Audit, Review, or Compilation: Choosing the Right Level of Assurance

Many closely held businesses are not legally or contractually required to have their financial statements audited, reviewed, or compiled by an independent CPA. A privately held business with no debt, bonding needs, or outside investors may be well served by internally prepared statements intended only for management.

Circumstances may change as the organization grows and develops relationships with outside parties who rely on its numbers. A lender, a surety, or a passive investor has a stake in the organization's financial health but no direct view into its accounting. As a result, these stakeholders often look to financial statements as a primary source of information when making lending, bonding, investment, or other business decisions.

When stakeholders require an independent CPA's report, there are typically three options: an audit, a review, or a compilation. Understanding what separates them and what each does for the party requesting it is key to choosing well and avoiding paying for more service than the situation requires.

Key Takeaways

• An independent CPA can report on an organization's financial statements at three levels: an audit, a review, or a compilation. Cost and effort scale with the level of assurance.
• A higher level of assurance is not inherently better. The right choice matches the level of those who rely on the statements and why.
• An assurance requirement is not necessarily permanent. When facts and circumstances change, a lower level may suffice.
• For organizations that may require audited financial statements in the future, a review engagement can provide a strong foundation. Because a review generally requires the same financial statement presentation and disclosures that would be needed in an audit, the transition to an audit may be more efficient when the need arises.

The Three Levels of Assurance

The three levels differ in one fundamental way: the degree of assurance the CPA provides that the financial statements are free from material misstatement. An audit provides reasonable assurance, a review provides limited assurance, and a compilation provides no assurance. Cost follows directly, because more assurance takes more work to support.

Audit

An audit provides the highest level of assurance. The CPA expresses an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable accounting framework. To support that opinion, the auditor gathers and tests evidence by confirming balances with third parties, testing samples of transactions against supporting documentation, and obtaining an understanding of internal control to design audit procedures. Reasonable assurance is a high level of assurance, but it is not absolute; therefore, an unmodified audit opinion does not guarantee that the financial statements contain no misstatement.

Review

A review sits one level of assurance below an audit. It generally covers the same financial statements required in an audit under the applicable reporting framework. The work is primarily based on analytical procedures and inquiries of management, through which the CPA evaluates relationships and fluctuations that appear unusual or inconsistent with expectations. The limited assurance is expressed in the negative: the CPA is not aware of any material modifications that should be made to the financial statements for them to be in accordance with the applicable framework.

A review does not ordinarily involve third-party confirmations or tests of transactions against supporting documentation. Because it is built on analysis and inquiry, a review tends to surface information that is useful to management along the way, such as an unexpected variance or an accounting process worth tightening. For many privately held organizations, that annual discussion with an independent CPA is a benefit in its own right.

Compilation

In a compilation, the CPA assists management in presenting its financial information in the form of financial statements and issues a report, without testing the information or expressing an opinion or conclusion on it. A compilation provides no assurance, but it can present a full set of financial statements with complete footnote disclosures. Unlike an audit or a review, though, a compilation also allows management to omit substantially all disclosures, provided the omission is disclosed in the accountant's report and is acceptable to the intended users. With no testing and, at times, no footnote disclosures, a compilation is ordinarily the least costly of the three options.

What Influences the Level of Service

The level of service requested is often influenced by the needs and expectations of the organization's financial statement users. A lender, a surety, an investor, or a regulator may require a CPA report to accompany the statements, and each has a different amount at risk if the statements are materially misstated. Considerations may include the nature and size of that exposure, the organization's financial condition and operating history, the user's familiarity with the organization, and any available collateral or other protections.

Contractual, regulatory, or policy requirements may also dictate a specific level. An operating agreement may require statements at a stated level for passive or minority members, a commercial lease may condition a tenant improvement allowance or a security deposit reduction on them, and a purchase agreement with an earnout may specify how the post-closing statements are to be prepared. Determining the appropriate level typically depends on the specific facts and circumstances of the organization and its financial statement users.

Matching the Level to the Situation

The following are illustrative examples only, in which a compilation, a review, or an audit may be appropriate. Actual lender, investor, surety, and regulatory requirements vary by situation.

When a Compilation May Be Enough

Consider a dermatology practice with $12 million in annual revenue and three owners. It secures a $3 million credit facility to fund the buildout and equipment for a new location and to carry additional working capital during the expansion. The lender takes the practice's receivables and equipment as collateral and requires the owners' personal guarantees.

With that exposure and that security in place, the lender may be satisfied with compiled financial statements. A compilation shows the practice's financial condition and results at the lowest cost and gives the lender a basis for evaluating compliance with the credit agreement's financial covenants. If users do not need footnote disclosures, management may elect to omit them, further reducing costs.

When a Review May Be the Fit

Consider a commercial electrical subcontractor with $35 million in annual revenue that wants to raise its bonding capacity to pursue larger projects. Its agent has indicated that the surety will consider roughly double its current limits if the entity can provide CPA-reviewed statements prepared in accordance with GAAP.

Underwriting varies by surety, but the analysis commonly starts with working capital. An underwriter may recalculate it by removing prepaid expenses, inventory, aged and related-party receivables, and underbillings tied to unapproved change orders, and then testing tangible net worth against bonded backlog.

A compilation may support only smaller programs. An audit is more often driven by a much larger program, a complex structure, or a lender covenant. A review provides the limited assurance the surety is looking for, at a cost the contractor can weigh against the additional bonding capacity it would support.

When an Audit Is Likely Required

An industrial products manufacturer with $150 million in annual revenue and operations in three countries takes on a $30 million senior secured facility from an institutional lender to fund new equipment and acquire a subsidiary. At this scale, institutional lenders commonly require audited financial statements as part of their underwriting and monitoring, driven by lender policy rather than by the organization's operating history or banking relationship.

Requirements Are Not Permanent

The right level of service today may not be the right level in a few years, and it can move in either direction.

When the Requirement Can Come Down

Consider a family-owned wholesale distributor of plumbing and HVAC supplies with $65 million in annual revenue. It took on its bank facility ten years ago, with a requirement for audited financial statements. Today, it carries an $8 million revolving line kept mainly as a seasonal backstop, and utilization has been consistently low. The distributor has reported strong profits, maintained healthy equity, and stayed in compliance with its covenants throughout.

The bank's position is also well protected. It already monitors receivables and inventory, secures the line, and the owners personally guarantee it. On those facts, asking to step the requirement down from an audit to a review is a reasonable request. The bank is not obligated to agree, and the decision will depend on the banking relationship and the bank's credit policies. If it does agree, the bank still receives reviewed financial statements, and the distributor avoids the cost and time commitment of an audit that the bank's exposure no longer warrants.

When It Makes Sense to Step Up Early

The same logic runs the other way for an organization heading toward a transaction. An organization that has already been through reviews has the presentation and disclosures in place and works with a CPA who understands how it operates. When an audit becomes necessary, the added work is testing and documentation applied to financial statements that are already sound, rather than a first attempt at GAAP statements and footnotes under a closing deadline.

A smaller sale may close on reviewed statements and a buyer's quality-of-earnings analysis. At the same time, a larger or institutionally financed transaction commonly expects two to three years of audited statements. Obtaining reviewed statements early is a useful bridge to either outcome.

The Bottom Line

One level of assurance is not better than another. The more common mistake is carrying forward a level that was set years ago without evaluating whether it still fits.

Before defaulting to last year's level, ask three questions. What do the third parties that rely on your financial statements require today? What do your lender, surety, or investors need, given their current exposure? And what will the organization's direction over the next few years require? The answers change over time, and the level of service you obtain should change with them.

When a lender, surety, investor, or other third party asks for a CPA report to accompany your financial statements, or you expect that they will, the EisnerAmper Assurance team can advise and assist you in meeting that requirement. We provide audits, reviews, and compilations for closely held organizations. Contact us below to discuss your specific circumstances.