Generally Accepted Auditing Standards: GAAP vs. GAAS Explained

GAAP (Generally Accepted Accounting Principles) and GAAS (Generally Accepted Auditing Standards) are two distinct frameworks that govern different sides of financial reporting. GAAP tells a company’s finance team how to prepare and present financial statements. GAAS tells the independent auditor how to examine those statements and form an opinion on whether they are fairly presented. The two sets of standards work together, but they come from different standard-setting bodies and carry different obligations for different parties.

What Is GAAP?

GAAP is the body of accounting rules that governs how U.S. companies recognize revenue, classify assets, measure liabilities, and present financial information to outside parties. The Financial Accounting Standards Board (FASB) is the primary standard-setter for GAAP in the private sector. Its rulings are organized into the FASB Accounting Standards Codification (ASC), which became the single authoritative source of nongovernmental U.S. GAAP effective September 2009.

Who Must Follow GAAP?

Any entity that issues financial statements to lenders, investors, or regulators under U.S. reporting requirements typically must follow GAAP. That includes:

• Publicly traded companies (which also follow SEC rules)
• Private companies seeking bank financing or investment
• Nonprofits filing Form 990 or seeking grant funding
• Employee benefit plans required to file Form 5500 with the DOL

GAAP is not a single rule or checklist. It spans hundreds of ASC topics covering everything from lease accounting (ASC 842) to revenue recognition (ASC 606) to credit losses (ASC 326). Finance teams, controllers, and CFOs are responsible for applying GAAP when preparing financial statements.

What GAAP Does Not Cover

GAAP says nothing about how an auditor should test management’s assertions. It does not define independence requirements for auditors, dictate how audit evidence should be gathered, or describe what an audit report should contain. Those responsibilities fall under a separate framework entirely.

What Are Generally Accepted Auditing Standards?

Generally accepted auditing standards are the set of guidelines that independent CPAs must follow when conducting a financial statement audit. GAAS defines the quality, conduct, and documentation requirements that auditors must meet to issue a credible opinion. The AICPA’s Auditing Standards Board (ASB) promulgates GAAS for non-public entities through Statements on Auditing Standards (SAS), which are codified as AU-C sections within the AICPA Professional Standards.

The Traditional 10-Standard Framework

The original GAAS framework established 10 standards grouped into three categories. Although the ASB has since modernized these into the AU-C codification through the Clarity Project, the three-category structure remains a useful organizing lens.

General Standards (3 standards)

These standards govern the auditor’s qualifications and conduct throughout the engagement:

1. Adequate technical training and proficiency
2. Independence in mental attitude
3. Due professional care in performing the audit and preparing the report

Standards of Field Work (3 standards)

These standards govern how the audit is planned and executed:

1. Adequate planning and proper supervision of any assistants
2. Sufficient understanding of internal control to plan the audit and assess risk
3. Sufficient appropriate audit evidence gathered to support the opinion

Standards of Reporting (4 standards)

These standards govern what the auditor must communicate in the report:

1. Whether the financial statements are presented in accordance with GAAP
2. Whether accounting principles have been consistently applied versus the prior period
3. Whether informative disclosures are reasonably adequate
4. An expression of opinion on the financial statements, or a statement that no opinion can be expressed and the reason why

The Modern AU-C Codification

The ASB’s Clarity Project produced the clarified Statements on Auditing Standards (SAS Nos. 122 through 124), which took effect for audits of financial statements for periods ending on or after December 15, 2012. This work replaced the 10 original standards with a full codification of AU-C sections numbered in alignment with the International Standards on Auditing (ISA). The AU-C structure organizes standards into logical clusters:

• AU-C 200 series: General principles and responsibilities (including independence, professional skepticism, and overall objectives)
• AU-C 300-499: Risk assessment and response to assessed risk
• AU-C 500-599: Audit evidence
• AU-C 600-699: Special areas (group audits, using the work of others)
• AU-C 700-799: Audit conclusions and reporting
• AU-C 800-899: Special-purpose reporting engagements

One of the most significant recent updates to GAAS is SAS No. 145, “Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement,” which substantially revised AU-C 315. SAS 145 is effective for audits of financial statements for periods ending on or after December 15, 2023, and sharpened requirements around how auditors identify and document significant risks.

GAAP vs. GAAS: The Core Differences

The simplest way to frame the distinction: GAAP is the language financial statements are written in; GAAS is the standard of review the auditor applies to reading them.

	GAAP	GAAS
Who it governs	Preparers (management, CFOs, controllers)	Auditors (independent CPAs)
Set by	FASB (private sector); GASB (governmental)	AICPA ASB (non-public entities)
Purpose	Consistent presentation of financial results	Credible, independent examination of those results
Output	Financial statements	Audit report with an opinion
Primary framework	FASB Accounting Standards Codification	AICPA AU-C sections (SAS)

Both frameworks exist because financial statements are only as useful as the confidence users can place in them. GAAP brings consistency so that different companies’ results can be compared. GAAS brings credibility so that users can trust those statements were independently verified.

When GAAS Applies to Your Organization

GAAS governs audits of non-issuers, which means it applies to private companies, nonprofits, and employee benefit plans rather than publicly traded companies. Publicly traded companies and SEC registrants must comply with PCAOB auditing standards, which were established under the Sarbanes-Oxley Act of 2002 and carry more prescriptive requirements, including mandatory testing of internal controls over financial reporting (ICFR) for larger accelerated filers.

Private Companies

A private company typically faces a GAAS audit when lenders, private equity sponsors, or shareholders require audited financial statements. Credit agreements above a certain size commonly require annual audited financials under GAAS. If a company is preparing for a sale or capital raise, an audited balance sheet under GAAS significantly reduces buyer risk and often speeds transaction due diligence. Modus provides audit and assurance services tailored to mid-market companies navigating these requirements.

Nonprofits

Nonprofits face GAAS audits when their bylaws require one, when a major funder mandates it, or when they cross thresholds that trigger a Single Audit. The Single Audit threshold, updated for fiscal years beginning on or after October 1, 2024, now requires a Single Audit for any nonprofit that expends $1,000,000 or more in federal awards in a fiscal year. Single Audits must follow not only GAAS but also Government Auditing Standards (the Yellow Book). Nonprofits that want to understand what level of assurance they need can start at Modus’s nonprofit industry page.

Employee Benefit Plans

Large employee benefit plans subject to ERISA require an annual audit filed with the Department of Labor on Form 5500. Whether a plan qualifies as “large” generally turns on having 100 or more eligible participants at the beginning of the plan year, with a practical exception known as the 80-120 rule that allows plans to remain in the small-plan category if they were previously eligible. For plan years beginning on or after January 1, 2023, the DOL changed how participants are counted: only participants with account balances count toward the threshold, replacing the prior method of counting all eligible participants. Plan sponsors with questions about audit obligations can learn more about Modus’s employee benefit plan audit practice.

Why the Distinction Matters in Practice

Finance leaders sometimes encounter GAAP and GAAS as if they were interchangeable. They are not, and conflating them creates real risk.

Management’s responsibility vs. the auditor’s responsibility. GAAP is management’s responsibility. The auditor’s report expressly states that management is responsible for the preparation and fair presentation of financial statements in accordance with GAAP, and that the auditor’s responsibility is to express an opinion on those statements based on the audit conducted under GAAS. If financial statements contain a GAAP error, that is a management failure. If an auditor fails to detect a material misstatement because audit procedures were inadequate, that is a GAAS failure.

Materiality. Both frameworks use the concept of materiality, but differently. Under GAAP, materiality determines which items require separate disclosure or different accounting treatment. Under GAAS, materiality sets the threshold for the auditor’s risk assessment and the nature, timing, and extent of audit procedures. Auditors set a planning materiality amount early in the engagement, and that number drives every major procedural decision.

Audit opinions and GAAP compliance. The fourth reporting standard under GAAS requires the auditor to evaluate whether the financial statements comply with GAAP and reflect that in the audit opinion. An auditor who issues an unmodified opinion (“clean opinion”) is providing assurance that the statements are fairly presented in all material respects in accordance with GAAP. A qualified or adverse opinion, or a disclaimer, signals a breakdown somewhere in the GAAP-GAAS relationship.

How AI-Native Audits Fit In

GAAS does not change just because an audit firm uses technology. The standards governing independence, professional skepticism, evidence sufficiency, and reporting still apply in full. What changes is how evidence is gathered and documented. AI-native audit approaches can link audit procedures directly to source evidence, reduce the volume of manual data requests sent to clients, and support faster completion without sacrificing the rigor that GAAS demands. The obligation to comply with both GAAP and GAAS remains with the company and its auditor, respectively.

Related reading: Audit Committee Responsibilities and Best Practices

Frequently Asked Questions

What is the difference between GAAP and GAAS?

GAAP (Generally Accepted Accounting Principles) governs how companies prepare and present their financial statements. GAAS (Generally Accepted Auditing Standards) governs how independent auditors examine those financial statements. GAAP is set primarily by the FASB and applies to financial statement preparers. GAAS is set by the AICPA’s Auditing Standards Board for non-public entities and applies to auditors.

Who sets GAAS in the United States?

For audits of non-public entities (private companies, nonprofits, employee benefit plans), GAAS is set by the AICPA’s Auditing Standards Board through Statements on Auditing Standards (SAS). For audits of public companies and SEC registrants, the PCAOB sets the applicable auditing standards under the authority granted by the Sarbanes-Oxley Act of 2002.

Does a company have to follow both GAAP and GAAS?

A company follows GAAP when preparing its financial statements. Its independent auditor follows GAAS when examining those statements. Management does not follow GAAS directly, but a company that requires an audit must engage a CPA firm that will apply GAAS. The two frameworks work together: GAAS requires the auditor to assess whether management applied GAAP correctly.

When is a GAAS audit required?

A GAAS audit may be required by contract (such as a loan agreement or investor requirement), by regulation (such as ERISA for large employee benefit plans), or by law (such as a Single Audit for entities expending $1,000,000 or more in federal awards in fiscal years beginning on or after October 1, 2024). Some nonprofits and private companies also undergo voluntary audits to support credibility with donors, lenders, or boards.

What is the difference between GAAS and PCAOB auditing standards?

Both GAAS and PCAOB standards govern the conduct of financial statement audits, but they apply to different entities. GAAS (AICPA AU-C sections) applies to audits of non-issuers: private companies, nonprofits, and employee benefit plans. PCAOB standards apply to audits of public companies and SEC registrants. PCAOB audits generally carry more stringent requirements, including mandatory internal control testing for larger accelerated filers and formal PCAOB inspection of registered firms.

What is SAS 145 and why does it matter?

SAS No. 145, “Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement,” is an AICPA standard that took effect for audits of financial statements for periods ending on or after December 15, 2023. It significantly updated AU-C 315 and raised the bar on how auditors identify, document, and respond to risks of material misstatement. Companies undergoing audits since fiscal year 2023 should expect their auditors to ask more detailed questions about internal controls and business processes as part of a more structured risk assessment process.