Audit vs. Review vs. Compilation: Which Assurance Do You Need?

An audit provides the highest level of assurance that financial statements are free from material misstatement, based on evidence-gathering, testing, and an independent opinion. A review provides limited assurance through inquiry and analytical procedures, without the depth of an audit. A compilation involves no assurance at all. The CPA assembles your financial data into proper form but does not test or verify it. Which one you need depends on who is asking for the financial statements and why.

Why the Distinction Between Audit, Review, and Compilation Matters

Finance leaders regularly field a deceptively simple question from lenders, investors, grant agencies, or their own boards: “Can we see your financials?” What they really mean is a specific level of scrutiny, and choosing the wrong level costs you either credibility or unnecessary expense.

The three services come from different AICPA standards. Audits are conducted under the Statements on Auditing Standards (SAS), governed by AU-C sections including AU-C 700 for forming an opinion. Compilations and reviews fall under the Statements on Standards for Accounting and Review Services (SSARS), specifically AR-C sections 80 and 90. Understanding these distinctions lets you have an informed conversation with your CPA before a stakeholder deadline forces the issue.

The Three Levels Defined

Audit: Reasonable Assurance and an Independent Opinion

An audit is the most rigorous financial statement service a CPA firm performs. The auditor must be independent, must assess the risk of material misstatement (including fraud risk), and must gather sufficient appropriate evidence to form an opinion under AU-C 700. That opinion states whether the financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework, typically U.S. GAAP.

The procedures are extensive: confirmation of balances with third parties, physical observation of inventory, testing of transactions, evaluation of internal controls, and substantive analytical procedures. The engagement concludes with a formal auditor’s report attached to the financial statements. The opinion can be unmodified (clean), qualified, adverse, or a disclaimer of opinion, depending on what the evidence shows.

Audit engagements for mid-market businesses typically run from several weeks to a few months depending on complexity, entity size, and quality of the client’s underlying records. AI-native workflows, like those Modus uses, with source-linked workpapers and automated evidence mapping, can compress the timeline and reduce the back-and-forth that traditionally burdens finance teams.

Review Engagement: Limited Assurance Without Deep Testing

A review, governed by AR-C section 90 (as updated by SSARS No. 25 effective for periods ending on or after December 15, 2021), provides limited assurance that no material modifications are needed for the financial statements to conform to GAAP. The phrase “limited assurance” has a precise meaning: it is less than the reasonable assurance of an audit, and the procedures are correspondingly narrower.

The accountant performing a review must be independent and must perform two primary categories of work: inquiry (asking management and key personnel about accounting policies, significant transactions, and known issues) and analytical procedures (comparing current-period data to prior periods, budgets, and industry benchmarks to identify unexpected fluctuations). The accountant does not test individual transactions, confirm balances with outside parties, or assess internal controls the way an auditor does.

The review report states that the accountant is not aware of any material modifications needed. That is a negative-assurance conclusion rather than a positive opinion. This distinction is meaningful: the absence of evidence of a problem is not the same as evidence that no problem exists.

Compilation Engagement: No Assurance, Professional Form

A compilation, under AR-C section 80, is the most basic CPA financial statement service that still produces a report. The accountant takes financial information management provides and presents it in the proper form of financial statements. The accountant does not verify the information, confirm its accuracy, or perform any analytical procedures.

Critically, a CPA performing a compilation is not required to be independent. If independence is impaired, the CPA must disclose that fact in the compilation report, but the engagement can still proceed. This stands in sharp contrast to reviews and audits, where independence is non-negotiable.

The compilation report explicitly states that no assurance is provided. Readers of compiled financial statements should understand they are getting professionally formatted numbers, not a professional opinion on those numbers.

A note on scope: AR-C section 70 governs preparation of financial statements, a service below even a compilation, where the CPA prepares the statements but does not issue any report at all, instead noting “no assurance provided” on each page. Preparation is appropriate when a client simply needs help structuring financials for internal use, not external reporting.

Audit vs. Review vs. Compilation: Side-by-Side

Feature	Compilation	Review	Audit
Assurance level	None	Limited	Reasonable (high)
AICPA standard	AR-C 80	AR-C 90	AU-C 700+
Independence required	No (disclose if impaired)	Yes	Yes
Procedures	None specified	Inquiry + analytics	Evidence, testing, controls
Report type	Compilation report	Negative assurance	Opinion (unmodified or modified)
Relative cost	Lowest	Moderate	Highest
Typical timeline	Days to weeks	Weeks	Weeks to months

When Each Service Is Actually Required

When an Audit Is Mandatory

Audits are not optional in several common situations:

Federal grant recipients. Any non-federal entity that expends $1,000,000 or more in federal awards in a fiscal year must undergo a Single Audit (or program-specific audit) under 2 CFR 200.501. That threshold increased from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024. The Single Audit is a full financial statement audit plus a compliance audit over federal programs, so a compilation or review does not satisfy this requirement.

Employee benefit plans. Large 401(k) and other ERISA-covered plans generally require an annual audit. Under revised DOL rules effective for plan years beginning on or after January 1, 2023, “large plan” status is determined by counting participants who had account balances at the beginning of the plan year (not all eligible participants). Plans with 100 or more such participants trigger the audit requirement, subject to the 80-120 rule for plans near the threshold.

Lender covenants. Many commercial loan agreements and bond indentures require audited financials annually as a condition of the credit facility. Private equity-backed companies almost universally operate under audited financials to satisfy investors and support future transactions.

Regulatory requirements. Certain SEC-reporting companies, broker-dealers, insurance carriers, and other regulated entities face statutory audit requirements. For issuers, PCAOB standards apply rather than AICPA SAS.

Nonprofit state registration thresholds. Most states have revenue thresholds above which registered nonprofits must submit audited financials to the state attorney general or charity regulator. Thresholds vary by state, so confirm with your state’s filing requirements. See Modus’s nonprofit practice for more on assurance obligations specific to tax-exempt organizations.

When a Review Engagement Makes Sense

A review is the right choice when stakeholders want meaningful assurance but the situation does not mandate a full audit:

• A bank or credit union providing a smaller commercial loan may accept reviewed financials rather than requiring an audit.
• Board governance policies at some nonprofits or closely held companies specify reviewed statements without requiring the cost of an audit.
• A business owner considering a sale or seeking minority investment may use reviewed financials as a preliminary step before a buyer’s due-diligence audit.
• SBA loan programs often accept reviewed or audited statements depending on loan size and program type.

A review provides enough scrutiny to catch obvious accounting errors and most departures from GAAP, making it a meaningful upgrade over a compilation for any external user who needs some confidence in the numbers.

When a Compilation Is Sufficient

Compiled financials serve legitimate purposes, particularly when:

• A small business needs formatted financial statements for an internal purpose, a tax preparer, or a very small private loan where the lender does not require assurance.
• A startup is preparing financials for the first time and needs professional presentation before it has grown to the point where a lender requires more.
• An owner-operated business needs financial statements for an insurance application or similar purpose.

The key question is always whether the party receiving the financial statements will find a compilation acceptable. If your banker, investor, or grantor has specified a particular level of service, that specification controls.

How to Choose: Questions to Ask Before Engaging a CPA

If you are unsure which service to request, work through these questions with your finance team before calling your auditor:

1. Who is requiring the financial statements, and have they specified the assurance level? Get this in writing, whether a loan commitment letter, grant agreement, or board resolution. Do not assume a review satisfies an audit requirement.
2. Do you expend $1,000,000 or more in federal awards? If yes, you likely need a Single Audit.
3. Do you sponsor an employee benefit plan with 100 or more participants with account balances? If yes, an ERISA audit is probably required.
4. Is there a financial covenant in a credit agreement? Read the exact covenant language; it will specify the service level.
5. Are you preparing for a transaction? If an M&A process is on the horizon, audited financials reduce friction in due diligence. Modus’s transaction advisory team can advise on timing and scope.

For an authoritative overview of all three services from the standard-setter, the AICPA’s Guide to Financial Statement Services is a plain-English resource worth bookmarking.

Related reading: Going Concern: What It Means and How Management Assesses It

Frequently Asked Questions

What is the difference between an audit, a review, and a compilation?

An audit provides the highest assurance, requiring independent testing of transactions, confirmation of balances, and an opinion on the financial statements. A review provides limited assurance through inquiry and analytical procedures, without the depth of an audit. A compilation involves no assurance. The CPA formats management’s data into proper financial statement form but does not verify it.

Can a review replace an audit for a federal grant recipient?

No. Federal grant recipients expending $1,000,000 or more in federal awards in a fiscal year (for fiscal years beginning on or after October 1, 2024) must have a Single Audit conducted in accordance with 2 CFR Part 200, Subpart F. A review does not satisfy this requirement.

Does a CPA need to be independent to perform a compilation?

No, but the CPA must disclose the lack of independence in the compilation report. Independence is required for both review engagements and audits, with no exception.

What is limited assurance in a review engagement?

Limited assurance is the conclusion reached in a review engagement that the accountant is not aware of any material modifications needed for the financial statements to be in conformity with GAAP. It is based on inquiry and analytical procedures, not the evidence-gathering and testing that support an audit opinion. It is a lower standard than the reasonable assurance expressed in an audit.

When does an ERISA plan require an audit rather than a review?

ERISA-covered retirement plans with 100 or more participants who had account balances at the beginning of the plan year are generally classified as large plans and must have an annual audit. For plan years beginning on or after January 1, 2023, DOL rules determine large-plan status by counting participants with balances rather than all eligible participants. Plans near the 100-participant line may qualify for small-plan treatment under the 80-120 rule.

How much more does an audit cost compared to a review or compilation?

Costs vary widely based on entity size, complexity, and the specific firm. As a general benchmark, audits for mid-market businesses often run from $15,000 to $50,000 or more, while reviews typically cost meaningfully less and compilations are the least expensive. The right metric is cost relative to the value of the relationship or financing being protected: paying for an audit when a review suffices is waste, but submitting reviewed financials when an audit is contractually required can trigger a default.