Do I Need an Audit? When Companies Are Required to Have One

A business is required to have an audit when a law, regulation, contractual agreement, or funding arrangement mandates independent verification of its financial statements. The most common triggers are: being a public company registered with the SEC, receiving federal awards above the Single Audit threshold, sponsoring a large employee benefit plan, or carrying loan agreements that include audited-financials covenants. Some businesses also pursue audits voluntarily to satisfy lenders, investors, or board governance requirements before those obligations become formal.

If you are asking “do I need an audit,” the answer depends on your legal structure, revenue sources, debt agreements, and industry. This article walks through each major trigger so you can assess your situation clearly.

When Is a Business Required to Be Audited?

Audit obligations fall into four broad categories: regulatory mandates (public companies, federal award recipients, benefit plans), contractual requirements (lender covenants, investor agreements), state law requirements (nonprofits and charities), and sector-specific requirements (government contractors, service organizations). Each is addressed below.

Public Companies and SEC Registrants

Every company with securities registered under the Securities Exchange Act of 1934, or that files a registration statement to go public, must have its annual financial statements audited by a PCAOB-registered public accounting firm. This is not optional. The Securities and Exchange Commission requires audited financial statements as part of the Form 10-K filing, and any 10-K that contains unaudited financials is considered substantially deficient.

The PCAOB sets the auditing standards that govern these engagements, including requirements for auditor independence, documentation, and the form of the audit report. Companies preparing to go public via an IPO, direct listing, or SPAC merger generally need two to three years of PCAOB-audited financial statements before their registration statement becomes effective. If your company is on a path toward a public offering, the audit clock starts earlier than most management teams expect.

Federal Award Recipients: The Single Audit

Nonprofit organizations, state and local governments, and universities that expend $1,000,000 or more in federal awards in a fiscal year must undergo a Single Audit (also called a Uniform Guidance audit) for that year. This threshold, codified at 2 CFR 200.501, was raised from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024, the first increase since 2003.

A Single Audit is broader than a standard financial statement audit. It covers:

• An audit of the entity’s financial statements under GAAS
• A review of the entity’s compliance with the terms and conditions of each major federal program
• Testing of internal controls over compliance

Organizations that cross the threshold solely because of a one-time federal grant often underestimate how significant this requirement is. The audit must be completed and the reporting package submitted to the Federal Audit Clearinghouse within the earlier of 30 calendar days after receiving the auditor’s report or nine months after the end of the audit period. The Modus audit and assurance practice works with nonprofit and governmental entities to meet these deadlines without disrupting operations.

Employee Benefit Plans: The 100-Participant Rule

If your company sponsors a 401(k) or other defined contribution plan, you may be required to have the plan audited and attach the audit report to your annual Form 5500 filing with the Department of Labor.

Which Plans Require an Audit

Plans classified as “large plans” on Form 5500 require an independent audit. Historically, large-plan status was determined by the number of eligible participants at the beginning of the plan year. For plan years beginning on or after January 1, 2023, the counting method changed: plans now count only participants who have an account balance, not all eligible employees. A plan with 100 or more participants with balances at the beginning of the plan year is a large plan and must be audited. The DOL estimated this change would remove roughly 20,000 plans from the audit requirement.

The 80-120 Rule

A transition rule known as the 80-to-120 participant rule provides flexibility when a plan hovers near the threshold. If the number of participants with balances at the beginning of the plan year is between 80 and 120, and the plan filed a Form 5500 for the prior year, the plan may continue to file in the same category (small or large) as the prior year. This means a plan that filed as a small plan last year and now has 105 participants with balances can choose to file as small again and avoid the audit requirement, at least temporarily.

Plan sponsors who are uncertain about their participant count or how the new counting method applies to their specific plan should confirm the number before assuming no audit is required. The consequences of filing without a required audit opinion are significant: late penalties, potential DOL enforcement, and the need to refile. Modus’s employee benefit plan audit team handles these engagements for plan sponsors across industries.

Nonprofits: Federal, State, and Grant Requirements

Charitable nonprofits face audit requirements from multiple directions simultaneously.

Single Audit (Federal Awards)

As noted above, nonprofits that spend $1,000,000 or more in federal awards in a fiscal year trigger a Single Audit. Many nonprofits that receive HUD, USDA, HHS, or Department of Education grants cross this threshold without realizing it until the grant is already under way.

State Charitable Registration Laws

Most states require registered charitable organizations to submit audited financial statements when they exceed a revenue or contributions threshold, as part of annual charitable solicitation registration. Those thresholds vary widely. California requires audited financials for nonprofits with gross revenues over $2 million. New York requires them at $1 million. Many states set the bar between $300,000 and $750,000. The National Council of Nonprofits maintains a state-by-state guide to these requirements.

Nonprofits that solicit donations in multiple states must satisfy the requirements in each state where they are registered, which can create a patchwork of obligations. Modus works with nonprofit boards and finance teams to manage these requirements efficiently. Learn more at our nonprofit services page.

Funder Requirements

Beyond legal mandates, many private foundations and government grantors require audited financial statements as a condition of any grant, regardless of size. A grant agreement may require audited financials even if the organization has revenues well below the state statutory threshold. Review every grant agreement before assuming no audit is required.

Bank Covenants and Lender-Required Audited Financials

Outside the regulatory world, audited financials for lenders are one of the most common reasons mid-market companies find themselves needing an audit for the first time. A financial covenant in a credit agreement is a contractual obligation. If the agreement requires annual audited financials and you do not deliver them, you are in technical default, which can give the lender the right to accelerate the loan.

Lenders generally begin requiring audited financial statements as loan sizes grow. For many commercial banks, the threshold is somewhere in the range of $2 million to $25 million in total debt, though no universal standard exists. Federal programs impose their own rules: participants in the SBA 8(a) Business Development Program with gross annual receipts over $20 million must submit audited annual financial statements to the SBA under 13 CFR 124.602, and those with receipts between $7.5 million and $20 million must submit reviewed statements. Private equity sponsors, mezzanine lenders, and institutional investors almost universally require audited statements from portfolio companies as an ongoing covenant and as a condition of close.

Common covenant language specifying audit obligations includes:

• A requirement to deliver audited financial statements prepared by an independent certified public accountant acceptable to the lender
• A deadline (often 90 to 120 days after fiscal year end) by which the audit must be delivered
• A requirement that the audit opinion be unqualified, with no going-concern language

If you are negotiating or renewing a credit facility, review the proposed covenant package carefully before signing. The cost of an audit is almost always far lower than the cost of a covenant violation.

Technology and Service Companies: SOC Reports

A different type of audit obligation applies to technology companies and service organizations that process data or provide outsourced functions for other businesses. Customers and enterprise buyers frequently require a SOC 2 report as a condition of doing business. While a SOC 2 is technically an attestation engagement rather than a financial statement audit, it is conducted by a licensed CPA firm under AICPA SSAE No. 18 and evaluated against the AICPA Trust Services Criteria.

SOC 2 is rarely mandated by statute, but it is commercially required in SaaS, cloud infrastructure, healthcare IT, and financial services contracting. Security is the only Trust Services criterion required in every SOC 2 engagement; scope for the other four criteria (Availability, Processing Integrity, Confidentiality, and Privacy) depends on customer commitments and contractual requirements. Modus’s SOC reporting practice guides service organizations through scoping, readiness, and the audit itself.

Do I Need an Audit If It Is Not Legally Required?

Some companies ask “do I need an audit” even when no statute forces the issue, and often the practical answer is yes. These businesses pursue an audit voluntarily because the alternatives are worse. Common voluntary triggers include:

• A sale or acquisition process: buyers in M&A transactions routinely require audited historical financials as part of due diligence, and the absence of audited statements can reduce valuation or kill a deal entirely.
• Board governance: many private company boards, particularly those with outside directors or institutional investors, require annual audited financials as a matter of fiduciary responsibility.
• Insurance programs: certain directors and officers (D&O) or professional liability policies require audited financial statements as a condition of coverage.
• International operations: subsidiaries operating in foreign jurisdictions often face statutory audit requirements under local corporate law even when the parent company has no U.S. audit obligation.

Related reading: Audit Process, Step by Step: What to Expect at Every Stage

Frequently Asked Questions

What is the difference between an audit, a review, and a compilation?

An audit provides the highest level of assurance. The auditor performs extensive testing, confirms balances with third parties, and issues an opinion on whether the financial statements are presented fairly in accordance with GAAP. A review involves limited procedures and provides limited assurance: the accountant performs analytical procedures and inquiries but not the full testing of an audit. A compilation involves no assurance; the accountant simply assembles financial statements from information provided by management. Many lenders and regulators require audited financials specifically, and a review will not satisfy that requirement.

Do small businesses ever need an audit?

Yes, depending on circumstances. A small business that receives federal grants, sponsors a 401(k) with 100 or more participants with balances, has a bank covenant requiring audited statements, or is being sold to a buyer who requires audited financials will need an audit regardless of company size. Small size does not automatically exempt a company from an audit requirement.

How often do I need an audit?

Most legal requirements are annual. The Single Audit covers each fiscal year in which the entity crosses the federal expenditure threshold. Form 5500 requires an audit opinion each year the plan qualifies as large. Lender covenants typically require audited financial statements within a specified number of days after each fiscal year end. If the triggering condition exists every year, the audit is annual.

Does a nonprofit need an audit if it is below the state revenue threshold?

Not by state law, but potentially yes for other reasons. A nonprofit below its state’s charitable registration threshold may still need an audit if it receives federal awards above $1,000,000, if a funder contractually requires one, or if the board has adopted a governance policy requiring independent audit. Check every grant agreement and funder requirement separately from state law.

What happens if I am required to have an audit and do not get one?

The consequences depend on the requirement. Failing to deliver audited financials under a bank covenant puts the borrower in technical default, potentially triggering acceleration of the loan. Failing to complete a Single Audit by the required deadline can result in penalties, loss of federal funding eligibility, and required repayment of federal awards. For employee benefit plan sponsors, a Form 5500 that omits a required audit opinion is treated as incomplete or unfiled, and the DOL can assess a civil penalty of up to $2,739 per day for 2025 with no annual cap. These per-day amounts are adjusted for inflation each year. Plan sponsors who catch the problem early can often reduce the exposure sharply through the DOL Delinquent Filer Voluntary Compliance Program.

Does the new 401(k) participant-counting rule apply retroactively?

No. The change to counting participants with account balances applies to plan years beginning on or after January 1, 2023. Plans with plan year start dates before that date use the old counting method for those years. Plans that already filed as large plans under the old rule should recount under the new rule when determining their filing category for 2023 plan years and later.