Your bank or grantor just asked for audited financials: what that means and what to expect

The letter that changes your year

It usually arrives as a single line in a longer document. The bank's renewal terms now require annual audited financial statements. A foundation's grant application asks for reviewed financials. A buyer's letter of intent calls for a quality of earnings review and audited statements for the past two years. A new board member asks when the nonprofit last had an audit. You have had your taxes prepared every year, your bookkeeper reconciles the accounts, and nobody has ever asked for this before.

At Malnory, McNeal & Company, audit and assurance is my practice, and this is the moment most of our new business and nonprofit clients first call us. They are not in trouble. They have simply grown to a point where someone outside the company wants financial statements they can rely on without taking the owner's word for it. That is what assurance means, and it comes in levels.

This guide explains the three levels, how to figure out which one is actually being asked for, what the work involves on your side, what drives the cost, and how to choose a firm.

Audit, review and compilation are not three words for the same thing

A compilation is the lowest level. The CPA takes your records and presents them in proper financial statement form, with no testing and no opinion; the firm is saying the statements are in the right format, not that they are right. A review is the middle level. The CPA performs analytical procedures and asks management questions, and provides limited assurance that no material changes are needed. An audit is the highest level. The CPA tests balances and transactions, confirms with third parties, evaluates internal controls, and issues an opinion on whether the statements are fairly presented.

The practical differences matter. An audit takes the most time, requires the most from your staff and costs the most, because the firm is independently verifying what you report. A review is lighter and relies more on inquiry and analysis. A compilation is largely a formatting exercise. The right level is the one the person asking actually needs, and in my experience that is not always the one they wrote down, which is the first conversation worth having.

• Compilation: statements prepared in proper form from your records, with no assurance given.
• Review: analytical procedures and management inquiry, resulting in limited assurance.
• Audit: testing, third-party confirmation and controls evaluation, resulting in an opinion.
• Each level requires the firm to be independent of your business; your bookkeeper cannot audit the books they keep.
• Nonprofits often face audit requirements set by grantors or their own bylaws, in addition to what the board wants.
• Lenders sometimes accept a review where the loan agreement says audit, but only if asked before the deadline.

Read the request and your own books before you call anyone

Start with the document that triggered this. Find the exact wording: audited, reviewed, compiled, or simply "financial statements prepared by a CPA." Note the deadline and the period it covers, since a request for the prior fiscal year that has already closed is a very different project from one for a year still in progress. If the language is ambiguous, ask the lender, grantor or buyer directly what level they require and whether they would accept a lower one.

Then look honestly at your records. Are the bank accounts reconciled through year-end? Are receivables and payables tracked in the system rather than in someone's head? Is inventory counted? Do you have signed leases, loan agreements, grant letters and board minutes in one place? Are there large unreconciled balances or accounts nobody can explain? The state of the books determines how much cleanup must happen before assurance work can begin, and that cleanup is often the longest part of a first-year engagement.

• Identify the exact level of assurance requested and the deadline.
• Confirm which fiscal period the statements must cover.
• Check that every bank, credit card and loan account is reconciled through period end.
• Gather contracts, leases, debt agreements, grant awards and governing documents.
• List any account balances you cannot explain or support.
• Decide who on your team will be the point of contact; the audit will need their time.

When a lower level will do, and when you should call a CPA this week

If no one has formally required a particular level and you simply want your statements in better shape, a compilation or review may be enough for now, and improving your monthly bookkeeping may matter more than any assurance report. We would rather tell you that than sell you an audit you do not need. Similarly, if a lender will accept reviewed statements for a smaller loan, a review may be the sensible place to start.

Call sooner rather than later when the request is firm and has a deadline, because audits are scheduled months ahead and the first-year work takes longer than clients expect. Call when the books are not clean, because cleanup must precede assurance and it cannot be rushed at the end. Call when a transaction is involved, since a buyer's timeline will not wait. And call when a nonprofit's board or grantor has asked, because the governance and reporting requirements around nonprofit audits are specific and the organization's funding may depend on them.

Whichever situation you are in, a short conversation with an auditor early will tell you what the request really requires and how much runway you have.

What an audit engagement looks like from your side

Our work begins with an engagement letter that defines the level of service, the period, the timeline and the fee, so expectations are set in writing. Then comes planning: we learn your business or organization, your systems and your risks, and we send a request list of documents and schedules. Many clients exchange these through our secure online portal, which keeps the back-and-forth organized and protected. The quality and timeliness of that first delivery sets the pace of the whole engagement.

Fieldwork follows. For an audit, that means testing transactions and balances, confirming cash and debt with banks and receivables with customers, observing inventory where it is material, evaluating internal controls and reviewing contracts and minutes. For a review, it means analytical procedures and detailed inquiry of management. We will have questions, and prompt answers keep the schedule. At the end we issue the report, present the findings to the owner or board, and, where we saw weaknesses in controls, provide a letter describing them and recommending improvements. For many clients that letter is the most valuable product of the first year.

• Engagement letter defining scope, level of assurance, period, timeline and fee.
• Planning and risk assessment, including understanding your systems and industry.
• Document request list, exchanged through the client portal.
• Fieldwork: testing, confirmations, inventory observation and controls evaluation for an audit; analytics and inquiry for a review.
• Resolution of open questions and proposed adjustments with your team.
• Issued report and presentation to management or the board.
• Internal control recommendations you can act on before next year.

What drives the fee

Assurance work is priced on the hours it will take, and a few things drive those hours. The level of service is the largest: an audit involves far more procedures than a review, and a review more than a compilation. The size and complexity of the organization is next, including revenue, number of accounts and locations, inventory, debt, grants with their own compliance requirements, and the number of related entities. First-year engagements cost more than subsequent years because the firm is learning the organization and because cleanup is usually needed.

The condition of your records matters a great deal. Clean, reconciled books with supporting documents organized ahead of time reduce hours directly; books that need reconstruction increase them. Deadlines affect cost too, since a compressed timeline means more staff on the job at once. We quote after understanding your situation rather than from a rate sheet, and the best way to lower the fee is to do the preparation work on the list above before we arrive. Our firm's approach is to be large enough to meet the need and small enough to know your name, and that extends to telling you where the fee comes from.

Choosing an audit firm you can work with every year

Assurance is a relationship that repeats annually, so choose a firm you can call. Ask whether the firm is licensed in Texas and whether it undergoes peer review, which is the profession's quality-control process in which another CPA firm examines its audit work; we do, and any firm performing audits should. Ask who will be on your engagement and whether that person will answer the phone. Ask about experience with organizations like yours, and if you are a nonprofit, ask specifically about nonprofit audits and the grant compliance work that comes with them.

Ask how the firm handles the rest of your needs. There is real value in one firm seeing your tax, bookkeeping, payroll and assurance picture, because the numbers stay consistent across all of them, with the important caveat that the same firm cannot audit statements it also prepares in a way that compromises independence; a good firm will explain where that line is. Finally, ask what the first year will look like in practical terms, and listen for whether the answer is specific.

• Licensed in Texas, with current peer review of its assurance practice.
• A named partner or manager who will lead your engagement and be reachable.
• Experience with your type of organization, including nonprofits if that is you.
• A clear explanation of independence and what the firm can and cannot do for you.
• A secure portal and an organized request process.
• Membership in professional bodies such as the AICPA.

Mistakes that make a first audit painful

The first is waiting until the deadline is close. Firms schedule audits months out, and a first-year engagement with cleanup cannot be compressed into a few weeks without cost and stress. The second is assuming the bookkeeper's reports are the financial statements. They are the raw material; converting them to statements with proper disclosures is part of the work, and gaps appear during that process.

The third is treating the auditor as an adversary. We are independent, not hostile, and clients who answer questions promptly and completely finish faster and pay less. The fourth is ignoring the internal control letter. It is a free roadmap for the next year and the quickest way to make the second audit easier than the first. The fifth is choosing on fee alone and getting a firm that cannot be reached between January and April. And the last is not asking whether the requested level is actually required; sometimes a conversation with the lender saves a great deal of work.

Responding to the letter with a plan

Bring the letter or agreement that triggered the request, your most recent financial statements or bookkeeper reports, and your fiscal year-end. In the first conversation we will confirm what level of assurance is actually being asked for, whether the request can be met in the time available, and what your records will need before fieldwork can start. If the right answer is a review rather than an audit, or better bookkeeping before either, we will tell you.

If we proceed, you receive an engagement letter, a timeline and a request list, and we begin. Our Dallas office serves businesses and nonprofits across the Dallas–Fort Worth area, and our Paris, Texas office serves Northeast Texas. The aim at the end is a report your lender, grantor, board or buyer will accept, a set of books that is stronger than it was, and a firm that knows your organization well enough that the second year is easier than the first.

Questions people ask me