Does Your Business Need an Audit? A Closer Look at Audits, Reviews and Compilations

Most business owners do not spend much time thinking about financial statement audits until a lender requests one, an investor starts asking questions or the company is preparing for a major change.

At that point, the process can feel unfamiliar. An audit involves much more than reviewing a set of financial statements. The CPA needs to understand how financial information moves through the business, where errors could occur and whether the controls supporting the numbers are working as intended.

This is where the experience of the audit team becomes valuable. A team that regularly performs this work knows which questions to ask, where to focus and how to keep the engagement moving while still giving higher-risk areas the attention they deserve.

An audit cannot remove every business risk or guarantee that fraud will be uncovered. It can give you an independent view of the financial information you rely on and the processes behind it.

What Is a Financial Statement Audit?

A financial statement audit is an independent examination of a company’s financial records and reporting.

During the engagement, the CPA learns how the business handles its financial processes, develops an understanding of its internal controls and performs procedures to gather evidence about the financial statements. The auditor then issues an opinion on whether those statements are fairly presented under the applicable accounting framework.

That opinion is often what a lender, investor or other outside party needs. For the company itself, the process can also provide more confidence in the numbers being used to manage cash flow, evaluate profitability and plan future investments.

The audit report is important, but it is not the only potential benefit. The work may also bring attention to accounting issues, reporting practices or internal processes that have not kept pace with the business.

At CJBS, our auditors bring extensive experience working with businesses across a range of industries. That perspective helps us understand which areas may deserve a closer look and communicate what we find in a way that is useful to management.

When Might Your Business Need an Audit?

Sometimes the answer is straightforward. A bank, investor, regulator, grantor or other outside party may require audited financial statements.

In other cases, an audit is something the company chooses to pursue. You may be preparing for financing, considering a sale or trying to get a clearer picture of the business after a period of growth.

An audit may be worth discussing when:

• A lender requests audited financial statements
• The company is seeking new financing or outside investment
• Ownership is preparing for a sale, merger or succession
• The business has added locations, departments or legal entities
• Financial reporting has become slower or less consistent
• Transaction volume has outgrown existing accounting procedures
• A new accounting or financial system has been implemented
• Management or the board wants an independent view of the company’s reporting

Completing an audit before a lender, buyer or investor begins asking questions can give the company more time to address accounting issues and organize supporting documentation.

It can also make the next step less disruptive. Instead of discovering a problem in the middle of due diligence, management has an opportunity to understand it and decide how it should be handled.

How an Audit Can Help You Better Understand Risk

Business risk does not always appear as one major problem.

It may begin with a missed reconciliation, an unsupported journal entry or a process that gives one employee too much control over a transaction. These issues can be easy to overlook when the company is busy and the financial statements still appear reasonable.

CJBS partner Ryan Guedel, CPA, has written about how fraud may begin with someone testing a weakness in the system. The first transaction may be relatively small. When it goes unnoticed, the person may continue or increase the activity.

His article focused on cannabis companies, which often face added complications involving cash, inventory and regulatory requirements. The broader point applies across industries. A business is more exposed when one person can initiate, approve and conceal the same transaction without meaningful review.

An audit creates an opportunity to look more closely at those processes and consider whether the controls still fit the way the company operates today.

A Practical Look at Internal Controls

Internal controls are the checks built into a company’s financial and operational processes. They help protect assets, maintain accurate records and clarify who is responsible for each step.

Some controls are formal, such as requiring two approvals for a large payment. Others may be as simple as having an owner or manager review the monthly bank reconciliation.

The right approach depends on the size and structure of the company. A business with a larger accounting department may divide responsibilities among several employees. A smaller company may need to create oversight in other ways.

As part of an audit, the CPA develops an understanding of these controls and considers where a material error or misstatement could occur. The auditor is not testing every transaction, but the process provides another perspective on how financial information moves through the organization and where gaps may exist.

Mapping How Work Actually Gets Done

As a business grows, financial processes often become more complicated without anyone intentionally redesigning them. New employees take on parts of a task, departments develop their own routines and approvals may happen differently depending on who is involved.

Flowcharting can make those changes much easier to see.

A flowchart maps each step in a process, including who initiates a transaction, who approves it, how it is recorded and who reviews the final result. Seeing the full process laid out visually can reveal gaps, duplicated work or situations where one person has too much control.

For example, a purchasing flowchart might follow a transaction from the original request through vendor approval, receipt of the goods, invoice review, payment authorization and entry into the accounting system.

Along the way, it may become clear that an approval is happening informally, supporting documentation is not always retained or one employee is responsible for several steps that would benefit from additional oversight.

Flowcharting can also help answer questions such as:

• Where does information enter the accounting system?
• Who can approve or change a transaction?
• Is there an independent review at an important point?
• What happens when the usual employee is unavailable?
• Are departments following the same process?
• Do written policies match what employees are actually doing?

An experienced audit team knows how to walk through these processes with employees, compare the explanations with the documented procedures and identify where controls may not be operating as expected.

The flowcharts can remain useful after the engagement. They may support employee training, clarify responsibilities and give management a practical reference when a process changes.

Internal Controls Worth Reviewing

A few areas commonly deserve attention when you are looking at how money, inventory and financial information move through the business.

Payment Approvals

Consider who prepares payments and who has the authority to release them.

When one person controls both steps, an incorrect or unauthorized payment may be harder to catch. Depending on the size of the business, a second approval may be appropriate for larger payments, while smaller transactions can be reviewed periodically by someone outside the process.

Account Reconciliations

Bank accounts, cash activity and other financial records should be compared with the company’s books on a consistent schedule.

When reconciliations fall behind, unusual transactions may sit unnoticed for weeks or months. Regular reviews make it easier to investigate a discrepancy while invoices, receipts and other supporting information are still available.

Invoice and Vendor Reviews

Before an invoice is paid, it can be compared with the purchase order, contract, packing slip or other documentation connected with the purchase.

Vendor records should also be reviewed periodically. Duplicate records, unfamiliar addresses or unexpected changes to banking information may point to an error or attempted fraud.

Physical Inventory Counts

Inventory software is helpful, but it only reflects what has been entered into the system.

Periodic physical counts allow the company to compare its records with what is actually on hand. Differences may point to shrinkage, damaged products, receiving errors or weaknesses in how inventory is recorded and moved.

Controls Need to Keep Up With the Business

A process that worked well when the company had five employees may not provide enough oversight once it has several departments, locations or systems.

It can be helpful to revisit internal controls after an expansion, leadership change, acquisition or software implementation. Even without a major event, a periodic review may reveal that employees still have access they no longer need, approval limits are outdated or departments are handling similar transactions in different ways.

No internal control system is perfect. The goal is to understand how transactions move through the business and make errors or unusual activity easier to spot.

Audit vs. Review vs. Compilation

A full audit is not the right fit for every business. The appropriate service depends on who will use the financial statements, what they need from them and how much assurance is required.

Audit

An audit provides the highest level of assurance among the three services. It includes detailed procedures, an understanding of internal controls and outside verification of selected financial information. At the end of the engagement, the CPA issues an opinion on the financial statements.

Review

A review provides limited assurance and involves less work than an audit. The CPA primarily uses inquiries and analytical procedures to determine whether any material changes appear necessary for the financial statements to follow the applicable accounting framework.

Compilation

During a compilation, the CPA uses financial information provided by management to prepare financial statements in the appropriate format. The CPA does not express an opinion or provide assurance on those statements.

Finding the Right Fit

The right engagement starts with understanding what you are trying to accomplish.

You may need audited financial statements for a lender. You may want a review before approaching investors. You may be concerned about one specific process, account or location rather than the financial statements as a whole.

In that case, an audit, review or compilation may not be the only option. Agreed-upon procedures or a customized consulting engagement can focus on the area creating concern.

It also helps to work with a CPA firm that understands the demands of the engagement and can guide you through the process from planning through completion. An experienced team can identify potential issues earlier, explain what information will be needed and communicate findings in a way that is useful to the people running the business.

CJBS provides audit and risk services backed by extensive experience in financial reporting, internal controls and assurance engagements. Contact our team to discuss which approach may be appropriate for your business.