Companies get audited because someone with leverage over the business needs independent confirmation that the financial numbers are real. That someone is usually a securities regulator, a bank, an investor, the IRS, the Department of Labor, a federal grant agency, or a buyer sitting across the deal table. Understanding why companies get audited comes down to identifying which of those parties has a claim on the company’s books and what they are entitled to demand. The trigger shapes everything else: the scope of the work, who pays for it, what standard governs it, and what happens if the results come back ugly.
Being Publicly Traded
Every company listed on a U.S. stock exchange must file audited financial statements with the Securities and Exchange Commission. The Securities Exchange Act of 1934 requires these companies to keep books that accurately reflect their transactions and to prepare financial statements under Generally Accepted Accounting Principles.1U.S. Securities and Exchange Commission. 15 USC 78m – Recordkeeping and Internal Controls Provisions The annual filing vehicle is Form 10-K, which must include the full audited statements and the independent auditor’s report.2U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1
The Sarbanes-Oxley Act of 2002 added a second layer. Section 404 requires management to assess and report on the effectiveness of the company’s internal controls over financial reporting. For accelerated filers, the independent auditor must also attest to management’s assessment and issue its own opinion on those controls.3U.S. Securities and Exchange Commission. Sarbanes-Oxley Section 404 – A Guide for Small Business Smaller reporting companies that qualify as non-accelerated filers are exempt from the auditor attestation piece, though they still have to run their own internal assessment.4U.S. Securities and Exchange Commission. Smaller Reporting Companies
Public company auditors pay particular attention to related-party transactions, which must be disclosed when they exceed $120,000.5eCFR. 17 CFR 229.404 – Transactions With Related Persons, Promoters, and Certain Control Persons An adverse audit opinion, a late filing, or a failure to sign off on controls can drop a stock price, trigger SEC enforcement, and expose executives to personal liability under federal securities law.
A Lender or Investor Requiring It
Private companies have no SEC filing obligation, but they still get audited constantly because someone with money on the line insists on it. The most common driver is a bank loan. When a commercial lender extends a large credit facility or term loan, the loan agreement almost always requires audited annual financial statements. The bank uses those numbers to monitor financial covenants such as minimum current ratios, maximum leverage ratios, or a debt service coverage ratio. Breach a covenant and the lender can declare a default, accelerate the loan, or both.
Private equity and venture capital investors demand the same thing before writing a check. They need confidence that the EBITDA figure driving the valuation actually holds up. Overstated earnings discovered after closing turn into indemnification claims. A clean opinion from a reputable audit firm lowers the risk premium investors assign to the deal, which flows straight through to price.
How much audit work a private company needs depends on the size of the capital at stake. A modest credit line might only require a review engagement, which is a lighter procedure that gives limited assurance. A large term loan or an institutional funding round will require a full audit. And when a private company has multiple passive shareholders who can’t watch operations directly, ownership sometimes commissions a voluntary audit purely as a governance check.
The IRS Selecting the Return
An IRS tax audit is a different creature from a financial statement audit. It asks a narrower question: did the company pay the right amount of tax? The auditor is a federal agent, not a CPA the company hired, and the outcome is measured in dollars owed.
The IRS uses a Discriminant Information Function scoring system to flag returns that deviate from statistical norms for similar businesses. High deductions relative to revenue, big swings in reported income, and significant related-party payments all push a return up the score. Large corporations draw extra scrutiny on transfer pricing, because the IRS can reallocate income between related entities in different countries if the intercompany prices don’t reflect what unrelated parties would charge.6Office of the Law Revision Counsel. 26 USC 482 – Allocation of Income and Deductions Among Taxpayers Domestic returns get scrutinized too, especially for excessive owner-executive compensation or above-market rent paid to property the owner controls.
If the IRS finds a substantial understatement of tax, it imposes a 20% accuracy-related penalty on the underpaid portion.7Internal Revenue Service. Accuracy-Related Penalty For C corporations other than S corporations and personal holding companies, an understatement is “substantial” if it exceeds the lesser of 10% of the tax that should have appeared on the return (with a $10,000 floor) or $10 million.8Office of the Law Revision Counsel. 26 US Code 6662 – Imposition of Accuracy-Related Penalty on Underpayments
The general assessment window is three years from the filing date.9Internal Revenue Service. Time IRS Can Assess Tax It stretches to six years when the company omits from gross income an amount exceeding 25% of the gross income shown on the return, and there is no time limit at all when the return was fraudulent.10Office of the Law Revision Counsel. 26 US Code 6501 – Limitations on Assessment and Collection
Crossing the 100-Participant Line on a Benefit Plan
Federal law requires the administrator of an employee benefit plan—a 401(k), pension, profit-sharing plan, or health and welfare plan—to engage an independent qualified public accountant to audit the plan’s financial statements each year, with the audit report attached to the plan’s annual filing with the Department of Labor.11Office of the Law Revision Counsel. 29 USC 1023 – Annual Reports
Plans with fewer than 100 participants at the beginning of the plan year are exempt and can file a simplified annual report instead.12eCFR. 29 CFR 2520.104-46 – Waiver of Examination and Report of an Independent Qualified Public Accountant for Employee Benefit Plans With Fewer Than 100 Participants The participant count sweeps in anyone with an account balance: active employees, part-timers, and former employees who left money behind. Once a plan crosses the 100-participant line, the audit requirement kicks in for that plan year even if the headcount later dips.
Failing to file the required annual report, audit included, exposes the plan administrator to a civil penalty from the Department of Labor under ERISA Section 502(c)(2).13U.S. Department of Labor. Enforcement Manual – Civil Penalties Separate IRS penalties can apply to late or incomplete Form 5500 filings. Growing companies routinely discover the obligation late, after the penalties have already stacked.
Spending Federal Grant Money Above the Threshold
Any organization that spends $1 million or more in federal award funds during its fiscal year must undergo a single audit or a program-specific audit under the federal Uniform Guidance.14eCFR. 2 CFR 200.501 – Audit Requirements The threshold was raised from $750,000 for fiscal years beginning on or after October 1, 2024. It applies to nonprofits, universities, state and local governments, and any other non-federal entity receiving grants from agencies such as the NIH, DOE, or DOD.
What matters is funds expended, not funds received. Direct grant costs plus indirect costs charged to grants both count toward the threshold, and acting as a pass-through that funnels sub-awards to other organizations doesn’t exempt those amounts either.
When all federal expenditures come from a single agency, the recipient can elect a program-specific audit focused on that program’s compliance requirements. When funding comes from multiple federal agencies, a full single audit is required, which adds an entity-wide financial statement audit to the compliance testing. Reports are due nine months after the fiscal year ends. Adverse findings can suspend or terminate future grant funding.
Doing a Major Deal
Certain one-time corporate events create their own audit demands. In an acquisition, the buyer runs a quality-of-earnings analysis that functions as a forensic audit of the target’s financials, validating whether the historical EBITDA used to set the price is sustainable and accurate. Finding $2 million in overstated earnings in a deal priced at 8x EBITDA means the buyer just uncovered $16 million in overvaluation, which is why purchase agreements tie indemnification clauses directly to these findings.
SEC rules layer additional audit obligations on public-company transactions. When a registrant completes or plans a significant business acquisition, it must file audited financial statements for the acquired business covering specified prior periods.15eCFR. 17 CFR 210.3-05 – Financial Statements of Businesses Acquired or To Be Acquired The same requirement arises on the sell side: carve-out financials isolating a divested unit’s performance have to be audited so buyers can evaluate the unit on its own.
Companies preparing for an initial public offering face the most demanding timelines. The SEC’s Form S-1 registration statement requires two years of audited balance sheets and, for companies that don’t qualify as smaller reporting companies, three years of audited income statements, cash flows, and changes in equity.2U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 1 For a private company that has never been audited, producing those historical audits while building the internal controls needed to operate as a public company is one of the most expensive parts of going public.