Auditing and Attestation Services: What They Are, How They Work, and Which One Your Business Needs

What Are Auditing and Attestation Services?

Auditing and attestation services are independent CPA engagements that provide stakeholders — lenders, investors, regulators, and business partners — with varying levels of confidence in the accuracy of financial information. Auditing refers specifically to the examination of financial records and statements. Attestation is the broader professional category encompassing any engagement where a CPA issues a written conclusion about subject matter measured against established criteria.

Only licensed CPAs meeting independence and competency requirements can perform attest services. This is a legal distinction enforced by state boards of accountancy, not an optional professional courtesy. The AICPA establishes the professional standards that govern every engagement type, from basic compilations to comprehensive audits.

The practical purpose is straightforward: external parties need independent confirmation that financial information is trustworthy before they commit capital, extend credit, or approve contracts. As companies scale past the $1M–$5M revenue mark, banks, investors, and government agencies increasingly require some form of independent financial verification. The specific level of assurance depends on who is requesting the information and what decisions they're making based on it.

Key Takeaway: Auditing and attestation services are independent CPA engagements governed by AICPA standards (GAAS, SSAE, SSARS) that provide stakeholders with confidence in financial information accuracy — the specific service level depends on who requires it and what decisions they'll make from it.

What Is the Difference Between Auditing and Attestation?

The relationship between auditing, attestation, and assurance confuses many business owners — and most competitor articles conflate the terms. A clear framework helps: think of these as nested categories where assurance is the broadest umbrella, attestation sits inside it, and auditing is one specific type of attestation.

How Auditing Works

An audit is the most comprehensive form of attestation. CPAs independently examine financial statements through risk assessment, transaction testing, third-party balance confirmations, internal control evaluation, and analytical procedures. The result is an opinion — the CPA's professional judgment on whether financial statements are free from material misstatement. GAAS (Generally Accepted Auditing Standards) govern audit engagements for private companies, while the Public Company Accounting Oversight Board (PCAOB) sets standards for publicly traded entities.

How Attestation Works

Attestation is the broader category. It encompasses any engagement where a CPA issues a written conclusion about subject matter against established criteria. Beyond financial statement audits, attestation includes examinations, reviews, and agreed-upon procedures on topics ranging from internal controls to compliance reports. The SSAE — currently SSAE 18 with updates through SSAE 23 — governs these engagements. Attestation work produces a formal report with a defined level of assurance, whether that's the reasonable assurance of an examination or the limited assurance of a review.

Where Assurance Fits In

Assurance is the umbrella concept. All attestation engagements are assurance engagements, but not all assurance engagements are attestation. In common business usage, "audit" and "attestation" are often used interchangeably — and that's fine for casual conversation. The technical distinctions matter when specifying what engagement your CPA will perform, what report you'll receive, and what conclusions that report supports.

Key Takeaway: Auditing is one type of attestation, which is one type of assurance — understanding this hierarchy (assurance → attestation → audit) helps business owners communicate precisely with their CPA about which engagement they need and what report they'll receive.

The Four Levels of Attest Services

CPA firms provide four distinct levels of attest services, each with a different scope, assurance level, governing standard, and cost. Matching the right service to your situation prevents overspending on assurance you don't need and underprotecting against risks you can't afford to ignore.

Compilation

A compilation is the lowest-cost CPA financial statement service. The CPA takes client-provided financial data and organizes it into properly formatted financial statements. No testing, no verification, no opinion. The compilation report states explicitly that no assurance is provided. Compilations are governed by SSARS and carry a unique advantage: CPAs can compile financial statements even when they lack independence from the client, provided the lack of independence is disclosed in the report. This means the same firm handling your bookkeeping can also compile your statements.

Review

A review engagement provides limited assurance through analytical procedures and management inquiries. The CPA compares current-period financial data to prior periods and industry benchmarks, asks management about significant transactions and accounting policies, and reads the financial statements for obvious issues. The review report states that "nothing came to our attention" requiring material modification — this is called negative assurance. Reviews are governed by SSARS and require CPA independence, with no exception. SSARS 25, effective for periods ending after December 15, 2023, now requires CPAs to determine and apply materiality in review engagements, strengthening the quality of this service.

Audit

An audit provides the highest level of assurance. The CPA independently examines financial statements through risk assessment, internal control evaluation, transaction testing, third-party confirmations with banks and customers, analytical procedures, and physical observations such as inventory counts. The result is an opinion on whether financial statements are fairly stated per GAAP. Audit opinions range from unqualified (clean — the best outcome) to qualified, adverse, or disclaimer. Audits are governed by GAAS for private companies and PCAOB standards for public entities.

Agreed-Upon Procedures

Agreed-upon procedures (AUP) engagements are customized: the CPA performs specific procedures agreed upon by the client and intended users, then reports factual findings without expressing an opinion or conclusion. Governed by SSAE 19, AUPs are useful for M&A due diligence, loan covenant compliance testing, royalty verification, and [government contractor compliance requirements](link-target: Government Contractor Audit Requirements). Cost varies entirely by scope — a narrowly defined AUP can cost $3,000–$5,000, while a comprehensive engagement may exceed $15,000.

Key Takeaway: The four CPA attest services — compilation, review, audit, and agreed-upon procedures — range from $3,000 to $50,000+ in the Maryland market and provide escalating levels of assurance, from no assurance (compilation) to a formal opinion (audit).

How Do You Know Which Attestation Service Your Business Needs?

The right attestation service depends on three factors: what your stakeholders require, where your business is headed, and what internal value the engagement provides beyond compliance.

Lender and Investor Requirements

Banks and credit unions specify the required service level in loan covenants. SBA loans may accept reviewed financial statements for businesses under $20M gross revenue. Venture capital investors typically require audited financials before funding rounds. Before engaging a CPA, read your loan documents and operating agreements carefully. If the language says "CPA-prepared financial statements" without specifying a service level, you have negotiation room — many businesses overspend by getting audits when a [review or compilation](link-target: Audit vs Review vs Compilation Decision Guide) would satisfy the requirement.

Regulatory and Government Contract Triggers

Certain situations require a specific service level by law or regulation:

1. Government contractors pursuing federal contracts may need DCAA-compliant accounting systems and audited financials for pre-award surveys
2. Nonprofit organizations exceeding Maryland's $750,000 charitable contributions threshold must obtain independent audits filed with the Maryland Secretary of State
3. Employee benefit plans with 100 or more participants with account balances require annual [ERISA audits](link-target: Employee Benefit Plan Audits) filed with the Department of Labor
4. Organizations receiving $1 million or more in federal awards must complete single audits under the Uniform Guidance
5. Publicly traded companies must obtain annual audits under SEC and PCAOB requirements

These triggers are non-negotiable — the service level is determined by statute or regulation, not business preference.

Voluntary Audits for Growth-Stage Businesses

Companies planning to seek investment, pursue acquisitions, or scale into government contracting within the next 12–24 months should consider getting ahead of audit requirements. A voluntary audit strengthens your negotiating position during fundraising, reveals internal control weaknesses before they become costly, and establishes a baseline that reduces the cost of subsequent annual audits.

Key Takeaway: Start with what your stakeholders require — loan covenants, regulations, and grant agreements often dictate the service level. If no specific level is stipulated, factor in your growth trajectory: businesses planning to seek investment or government contracts within 12–24 months benefit from proactive audits.

What Do Auditing and Attestation Services Cost?

Cost transparency builds trust. In the Maryland and D.C. metro market, here's what mid-market businesses ($1M–$25M revenue) can expect:

The single biggest cost driver across all service types is the quality of the client's accounting records. Businesses with disorganized books, incomplete reconciliations, and missing documentation pay significantly more because the CPA must spend additional time requesting, organizing, and verifying information. Proper [audit preparation](link-target: How to Prepare for a Financial Audit) can reduce engagement costs by 15–25%.

First-year engagements cost more than recurring work. The CPA must establish opening balances, understand the business from scratch, and perform additional procedures that aren't necessary in subsequent years. Plan for a 20–30% premium in year one.

Regulated industries pay more. Government contractors subject to FAR compliance, healthcare organizations with Medicare/Medicaid participation, and financial institutions with multiple entities and complex transactions require specialized expertise and additional procedures that increase engagement costs.

Key Takeaway: Maryland mid-market businesses should budget $3,000–$8,000 for compilations, $8,000–$20,000 for reviews, and $15,000–$50,000+ for audits — with the quality of accounting records being the single largest controllable cost factor across all engagement types.

Who Can Perform Audit and Attestation Services in Maryland?

In Maryland, only licensed CPAs can perform attest services — and not all CPA firms are qualified. The Maryland Board of Public Accountancy requires specific education (150 semester hours including 30 in accounting and ethics), examination (all four sections of the Uniform CPA Exam), and experience (one year or 2,000 hours endorsed by an active CPA) before individual licensure.

CPA firms providing audit or attest services for Maryland clients must undergo peer review at least once every three years. This requirement, administered through the Maryland Association of CPAs (MACPA), is a quality assurance mechanism — an independent assessment of the firm's quality control system. Not all CPA firms maintain peer review status. Firms that handle only tax preparation, bookkeeping, or consulting do not undergo peer review.

Independence is a legal requirement, not an ethical aspiration. The CPA performing your audit or review cannot have financial ties to your business and must follow AICPA Code of Professional Conduct independence rules. Compilations are the exception — a CPA can compile financial statements even without independence, provided the report discloses the impairment.

This matters practically: hiring a CPA firm without current peer review status or without attest authority means their report may not be accepted by your lender, regulatory agency, or government contracting officer. Before engaging a firm for attest services, confirm their peer review status and the date of their most recent review.

Key Takeaway: Maryland CPA firms performing attest services must maintain peer review status (renewed every three years through MACPA) — firms handling only tax and bookkeeping don't undergo this quality review, so verify your firm's attest credentials before engaging.

Industry-Specific Attestation Needs

Different industries face different attestation requirements based on their regulatory environment, funding sources, and stakeholder expectations. For businesses operating in the D.C. metro and Maryland market, four sectors carry particularly complex requirements.

Government Contractors

Federal contracts frequently require audited financial statements as part of pre-award surveys. The Defense Contract Audit Agency (DCAA) evaluates accounting system adequacy, incurred costs, and pricing proposals for defense and federal civilian contracts. Federal Acquisition Regulation (FAR) compliance requires specific cost accounting practices — including proper segregation of direct and indirect costs — that affect how auditors test transactions. Firms pursuing government work should build audit-readiness into their accounting systems from day one, not after a contract is awarded. For detailed guidance, see [government contractor audit requirements](link-target: Government Contractor Audit Requirements).

Healthcare Organizations

Healthcare entities face multiple attestation triggers. Medicare and Medicaid participation, state licensing, and grant funding may each require audited financial statements with specific supplementary schedules. Healthcare organizations also navigate additional compliance layers — including HIPAA privacy requirements and Stark Law physician self-referral restrictions — that auditors must evaluate when assessing controls and testing transactions.

Real Estate and Construction

Lender covenants for commercial real estate loans frequently require reviewed or audited financial statements. Percentage-of-completion revenue recognition under ASC 606 adds audit complexity that affects both testing procedures and cost. Joint ventures, partnerships, and multi-entity structures common in commercial real estate create consolidated financial statement requirements that increase engagement scope.

Technology Companies and Startups

Venture capital investors require audited financial statements before funding rounds — typically starting at Series A. SOC 2 attestation reports are increasingly mandatory for SaaS and technology companies handling customer data, addressing security, availability, processing integrity, confidentiality, and privacy controls. Growing tech firms often encounter audit requirements for the first time when scaling, making early engagement with an attest-qualified CPA firm essential for timeline management.

Key Takeaway: Government contractors (DCAA/FAR compliance), healthcare organizations (Medicare/Medicaid participation), real estate firms (lender covenants), and technology companies (investor requirements and SOC 2) each face industry-specific attestation obligations that require specialized CPA expertise beyond standard financial statement audits.