GAAS Standards Explained: What Auditors Need to Know in 2026

With GAAS standards explained properly, most of the confusion about them goes away. GAAS stands for Generally Accepted Auditing Standards. They are the rules a CPA must follow when auditing the financial statements of a US entity that is not an SEC registrant: private companies, nonprofits, employee benefit plans and state and local governments. The AICPA's Auditing Standards Board (ASB) issues them as Statements on Auditing Standards (SASs).

Many textbooks still describe GAAS as "ten standards." That structure was retired more than a decade ago. Below we explain the original ten (they still appear on the CPA exam and in older literature), what replaced them, and the 2025 and 2026 effective dates that matter for audit work this year.

GAAS full form and who sets the standards

GAAS full form: Generally Accepted Auditing Standards. Three bodies set auditing standards in the US, and the one that applies depends on the entity being audited:

A common error is citing PCAOB section numbers such as AS 2110 as if they were SASs. They are separate standards for issuer audits. A private company audit report refers to "auditing standards generally accepted in the United States of America," and the work is measured against the AU-C sections.

GAAS also should not be confused with GAAP. GAAP governs how the company prepares its financial statements; GAAS governs how the auditor tests them. Our explainer on GAAP, generally accepted accounting principles covers the accounting side.

The 10 generally accepted auditing standards (original framework)

Before the clarity project, AU section 150 listed ten standards in three groups. They remain the easiest way to understand what an audit demands.

General standards (3)

1. The audit must be performed by a person or persons with adequate technical training and proficiency as an auditor.
2. The auditor must maintain independence in mental attitude in all matters relating to the audit.
3. The auditor must exercise due professional care in planning and performing the audit and preparing the report.

Standards of field work (3)

1. The auditor must adequately plan the work and properly supervise any assistants.
2. The auditor must obtain a sufficient understanding of the entity and its environment, including internal control, to assess the risk of material misstatement and design further audit procedures.
3. The auditor must obtain sufficient appropriate audit evidence to afford a reasonable basis for an opinion.

Standards of reporting (4)

1. The report must state whether the financial statements are presented in accordance with GAAP.
2. The report must identify circumstances in which GAAP has not been consistently observed.
3. When informative disclosures are not reasonably adequate, the auditor must say so in the report.
4. The report must contain an opinion on the financial statements as a whole, or state that an opinion cannot be expressed, with reasons.

Some sources list "four general standards," adding ethics as a fourth. That is not how either the original or the clarified framework is organized. Ethics and independence requirements come from the AICPA Code of Professional Conduct, which GAAS requires the auditor to follow. Our guide to AICPA ethics rules for outsourcing shows how those rules apply when a firm uses offshore staff.

How the clarified standards replaced the ten

The ASB's clarity project redrafted every SAS into a consistent format (objective, definitions, requirements, application material) and converged them closely with the international standards on auditing. The clarified SASs are codified with an "AU-C" prefix and became effective for audits of financial statements for periods ending on or after December 15, 2012.

The ten standards were replaced by principles underlying an audit conducted in accordance with GAAS, grouped into four areas:

• Purpose and premise. The audit exists to increase users' confidence in the financial statements. It rests on the premise that management is responsible for the statements and for internal control, and gives the auditor access to the information needed.
• Responsibilities. Auditors must have appropriate competence and capabilities, comply with ethical requirements and maintain professional skepticism and judgment throughout.
• Performance. The auditor obtains reasonable assurance by planning, assessing risks of material misstatement due to fraud or error, and gathering sufficient appropriate evidence.
• Reporting. The auditor forms and expresses an opinion in a written report.

AU-C 200 sets the auditor's overall objective: to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to report on them. "Reasonable assurance" is high but not absolute, which is why the concept of materiality runs through every later section. Our piece on materiality and risk in audits explains how auditors set it.

The AICPA's codification of currently effective SASs is the authoritative source and groups the AU-C sections by subject, for example AU-C 200 to 299 for general principles and responsibilities.

Recent SASs and effective dates for 2026 audits

The ASB has rewritten a large share of GAAS since 2019. These are the standards a firm should have built into its methodology by now.

SAS 146 and the quality management standards

SAS 146, Quality Management for an Engagement Conducted in Accordance With GAAS, makes the engagement partner responsible for managing and achieving quality on each audit, including sufficient and appropriate involvement throughout the engagement. It works alongside two firm-level standards issued at the same time: SQMS 1, which requires a risk-based system of quality management that firms had to design and implement by December 15, 2025, and SQMS 2 on engagement quality reviews. Firms must complete the first evaluation of their SQMS 1 system within one year of that date. Our article on SQMS and the AICPA quality management standards covers the firm-level requirements.

For a calendar-year client, SAS 146 first applies to the audit of the year beginning January 1, 2026, so most firms will feel it in the 2027 busy season.

SAS 149 and group audits

SAS 149 replaces the "significant component" approach with a risk-based one. The group auditor decides where work is needed based on assessed risks, and has more responsibility for directing and reviewing component auditors' work. The US option to make reference to another auditor's report remains. For calendar-year groups, the December 31, 2026 audit is the first under the new standard. See our summary of how SAS 149 changes group audits.

Projects still in progress

The ASB's 2026 agenda includes fraud, going concern, confirmations, technology and a definition of public interest entities. On going concern, the Journal of Accountancy reports that the ASB began a project in August 2025 to consider targeted amendments to AU-C 570 in light of the IAASB's revised ISA 570. As of October 2026 no final US standard on either topic has an effective date, so treat these as watch items.

GAAS in practice: what a compliant audit file shows

Peer reviewers and courts look for evidence in the file, so it helps to know what GAAS expects to see.

Engagement acceptance and independence. A signed engagement letter that sets out management's responsibilities (AU-C 210), plus a documented independence evaluation.

Risk assessment. Under SAS 145, auditors must separately assess inherent risk and control risk, understand the entity's IT environment and general IT controls, and identify significant risks. If the auditor does not plan to test controls, control risk is assessed at maximum. Clients with weak controls should expect more substantive testing; our post on internal controls testing for small businesses shows what auditors look for.

Evidence. SAS 142 asks the auditor to evaluate the relevance and reliability of information used as evidence, including data the client generates from its systems and data analysed with automated tools. That is the basis for using analytics in place of some sampling. Our guide to AI in audit and assurance covers how firms apply it.

Documentation. AU-C 230 requires the final audit file to be assembled within 60 days of the report release date and retained for at least five years from that date, unless law or regulation requires longer. (PCAOB rules for issuer audits require seven years, which is where the "seven-year" figure often quoted for GAAS comes from.)

Reporting. Since SAS 134, the opinion comes first, followed by the basis for opinion, and the report includes explicit statements on management's and the auditor's going concern responsibilities.

Worked example: a first audit for a $25 million company

A private manufacturer with $25 million in revenue needs its first audit for a bank covenant. The audit is under GAAS, not PCAOB standards, because the company is not an issuer.

• The auditor will set overall materiality using a benchmark such as revenue or pre-tax income, then a lower performance materiality.
• Under SAS 145, inventory valuation and revenue cut-off are likely to be identified as significant risks for a manufacturer, which means specific procedures such as observing the physical count.
• Under SAS 143, the inventory reserve and warranty accrual will be tested as accounting estimates, including management's method, assumptions and data.
• If the company receives federal grants above the Single Audit threshold, the Yellow Book and Uniform Guidance add requirements on top of GAAS.

Owners can shorten this audit by preparing a complete PBC package before fieldwork. Our PBC request list template for first-time audits lists what to gather.

GAAS, the Yellow Book and Single Audits

Government Auditing Standards apply when law, regulation, contract or grant terms require them. For financial audits they adopt GAAS and add requirements on independence, internal control reporting, compliance reporting and continuing education. The 2024 revision of the Yellow Book is effective for financial audits of periods beginning on or after December 15, 2025, and requires audit organizations to have a quality management system designed and implemented by that date.

Our guides to the Yellow Book audit for government contractors and Single Audit requirements for federal awards go further.

How firms are keeping up

The volume of new SASs has stretched smaller firms, especially in the 2024 to 2026 seasons when SAS 145, SQMS 1, SAS 146 and SAS 149 all landed. Firms commonly update their audit methodology through a licensed practice aid provider, add risk assessment and IT controls training, and move preparation work (lead schedules, confirmations, sample selections) to support staff so senior auditors can concentrate on judgment areas. Many firms now use outsourced audit support for that preparation work, with review and sign-off staying with the US engagement team.

Frequently asked questions

What is the full form of GAAS?

GAAS stands for Generally Accepted Auditing Standards. In the US, the term refers to the AICPA's Statements on Auditing Standards, codified as AU-C sections, which govern audits of entities that are not SEC issuers.

Are the ten generally accepted auditing standards still in effect?

Not in their original form. Since the clarified SASs took effect for periods ending on or after December 15, 2012, the ten standards have been replaced by principles underlying a GAAS audit and the detailed AU-C requirements. The ten remain useful for studying and for reading older literature.

What is the difference between GAAS and PCAOB standards?

GAAS applies to audits of nonissuers such as private companies and nonprofits. PCAOB standards apply to audits of public companies and SEC-registered broker-dealers, and the PCAOB inspects the firms performing them.

Does GAAS apply to reviews and compilations?

No. Reviews and compilations of a private company's financial statements fall under the Statements on Standards for Accounting and Review Services (SSARS). Our comparison of financial statement audits vs. reviews vs. compilations explains which level of service a lender or investor will usually require.

What changes in GAAS for audits in 2026?

SAS 146 applies to audits of periods beginning on or after December 15, 2025, and SAS 149 applies to group audits of periods ending on or after December 15, 2026. Firms also had to have SQMS 1 quality management systems in place by December 15, 2025.

Next step

If your firm needs extra capacity for audit preparation work under the new SASs, Madras Accountancy supports US CPA firms with workpapers, lead schedules and PBC tracking under your review. Contact us to discuss your audit season.