Audit vs Review vs Compilation: Which One You Actually Need

What Is a Compilation, a Review, and an Audit?

Audit vs review vs compilation is one question with three answers, and the only variable is how much assurance a CPA will sign. Compilation and review engagements run under the AICPA’s Statements on Standards for Accounting and Review Services, the AR-C sections. Audits of private companies run under generally accepted auditing standards, the AU-C sections. Two rulebooks. Two peer review regimes. Two independence postures. At indinero we field this question most often from a Controller who just read a covenant and has a week to answer it.

The short version of each deliverable:

• Compilation (AR-C 80). The accountant assembles your statements into proper form and attaches a report. Nothing is verified, and no assurance is expressed.
• Review (AR-C 90). The accountant performs inquiry and analytical procedures, then reports limited assurance, stated negatively, that they aren’t aware of material modifications needed.
• Audit (GAAS, AU-C). The accountant gathers evidence from outside your accounting system and expresses a positive opinion on fair presentation.

Every SSARS engagement runs first through AR-C 60, the general principles section, and the AICPA publishes the full preparation, compilation and review standards index.

The distinction Controllers miss sits one level below all three. AR-C 70 governs preparation of financial statements. It produces statements carrying a no-assurance legend with no report attached, and it doesn’t require the accountant to be independent. Banks and boards routinely ask for compiled statements when what they’ve been receiving all year is an AR-C 70 preparation. Check the cover page before you answer.

Here’s the part most comparison pages bury. You don’t choose. Your credit agreement chooses, or your investors’ rights agreement chooses, or your plan participant count chooses. The CPA prices what somebody else already decided, which is why this belongs in your GAAP reporting foundation long before it lands in an engagement letter.

The Three Levels of Assurance

The three levels of assurance aren’t low, medium, and high. Each report carries language the standards prescribe word for word, and that language is what a credit committee actually reads.

	Compilation (AR-C 80)	Review (AR-C 90)	Audit (GAAS, AU-C)
Assurance	None	Limited, expressed negatively	Reasonable, expressed positively
Independence required	No, but the lack of it must be disclosed	Yes	Yes
Notes to the statements	May be omitted with disclosure of the omission	Required	Required
Materiality determined	No	Yes, since SSARS No. 25	Yes
Modified outcome available	No	Qualified or adverse conclusion	Qualified, adverse, or disclaimer

Three amendments reshaped this map recently, and each one is worth knowing before you sign anything.

SSARS No. 25, effective for periods ending on or after December 15, 2021, amended AR-C 60, 70, 80, and 90. It requires the accountant to determine materiality for the statements as a whole, adds an explicit independence statement to the review report, and permits an adverse conclusion when statements are materially and pervasively misstated. If your lender’s template still says SSARS 21 review engagement, that’s the codification that created the AR-C numbering. AR-C 90 as amended by SSARS 25 is what your accountant performs today.

SSARS No. 26 brought quality management into the SSARS framework for engagements covering periods ending on or after December 15, 2025. It surfaces in 2026 engagement letters as fee escalation, alongside the firm-level systems required under SQMS No. 1.

SSARS No. 27, issued April 2025 and effective for preparation engagements covering periods ending on or after December 15, 2026, is the one almost nobody is writing about. It excludes financial statements prepared as part of a consulting services engagement from the engagements required to apply AR-C 70. In plain terms, the monthly package your outsourced accounting team produces is a management work product, not an attest deliverable, and the standard now says so in writing. That matters the first time a lender asks what your monthly statements actually are.

Compilation: No Assurance

Under AR-C 80 the accountant reads the statements in light of the applicable financial reporting framework and significant accounting policies, then considers whether they appear appropriate in form and free from obvious material misstatement. That’s the entire procedure set. No verification, no third-party contact, no sampling.

The report says it plainly:

“I (We) did not audit or review the financial statements nor was (were) I (we) required to perform any procedures to verify the accuracy or completeness of the information provided by management. Accordingly, I (we) do not express an opinion, a conclusion, nor provide any form of assurance on these financial statements.”

Management owns the numbers. The accountant owns the format. Notes to the financial statements may be omitted entirely, provided the omission is disclosed in the report.

Review: Limited Assurance

Two procedure families, and only two. Inquiry of management and the people responsible for financial and accounting matters, and analytical procedures designed to surface relationships and individual items that look unusual. Since SSARS 25 the accountant also determines materiality, evaluates misstatements against it, and obtains written management representations covering every statement and period in the report.

The conclusion reads:

“Based on my (our) review, I am (we are) not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in accordance with accounting principles generally accepted in the United States of America.”

That’s negative assurance. The accountant isn’t asserting your statements are right. The accountant is asserting the absence of awareness of a problem. Which is exactly why a review won’t satisfy a covenant drafted to require an opinion. A review also excludes understanding internal control, assessing fraud risk in the GAAS sense, testing controls, and corroborating management’s answers with outside evidence.

Audit: Reasonable Assurance

Reasonable assurance is defined in AU-C 200 as a high level of assurance, not absolute assurance, and not a guarantee that a GAAS audit will always detect a material misstatement when one exists. The opinion is affirmative, and since SAS No. 134 restructured the reporting suite it appears first in the report, in the form “In our opinion, the accompanying financial statements present fairly, in all material respects.”

Getting there takes evidence a review never touches:

• Risk assessment under SAS No. 145. Covers the entity’s information system and the risks arising from IT, including general IT controls relevant to assertion-level risk. For a SaaS company that reaches the billing system, the revenue subledger, and the ERP.
• External confirmations under AU-C 505. Cash, debt, and often accounts receivable, confirmed with the counterparty rather than accepted from your ledger.
• Inspection of source documents, contracts, and board minutes. Under ASC 606 that means reading real customer contracts and testing the five-step conclusions, SSP allocation and modifications included.
• Audit sampling under AU-C 530. Across revenue, disbursement, and payroll populations, plus tests of controls where the auditor plans to rely on them.

A review team asks you questions and runs ratios. An audit team asks your bank, your customers, your lawyers, and your system logs. That’s where the hours go.

What Each Engagement Costs and How Long It Takes

Financial statement audit cost is driven by hours, not by revenue, even when the firm quotes a fixed fee. Published 2026 benchmark data puts most US CPA firm billing between roughly $150 and $450 per hour, with partner time in a major metro running materially higher and staff time lower. Firms are also running annual or biennial increases in the 6 percent to 10 percent band, which compound. That rate structure comes from the 2026 Cornerstone Report on CPA billing rates.

Two named anchors are worth having before you negotiate. The National Council of Nonprofits reports that for organizations with annual revenue above $1 million, an independent audit generally runs $10,000 to $20,000. Single-employer 401(k) plan audits are commonly quoted as flat fees in the high four figures to low five figures, driven by plan type, participant count, asset types, service providers, and whether an ERISA Section 103(a)(3)(C) certification is available.

The ranges below are engine-derived planning figures, built from published 2026 billing rates and typical engagement hours. They are not survey results. Reliable public fee survey data for private company audits does not exist, so treat any page quoting one with suspicion.

Engagement	Typical hours	Planning range	Elapsed time
Compilation, annual	10 to 30	Low four figures to roughly $7,500	1 to 3 weeks
Review, annual	40 to 120	Roughly $8,000 to $25,000	3 to 6 weeks
First-year audit, single entity, under $25M revenue	150 to 350	Roughly $30,000 to $80,000	8 to 16 weeks
Recurring audit, same profile	120 to 250	Roughly $25,000 to $60,000	6 to 12 weeks
Each additional legal entity or foreign sub	30 to 100	Add roughly $8,000 to $25,000	Adds 1 to 3 weeks

Seven things move that number, roughly in this order:

1. Revenue scale and transaction volume. Sample sizes under AU-C 530 scale with population size and assessed risk, not with revenue directly, but revenue is the proxy firms price on.
2. Entity count and structure. Each additional legal entity, foreign subsidiary, or equity-method investee is a component requiring its own scoping judgment under SAS No. 149 for periods ending on or after December 15, 2026. The most underestimated driver here.
3. First year versus recurring. A first audit is an initial audit engagement under AU-C 510, with opening-balance evidence and predecessor communication under AU-C 210. You’re buying two balance sheets in year one. Whether firms discount first-year work is an open academic question, not a market rate, so treat a vendor’s first-year number as a negotiating position.
4. Condition of the books. Unreconciled control accounts and a close still moving in week six of fieldwork turn fixed-fee engagements into scope-change letters.
5. Revenue recognition complexity. Multi-element arrangements, usage-based pricing, reseller deals, and contract modifications under ASC 606 each add substantive testing. Revenue is presumed a fraud risk.
6. Deadline compression. A covenant requiring delivery within 90 or 120 days of fiscal year end puts you in every firm’s January to March queue at list price.
7. Firm tier. National brand recognition matters to some lenders and acquirers and to nobody else. Confirm your counterparty specifies firm standing before you pay for it.

Readiness, not firm capacity, is the usual swing factor on timing. And the fee is only the visible number. A first-year audit routinely consumes several hundred hours of Controller, staff accountant, and systems-admin time across request-list preparation, tie-outs, sample pulls, and adjustment cycles. Budget the fee, then budget the people.

Who Requires Which Level

Does my startup need an audit? Only if somebody holding a signed contract has asked for one. Nobody wakes up wanting an audit, so audit vs review vs compilation is really a question about who has the right to demand what.

Lenders and venture debt. Credit agreements and venture loan and security agreements typically require annual audited financial statements within 90 to 180 days of fiscal year end, and many require the report carry no going concern qualification or similar emphasis. That clause turns an accounting decision into default risk. Smaller facilities and asset-based lines frequently accept a review, and some accept compiled statements plus a guaranty.

Institutional equity investors. Information rights get negotiated in the investors’ rights agreement, and the NVCA model documents set the pattern: audited annual financials to Major Investors within 90 days of year end, certified by independent public accountants of nationally recognized standing. The requirement usually doesn’t bite until Series B, though it sometimes lands earlier. The obligation is often already sitting in your Series A documents as a board-triggered option. Read it before your lead exercises it.

Acquirers. Worth stating plainly, because competing pages get this backwards. Buyers rarely rely on an audit alone for financial due diligence. They commission a quality of earnings analysis, which is forward-looking and normalization-focused, reporting on adjusted EBITDA, net working capital, and indebtedness. An audit opinion addresses none of those. An audit verifies historical GAAP presentation. A quality of earnings report tests whether the earnings repeat.

401(k) and other ERISA plans. A bright-line count, and the rule changed for plan years beginning on or after January 1, 2023. A defined contribution plan now counts only participants with account balances at the beginning of the plan year when determining large-plan versus small-plan status. The 100-participant threshold and the 80-120 rule both survive, and the DOL projected the change would drop the audit requirement for roughly 20,000 small business plans. When the audit is required it runs under AU-C 703, established by SAS No. 136. The old limited scope audit no longer exists by that name, and an ERISA Section 103(a)(3)(C) audit is not a scope limitation.

State charitable registration. If you operate or fund a 501(c)(3) affiliate, thresholds are statutory and vary. California’s Nonprofit Integrity Act requires audited statements from an independent CPA at $2 million or more in gross annual revenue. New York requires a CPA review from $250,000 to $1,000,000 in gross revenue and support, and an audit above $1,000,000.

IPO track. If an S-1 is on the horizon, the AICPA path ends. Registration statements require audited financials from a PCAOB-registered firm applying PCAOB standards. An emerging growth company may present two years rather than three under Regulation S-X Rule 3-02. Switching firms 18 months before filing means reauditing prior periods, so choose around that timeline.

And nobody requires a compilation. No statute, no regulation, no standard-setter mandates one. It exists because a third party wanted a CPA’s name on the statements without paying for assurance. Banks accept one for smaller facilities, landlords for lease guaranties, bonding agents occasionally. That’s the whole market. If nobody has asked for a CPA report, an AR-C 70 preparation does the same job for less.

Common Pitfalls

1. Assuming a review upgrades into an audit. It doesn’t. Review evidence isn’t audit evidence, and a review file doesn’t meaningfully reduce audit procedures. Worse, if last year was reviewed and this year is audited, this year is an initial audit engagement under AU-C 510. The auditor has to obtain sufficient appropriate evidence about whether opening balances contain misstatements that materially affect the current period, and in comparative presentation the report must disclose that the prior period was reviewed rather than audited. You’re paying twice for one balance sheet.

2. The independence trap. This is the structural mistake that catches growth-stage companies, and it explains why a firm that’s been handling everything suddenly can’t sign. Under the AICPA Code of Professional Conduct, the nonattest services rules at ET section 1.295 govern whether bookkeeping, payroll, and similar work impairs independence with respect to an attest client. Your company has to assume all management responsibilities, designate someone with suitable skill, knowledge, and experience to oversee the service, evaluate the adequacy and results, and accept responsibility for them. Miss any element and independence is impaired, which means no review and no audit. The AICPA’s nonattest services toolkit walks the requirements element by element. Now note the asymmetry, because it decides your vendor structure. A firm lacking independence may still perform a compilation under AR-C 80, provided the lack of independence is disclosed in the report. It may not perform a review or an audit. The firm that keeps your books can compile. It cannot opine.

3. Opening fieldwork on unreconciled books. Auditors don’t reconcile your accounts. They test the reconciliations you produced. Fieldwork that opens on unexplained variances in cash, deferred revenue, accrued liabilities, or intercompany converts a fixed fee into hourly overage and pushes delivery past the covenant date. The fix lives upstream in the close. Our audit preparation guide covers the readiness sequence.

4. Budgeting the fee and not the hours. Said twice on purpose, because Controllers consistently underprice their own team’s time.

One more trap for 2026. If you have subsidiaries or equity-method investments and your fiscal year ends on or after December 15, 2026, your audit gets scoped under SAS No. 149 for the first time. It replaces the significant components model with risk-based scoping and introduces referred-to auditors as distinct from component auditors. Ask your firm during planning how that changes their approach and their fee. Ask before the engagement letter, not after.

The Audit-Ready Standard

Audit-ready isn’t a season. It’s a standard the books are held to every month, and it’s why two companies buying the same level of assurance pay very different fees for it.

Here’s what defensible looks like when fieldwork opens:

• Every control account reconciled, dated, and reviewed. Cash, AR, AP, deferred revenue, accrued liabilities, and intercompany tie to subledgers rather than to a plug. For the mechanics, start with account reconciliation fundamentals.
• Contemporaneous documentation, not reconstructed memory. Revenue contracts, SSP support, and the reasoning behind each material estimate written down when the judgment was made, not the following March.
• A defined materiality threshold your team applies. Since SSARS 25 even a review requires the accountant to determine materiality. If you haven’t set your own, you’ll spend fieldwork arguing about theirs.
• Journal entries with support and a named approver. Anything above your threshold traceable to a source document without a scavenger hunt.
• A close that finishes. Closing the books on a predictable cadence is the difference between answering questions and manufacturing answers.

Indinero’s books are audit-ready by default, because GAAP discipline is baked into how the team operates, not added later. That isn’t a marketing position. It’s a cost position. Condition of the books is one of the seven fee drivers above, and the other six are structural. Revenue scale, entity count, first year versus recurring, revenue recognition complexity, deadline compression, and firm tier are set by your business or by your counterparty.

The books are the variable you control.

How Indinero Approaches Assurance Readiness

Indinero is not an audit firm. That’s precisely why we can do the part that determines how your audit goes.

Under ET 1.295 the firm maintaining your books generally cannot issue your review or audit opinion. Any provider claiming to do both is either performing a compilation with a disclosed lack of independence or is heading for an uncomfortable conversation with a peer reviewer. So we don’t claim both. We take the side of the line where the work lives.

The division of labor that works:

• We own the close. Monthly GAAP close, reconciliations, supporting schedules, revenue documentation under ASC 606, multi-entity consolidation, and the request list once fieldwork starts, all inside our accounting services engagement.
• An independent CPA firm owns the opinion. You pick the firm. We hand it a clean file and answer its questions directly instead of routing every request through your Controller.
• You stop spending your quarter as a document retrieval service. That’s the cost line nobody budgets and everybody pays.

This sits inside the same engagement as your bookkeeping, tax, and CFO advisory, not as an audit-season carve-out priced separately. For SaaS companies it matters most in revenue, where the contract documentation an auditor wants is the same documentation a disciplined ASC 606 close already produces.

The track record, stated plainly: continuous operations since 2009, 500+ regular customers, 100+ years combined team experience, SOC 2 compliant (2026), and a 5-star Clutch rating. Pricing starts at $750/mo, with month-to-month engagements available.

You’re not just buying a level of assurance. You’re buying whether the engagement goes to plan. If a lender or a lead investor just named one and you’re not sure your books can produce it, that’s a conversation worth having before the engagement letter is signed. Reach out for a free consultation.

Frequently asked questions

These are the questions Controllers and VPs of Finance bring us in the week after a lender, a lead investor, or a plan administrator names a service level. Most of them reduce to two concerns. What will this cost, and will the report satisfy the person who asked for it. The answers below cover investor requirements at Series A, whether a review can stand in for an audit under a covenant, first-audit budgeting for a growth-stage SaaS company, the independence question about your own accounting provider, and what happens when fieldwork opens on books that aren’t ready.

Does a Series A investor usually require audited financial statements?

Can a review satisfy a bank covenant that asks for audited financials?

How much should a growth-stage SaaS company budget for a first audit?

Can our outsourced accounting provider also perform the audit?

What happens if our books are not ready when fieldwork starts?