Audit requirements in the USA are not uniform. Whether a business must undergo an independent financial audit depends on its legal structure, size, funding sources, and the state in which it operates. Public companies face mandatory federal audit obligations under securities law, while private companies, nonprofits, and government contractors each operate under distinct frameworks. This guide covers who must be audited in the USA, which authorities and standards apply, what the audit process involves, and what the consequences of non-compliance look like.
The USA does not impose a single, universal audit mandate on all businesses. Instead, the obligation arises from a combination of federal law, state law, contractual requirements, and industry-specific regulation.
Public companies registered with the Securities and Exchange Commission (SEC) are subject to the most rigorous audit requirements in the USA. Under the Securities Exchange Act of 1934 and the Sarbanes-Oxley Act (SOX), these companies must file audited annual financial statements prepared in accordance with Generally Accepted Accounting Principles (GAAP). The audit must be conducted by a registered public accounting firm that is subject to oversight by the Public Company Accounting Oversight Board (PCAOB).
Private companies have no blanket federal audit requirement. However, audit obligations can arise from lenders, investors, or contractual arrangements. A private equity-backed company, for example, will almost always be required by its investors to produce audited financials annually, regardless of any statutory mandate.
Nonprofit organisations that receive federal funding above a certain threshold are subject to the Single Audit requirement under the Uniform Guidance (2 CFR Part 200). This is a specific type of compliance audit that examines how federal grant money was spent. The threshold is set at a level that captures organisations receiving substantial federal awards in a given fiscal year.
Government contractors and subcontractors may also face audit requirements under the Federal Acquisition Regulation (FAR) and the Defense Contract Audit Agency (DCAA) framework, particularly when cost-reimbursable contracts are involved.
Two bodies set the professional standards that govern most audits conducted in the USA: the PCAOB and the American Institute of Certified Public Accountants (AICPA).
The PCAOB was established by the Sarbanes-Oxley Act and has authority over audits of public companies and broker-dealers registered with the SEC. It issues auditing standards, conducts inspections of registered audit firms, and can sanction firms and individual auditors for deficiencies. Any firm that audits a public company must be registered with the PCAOB and comply with its standards, which differ in several respects from those issued by the AICPA.
The AICPA issues Generally Accepted Auditing Standards (GAAS), which apply to audits of private companies, nonprofits, and other non-public entities. These standards govern how an auditor plans and performs an audit, evaluates internal controls, and issues an opinion. The AICPA also issues Statements on Auditing Standards (SAS), which are updated periodically to reflect changes in practice and risk.
A common mistake made by foreign founders entering the US market is assuming that any licensed accountant can conduct a statutory audit. In practice, only a Certified Public Accountant (CPA) licensed in the relevant state can issue an audit opinion, and for public companies, the firm must also be PCAOB-registered. Selecting an unqualified auditor can invalidate financial statements and trigger regulatory consequences.
Beyond federal obligations, individual US states impose their own audit requirements, particularly for nonprofits, charities, and certain regulated industries.
Many states require nonprofits that solicit charitable contributions above a specified revenue threshold to file audited financial statements with the state attorney general or a designated charities bureau. The revenue thresholds and filing deadlines vary significantly from state to state. California, New York, and Florida, for example, each have distinct thresholds and procedural requirements under their respective charitable solicitation statutes.
State-regulated industries - including insurance companies, banks, and credit unions - face additional audit requirements imposed by state regulators. Insurance companies are typically required to file audited financial statements with the state insurance commissioner under the NAIC Model Audit Rule, which has been adopted in most states. Banks chartered at the state level must comply with audit requirements set by their state banking department, often in conjunction with federal banking regulators.
Professional licensing boards in some states also require audit or review-level financial statements from licensees in certain professions, particularly where client funds are held in trust.
In practice, founders should consider the state of incorporation and the states in which the business operates as separate compliance layers. A company incorporated in Delaware but operating primarily in California may face audit-related filing obligations in both states.
For companies listed on US stock exchanges or otherwise registered with the SEC, the Sarbanes-Oxley Act introduced audit requirements that go significantly beyond a standard financial statement audit.
Section 302 of SOX requires the CEO and CFO to certify personally that the company';s financial statements are accurate and that they have evaluated the effectiveness of disclosure controls and procedures. This certification is filed with the SEC as part of the annual report (Form 10-K) and quarterly reports (Form 10-Q).
Section 404 of SOX is the most demanding provision for larger public companies. It requires management to assess and report on the effectiveness of internal control over financial reporting (ICFR). For accelerated filers and large accelerated filers, the external auditor must also issue a separate attestation report on management';s ICFR assessment. Smaller reporting companies and non-accelerated filers are exempt from the auditor attestation requirement, though management';s own assessment is still required.
The external auditor for a public company must rotate the lead audit partner every five years under PCAOB rules. Audit firm rotation itself is not mandated by US law, but the PCAOB monitors audit quality and publishes inspection reports on registered firms, which are publicly available.
Many underestimate the internal resource burden of SOX compliance. Documenting and testing internal controls requires significant time from finance, IT, and operations teams, and the costs of external audit and advisory services for a mid-size public company can reach into the high six figures annually.
If your company is approaching a US listing or is already SEC-registered and you need guidance on structuring your audit and compliance programme, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
The Single Audit, formally governed by the Uniform Guidance (2 CFR Part 200), is a specific audit framework that applies to non-federal entities - including nonprofits, universities, state and local governments, and tribal organisations - that expend federal awards above the applicable threshold in a fiscal year.
A Single Audit is broader than a standard financial statement audit. It includes an audit of the entity';s financial statements and a separate compliance audit of the federal programs through which the entity received funding. The auditor must test compliance with the specific requirements of each major federal program and report findings in a Schedule of Expenditures of Federal Awards (SEFA).
The Single Audit must be completed and submitted to the Federal Audit Clearinghouse within the earlier of 30 calendar days after receipt of the auditor';s report or nine months after the end of the fiscal year. Failure to submit on time can result in the suspension of federal funding, repayment demands, or referral to the relevant federal agency';s inspector general.
A non-obvious requirement is that the auditor conducting a Single Audit must comply with Government Auditing Standards (the "Yellow Book") issued by the US Government Accountability Office (GAO), in addition to GAAS. This requires the auditor to meet additional independence, continuing education, and quality control requirements beyond those applicable to private-sector audits.
Scenario one: a mid-size nonprofit that receives federal housing grants crosses the expenditure threshold for the first time. Its existing CPA firm, which has conducted its financial statement audit for several years, may not be qualified to conduct a Single Audit if the firm lacks Yellow Book compliance. The nonprofit must either engage a different firm or confirm that its existing auditor meets the additional requirements.
Scenario two: a university research department receives multiple federal grants from different agencies. Each grant may constitute a major program requiring separate compliance testing, significantly increasing the scope and cost of the Single Audit compared with a standard financial statement audit.
Companies that contract with the US federal government, particularly under cost-reimbursable or time-and-materials contracts, face audit requirements administered primarily by the Defense Contract Audit Agency (DCAA) and, for civilian agencies, the relevant agency';s inspector general or contracting officer.
The DCAA conducts audits of contractor accounting systems, incurred costs, forward pricing proposals, and compliance with the Cost Accounting Standards (CAS). Contractors whose contracts exceed certain dollar thresholds must submit an annual Incurred Cost Submission (ICS) to the DCAA within six months of the close of the contractor';s fiscal year. The DCAA then audits the submission to verify that costs claimed are allowable, allocable, and reasonable under the Federal Acquisition Regulation.
A common mistake among smaller contractors entering the federal market for the first time is failing to establish an accounting system that meets DCAA requirements before contract award. The DCAA can conduct a pre-award accounting system audit, and a finding of inadequacy can delay or prevent contract award. Costs that are not properly segregated, documented, or allocated may be disallowed after the fact, creating significant financial exposure.
Contractors subject to the Cost Accounting Standards must also disclose their accounting practices in a CAS Disclosure Statement and notify the government of any changes to those practices. Failure to comply with CAS can result in contract price adjustments and potential liability under the False Claims Act.
What triggers a mandatory audit for a private company in the USA?
Private companies in the USA are not subject to a general statutory audit requirement at the federal level. The obligation most commonly arises from contractual arrangements with lenders or investors, from state nonprofit registration laws, from federal grant expenditure thresholds under the Single Audit framework, or from industry-specific regulation such as banking or insurance licensing. A private company that takes on institutional debt financing will almost always find that its loan covenants require annual audited financial statements. Similarly, a private company preparing for an IPO will need to produce audited financials covering prior fiscal years before it can file a registration statement with the SEC.
How long does an audit typically take and what does it cost in the USA?
The timeline for a US financial statement audit varies considerably by entity size and complexity. A small nonprofit audit may be completed in four to eight weeks. A mid-size private company audit typically takes two to four months. A public company audit, coordinated with SEC filing deadlines, is an ongoing process with interim procedures conducted throughout the year and year-end fieldwork taking several weeks. Costs follow a similar range: professional fees for a small entity audit usually start from the low thousands of USD, while a public company audit can cost several hundred thousand USD or more annually, depending on complexity, the number of subsidiaries, and the extent of internal control testing required.
Can a foreign company operating in the USA use its home-country audit for US compliance purposes?
Generally, no. US regulators and lenders require financial statements prepared under GAAP and audited in accordance with PCAOB standards or GAAS, depending on the entity type. A foreign private issuer listed on a US exchange may file financial statements prepared under IFRS as issued by the IASB, but the audit must still be conducted by a PCAOB-registered firm in accordance with PCAOB standards. For private transactions, a lender or investor may accept IFRS-based financials in some cases, but this is a matter of negotiation rather than a regulatory entitlement. A foreign company establishing a US subsidiary will typically need a separate US audit for the subsidiary if audit obligations arise at the subsidiary level.
Audit requirements in the USA form a layered system shaped by federal securities law, grant regulations, state statutes, and contractual obligations. Public companies, nonprofits receiving federal funding, government contractors, and regulated industries each operate under distinct frameworks with different standards, timelines, and enforcement consequences. Understanding which framework applies to your business is the essential first step.
For international businesses entering the US market, navigating these requirements without local expertise creates real compliance risk. Contact info@vlolawfirm.com for a consultation on your specific situation.
VLO Law Firms advises international clients on audit requirements in the USA. We can assist with identifying applicable audit obligations, selecting qualified auditors, structuring accounting systems for DCAA or SOX compliance, and managing state-level filing requirements. To request a consultation, contact: info@vlolawfirm.com