The Financial Statement Audit Process: What Happens at Each Phase and How to Prepare

What Is a Financial Statement Audit?

A financial statement audit is an independent examination of an organization's financial statements — balance sheet, income statement, statement of cash flows, and statement of changes in equity — conducted by a licensed CPA firm under GAAS. The audit's purpose is to provide reasonable (not absolute) assurance that financial statements are free from material misstatement, whether caused by error or fraud. The result is a formal audit opinion expressing the CPA's professional judgment on whether the statements are presented fairly in accordance with GAAP.

Common triggers include bank or lender covenant requirements, investor due diligence before funding rounds, regulatory obligations (ERISA, SEC, state nonprofit thresholds), board governance policies, franchise agreements, and proactive decisions by growth-stage companies preparing for capital raises or acquisitions. An audit differs from a review or compilation in both depth and assurance level — audits involve substantive testing, third-party confirmations, and internal control evaluation that reviews and compilations do not.

Key Takeaway: A financial statement audit provides reasonable assurance — via a formal CPA opinion under GAAS — that financial statements are free from material misstatement, and is triggered by lender requirements, regulatory obligations, investor due diligence, or proactive growth planning.

What Are the 5 Phases of a Financial Statement Audit?

The financial statement audit process moves through five distinct phases, each with specific activities, deliverables, and time requirements:

1. Pre-Planning and Engagement — auditor selection, engagement letter, document request list
2. Planning and Risk Assessment — business understanding, control walkthroughs, audit plan development
3. Fieldwork and Testing — substantive testing, confirmations, control evaluation, analytical procedures
4. Reporting and Opinion — financial statement review, management representation letter, opinion issuance
5. Follow-Up and Remediation — addressing findings, implementing improvements, ongoing communication

Phase 1 — Pre-Planning and Engagement (Weeks 1–2)

The audit begins with auditor selection and the issuance of an engagement letter — a formal document defining the scope, timeline, estimated fees, and responsibilities of both the CPA firm and the company. Shortly after signing, the audit team sends a document request list (often called the PBC — Prepared by Client list) containing 30–80 items depending on complexity. The company should designate one internal contact to coordinate document delivery and schedule staff availability for auditor interviews. Preparing these documents in advance is the single most effective way to reduce audit duration and cost.

Phase 2 — Planning and Risk Assessment (Weeks 3–5)

Auditors interview management and key staff to understand the business, its industry, and its financial control environment. They conduct walkthroughs of major transaction cycles — revenue, purchasing, payroll, and cash — tracing a sample transaction from initiation to recording. Based on these walkthroughs, the audit team performs a risk assessment, identifying areas with the highest probability of material misstatement. High-risk areas receive more intensive testing during fieldwork. The outcome is a detailed audit plan specifying which accounts to test, what sample sizes to use, and which procedures to perform.

Phase 3 — Fieldwork and Testing (Weeks 6–9)

Fieldwork is the most intensive phase for both the audit team and the company. Auditors perform three categories of procedures:

• Substantive testing examines evidence supporting specific account balances. Examples include sending confirmation letters directly to banks, confirming accounts receivable balances with customers, observing physical inventory counts, and examining supporting invoices for significant transactions.
• Internal controls testing evaluates whether the company's financial controls — approval processes, segregation of duties, reconciliation procedures — are designed effectively and operating as intended.
• Analytical procedures compare current-year numbers against prior years, budgets, and industry benchmarks to identify unusual fluctuations requiring explanation.

Companies should expect daily or bi-weekly open items requests during active fieldwork. Responding promptly to these requests directly reduces the engagement timeline.

Phase 4 — Reporting and Opinion (Weeks 10–12)

The audit team prepares or reviews the financial statements, including all required footnote disclosures per GAAP. Management reviews and approves the financial statements — even when the auditor assists with preparation, management takes full responsibility for the statements' accuracy and completeness.

The company's leadership signs the management representation letter — a formal confirmation that all information provided to auditors was complete and accurate. The auditor then issues one of four opinions: unqualified (clean), qualified, adverse, or disclaimer. If internal control weaknesses were identified, the auditor issues a separate management letter detailing deficiencies and recommendations.

Phase 5 — Follow-Up and Remediation (Ongoing)

After the opinion is issued, the company addresses any control deficiencies or recommendations from the management letter, implements process improvements identified during the audit, and maintains communication with the CPA firm between annual engagements — particularly when unusual transactions or accounting questions arise.

Key Takeaway: The five audit phases span 6–16 weeks for mid-market companies, with fieldwork (Weeks 6–9) being the most intensive — designating one internal audit contact and responding promptly to document requests are the two most effective ways to keep the engagement on schedule.

How Long Does a Financial Statement Audit Take?

Audit timelines vary by company size, complexity, and preparation quality. For the Maryland and D.C. metro market:

First-time audits take 20–30% longer than recurring engagements because the auditor must establish opening balances, understand the business from scratch, and perform additional verification procedures. Calendar year-end clients (December 31) face peak auditor workload from January through April — fiscal year-ends outside this window often receive faster turnaround and more flexible scheduling.

The single biggest variable is client preparation. Companies that provide complete, organized documentation at the start of fieldwork can reduce the timeline by 2–4 weeks. Companies with unreconciled accounts, missing documentation, or incomplete schedules add significant time as auditors request, wait for, and verify additional information.

Key Takeaway: Mid-market financial statement audits take 10–16 weeks, with first-time engagements running 20–30% longer. Client preparation quality is the single biggest controllable variable, capable of reducing timelines by 2–4 weeks.

What Does an Auditor Look For During Fieldwork?

During fieldwork, auditors examine six core areas to gather sufficient evidence for their opinion on the financial statements.

Cash and bank accounts. Auditors send confirmation letters directly to every bank where the company holds accounts — the bank responds to the auditor, not the company. Auditors verify outstanding items on reconciliations and test a sample of cash transactions for proper recording and authorization.

Accounts receivable. Auditors may send confirmation letters to a sample of customers asking them to verify their outstanding balance. They test collectibility by reviewing aging reports and evaluate the adequacy of the allowance for doubtful accounts.

Inventory. For companies with significant inventory, auditors observe the physical inventory count (often attending the count in person), test pricing and valuation against purchase invoices and market data, and review for obsolescence or slow-moving items.

Revenue recognition. Auditors test that revenue is recorded in the correct period through cutoff testing — examining transactions near year-end to verify they land in the right fiscal year. Revenue recognition policies are evaluated for compliance with GAAP, particularly ASC 606 for contracts with customers.

Accounts payable and expenses. Auditors search for unrecorded liabilities by examining payments made after year-end — if a payment in January relates to a December expense, it should appear as an accrued liability. Expense classification and period accuracy are tested through sampling.

Internal controls. Auditors evaluate whether key controls — including approval hierarchies, segregation of duties, bank reconciliation procedures, and access restrictions to accounting systems — are designed effectively and operating consistently. Control weaknesses are documented and communicated to management.

Key Takeaway: Auditors independently confirm balances with banks and customers, observe physical inventory counts, test revenue cutoff near year-end, search for unrecorded liabilities, and evaluate internal controls — these six areas form the core of every financial statement audit's fieldwork phase.

What Are the Four Types of Audit Opinions?

The audit opinion is the formal conclusion of the financial statement audit process. Four opinion types exist, each carrying different implications for your business relationships and next steps.

An unqualified opinion — the goal of every audit — means the auditor found the financial statements presented fairly in all material respects. A qualified opinion identifies a specific exception but confirms the rest of the statements are reliable. An adverse opinion is a serious red flag indicating the statements should not be relied upon. A disclaimer of opinion means the auditor was unable to complete the audit sufficiently to form any conclusion, typically due to severe documentation gaps or going-concern uncertainties.

Key Takeaway: Over 90% of audits result in an unqualified (clean) opinion — qualified opinions identify specific exceptions that can usually be resolved for the following year, while adverse opinions and disclaimers are rare but require immediate remediation action.

What Happens When an Auditor Finds Problems?

Finding issues during an audit is normal — most engagements identify some adjustments and internal control recommendations. Discovery of errors doesn't mean the company is in trouble; it means the audit process is working as designed.

Adjusting journal entries are corrections the auditor proposes for material misstatements found during testing. Common examples include uncorrected accruals, revenue cutoff errors, and classification issues. The company can accept and record these entries. If the company disagrees with a proposed adjustment, the item may affect the audit opinion depending on materiality.

Passed adjustments are immaterial misstatements below the auditor's posting threshold. These are documented in a summary of unadjusted differences but don't require correction. The auditor monitors them cumulatively — if individually immaterial items accumulate to a material level over multiple years, they may require correction.

Management letter findings address internal control weaknesses identified during the audit. Findings are graded by severity: significant deficiencies represent meaningful weaknesses that merit attention, while material weaknesses are severe enough to create a reasonable possibility of material misstatement and may need to be reported to lenders or the board. Most management letter items are process improvements, not crises.

The audit team works collaboratively with management to resolve issues during the engagement — not after. A good auditor raises concerns as they emerge, giving the company time to gather additional evidence, make corrections, or implement controls before the opinion is finalized. The goal is accurate financial statements and stronger processes, not punitive findings.

Key Takeaway: Most audits produce some adjusting entries and management letter recommendations — significant deficiencies and material weaknesses require attention and may need external reporting, but the majority of findings are correctable process improvements identified collaboratively during the engagement.

What Documents Do You Need for a Financial Statement Audit?

Organizing documents before the auditor's first request reduces both timeline and cost. The typical PBC (Prepared by Client) list falls into five categories:

Financial records: Year-end trial balance, general ledger detail for all accounts, bank reconciliations for every account through year-end, investment statements from custodians, accounts receivable and payable aging reports, and revenue detail by customer or category.

Legal and organizational documents: Articles of incorporation or operating agreement, board meeting minutes (especially those authorizing significant transactions, executive compensation, or debt), all contracts and lease agreements in effect during the year, loan agreements with debt schedules, and current insurance policies.

Tax and compliance filings: Prior-year tax returns, current-year estimated tax payments, sales tax filings (if applicable), Form 990 (for nonprofits), and property tax records.

Internal controls documentation: Chart of accounts, accounting policies manual, authorization matrices (who can approve expenditures at each dollar level), bank signature cards, and voided check copies for payroll verification.

Supporting schedules: Fixed asset register with depreciation schedules, prepaid expense schedules, accrued liability schedules with supporting calculations, equity roll-forward showing all ownership changes, and intercompany transaction detail for multi-entity organizations.

Companies [preparing for their first audit](link-target: How to Prepare for a Financial Audit) should start assembling these documents 2–3 months before the engagement begins. Missing documents are the most common source of audit delays — and delays increase costs.

Key Takeaway: The typical audit PBC list includes 30–80 items across five categories (financial records, legal documents, tax filings, controls documentation, and supporting schedules) — start assembling these 2–3 months before the engagement to avoid the delays that increase audit costs.