You need audited accounts when a specific law, regulator, funder, lender, investor, or governance document requires independent verification of your financial statements. The most common triggers are SEC registration, banking and broker-dealer regulation, spending $1,000,000 or more in federal awards, running an employee benefit plan with 100 or more participants, loan covenants, and due diligence for a financing round or sale. Everything below explains which of these applies to which kind of organization, and what happens if you ignore a requirement that does apply.
Public Companies Filing With the SEC
Every company registered with the Securities and Exchange Commission must include audited financial statements in its annual Form 10-K.1U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 – Registrants Financial Statements If your shares trade on a public exchange, you file audited financials every year. No exceptions.
Sarbanes-Oxley adds a second layer. Accelerated filers must also include an external auditor’s report on the effectiveness of their internal controls over financial reporting under Section 404(b). Smaller reporting companies that qualify as non-accelerated filers, generally those with a public float below $75 million, are exempt from that external internal-controls attestation, though the underlying financial statement audit still applies.2U.S. Securities and Exchange Commission. Smaller Reporting Companies
Banks, Broker-Dealers, and Insurance Companies
Insured depository institutions face a federal audit mandate tied to asset size. Under FDIC rules, any insured institution with $1 billion or more in consolidated total assets at the beginning of its fiscal year must obtain an annual independent audit.3eCFR. 12 CFR 363.1 – Scope The threshold was previously $500 million; the FDIC raised it to $1 billion in a recent rulemaking.4Federal Deposit Insurance Corporation. Part 363 – Summary of Filing Requirements Institutions below that line may still face audit requirements from their primary federal regulator or state banking authority.
Broker-dealers have no size exemption. SEC Rule 17a-5 requires every registered broker-dealer to file an annual financial report accompanied by a report from an independent public accountant, due within 60 days of the fiscal year-end.5eCFR. 17 CFR 240.17a-5 – Reports To Be Made by Certain Brokers and Dealers The report also goes to the firm’s designated examining authority and, where applicable, the Securities Investor Protection Corporation.
Insurance companies file annual audited financial statements with state insurance commissioners. These audits follow statutory accounting principles rather than GAAP, reflecting the regulators’ focus on solvency and reserve adequacy.
Organizations Spending $1,000,000 or More in Federal Awards
Any non-federal entity that spends $1,000,000 or more in federal awards during its fiscal year must undergo a Single Audit under the Uniform Guidance.6eCFR. 2 CFR 200.501 – Audit Requirements That threshold was $750,000 for many years; the Office of Management and Budget increased it to $1,000,000 effective for audit periods beginning on or after October 1, 2024.7Office of Inspector General. Single Audits FAQs
A Single Audit goes beyond ordinary financial statement testing. It also evaluates whether the organization complied with the specific conditions attached to each major federal program, so the auditor needs experience with the Uniform Guidance, not just general financial-statement work. Entities that spend less than $1,000,000 are exempt from federal audit requirements for that year, though they must still keep records available for review by the awarding agency or the Government Accountability Office.6eCFR. 2 CFR 200.501 – Audit Requirements This is the audit trigger that catches most universities, state agencies, hospitals, and nonprofits administering federal grants.
Employee Benefit Plans With 100 or More Participants
This is the trigger that catches many mid-sized companies off guard. Federal law requires employee benefit plans with 100 or more participants to include an independent auditor’s report as part of the annual Form 5500 filing with the Department of Labor.8U.S. Department of Labor. Selecting An Auditor For Your Employee Benefit Plan The count is based on participants who have an account balance at the beginning of the plan year, and that includes terminated employees who have not yet rolled over or withdrawn their balances.
The 80-120 rule provides a buffer. If your plan previously filed as a small plan (under 100 participants) and you have between 80 and 120 participants at the start of the plan year, you can continue filing as a small plan and skip the audit. Once you cross 121 participants with balances, you file as a large plan and the audit becomes mandatory. Some pension plans with fewer than 100 participants may also trigger an audit if they fail to satisfy certain conditions related to plan investments and bonding.
The auditor must follow generally accepted auditing standards and issue an opinion on the plan’s financial statements and schedules.9eCFR. 29 CFR 2520.103-1 – Contents of the Annual Report
Nonprofits Under State Law and Grantmaker Requirements
Nonprofits face a patchwork. The IRS does not mandate an audit for Form 990, but many states impose their own threshold based on annual revenue or the amount of charitable contributions received. Those thresholds range from roughly $500,000 to $2 million or more, depending on the state. A nonprofit registered to solicit in multiple states may need to satisfy the most restrictive threshold among them.
Grantmakers add a second layer. Major foundations and corporate sponsors routinely require audited financial statements before releasing funds, so for a nonprofit relying on large institutional grants, audited financials become a practical necessity regardless of state law. And any nonprofit that spends $1,000,000 or more in federal awards falls under the Single Audit requirement on top of any state-level audit mandate.6eCFR. 2 CFR 200.501 – Audit Requirements
Companies Preparing To Go Public
If you are taking a company public, you must include audited financial statements in your SEC registration statement. Most registrants need three years of audited income statements, cash flow statements, and changes in equity, plus two years of audited balance sheets.1U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 – Registrants Financial Statements Smaller reporting companies and emerging growth companies only need two years of audited financial statements.10U.S. Securities and Exchange Commission. Emerging Growth Companies
The practical problem: if your company has never been audited and you decide to pursue an IPO, you may need to audit two or three prior years retroactively. That is far more expensive and time-consuming than auditing each year as it closes, so companies that anticipate going public within a few years typically start annual audits well in advance.
Loan Covenants and Surety Bonds
Commercial banks extending significant credit almost always require audited financial statements, not because a statute compels it but because the loan agreement says so. A typical term loan or revolving credit facility includes a covenant requiring the borrower to deliver annual audited financials within 90 to 120 days of fiscal year-end. The audit gives the bank independent assurance that the balance sheet is reliable and that ratios like debt-to-equity and interest coverage are being calculated from verified numbers.
Failing to deliver on time is a technical default under most loan agreements, which gives the lender the right to accelerate repayment, raise the interest rate, or refuse future draws on a line of credit. In practice most banks grant a short extension before exercising those remedies, but the leverage shifts to them the moment you miss the deadline.
Construction contractors hit a related requirement through surety bonds. Bonding companies generally accept compiled or reviewed financials for smaller projects, but as bond amounts grow into the tens of millions of dollars, audited statements become the standard expectation.
Investor Due Diligence and M&A
Private equity and venture capital firms require audited financials as a standard part of due diligence before committing capital. The audit validates historical revenue, expenses, and cash flow, giving investors a verified baseline for valuation. Later-stage rounds carry the strongest expectation; a company seeking Series B or growth equity without at least one year of audited statements will face skepticism from institutional investors who need to justify the investment to their own limited partners.
In a merger or acquisition, the buyer’s diligence team almost always insists on audited financials for the target, even if the target has historically used only reviewed or compiled statements. Sellers who enter the process without them often discover the buyer demands one as a condition of closing, which delays the transaction and weakens the seller’s negotiating position.
Governance Agreements and Voluntary Audits
Shareholder agreements and operating agreements in multi-owner businesses frequently require annual audited financials. The logic is straightforward: when owners who are not involved in day-to-day operations need to rely on the numbers for profit distributions, management bonuses, or valuing an ownership stake on exit, an independent audit heads off disputes. This contractual trigger is especially common in family businesses, joint ventures, and partnerships where the financial interests of the parties diverge.
Large private companies sometimes commission a voluntary audit purely for internal control purposes. The process forces management to formalize and document financial procedures, and the auditor’s management letter typically contains specific observations about operational weaknesses and control gaps.
Audit, Review, or Compilation: Which One Do You Actually Need
Before committing to a full audit, check what the requirement actually says. The word “audit” is often used loosely, and the two lower levels of assurance cost significantly less.
- Audit (highest assurance): the accountant tests internal controls, confirms account balances directly with banks and customers, observes inventory, and examines source documents. The opinion provides reasonable assurance that the financial statements are free from material misstatement. This is what regulators, major lenders, and institutional investors mean by “audited financials.”
- Review (limited assurance): the accountant performs analytical procedures and asks management questions but does not test controls or confirm balances with third parties. The report states only that the accountant is not aware of material modifications needed. Some lenders accept a review for smaller credit facilities.
- Compilation (no assurance): the accountant organizes management’s financial data into standard format without performing any verification. The report explicitly disclaims any opinion on accuracy.
If your loan covenant says “reviewed financial statements,” paying for a full audit is unnecessary. Read the specific language in your agreement, grant terms, or regulatory filing requirement before engaging a CPA firm.
What Happens If You Skip a Required Audit
Public companies that fail to file Form 10-K on time face potential SEC enforcement, including trading suspensions of up to 10 business days and proceedings that can lead to revocation of the company’s Exchange Act registration. Both the NYSE and Nasdaq append delinquency indicators to the ticker and begin delisting proceedings if the filing remains outstanding for six months or more.
Organizations subject to the Single Audit that fail to comply risk remedial action under the Uniform Guidance, including withholding of funds, suspension of the award, or required repayment of disallowed costs.11eCFR. 2 CFR Part 200 Subpart F – Audit Requirements For a university or nonprofit that depends on federal grants, losing access to future funding can be existential.
Employee benefit plans that fail to include the required independent auditor’s report with Form 5500 face DOL civil penalties for late or incomplete filings, and the IRS can impose separate penalties. Plan fiduciaries can face personal liability for the failure.
For privately held companies, the most common consequence is contractual. Missing an audit deadline under a loan covenant triggers a technical default. Missing one under a shareholder agreement can give minority owners the right to demand remedies or pursue legal action. Those consequences lack the drama of an SEC enforcement action, but they can be just as costly.