How to prepare for an audit.

What kind of audit do we need?

Some of the more common types of audits include:

Compliance audits are performed by government regulatory auditors, and internal and external auditors, and examine compliance with laws, regulations, and contractual agreements. Audits done by the IRS, or by the bank as terms of a loan, are examples of compliance audits.

Operational audits are often performed by internal auditors, and examine internal controls and entity performance.

Forensic audits are conducted to investigate potential fraud or financial irregularities. This involves detailed examination and analysis of financial records and transactions.

Financial statement audits are performed by external auditors, who must be CPAs, and examine compliance with applicable reporting frameworks, such as GAAP and IFRS.

When should we perform a financial statement audit?

There are certain common triggers for an audit, including:

• Investors request an audit, which typically happens around Series C funding.
• Your company is preparing to go public. Companies are required to have three years of audited financial statements before they can sell their stocks.
• You’re planning to sell your business. Purchasers like to see two to three years of audited financial statements.
• You are looking to have extended credit from major suppliers.
• Your business has federal or state government funding.

Who should do the audit?

One of the first steps in audit preparation is determining who will perform the audit. Accounting firms that conduct audits can be divided into two groups: the Big Four accounting firms and other smaller and sometimes regional or specialist firms. The Big Four refers to Deloitte, PricewaterhouseCoopers (PwC), Ernst & Young (EY), and KPMG, the four largest professional services firms providing audit, tax, and advisory services.

When deciding which is right for you, budget is often a key consideration, with Big Four auditors typically being much more expensive. (A financial statement audit can run between 50–150K.) Some other things to consider include:

• Do they have experience in your industry?
• Do your investors have a preference for Big Four auditors?
• Have prospective auditors done their homework with regards to your business’s unique needs?
• Do they have a global presence? This can be important if you plan to expand internationally.
• Do they have any financial interest in your company? You shouldn’t work with auditors who do.
• Do they have enough resources to complete the audit before your deadline?

It’s difficult to change auditors partway through the process, so it’s vital to do your due diligence and ask for references from other companies whenever possible. If you anticipate an audit in your future, start this research early.

Once you’ve decided, the auditor evaluates you as a client to determine the scope of the audit, and, after signing an engagement letter, creates an audit program. The program is based on materiality, risk of misstatement, and other industry considerations.

What can I do to prepare for an audit?

Before you move into the field stage of the audit process, it’s important to have all your ducks in a row. Some proactive preparation beforehand can save hours of frustration — or even a poor audit result.

1. Understand what kind of audit will be performed. Audits follow two standards: those defined by the American Institute of Certified Public Accountants (AICPA) and those defined by the Public Company Accounting Oversight Board (PCAOB). PCAOB was created as part of the Sarbanes-Oxley Act, and is generally the more rigorous standard, with closer scrutiny and a lower materiality threshold. If your company is going through a special purpose acquisition company (SPAC), a PCAOB audit may be required.

2. Identify your resources. The SMEs who help with the audit process should have audit experience, if possible. Keep in mind that an audit is a lot of work, and these people will still have their “day jobs” to keep the company moving, so build that into your schedule and deadlines.

3. Determine all of your internal procedures. Examine every process, leaving no stone unturned. This will help you identify any gaps to address prior to the audit.

4. Gather documents. It all comes down to document management. Some of the items you need to assemble include:

• An audit trail for every line item in your financial statements.
• All journal entries, which should have all been reviewed and approved before being posted.
• Written policies and procedures, which should be rigorous and comprehensive.
• Articles of incorporation.
• Board meeting minutes.
• Stock plans.
• 409a evaluations.
• All significant agreements.

Auditors look for evidence of internal controls, and proof that they are implemented properly, including:

• Process artifacts that demonstrate the controls are working as they should.
• An approval matrix and evidence that it is followed.
• An org chart and evidence of segregation of duties. Startup culture frequently has people doing tasks outside of their job description, but there should be some clarity around who does what.
• Evidence of physical access control (i.e., the person who stores the checks shouldn’t be the person who signs them).
• IT access control.
• The SOC report from your payroll vendor.

Be prepared to show all reconciliations for all balance sheets, and ensure that bank statements are in agreement with your cash reconciliations. (Note that auditors will confirm your ending bank balances with the bank.)

Speaking at an Airbase webinar, KongBasileConsulting Director Wanda Wang addressed the “hot topics” with auditors. One centers around checking if businesses are following ASC 606 and have a memo or other documentation about the process. She suggested asking your auditor for a memo template if you don’t currently have one. The other hot area is around stock-based compensation: ensuring businesses are following ASC 718, have supporting documentation for the assumptions used, and all setups are correct in Carta.