Financial Statement Review vs. Audit: Which Does Your Business Need?

When a bank, bonding company, or grantor asks for your "financial statements," what they really mean is financial statements with a specific level of CPA assurance attached. The three levels -- compilation, review, and audit -- represent a spectrum from zero to moderate to high assurance, and each comes with different procedures, costs, and value. Using the wrong level can mean wasting money on more assurance than you need, or worse, losing a financing opportunity because you provided less assurance than required.

The Three Levels of CPA Assurance

A compilation is the lowest level of service. Under SSARS (Statements on Standards for Accounting and Review Services), a CPA takes the financial information you provide, puts it into proper financial statement format, and issues a report. The CPA does not verify the information, perform tests, or provide any assurance that the numbers are accurate. A compilation is essentially a presentation service. A review provides limited assurance. The CPA performs analytical procedures (comparing current year to prior year, checking ratios, identifying unusual relationships) and asks management questions about the financial statements. If nothing comes up that suggests material misstatement, the CPA issues a report stating there is no material modification required. This is sometimes called "negative assurance." An audit provides the highest level of assurance. The CPA performs extensive procedures: confirming account balances with third parties, physically observing inventory, testing a sample of transactions with source documents, evaluating internal controls, and issuing a positive opinion on whether the financial statements are fairly presented in accordance with GAAP. Audits follow GAAS (Generally Accepted Auditing Standards) and, when government funding or Yellow Book requirements apply, also GAGAS.

Who Accepts What: Practical Decision Guide

The level of assurance required depends entirely on who is asking for your financial statements and why. Commercial banks making business loans of $500,000 or less typically accept reviewed financial statements. Above that threshold -- particularly for real estate loans, construction loans, and larger term loans -- many banks require audited statements. The larger and more complex the loan, the more likely the bank will require an audit. Bonding companies (sureties) for construction and government contractors almost universally require audited financial statements for bond amounts above certain thresholds, typically $1 million to $5 million in single-job bonding capacity. Below those thresholds, some sureties accept reviewed statements. SBA loans have specific requirements depending on the program: the 7(a) loan program generally does not require audited statements for smaller loan amounts, but larger SBA 504 loans and some specialized programs require CPA-prepared financial statements. Federal and state grantors typically specify their requirements in the grant agreement -- these range from compilation to full audit with Single Audit requirements for large federal awards.

Cost Comparison

The cost difference between these levels is significant. In the DC, Maryland, and Virginia market, a compilation for a small business typically costs $1,500 to $4,000. A review runs $4,000 to $10,000 depending on complexity. A full audit starts at $8,000 for simple organizations and can easily reach $25,000 or more for complex businesses with multiple locations, inventory, or complex transactions. Before engaging a CPA for any of these services, confirm with your bank, bonding company, or grantor exactly what level they require. Many business owners have paid for full audits when their lender would have accepted reviewed statements.

When to Upgrade from Review to Audit

There are situations where obtaining an audit makes sense even if it is not strictly required. If you are planning to sell your business, prospective buyers and their lenders will typically require audited financial statements for the most recent two to three years -- having these ready accelerates the due diligence process. If your business is experiencing rapid growth and you anticipate needing larger credit facilities or bond capacity within the next year or two, starting audit-level reporting now creates a track record that lenders and sureties value. If your business has experienced management turnover, partnership disputes, or suspected employee fraud, an audit provides the independent scrutiny needed to establish accurate baseline financials.

GAGAS and Yellow Book Requirements

Some engagements require financial statements audited under Government Auditing Standards (GAGAS), commonly called the Yellow Book after the color of the GAO publication. Yellow Book audits are required when federal or state grantor agencies specify them, when Single Audits are required, and in some government contractor contexts. Yellow Book audits add requirements beyond a standard GAAS audit: auditors must meet additional independence standards, complete enhanced CPE requirements, and issue additional reports on internal controls and compliance. If your grantor or awarding agency specifies "GAGAS" or "Yellow Book" or references "Government Auditing Standards" in your award agreement, ensure your auditor has Yellow Book credentials.

SSARS vs. GAAS: The Standards Difference

Compilations and reviews are performed under SSARS (Statements on Standards for Accounting and Review Services), which are issued by the AICPA's Accounting and Review Services Committee. Audits are performed under GAAS (Generally Accepted Auditing Standards), also issued by the AICPA (and for public companies, under PCAOB standards). This distinction matters because the level of professional skepticism, documentation, and testing required under GAAS is substantially higher than under SSARS. When a bank or grantor asks for "audited financial statements," they mean GAAS audit, not a compilation or review. Providing a review or compilation when an audit is requested is not a minor shortcoming -- it can invalidate a financing application or cause a grant award to be rescinded.

Choosing the Right CPA for Each Level

Any CPA firm can perform compilations and reviews. Audits require audit-licensed CPAs with sufficient competence and experience in your industry. For specialized audits -- nonprofit organizations, government contractors, employee benefit plans, healthcare entities -- industry expertise matters enormously. A CPA who primarily serves for-profit businesses may not understand the specific accounting standards, compliance requirements, and auditing procedures applicable to your sector. Ask prospective auditors about their client base, the percentage of their practice devoted to organizations like yours, and whether their staff have relevant certifications (CPA with governmental audit experience, Certified Government Financial Manager, or similar).