Audit, Review, or Compilation: Choosing the Right Level of Assurance

Someone tells a business owner their bank, their investors, or a grant program "needs audited financials," and the owner hears the one word that matters, audit, and braces for the most invasive, most expensive engagement a CPA firm offers. Half the time, that is not actually what's being requested. Lenders and investors use "audit" as shorthand for "financials I can trust," when the loan covenant or grant agreement in front of them actually calls for a review, or in some cases just a compilation. The first real task, before any fieldwork gets scheduled, is translating the request into the specific engagement standard being invoked, because the gap in cost, timeline, and intrusiveness between the three levels is not small, and quoting the wrong one wastes everyone's time.

A compilation is the lightest of the three. The CPA takes management's numbers and puts them into proper financial statement form, applies professional judgment on presentation, but expresses no opinion or assurance at all about whether the numbers are accurate. It exists for situations where a lender or partner wants statements that carry a CPA's name and format discipline, without needing any testing behind them. It is fast, comparatively inexpensive, and it is often the right answer for a small business whose real need is "make this look professional," not "prove it's correct."

A review sits in the middle, and it is where a surprising number of lending and line-of-credit requirements actually land once you read the covenant language closely. The CPA performs analytical procedures and makes inquiries of management, comparing current results to prior periods, asking about unusual fluctuations, checking that the numbers make internal sense. But does not test underlying transactions or confirm balances with third parties. The resulting report states that nothing came to the CPA's attention causing them to believe the statements need material modification. That is limited assurance, not a guarantee, but for most bank covenant purposes it is exactly the level of comfort a lender is actually asking for.

An audit is the real thing, and it earns its reputation for being disruptive. The auditor tests transactions, confirms balances directly with banks and major customers, evaluates internal controls, and ultimately issues an opinion on whether the financial statements fairly present the company's position in accordance with GAAP. This is what's actually required for a 401(k) or other retirement plan once it crosses the eligible-participant threshold that triggers a plan audit requirement, for many state single-audit thresholds tied to federal or state grant funding, and frequently for bond covenants and larger institutional financing. It is also what most private equity buyers want to see for the trailing two or three years before a transaction closes, regardless of what any loan document says.

Getting the trigger right matters because the consequences of guessing wrong run in both directions. Scoping a full audit when a review would have satisfied the lender burns weeks of staff time and a meaningfully larger fee for no real benefit. Scoping a review or compilation when the actual requirement was an audit, common when a company crosses a plan-participant threshold mid-year and nobody flags it, creates a compliance gap that surfaces later, often when a regulator or plan auditor notices the mismatch, which is a far worse conversation than the one that would have happened up front.

The single biggest driver of cost overruns on any of these engagements, audits especially, is the condition of the books walking in. An auditor who has to spend billable hours reconciling bank accounts, tracking down unsupported journal entries, or reconstructing a fixed asset ledger before they can begin actual testing is not doing audit work. They are doing bookkeeping cleanup at audit rates. Businesses that keep a disciplined monthly close, document related-party transactions as they happen, and maintain a real fixed asset schedule routinely cut weeks off an audit timeline and a meaningful amount off the fee, simply because fieldwork starts on clean ground instead of starting with reconstruction.

Independence is worth understanding before you assume your regular accounting firm can simply add an audit on top of the bookkeeping they already do. Professional standards place real limits on a firm providing both ongoing bookkeeping services and an audit opinion for the same client, and where it is permitted at all, it requires specific safeguards and documentation that your auditor has to justify, not something either side wants to discover mid-engagement. If an audit is on the horizon, it is worth having that conversation with whoever prepares your books well before the engagement letter is signed, not after.

Timeline is the practical constraint that catches owners off guard most often. A compilation can turn around in days. A review typically takes a few weeks once the books are in order. An audit, even a well-prepared one, runs months rather than weeks once fieldwork, testing, and partner review are accounted for. If a lender has given you a hard deadline, work backward from that date immediately, not after the engagement letter is signed, because "audited financials by the fifteenth" and "we start fieldwork on the tenth" are two very different conversations.

OICPA scopes assurance engagements by confirming the actual requirement in writing with whoever is asking for it, assesses whether the books are ready for the level requested before committing to a timeline, and coordinates compilation, review, and audit work, including plan audits and lender-driven reviews. So the engagement matches what's actually required instead of what sounded safest to ask for.