• Three things called an audit
  • What an external audit gives you (US public companies)

An accounting audit, also called a financial statement audit, is an independent check of a company's financial statements by an external auditor, who then gives an opinion on whether the statements are presented fairly. It isn't a guarantee that the numbers have no errors, and it's a different thing from an internal audit, done by the company's own staff, and from an IRS audit, which examines a tax return. The financial statements themselves stay the company's responsibility.

Billed publishes this page. It's general information, not accounting, tax or legal advice; ask your accountant or CPA how it applies to you. The definitions come from the open textbook Principles of Accounting, Volume 1 (OpenStax), the auditing standard AS 1000 and the About page of the Public Company Accounting Oversight Board (PCAOB), and the IRS pages on IRS audits (last reviewed or updated February 17, 2026) and how long to keep records (last reviewed or updated June 30, 2026). All were opened on October 30, 2026. The IRS and PCAOB rules are US rules.

Three things called an audit

  • External audit of the financial statements. OpenStax says an external auditor "generally works for an outside CPA firm or his or her own private practice and conducts audits and other assignments, such as reviews".
  • Internal audit. OpenStax defines an internal auditor as an "employee of an organization whose job is to provide an independent and objective evaluation of the company's accounting and operational activities".
  • IRS audit (US tax). The IRS says: "An IRS audit is a review/examination of an organization's or individual's books, accounts and financial records to ensure information reported on their tax return is reported correctly according to the tax laws and to verify the reported amount of tax is correct."

The first two look at the accounts and financial statements. An IRS audit looks at a tax return. A company can have one without the others.

What an external audit gives you (US public companies)

For audits of US public companies, the PCAOB says it is "a nonprofit corporation established by Congress to oversee the audits of public companies in order to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports." Its standard AS 1000 sets the auditor's objectives. In an audit of financial statements, they are to:

  • "(1) obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud; and (2) issue an auditor's report that expresses an opinion about whether the financial statements, taken as a whole, are presented fairly, in all material respects, in conformity with the applicable financial reporting framework"

AS 1000 explains: "Reasonable assurance is not absolute assurance, but a high level of assurance." It also notes: "In an audit of financial statements, the financial statements, including their preparation, are management's responsibility and the auditor's responsibility is to express an opinion on the financial statements."

PCAOB standards apply to the audits the PCAOB oversees. For an audit of a private company, ask your CPA which auditing standards apply.

Internal controls

Internal controls are the company's own checks on its records. OpenStax defines internal controls as "systems used by an organization to manage risk and diminish the occurrence of fraud, consisting of the control environment, the accounting system, and control activities." For the checks that keep balances right during the year, see account reconciliation and the accounting cycle.

IRS audits are different (US)

  • How it starts: the IRS says: "Should your account be selected for audit, we will notify you by mail. We won't initiate an audit by telephone."
  • How it's done: "The IRS conducts audits either by mail or through an in-person interview to review your records."
  • How far back: "Generally, the IRS can include returns filed within the last three years in an audit. If we identify a substantial error, we may add additional years."
  • Records: "The law requires you to keep all records you used to prepare your tax return – for at least three years from the date the tax return was filed."

If you receive an audit letter, ask your accountant or a tax professional before you respond.

Sample: record-keeping dates for an IRS audit (US)

The business and dates here are a sample, invented for this example.

The IRS records page says: "Keep records for 3 years if situations (4), (5), and (6) below do not apply to you." It adds: "Unless otherwise stated, the years refer to the period after the return was filed. Returns filed before the due date are treated as filed on the due date." For payroll, it says: "Keep employment tax records for at least 4 years after the date that the tax becomes due or is paid, whichever is later."

A sole proprietor with one employee:

  1. Income tax return: in this sample, the 2025 return was filed on October 12, 2026, after the return's April 15, 2026 due date, and none of situations (4), (5) or (6) applies. Three years after October 12, 2026 is October 12, 2029.
  2. Employment tax: in this sample, a payroll tax became due on February 2, 2027 and was paid early, on January 28, 2027. The later of the two dates is February 2, 2027, and four years after it is February 2, 2031.

So in this sample, the income tax records are kept until at least October 12, 2029, and the employment tax records until at least February 2, 2031. Ask your accountant which periods apply to your records.

Where Billed fits

Billed's financial reporting page says: "All reports in Billed can be exported for use with your accountant, bookkeeper, or tax software." Its expense tracking page says: "Attach the receipt when you record the expense". For closing the year, see 6 steps to close your accounting year, and for the kinds of accounting work an auditor may meet, the different types of accounting.

Related Articles

Frequently Asked Questions

What is an accounting audit?

An independent check of a company's financial statements by an external auditor, who gives an opinion on whether they're presented fairly. For US public companies, PCAOB standard AS 1000 says the auditor obtains reasonable assurance, which "is not absolute assurance, but a high level of assurance."

Is an IRS audit the same as a financial statement audit?

No. The IRS describes its audit as a review or examination of books, accounts and financial records to check that a tax return is reported correctly under the tax laws. A financial statement audit gives an opinion on the financial statements.

What is the difference between an internal and an external audit?

OpenStax describes an internal auditor as an employee of the organization who provides an independent and objective evaluation of its accounting and operational activities, and says an external auditor "generally works for an outside CPA firm or his or her own private practice".

How far back can the IRS audit a return?

The IRS says: "Generally, the IRS can include returns filed within the last three years in an audit. If we identify a substantial error, we may add additional years." Ask your accountant or a tax professional about your own returns.

Share

Was this article helpful?