The financial statement audit vs review vs compilation decision usually lands on a business owner's desk because someone else asked for it: a bank renewing a line of credit, an investor writing a check, a surety company, or a federal grantor. Each of the three engagements produces financial statements with a CPA's name attached, but the CPA does very different work in each one, and the report tells the reader exactly how much reliance they can place on the numbers.
There is also a fourth option most comparisons leave out. Since 2015, AICPA standards have recognized a preparation engagement, where a CPA prepares the statements and attaches no report at all. If a lender only wants "CPA-prepared" statements, that may be all you need.
Private-company compilations, reviews and preparation engagements follow the AICPA's Statements on Standards for Accounting and Review Services (SSARS), codified in the AR-C sections. Audits of private companies follow generally accepted auditing standards (GAAS), codified in the AU-C sections. Public company audits follow PCAOB standards instead.
| Preparation | Compilation | Review | Audit | |
|---|---|---|---|---|
| Standard | SSARS, AR-C 70 | SSARS, AR-C 80 | SSARS, AR-C 90 | GAAS (AU-C) or PCAOB |
| Assurance | None | None | Limited | Reasonable (high, but not absolute) |
| CPA must be independent? | No determination required | No, but lack of independence must be disclosed in the report | Yes | Yes |
| Core procedures | Prepares statements from client records | Reads statements for obvious material misstatements | Inquiry and analytical procedures | Risk assessment, internal control understanding, testing, confirmations |
| Management representation letter | Not required | Not required | Required | Required |
| Output | "No assurance is provided" legend on every page | Compilation report | Review report with a conclusion | Auditor's report with an opinion |
In a preparation engagement the CPA builds the financial statements from the records, documents and explanations management supplies. Under SSARS No. 21, the accountant does not have to verify the accuracy or completeness of that information and does not issue a report. Instead, each page of the statements must state, at a minimum, that "no assurance is provided." If that legend can't go on every page, the CPA has to issue a disclaimer instead.
Preparation is a nonattest service, so it can work well for a company that wants clean monthly or quarterly statements from an outside firm for its own use or for a friendly lender.
One recent change matters to firms that run client accounting services. SSARS No. 27, approved by the AICPA's Accounting and Review Services Committee in March 2025, clarifies that a CPA who prepares financial statements inside a consulting engagement (such as outsourced controller or CFO work under CS section 100) is not required to apply AR-C 70. According to the Journal of Accountancy's report on the amendment, it is effective for periods ending on or after December 15, 2026, with early implementation permitted. Engagements performed outside AR-C 70 fall outside the quality management standards and the peer review population.
A compilation is the lowest level of report-bearing service. The CPA presents management's information in financial statement form and reads the finished statements, considering whether they look appropriate in form and free from obvious material misstatements. There is no inquiry program, no analytics requirement and no testing.
The compilation report says the accountant did not audit or review the statements, was not required to verify the information, and does not express an opinion, a conclusion or any assurance. A CPA does not need to be independent to perform a compilation, but must decide whether they are. If independence is impaired, the report's final paragraph has to say so, and if the CPA chooses to explain why, all the reasons must be listed.
Compilations also allow statements that omit substantially all required disclosures, as long as the report says so. That keeps costs down for owners who only need a balance sheet and income statement.
A review gives limited assurance. The CPA's objective is to report whether they are aware of any material modifications needed for the statements to conform with the applicable framework, mainly through inquiry and analytical procedures. Independence is mandatory. If the CPA discovers mid-engagement that independence is impaired, they must withdraw.
Two details separate a review from an audit in practice. First, a review does not include obtaining an understanding of internal control, assessing fraud risk, or testing records through inspection, observation, confirmation or examination of source documents. Second, management must sign a representation letter, and without it the review is incomplete and no report can be issued.
SSARS No. 25, effective for periods ending on or after December 15, 2021, tightened reviews further. It added an explicit requirement to determine materiality for the financial statements as a whole and addressed adverse conclusions, bringing AR-C 90 closer to the international review standard. For more on how materiality thresholds work in practice, see our explainer on materiality risk in audits.
An audit is designed to give reasonable assurance that the statements are free of material misstatement, whether caused by error or fraud. The auditor assesses risk, gains an understanding of internal control, and gathers evidence through confirmations, inventory observation, cutoff testing, vouching and recalculation. Our explainer on GAAS standards walks through the general principles.
Two standards reshaped private company audits recently:
The opinion can be unmodified (clean), qualified (misstated or unverifiable in one area), adverse (materially and pervasively misstated) or a disclaimer (the auditor could not gather enough evidence to form an opinion). Because the Opinion section now sits at the top of the report, a lender sees which of the four applies before reading anything else.
Companies that file with the SEC are audited under PCAOB standards. The PCAOB was created by the Sarbanes-Oxley Act of 2002 to oversee auditors of publicly traded companies.
Take an illustrative distributor with $1.2 million of accounts receivable, up from $800,000 last year while sales grew only 10%.
In a review, the CPA computes days sales outstanding, sees it jump, and asks the controller why. The controller explains that two large customers moved to 90-day terms. If that answer is consistent with everything else the CPA knows, the review moves on. The CPA may also ask about the allowance for credit losses and read the aging, but does not contact customers.
In an audit, the same receivable becomes a set of procedures. The auditor sends confirmations to a sample of customers, tests subsequent cash receipts for those that don't reply, examines the two contracts with extended terms, tests revenue cutoff around year end, and evaluates whether the allowance is supportable. Each of those steps generates documentation that a reviewer of the audit file will expect to see.
That difference in evidence is why an audit takes longer and costs more. Strong internal controls testing inside the company can reduce the substantive testing the auditor needs, but it does not remove the need for evidence.
A compilation tells the reader a CPA put the statements together. A review tells the reader an independent CPA asked questions, ran analytics and found nothing suggesting a material problem. For a bank, that difference often decides the covenant package.
Move from a compilation to a review when:
Before switching, gather what a lender will ask for. Our business loan preparation checklist lists the usual documents.
Most private companies are never legally required to have an audit. The requirement usually comes from a contract or a regulator:
If you are facing your first audit, read our first external audit preparation guide, then start on the PBC request list well before fieldwork.
Fees rise with each level because the hours rise. A preparation engagement costs the least, a compilation adds report work, a review adds inquiry, analytics and a representation letter, and an audit adds testing across every material account. Size, complexity, number of locations, inventory, and the state of the books drive the final number more than revenue alone. First-year audits cost more because the auditor must test opening balances.
We cover actual fee ranges and what drives them in how much audited financial statements cost.
On timing, the biggest delay is almost always the client's close. If the general ledger is reconciled, the trial balance is final, and the supporting schedules tie out on day one, a review or audit moves quickly. If adjusting entries are still arriving during fieldwork, the engagement stalls.
Busy season compresses all three engagement types into the same few months. Many US firms now keep the partner, the independence assessment and the report sign-off in-house while outsourcing preparation of the underlying work: trial balance cleanup, account reconciliations, lead schedules, draft statements and disclosure checklists, and first-pass analytics.
Madras Accountancy supports US CPA firms with this kind of work on audit, review and compilation engagements. The CPA firm keeps responsibility for the engagement and the report under the AICPA standards. Our overview of outsourced audit support for CPA firms explains how firms split the work, and our note on offshore audit workpapers covers documentation and review controls.
Yes. When a bank asks for reviewed statements, it means statements accompanied by an independent CPA's review report under AR-C 90. Confirm with the bank which financial reporting framework it expects, such as GAAP or the tax basis, before the engagement letter is signed.
Only if the firm is independent. Preparing statements or keeping the books for a client can impair independence unless the safeguards in the AICPA's nonattest services rules are met. The firm has to evaluate this before it accepts the review, and must withdraw if it later finds independence impaired.
It means the CPA is telling the reader they did not check whether the numbers are right. A compilation still has value, because a CPA applied the reporting framework and read the statements for obvious errors, but a reader cannot rely on it the way they would on a review or audit.
A review is not designed to detect fraud, and the CPA does not assess fraud risk the way an auditor does. If inquiry or analytics turn up something that looks wrong, the CPA must follow up, so problems sometimes surface anyway.
Yes. SSARS No. 25 added guidance on adverse conclusions, which a CPA issues when the statements are materially and pervasively misstated.
If your firm needs extra hands on trial balances, lead schedules or draft statements for audit, review or compilation clients, contact our team to talk through scope and turnaround.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
