Audit, review or compilation: which one does your organization need?
Short answer: An audit gives reasonable (high) assurance that your financial statements are free of material misstatement, a review gives limited assurance based on inquiry and analytics, and a compilation gives no assurance at all. Which one you need is set by whoever is asking: a lender, a state law, a funder, your bylaws or your board. Start by reading the exact wording of that requirement.
Key takeaways
- Audits are performed under generally accepted auditing standards (GAAS); reviews and compilations under the AICPA's SSARS.
- Only an audit involves testing transactions, confirming balances with third parties and understanding internal controls.
- A review is usually a fraction of the cost and time of an audit and is accepted by many lenders, states and grantors for mid-size organizations.
- A compilation can be done by a CPA who is not independent, as long as that is disclosed in the report.
- You can always deliver a higher level than required, but never a lower one without the requester's agreement.
What are the three levels of CPA financial statement reports?
When a CPA puts their name on your financial statements, they issue one of three main types of reports. Each one tells the reader something different about how much they can rely on the numbers:
- Audit: the CPA expresses an opinion that the statements are fairly presented, in all material respects, under the applicable framework (usually GAAP).
- Review: the CPA states they are not aware of any material modifications needed. This is called limited, or negative, assurance.
- Compilation: the CPA helps present your financial information in proper form but expresses no opinion or assurance.
There is also a fourth, lighter service called a preparation engagement, where a CPA prepares statements without issuing any report. It works for internal use but rarely satisfies an outside requirement.
What does a CPA do in a financial statement audit?
An audit is the most thorough engagement. To support an opinion, the auditor gathers evidence, not just explanations. A typical audit includes:
- Risk assessment: understanding your organization, its environment and where material errors or fraud could occur.
- Internal controls: learning how transactions are approved, recorded and reconciled, and testing key controls where the auditor plans to rely on them.
- Confirmations: contacting banks, lenders, and sometimes customers or donors directly to verify balances.
- Substantive testing: selecting samples of revenue, expenses, payroll and disbursements and tracing them to invoices, contracts, approvals and bank activity.
- Cut-off and estimates: checking that transactions land in the right year and that estimates (allowances, depreciation, accruals) are reasonable.
- Disclosures: making sure the notes tell readers what they need to know, such as commitments, related parties, restrictions and subsequent events.
At the end, management signs a representation letter, and the auditor issues an opinion. Most clean audits receive an unmodified opinion. Auditors also communicate significant deficiencies in internal control to those charged with governance, which is useful feedback for a board.
What does a CPA do in a review engagement?
A review sits in the middle. The CPA must be independent, but the work is mostly:
- Inquiry: asking management targeted questions about accounting policies, unusual transactions, estimates and events after year-end.
- Analytical procedures: comparing this year to prior years, to budget and to expected relationships (for example, payroll taxes as a percentage of wages), then following up on anything that doesn't make sense.
- Reading the statements: checking that the presentation and disclosures follow the framework.
A review does not include confirmations, sample testing of invoices or a review of internal controls. That is why it costs less and finishes faster, and also why some readers will not accept it.
What does a CPA do in a compilation?
In a compilation, the CPA uses accounting expertise to put management's information into proper financial statement form. They read the statements for obvious errors, but they do not verify the numbers. A compilation report says plainly that no assurance is provided.
Two features make compilations practical for smaller organizations:
- The CPA does not have to be independent. A firm that also does your bookkeeping can compile your statements, as long as the report says it isn't independent.
- Management can omit most disclosures if the report says so. That is fine for internal and board use, though outside readers often want full disclosures.
Audit vs review vs compilation: side-by-side
| Audit | Review | Compilation | |
|---|---|---|---|
| Assurance | Reasonable (high) | Limited | None |
| Standards | GAAS (AICPA) | SSARS (AR-C 90) | SSARS (AR-C 80) |
| CPA must be independent? | Yes | Yes | No, if disclosed |
| Main procedures | Risk assessment, controls, confirmations, sample testing | Inquiry and analytical procedures | Formatting and reading for obvious errors |
| Internal control feedback | Yes, significant deficiencies reported | No | No |
| Relative cost | Highest | Moderate | Lowest |
| Typical timeline | Several weeks | A few weeks | Days to a couple of weeks |
Who asks for an audit, review or compilation?
Lenders and banks
Loan agreements often specify the level of financial reporting by loan size. Smaller lines of credit might accept a compilation or review. Larger term loans and SBA-related lending often require a review or audit. The covenant usually also sets a deadline, such as within 120 days of year-end.
State laws
Many states require charities to file reviewed or audited statements once revenue or contributions pass a threshold, and some states set similar tiers for condo and homeowners' associations. Florida, for example, ties an association's required report directly to its annual revenue.
Federal grants
Nonprofits that spend $1,000,000 or more in federal awards in a year need a Single Audit, a specific type of audit that includes compliance testing.
Foundations, investors and buyers
Foundations often ask for audited statements above a certain grant size. Investors, acquirers and franchisors may ask for audits or reviews as part of diligence. Sometimes the better fit is an agreed-upon procedures engagement focused on specific accounts.
Your own bylaws or board
Many nonprofit and association bylaws require an annual audit regardless of size. Boards can amend the bylaws, but until they do, the requirement stands.
How to choose: a 4-question test
- Who is asking, and what exact words do they use? "Audited," "reviewed" and "CPA-prepared" mean different things. Get the requirement in writing.
- Is there a legal threshold? Check state charity or association rules and your federal award spending.
- What do your governing documents say? Bylaws, loan covenants and grant agreements can each set a minimum.
- What does your board need? If fraud risk, rapid growth or turnover in finance staff is a concern, the extra work of an audit can be worth it even when no one requires one.
Pick the highest level any of these requires. One audit can satisfy a lender, a state and a funder at the same time.
Tip: Ask the requester whether a review would be acceptable. Lenders and foundations often agree for smaller organizations, and the savings can be significant.
When should you move up from a review to an audit?
- Your revenue or contributions are about to cross a state audit threshold.
- You expect to spend $1,000,000 or more in federal funds in the coming year.
- A new lender, investor or major funder requires it.
- You have had a control problem, such as a misappropriation, and the board wants stronger oversight.
A first-year audit takes extra work, because the auditor has to gain comfort over opening balances. Planning a year ahead keeps the first audit on schedule.
Frequently asked questions
Is a review the same as an audit?
No. A review provides limited assurance using inquiry and analytical procedures. An audit provides reasonable assurance and includes testing, confirmations and an understanding of internal controls.
Can my bookkeeper's CPA firm also audit us?
Generally a CPA firm must be independent to perform an audit or review. Some bookkeeping services can be provided alongside an audit only if specific safeguards are met; otherwise you need a separate firm. A compilation does not require independence.
Which is cheaper, a review or an audit?
A review is usually significantly cheaper than an audit, because it involves far fewer procedures. A compilation is cheaper still.
Can I give the bank an audit if they only asked for a review?
Yes. A higher level of assurance always satisfies a lower-level requirement. The reverse is not true.
Does an audit find fraud?
An audit is designed to detect material misstatements, whether from error or fraud, but it is not a forensic fraud investigation and cannot guarantee that all fraud is found.
GreyWood CPA PLLC is a licensed CPA firm headquartered in Richmond, Virginia (Virginia Board of Accountancy firm license #134961), serving nonprofits, community associations and businesses nationwide. This article is general information as of June 9, 2026, not legal or tax advice for a specific organization. Rules change, so confirm current requirements before acting.