What should a checklist for auditing already-prepared financial statements contain?

What does an audit provide, and who may perform one?

The preface to the AU-C sections, the AICPA's auditing standards, sets out principles that are not requirements, including an audit's purpose: an auditor's opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework. AU-C section 200 bases that opinion on reasonable assurance, a high but not absolute level of assurance, that the statements as a whole are free from material misstatement, whether due to fraud or error. The AU-C foreword says the standards govern audit reports for entities outside the PCAOB's oversight. AU-C section 200 also requires the auditor to be independent of the entity unless the standards provide otherwise or law or regulation requires the auditor to accept the engagement and report; an auditor who is not independent, with neither exception applying, may not issue a report under the standards.

State law decides who may perform the audit and sign the report, and it differs by state, as California and Florida show.

What does California require?

Business and Professions Code section 5051 treats preparing or certifying reports on audits of financial statements for clients as the practice of public accountancy, and section 5050 bars that practice in California without a California permit or a practice privilege under Article 5.1, apart from exceptions it names. Under section 5096, an individual whose principal place of business is outside California and who holds a current and active license, certificate or permit from another state may practice under a practice privilege, subject to that article's conditions and limitations. That individual may audit or review the financial statements of an entity headquartered in California only through a CPA firm registered with the California board under section 5096.12.

What does Florida require?

Florida Statutes section 473.302(8)(a) counts offering or performing, for the public, services involving an opinion on financial statements as public accounting. Section 473.3101 requires a Florida license for a firm with a Florida office that does that work. A firm without one that does it for a client whose home office is in Florida also needs the license unless it meets section 473.3101(1)(c), which lists these conditions: the qualifications in section 473.309; enrollment in a peer review program under section 473.3125(4); performing the services through an individual with Florida practice privileges; lawful practice in a state where such an individual has his or her principal place of business. Ask the Florida Board of Accountancy whether a firm relying on that paragraph qualifies.

Section 473.3141 lets a CPA without a Florida office practice there with no Florida license, notice or fee if the conditions that section sets are met. Such a CPA may perform opinion work only through a firm licensed under section 473.3101 or authorized by it.

Before engaging anyone, ask the board of accountancy in the state where the business is headquartered, and in the states of the practitioner's principal place of business and the firm's offices, whether the individual may practice there and whether the firm is licensed, registered or otherwise authorized for this engagement.

Is an audit what your situation calls for?

The requirement you received, or its absence, decides which piece of work you need:

The AR-C glossary defines limited assurance, the level of assurance a review gives, as less than an audit's reasonable assurance but acceptable as the basis for the review conclusion, and AR-C section 70 says preparing statements does not require gathering evidence for an opinion or conclusion. Readiness work prepares records and the audit tests them; readiness matters because AU-C section 330 requires a qualified opinion or a disclaimer when the auditor cannot obtain sufficient appropriate evidence about a relevant assertion. Each of those other pieces of work, and the service level a lender needs, is a separate question.

If the requirement proves to be for less once an audit is under way, AU-C section 210 leaves the auditor to determine whether reasonable justification exists for changing to an engagement with less assurance, so settle the level of service before engaging anyone.

Who performs the work, and what can each path conclude?

Only one path supports an audit conclusion on the statements:

Describing either of the last two as an audit misstates the work to everyone who relies on it; the internal audit checklist is a separate question.

What must be settled before any audit work is planned?

When an outside party requires the audit, the program opens by recording who requires it, the document imposing it and what it specifies: statements and periods, reporting framework, auditing standards, deliverable and deadline, taken from that party's own loan agreement, franchise agreement, grant award or regulation. AU-C section 210 then has the auditor establish, before accepting, that the preconditions for an audit exist, meaning an acceptable reporting framework and management's agreement to its responsibilities, and requires the agreed terms, including the audit's objective, scope and framework, to be documented in an engagement letter or other written agreement.

If the entity is a nonprofit or spends federal grant funds, more rules may attach. The Federal Audit Clearinghouse, where federal grant audits are submitted, says the Uniform Guidance outlines the policy for single audits and that states, local governments and nonprofit organizations should follow it when completing audits. Before planning, establish from the award terms and the Uniform Guidance whether a single audit or another award-driven requirement applies, because it changes the scope; for state or private grants, take any audit requirement from the award agreement. The nonprofit audit checklist is a separate question.

The planning section then records three things:

• Acceptance and ethics. AU-C section 300 requires each engagement to begin with acceptance and continuance procedures and an evaluation of compliance with relevant ethical requirements.
• Strategy and scope. AU-C section 300 requires a strategy setting the audit's scope, timing and direction, and a plan setting the risk assessment and further procedures at the assertion level.
• Materiality. AU-C section 200 treats misstatements as material when there is a substantial likelihood that, individually or together, they would influence a reasonable user's judgment, and says judgments about materiality weigh the surrounding circumstances and a misstatement's size or nature, or both. AU-C section 320 requires overall materiality, lower levels for particular items where smaller misstatements would matter, and a performance materiality set below overall materiality, used to assess risks and set further procedures. Section 320 also requires overall and item-level materiality to be revised if information found during the audit would have produced a different amount and, if materiality is lowered, a decision on whether performance materiality must change too.

How does risk assessment set the procedures?

AU-C section 315 requires the auditor to understand the entity, its environment, framework and accounting policies well enough to identify the risks of material misstatement at the statement and assertion levels and to assess each by likelihood and magnitude, marking the significant ones. Under the AU-C glossary, the factors that affect inherent risk include complexity, subjectivity, change, uncertainty and susceptibility to management bias or other fraud risk factors. AU-C section 240 adds a presumption that risks of fraud exist in revenue recognition and treats assessed fraud risks as significant risks. AU-C section 240 also treats management override of controls as a significant risk present in every entity and requires procedures addressing it whatever other risks are found, so every program carries lines for it.

The assessed risk then sets the work. AU-C section 330 requires further procedures whose nature, timing and extent respond to the assessed risk at each relevant assertion, with more persuasive evidence the higher that risk, and, for a significant risk, procedures specifically responsive to it, including tests of details when only substantive procedures are used. Running the same steps on every area spends effort where little is at stake and shortchanges the areas carrying the risk.

How far must controls be understood or tested?

The program records, for each area, which level of control work applies and why:

• Understanding, always. AU-C section 315 requires an understanding of each component of the entity's system of internal control. For the controls it has the auditor identify, including those addressing significant risks and those over journal entries, the auditor evaluates design and determines implementation, using procedures beyond inquiry.
• Testing, when relied on or needed. AU-C section 330 requires tests of operating effectiveness when the risk assessment expects controls to operate effectively or when substantive procedures alone cannot provide sufficient appropriate evidence. Without such tests, AU-C section 315 has control risk assessed at the maximum.

Either way, AU-C section 330 requires substantive procedures for each relevant assertion of each significant class of transactions, account balance and disclosure.

How is the substantive section organized by statement area?

Each significant account or disclosure gets its own lines, each naming the relevant assertion, the assessed risk, the procedure and the evidence expected. AU-C section 315's application material lists the assertions, one set for classes of transactions and another for period-end account balances.

The AU-C glossary defines the appropriateness of evidence as its relevance and reliability and its sufficiency as its quantity, with the quantity needed depending on the assessed risk and the evidence's quality. AU-C section 500's application material notes that evidence relevant to one assertion may not be relevant to all: collecting receivables after period-end may evidence their existence and valuation and the occurrence and accuracy of revenue, but not necessarily completeness. AU-C section 330 also requires procedures on the closing process, including agreeing or reconciling the statements to the accounting records and examining material journal entries and other adjustments.

Where must the program require outside confirmation?

Three sections of the standards shape this part:

• Where confirmation is required. AU-C section 330 requires the auditor to consider external confirmation in each area and to use it for accounts receivable unless the balance is immaterial, confirmation would be ineffective, or the assessed risk is low and the other planned substantive procedures address it. Not confirming a material receivables balance needs a documented basis.
• Why outside evidence counts. AU-C section 500 says reliability generally increases when evidence comes from external parties, because it is less susceptible to management bias.
• How requests are controlled. AU-C section 505 requires the auditor to keep control of every request, each designed for a reply directly to the auditor. It also requires further evidence when a reply's reliability is in doubt, alternative procedures for each nonresponse, and investigation of every exception. Where the auditor has decided a written reply is necessary, AU-C section 505 says alternative procedures cannot replace it; without the reply, the auditor must determine the effect on the audit and the opinion.

Where do analytical procedures sit?

Analytical procedures appear at three stages:

1. Planning. AU-C section 315 includes them among the risk assessment procedures.
2. Substantive testing. Where they serve as substantive procedures, AU-C section 520 requires an expectation precise enough to reveal a material misstatement and a set amount of difference the auditor accepts without further investigation.
3. Near the end. AU-C section 520 requires analytical procedures near the end of the audit to help conclude whether the statements are consistent with the auditor's understanding of the entity.

For the last two, AU-C section 520 requires significant unexpected differences to be investigated, including by obtaining evidence about management's explanations.

How are items selected, and what triggers more testing?

AU-C section 330 requires a means of selecting items that is effective for each test; its application material names selecting all items, selecting specific items and audit sampling, and says results from specific items cannot be projected to the rest of the population. For samples, AU-C section 530 requires selection the auditor can reasonably expect to be representative, investigation of the nature and cause of each misstatement or deviation, and projection of sample misstatements to the population.

The program states in advance what extends the work:

How are misstatements accumulated and evaluated?

AU-C section 450 requires every misstatement that is not clearly trivial to be accumulated and put to management for correction, and those left uncorrected, with uncorrected prior-period misstatements, to be judged by size and nature, alone and in aggregate, against materiality reassessed on actual results. Its application material treats any doubt about whether an item is clearly trivial as meaning it is not. AU-C section 580 requires management's written representation on whether uncorrected misstatements are immaterial, with a summary of them attached.

Every line of the program therefore carries its differences to one summary of misstatements, because differences that pass one at a time can be material together.

What does one line of the program look like?

Take a distributor reporting on the accrual basis whose sales staff earn a bonus on invoiced sales, with fourteen invoices totaling 212,600.00 dated in the last week of the year:

AU-C section 330's application material describes confirming the date and delivery terms of sales where invoicing before shipment is a risk, and AU-C section 530's application material gives later cash receipts, with evidence of what they settle, as an alternative for an unanswered receivables confirmation.

What completes the audit?

The completion section covers six steps before the report is dated:

• Subsequent events. AU-C section 560 requires procedures covering the period from the date of the statements to the date of the auditor's report, designed to identify every subsequent event that requires adjustment of, or disclosure in, the statements.
• Going concern. AU-C section 570 requires the auditor to consider during risk assessment whether conditions or events raise substantial doubt about the entity's ability to continue as a going concern for a reasonable period, to remain alert for them, and to conclude on it.
• Representations. AU-C section 580 requires management's written representations, dated as of the report date, and says they complement other procedures but are not sufficient appropriate evidence on their own.
• Final analytical review. The near-the-end analytical procedures that AU-C section 520 requires are performed here.
• Overall evaluation. AU-C section 330 requires a conclusion on whether sufficient appropriate evidence has been obtained, considering evidence that contradicts the statements as well as evidence that supports them.
• File review. AU-C section 220, effective for periods beginning on or after December 15, 2025, and section 220A both require the engagement partner, on or before the report date, to establish through review of the documentation and discussion with the team that sufficient appropriate evidence supports the conclusions.

What must the working-paper file contain?

AU-C section 230 requires a file from which an experienced auditor new to the audit could understand the work, results and conclusions, showing for each procedure the items tested and who performed and reviewed it, and when. AU-C section 330 adds the link between each procedure and the assessed risk at the relevant assertion, which a folder of collected documents lacks. Other sections add records of their own, such as the materiality amounts under AU-C section 320 and every accumulated misstatement, and whether it was corrected, under AU-C section 450.

AU-C section 230 requires the final file to be assembled no later than 60 days after the report release date and kept for at least five years from that date, and notes that law, regulation or other standards may add requirements. California's Business and Professions Code section 5097 does: it presumes, rebuttably, that procedures the file does not document were not performed, and requires retention for at least seven years, with the extensions and exceptions that section sets. Auditors: check the retention rule of each state that licenses you before discarding audit documentation. The 2025 edition of AU-C section 230 notes that SAS No. 149 amends the section for audits of periods ending on or after December 15, 2026; check the amended text for those audits.