Audit Process, Step by Step: What to Expect at Every Stage

The audit process follows a defined sequence of phases: engagement acceptance, planning and risk assessment, internal control evaluation, substantive testing, and final reporting. Each phase builds on the last, and the depth of work in any given area flows directly from what auditors learn in the phases that precede it. Understanding how the audit process works helps CFOs, controllers, and audit committees prepare more efficiently and engage more productively with their audit team.

Phase 1: Engagement Acceptance and Pre-Planning

Before substantive work begins, an audit firm must decide whether to accept or continue the engagement. Under AICPA AU-C Section 210, the auditor evaluates management integrity, confirms independence, and agrees on the terms of the engagement in an engagement letter. For a new client, the firm performs client acceptance procedures that typically include background checks, conversations with predecessor auditors (when applicable), and a review of preliminary financial information.

The engagement letter defines the scope of the audit, management’s responsibilities for the financial statements and internal controls, and the auditor’s responsibilities under Generally Accepted Auditing Standards (GAAS). Getting this document right matters: scope disputes that arise mid-audit almost always trace back to ambiguity in the engagement letter.

What management should prepare

• Prior-year financial statements and the prior audit report, if any
• Draft current-year financials or trial balance
• Entity organizational chart and list of subsidiaries or related parties
• List of significant accounting policies and any recent changes

Phase 2: Planning and Risk Assessment

The audit process is shaped by risk. Under SAS No. 145 (effective for audits of financial statements for periods ending on or after December 15, 2023), auditors are required to perform risk assessment procedures to understand the entity and its environment, including its internal controls, before designing further audit procedures. The goal is to identify where the financial statements are most likely to be materially misstated.

The audit risk model

Auditors use the audit risk model as their analytical foundation. The model expresses audit risk as a function of three components:

• Inherent risk: The susceptibility of an assertion to a material misstatement before considering related controls. Complex estimates, non-routine transactions, and areas with significant management judgment carry higher inherent risk.
• Control risk: The risk that a misstatement will not be prevented or detected by the entity’s internal controls on a timely basis.
• Detection risk: The risk that the auditor’s own procedures will fail to catch a material misstatement that exists. Detection risk is the lever the auditor controls directly by adjusting the nature, timing, and extent of substantive procedures.

Where inherent and control risk are assessed as high, the auditor must lower detection risk by performing more extensive or more targeted substantive testing. Where controls are strong and inherent risk is low, the auditor can accept higher detection risk and perform less work. This is the mechanism that makes risk-based auditing more efficient than a checklist approach.

Materiality

Auditors set a materiality threshold during planning. Materiality represents the magnitude of a misstatement that could reasonably influence the economic decisions of financial statement users. Performance materiality, set below overall materiality, gives the auditor a margin to aggregate smaller misstatements without inadvertently exceeding the overall threshold. Items below a separate, lower “clearly trivial” threshold are generally not evaluated individually.

Understanding internal controls

Risk assessment includes evaluating the design and implementation of relevant internal controls. Auditors typically perform walkthroughs: they trace a transaction from initiation through recording in the general ledger, observing the controls that operate along the way. A walkthrough tests design adequacy and confirms that the control exists as described. It does not, by itself, demonstrate that the control has operated effectively throughout the period under audit.

Phase 3: Tests of Controls

If the auditor plans to rely on a specific control to reduce assessed control risk, that reliance must be supported by testing the control’s operating effectiveness over a representative period. This is the test of controls phase, and the extent of testing depends on how much reliance the auditor intends to place on the control and for how long the period of reliance extends.

Control testing techniques include:

• Inspection: Examining a sample of physical documents, approvals, or system-generated logs that demonstrate a control operated.
• Observation: Watching a control being performed in real time.
• Reperformance: Independently re-executing the control procedure to verify it produces the correct result.
• Re-inquiry combined with corroborating evidence: Inquiry alone is not sufficient to test operating effectiveness; it must be paired with one of the other techniques above.

If control testing reveals that a control is not operating effectively, the auditor cannot rely on it to reduce assessed control risk. That means more substantive testing is required for the affected assertions.

When tests of controls are required

Auditors are not required to test controls in every audit. If the auditor assesses control risk at maximum (i.e., does not plan to rely on any controls), tests of controls can be skipped and the auditor proceeds directly to substantive procedures. However, for audits of public companies under PCAOB AS 2201, an integrated audit of internal control over financial reporting is required, which mandates both testing of controls and a separate opinion on the effectiveness of internal controls.

Phase 4: Substantive Testing

Substantive testing is the core of the audit process and the phase that generates the most evidence. AU-C Section 330 requires substantive procedures for every material class of transactions, account balance, and disclosure, regardless of the assessed level of control risk. Even when controls test effectively, the auditor cannot omit substantive work entirely on a material account.

Substantive procedures take two forms.

Tests of details

Tests of details examine individual transactions, balances, or disclosures. Common examples include:

• Confirming accounts receivable balances directly with customers
• Tracing cash receipts to bank statements and deposit slips
• Vouching expense transactions back to invoices and purchase orders
• Physically observing inventory counts and performing test counts
• Obtaining external confirmations for loan balances and terms
• Reviewing support for significant accounting estimates

The direction of testing matters. Testing from the recorded balance outward tests the existence assertion (are recorded amounts real?). Testing from source documents into the ledger tests the completeness assertion (are all real amounts recorded?). A well-designed audit program tests both directions for high-risk accounts.

Substantive analytical procedures

Substantive analytical procedures develop an independent expectation of a balance or ratio and then compare it to the recorded amount. If the difference exceeds a threshold, the auditor investigates the discrepancy. These procedures work well for large volumes of predictable transactions, such as payroll, recurring revenue, or utilities expense. They are generally less persuasive than tests of details for high-risk assertions or accounts with volatile or non-recurring balances.

Audit sampling

For most tests of details, auditors select a sample rather than testing every transaction. Sample sizes are determined by the assessed risk, the desired confidence level, tolerable misstatement, and expected population error rate. When misstatements are found in a sample, auditors project those errors to the full population to assess whether the account is materially misstated.

Phase 5: Evaluating Evidence and Wrapping Up

After substantive procedures are complete, the auditor evaluates all evidence obtained. This includes:

• Aggregating identified misstatements and comparing them to materiality
• Reviewing disclosures for completeness and accuracy
• Evaluating whether accounting estimates are reasonable
• Assessing whether the financial statements as a whole are free of material misstatement

Identified misstatements are communicated to management in a schedule of differences. Management can choose to correct items; those they decline to correct are evaluated in aggregate to determine whether the financial statements remain fairly presented. The auditor also evaluates whether any uncorrected misstatements reflect intentional management bias.

Near the end of fieldwork, the auditor performs final analytical procedures as an overall review. These procedures ask whether the financial statements, viewed as a whole, are consistent with the auditor’s understanding of the entity. Unexpected relationships or balances that cannot be explained may require additional work before the audit can be concluded.

Management and governance communications

Before issuing the report, the auditor communicates with those charged with governance, typically the audit committee or board. Under AU-C Section 260, required communications include significant findings from the audit, qualitative aspects of significant accounting practices, difficulties encountered during the audit, and uncorrected misstatements. These conversations are an important check before the report is signed.

Phase 6: The Auditor’s Report

The auditor’s report is the deliverable that financial statement users see. Under AU-C Section 700, the standard report contains an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.

There are four possible opinion types:

• Unmodified opinion: The financial statements are fairly presented. This is the standard outcome when the audit is completed without material issues.
• Qualified opinion: There is a material, but not pervasive, departure from the financial reporting framework, or the auditor was unable to obtain sufficient evidence about a specific area. The report includes an explanatory paragraph describing the basis for the qualification.
• Adverse opinion: The financial statements are materially misstated and the effect is pervasive. An adverse opinion is relatively rare and is a serious finding.
• Disclaimer of opinion: The auditor was unable to obtain sufficient appropriate audit evidence, and the possible effects are material and pervasive. The auditor declines to express an opinion.

For audits subject to the PCAOB standards, the report also includes a description of critical audit matters (CAMs): issues that required especially challenging or complex auditor judgment and were communicated to the audit committee.

How Long Does the Audit Process Take?

The timeline of the audit process depends on entity size, complexity, quality of books and records, and how quickly management responds to auditor requests. For a mid-market company, audits often run 6 to 14 weeks from fieldwork start to report issuance. The single biggest driver of delays is document turnaround from the client side. Finance teams that prepare a thorough provided-by-client (PBC) list and deliver supporting schedules on time consistently see shorter timelines.

Audit & assurance services at Modus are designed around this reality. Source-linked workpapers and structured request lists make it easier to see exactly what is outstanding and why, which reduces back-and-forth and compresses elapsed time without cutting corners on audit quality.

The same phased structure applies to specialized audits. An employee benefit plan audit, for example, follows the same risk assessment, control testing, and substantive testing sequence but applies it to plan-specific assertions: participant eligibility, contribution completeness, benefit payments, and investment valuation.

Related reading: How to Prepare for an Audit: Your First Financial Statement Audit

Frequently Asked Questions

What are the main steps in a financial statement audit?

A financial statement audit has six main phases: (1) engagement acceptance and pre-planning, (2) planning and risk assessment including materiality setting, (3) tests of controls, (4) substantive testing (tests of details and analytical procedures), (5) evaluation of evidence and wrap-up communications, and (6) issuance of the auditor’s report.

What is the audit risk model?

The audit risk model states that audit risk equals inherent risk multiplied by control risk multiplied by detection risk. Auditors use the model to determine how much substantive testing to perform. When inherent or control risk is high, auditors must lower detection risk by doing more extensive or targeted substantive procedures.

What is the difference between tests of controls and substantive testing?

Tests of controls determine whether specific internal controls are operating effectively so the auditor can rely on them to reduce assessed control risk. Substantive testing, which includes tests of details and analytical procedures, gathers direct evidence about whether financial statement balances and disclosures are free of material misstatement. Both may be performed in the same audit, but substantive testing is required for all material accounts regardless of control test results.

What does an unmodified audit opinion mean?

An unmodified opinion means the auditor found that the financial statements are presented fairly, in all material respects, in accordance with the applicable accounting framework (such as U.S. GAAP). It does not mean the financial statements are perfect or that the auditor reviewed every transaction; it means the auditor obtained reasonable assurance that no material misstatements exist.

How can management help the audit go faster?

The most effective step is delivering a complete, organized provided-by-client (PBC) package before fieldwork begins. This includes reconciled account schedules, support for significant estimates, contracts or agreements for material transactions, and prior-year audit support. Prompt responses to auditor questions during fieldwork, and having knowledgeable staff available to answer process and control questions, also reduce elapsed time substantially.

Are audits required by law?

Public companies registered with the SEC are required to have annual audits under PCAOB standards. Many private companies face audit requirements through loan covenants, investor agreements, or federal program participation. Under the Uniform Guidance at 2 CFR 200.501, a non-federal entity that expends $1,000,000 or more in federal awards during its fiscal year must have a Single Audit; the raised $1,000,000 threshold (up from $750,000) applies to fiscal years beginning on or after October 1, 2024. Employee benefit plans with 100 or more participants with account balances at the beginning of the plan year generally require an annual audit under ERISA, and the 80-120 rule lets plans near that line keep their prior-year filing status.