.
Weak internal controls make audits more expensive because the auditor has to test more transactions directly. Strong controls, like proper separation of duties, let the auditor lean on the system itself and reduce sample sizes.
What the Auditor’s Opinion Actually Says
The auditor’s report is the payoff of the entire process. It’s addressed to shareholders and the board, and the opinion paragraph is what matters. Four outcomes are possible.
An unqualified opinion, often called a clean opinion, means the auditor found the statements present fairly, in all material respects, the company’s financial position and results of operations under the applicable accounting framework. This is the standard result and the outcome every business wants. If the opinion is unqualified, the P&L figures are reliable for decision-making.
A qualified opinion means the statements are fairly presented except for one specific issue. Maybe the auditor couldn’t verify one asset’s valuation, or the company departed from GAAP on a single policy. The qualification tells you exactly what the exception is. The rest of the statements remain reliable.
An adverse opinion is a red flag. The auditor is stating outright that the statements do not fairly present the company’s financial position. This happens when misstatements are both material and pervasive across multiple accounts. An adverse opinion tells investors and lenders that the P&L cannot be trusted.
A disclaimer of opinion means the auditor couldn’t gather enough evidence to form any opinion at all. This usually happens when management blocks access to records or when independence has been compromised. A disclaimer is as alarming as an adverse opinion because it signals that the audit itself broke down.
Going Concern Warnings
Separately from the four opinion types, an auditor may add a going concern paragraph when there’s substantial doubt about the company’s ability to keep operating for the next twelve months. This usually appears when the company can’t meet its debt obligations without drastic measures like asset sales or restructuring. A going concern paragraph doesn’t change the opinion type; a company can receive a clean opinion with a going concern warning attached. The absence of one is not a promise the company will survive. Auditors don’t predict the future.
What an Audit Won’t Catch
A common assumption is that an audit is designed to uncover fraud. It isn’t, at least not primarily. The auditor’s job is to obtain reasonable assurance that the statements are free from material misstatement, whether from error or fraud. “Reasonable assurance” is explicitly not a guarantee, and even a properly conducted audit can miss material fraud.
Auditors don’t ignore fraud risk. Professional standards require them to approach every engagement with professional skepticism, assess where fraud is most likely, and build in an element of unpredictability so management can’t anticipate which transactions will be tested. But audits are far better at catching unintentional errors like transposed numbers, miscategorized expenses, and incorrect accruals than at detecting deliberate concealment. Sophisticated fraud, especially when it involves collusion among senior management or forged documents, can evade even rigorous audit procedures.
What It Costs and How Long It Takes
A full financial statement audit for a small to midsize company typically takes about three months from kickoff to final report: roughly four weeks of planning, four weeks of on-site fieldwork, and four weeks to compile and review the report. Auditors work on multiple engagements at once, so calendar time usually stretches past the hours actually spent on your files.
Fees vary widely by company size, complexity, and firm. A straightforward audit from a regional or local CPA firm might start around $12,000 to $15,000, while engagements with larger firms or more complex businesses can run $20,000 to $50,000 or more. Costs climb when records are disorganized, internal controls are weak, or the auditor discovers issues that require expanded testing. Reviews cost substantially less than audits, and compilations less still, but neither produces the opinion lenders and regulators typically demand.
Preparation is the biggest controllable factor. The auditor will send a document request list, often called a PBC (“prepared by client”) list, early in the process. Expect to provide the trial balance, general ledger, bank statements, accounts receivable and payable aging reports, major contracts, payroll summaries, and tax filings. Companies that deliver complete, organized records on day one keep fees near the low end of the range. Companies that trickle documents in over weeks pay for every hour of the auditor’s patience.
Your books also need to be on the accrual basis, not cash basis, because GAAP requires accrual accounting for audited statements. If you’ve been tracking finances on a cash basis, you’ll need to convert before the audit begins, and that conversion alone can take weeks when the underlying records aren’t clean.