Introduction
"Audit" carries a specific institutional weight, but the actual rules governing one depend entirely on who's being audited — a private business and a public company are held to genuinely different standards, set by different regulatory bodies, for reasons that trace back to a specific moment in recent financial history.
Table of Contents
- The Core Definition
- "Reasonable Assurance," Not Absolute Certainty
- AICPA Audits: The Private-Company Standard
- PCAOB Audits: The Public-Company Standard
- Why the PCAOB Exists
- Audit vs Review vs Compilation
- Does Your Business Actually Need an Audit?
- FAQ
- Conclusion
The Core Definition
A financial audit is an independent examination of a company's financial statements, performed to produce a professional opinion on whether those statements fairly represent the company's financial position, prepared in accordance with GAAP or IFRS. An auditor reviews the income statement, balance sheet, and cash flow statement, along with the underlying records and internal controls, to form this opinion.
"Reasonable Assurance," Not Absolute Certainty
This is a genuinely important, precise distinction that's easy to misunderstand: an audit provides "reasonable assurance" — a high but explicitly not absolute level of confidence that the financial statements are free from material misstatement. An audit is not a guarantee against every possible error or instance of fraud; it's a rigorous, professionally standardized examination designed to catch anything significant enough to genuinely mislead someone relying on the statements.
AICPA Audits: The Private-Company Standard
Audits of private companies are generally governed by standards set by the American Institute of Certified Public Accountants (AICPA) — specifically, Statements on Auditing Standards (SAS). These standards give auditors meaningful flexibility and professional judgment, particularly in lower-risk areas of the engagement, and the resulting audit reports are typically more concise than their public-company counterparts.
PCAOB Audits: The Public-Company Standard
Audits of public companies are governed by the Public Company Accounting Oversight Board (PCAOB), and these standards are significantly more prescriptive and rigorous. PCAOB audits require:
- Detailed testing of high-risk areas, including specific fraud-risk assessment
- Formal communication with the company's audit committee
- Disclosure of Critical Audit Matters (CAMs) — narrative explanations of the most complex or high-risk areas the audit addressed
- Strong documentation standards and internal control assessments
- Periodic inspections and enforcement by the PCAOB itself, of the audit firms performing this work
Worth noting for 2026 specifically: PCAOB's QC 1000 quality-control standard takes effect December 15, 2026, and AS 1000 has cut the audit documentation completion window from 45 days down to just 14 days — genuinely significant, current tightening of audit-firm requirements worth being aware of if your business is approaching public-company status.
Why the PCAOB Exists
The PCAOB was established in 2002, under the Sarbanes-Oxley Act, passed by Congress in direct response to major accounting scandals — including Enron and WorldCom — that severely damaged public trust in corporate financial reporting. Its specific mission: to oversee audits of public companies and protect the interests of investors through standardized, enforceable, more rigorous auditing requirements than the general AICPA framework provided at the time.
Audit vs Review vs Compilation
These three engagement types offer genuinely different levels of assurance, at correspondingly different costs:
| Audit | Review | Compilation | |
|---|---|---|---|
| Assurance level | High (reasonable assurance) | Limited | None |
| Method | Detailed testing, independent verification | Analytical procedures, inquiry | Data presentation only |
| Relative cost | Highest | Moderate | Lowest |
| Who performs it | Licensed CPA, independent | Licensed CPA | Accountant (verification not required) |
A review relies mainly on analytical procedures and inquiry, rather than the detailed testing an audit requires — genuinely less rigorous, and correspondingly less expensive. A compilation provides no assurance at all — the accountant simply helps organize and present financial data in a standard format, without independently verifying its underlying accuracy.
Does Your Business Actually Need an Audit?
For most small, private businesses, an audit isn't a general legal requirement — but specific circumstances can create a genuine obligation:
- Loan covenants — some lenders require audited financials as a condition of financing
- Investor agreements — venture capital or private equity investors sometimes require audits as part of their governance terms
- Grant requirements — certain government or foundation grants require audited financial statements
- State-specific regulations — some industries or entity types face state-level audit requirements
Absent one of these specific triggers, many small businesses reasonably choose a review or compilation instead — genuinely less costly, while still providing a level of external validation appropriate to their actual needs.
FAQ
An auditor examines a company's financial statements — income statement, balance sheet, cash flow statement — along with the underlying records and internal controls, to form an independent opinion on whether the statements fairly represent the company's financial position in accordance with GAAP or IFRS. The audit provides "reasonable assurance," not an absolute guarantee, that the statements are free from material misstatement.What does a financial audit actually check?
AICPA audits, governed by Generally Accepted Auditing Standards, apply to private companies and give auditors more flexibility and professional judgment, particularly for lower-risk areas. PCAOB audits, mandated for public companies, are significantly more prescriptive and rigorous — they require detailed fraud-risk testing, formal audit committee communication, and disclosure of Critical Audit Matters, reflecting PCAOB's specific mission to protect public market investors.What's the difference between an AICPA audit and a PCAOB audit?
The Public Company Accounting Oversight Board was established in 2002 under the Sarbanes-Oxley Act, passed in direct response to major accounting scandals (including Enron and WorldCom) that severely damaged investor trust in public company financial reporting. Its mission is specifically to oversee audits of public companies and protect investors through stricter, more standardized auditing requirements.Why was the PCAOB created?
Generally not by legal requirement, unless specific circumstances apply — certain loan covenants, investor agreements, grant requirements, or state-specific regulations can create an audit obligation even for a private company. Many small businesses instead opt for a less intensive review or compilation engagement, which cost less and involve a lower level of assurance than a full audit.Does a small private business need an audit?
An audit provides the highest level of assurance, involving detailed testing and independent verification. A review provides limited assurance, based mainly on analytical procedures and inquiry rather than detailed testing — less rigorous and less costly. A compilation provides no assurance at all; the accountant simply helps present financial data in a standard format without verifying its accuracy.What's the difference between an audit, a review, and a compilation?
Only a licensed Certified Public Accountant (CPA), acting independently of the company being audited, can perform and sign off on a financial statement audit. For public companies, the audit firm must additionally be registered with and subject to inspection by the PCAOB.Who can legally perform a financial audit?
Conclusion
Understanding the real difference between AICPA and PCAOB standards — and between an audit, a review, and a compilation — genuinely matters the moment a lender, investor, or grant-maker asks for one specifically. Knowing which level of assurance your situation actually requires, rather than defaulting to the most expensive option out of uncertainty, is a real, practical decision worth making deliberately.
Preparing your books for an eventual audit, review, or investor due diligence? Our Financial Reporting service builds books structured to hold up to that level of scrutiny. Book a free consultation to talk through your specific situation.