When Does a Startup Need a Financial Audit? Audit vs Review vs Compilation

No startup needs audited financials just because it is incorporated in Delaware or files a Form 1120. A private company gets audited because a contract, a regulator or a deal requires it. If nobody with a signature on your term sheet, loan agreement or offering documents has asked for audited statements, you probably do not need one this year.

The practical rule we give founders:

• Get an audit if your investor rights agreement or loan agreement requires one, you are raising more than $618,000 through Regulation Crowdfunding (more than $1,235,000 on a first raise), you are filing a Reg A Tier 2 offering, you expect to sign an acquisition with a public company within 12 to 18 months, or you are planning an IPO.
• Get a review if a bank, landlord, crowdfunding portal or strategic partner wants some outside assurance but the agreement does not say "audited".
• Get a compilation, or nothing if you only need clean statements for the board, a 409A provider or an insurance application.
• Get a SOC 2, separately if customers are asking about your security controls. That request has nothing to do with your financial statements.

The most common real-world trigger is the Series B or Series C close. Earlier-stage term sheets usually ask for annual and quarterly financial statements with no audit, and a later lead investor (or its fund auditors, who have to value the position) asks to upgrade that to audited annual statements. Read the information-rights section of your investor rights agreement before you assume either way. The exact words matter: "audited", "reviewed", "prepared in accordance with GAAP" and "certified by the CFO" are four different obligations.

Each source of audit demand has different rules, deadlines and tolerance for a first-year qualified opinion.

Venture investors. Information rights in a priced round usually require annual financial statements within a set number of days after year-end (120 and 180 days are both common). Many agreements only require an audit if the board or a majority of preferred holders asks for one, so a later-stage investor can switch it on. If you already promised audited statements in an earlier round and never delivered, fix that before diligence on the next round starts.

Banks and venture lenders. Loan covenants commonly require annual statements and a compliance certificate. Smaller facilities often accept reviewed or company-prepared statements; larger term loans and revolvers tend to require an audit once outstanding debt or revenue passes a size the lender sets. Missing an audit delivery date is usually a covenant default even if you are current on payments.

Regulation Crowdfunding. The SEC sets tiers by the amount offered in a 12-month period, and the cap is $5 million. See the table in the next section for the exact thresholds. Ongoing annual reports on Form C-AR are due within 120 days of fiscal year-end and do not themselves need an audit or review.

Regulation A. Tier 1 (up to $20 million in 12 months) does not require audited statements unless you already have them. Tier 2 (up to $75 million) requires financial statements audited under AICPA or PCAOB standards in the offering circular, and every Form 1-K annual report includes two years of audited statements, due within 120 calendar days after year-end.

Government contracts and grants. The federal Single Audit rule (2 CFR 200.501) applies to non-federal entities spending $1,000,000 or more of federal awards in a year, but paragraph (i) says the subpart does not apply to for-profit organizations. For a for-profit startup, the requirements come from the contract or the pass-through entity. Cost-reimbursement contracts are the bigger issue: the contracting officer needs to see an adequate accounting system before award (FAR 16.301-3), and defense contractors face DCAA review of that system. That is a system and incurred-cost review, not an opinion on your statements, but the cleanup work overlaps heavily with audit readiness.

Acquirers. Private-equity and strategic buyers usually commission a quality-of-earnings review rather than demand an audit. A public acquirer is different: if your company is significant enough to it under Rule 3-05 of Regulation S-X, it must file your audited financial statements with the SEC after closing.

IPO. An emerging growth company (revenue below $1.235 billion) can present two years of audited financial statements in its registration statement instead of three. Those audits must be performed under PCAOB standards by an auditor independent under SEC rules for every period presented.

If you plan to raise from the public through a funding portal, the size of the raise decides the level of assurance. The thresholds below are from 17 CFR 227.201(t) as adjusted for inflation in 2022, checked October 2026. The SEC must revisit them for inflation at least every five years, so check again before filing a Form C in 2027 or later.

Worked example: a first-time issuer targets $900,000 on a funding portal. That is above $618,000 but below $1,235,000, so a review is enough. Twelve months later it launches a second Reg CF round of $700,000. Because it has now sold securities under Regulation Crowdfunding before, the first-time exception is gone, and the second Form C needs audited statements. Budget the audit fee and the eight to twelve weeks it takes before you pick a launch date for round two.

One trap: "audited if you have them" is mandatory, not optional. If an investor already made you get an audit, you must use the audited statements in the Form C even when the tier only calls for a review.

For Reg A Tier 2, the offering circular needs two fiscal years of audited balance sheets and related statements (or since inception if shorter), audited under AICPA or PCAOB standards. The ongoing Form 1-K requirement means Tier 2 is a commitment to an annual audit for as long as you report, not a one-time cost.

The difference between the three is the level of assurance the CPA gives, which drives the work performed and the fee. Compilations and reviews of private companies are governed by the AICPA's Statements on Standards for Accounting and Review Services (SSARS), codified as AR-C sections. Private company audits follow AICPA Generally Accepted Auditing Standards (GAAS, the AU-C sections). Audits of SEC registrants follow PCAOB standards.

There is also a fourth level that is not on most comparison pages: a preparation engagement under AR-C 70. The CPA prepares the statements and issues no report at all; each page simply states that no assurance is provided. It is the cheapest option and is useful when the reader just wants GAAP-format statements from a CPA.

What a review does not do matters as much as what it does. A reviewer does not confirm your bank balances with the bank, does not count inventory, does not test that your customer contracts exist and does not evaluate internal controls. A review report says the CPA is not aware of material modifications that should be made. An audit opinion says the statements are presented fairly, in all material respects, in accordance with GAAP.

Our view: if a lender will accept a review, take the review. Do not buy an audit early "to look serious" unless a specific transaction in the next 12 months needs it. Spend that money getting the books GAAP-clean instead, because that is what makes the eventual audit cheap.

A SOC 2 report is an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy, measured against the AICPA's Trust Services Criteria. It tells a customer whether your systems and controls protect their data. It says nothing about whether your revenue, deferred revenue or cash balance is right.

Founders mix the two up because both are performed by CPA firms, both follow AICPA attestation or auditing standards, and sales teams call SOC 2 "our audit". Keep them separate in your planning:

• An investor asking for audited financials will not accept a SOC 2 report.
• An enterprise customer asking for a SOC 2 Type II will not accept your audited financial statements.
• The same CPA firm can do both, but the teams, scope, timing and fee are separate. A combined engagement letter does not make either one cheaper by much.

There is one useful overlap. The access controls, change management and logging work you did for SOC 2 gives a financial auditor more comfort over the systems that produce your revenue data, which can reduce testing. Tell your financial auditor you have a current SOC 2 report and offer it early.

An auditor must be independent of the company it audits, and keeping your books is the classic way to lose independence. The problem is the self-review threat: an auditor cannot objectively test numbers its own team produced.

The rules depend on whether you are, or will become, an SEC registrant:

• SEC and PCAOB rules. Rule 2-01(c)(4)(i) of Regulation S-X says an accountant is not independent if it provides bookkeeping or other services related to the client's accounting records or financial statements, including maintaining or preparing the accounting records, preparing the financial statements, or originating source data, unless it is reasonable to conclude the results will not be subject to audit procedures. For an IPO, independence is tested for every period in the registration statement, so a firm that did your books two years ago may be disqualified from auditing those years.
• AICPA rules for private companies. The AICPA Code of Professional Conduct (the nonattest services interpretations at ET 1.295) allows a CPA firm to provide bookkeeping or financial statement preparation for an attest client only if the client takes on all management responsibilities: a qualified person on your side oversees the work, evaluates it and accepts responsibility for the results. A separate 2022 interpretation (ET 1.295.113) covers helping a client implement new accounting standards, a common issue with ASC 606 and ASC 842 projects.

In practice, most audit firms will not audit a startup whose books they keep, even when the AICPA code would technically permit it, and every SEC-track company should treat it as off-limits. Tax return preparation is generally permitted for an audit client under both sets of rules, but tax planning and advisory work for SEC registrants has its own limits and audit committee pre-approval.

The practical consequence: when you hire an auditor, you keep your outsourced accounting firm and add a separate audit firm. Your accountant prepares the statements and the audit schedules. The auditor tests them.

A private company audit is performed under AICPA GAAS; an audit of an SEC registrant is performed under PCAOB standards by a PCAOB-registered firm. Reg A Tier 2 and Reg CF issuers may use either.

The gap matters when you go public. The financial statements in an IPO registration statement must be audited under PCAOB standards by an auditor that meets SEC independence rules for all periods presented. If your existing audits were done under AICPA standards, the auditor typically has to perform additional procedures and reissue the opinion under PCAOB standards, sometimes called an uplift. If the old auditor was not independent under SEC rules (for example, it also kept your books), those years usually have to be re-audited by a different firm.

Decision rule for timing:

1. If an IPO is more than three years away, an AICPA audit from any reputable firm is fine.
2. If an IPO or a sale to a public company is plausible within two to three years, pick an auditor that is PCAOB-registered and confirm in writing that it can meet SEC independence rules for every year it audits.
3. If you are inside 18 months of an S-1, the audits for the two years you will present should be PCAOB-standard from the start. Paying an uplift on an audit you just finished is the most avoidable cost in this whole process.

An EGC does not need an auditor attestation on internal control over financial reporting (the SOX 404(b) report) while it remains an EGC, but management's own assessment begins with the second annual report after the IPO. Controls work therefore starts well before the IPO, not after.

Most first-audit pain comes from GAAP areas that cash-basis or tax-basis bookkeeping ignored. Work through this list before the auditor arrives:

• Revenue under ASC 606. Signed contracts for every material customer, a documented five-step analysis for each contract type, performance obligations identified, standalone selling prices supported, deferred revenue and unbilled receivables reconciled to the billing system.
• Contract costs under ASC 340-40. Sales commissions capitalized and amortized over the expected customer life where required, with a schedule that ties to the commission plan.
• Stock compensation under ASC 718. A grant-level expense schedule from the cap table platform, using the 409A value on each grant date, the option-pricing inputs, and forfeiture policy. Private companies can elect the practical expedient in ASU 2021-07 to use a reasonable valuation as the current share price, which a supportable 409A report covers.
• Equity rollforward. Shares, preferred series, SAFEs, convertible notes and warrants rolled from the beginning of the period to the end, tied exactly to the cap table and to board minutes. SAFE and note classification (liability vs equity) needs a written position.
• Leases under ASC 842. Effective for private companies for fiscal years beginning after December 15, 2021. Every office lease, sublease and embedded equipment lease recorded as a right-of-use asset and lease liability, with the discount rate documented.
• Cutoff. Expenses recorded in the period incurred (accrued payroll, bonuses, professional fees, cloud hosting), not when paid. Auditors test the 30 to 60 days after year-end for unrecorded liabilities.
• Cash and debt. Every bank, brokerage, sweep and card account reconciled monthly; debt agreements, warrants issued to lenders and covenant calculations on file.
• Inventory, if any. A year-end count the auditor can observe (schedule it now; it cannot be recreated later), costing method documented, reserves for obsolete stock.
• Capitalized software and R&D. Internal-use software capitalization policy, and the tax-only treatment of R&E under the new IRC §174A kept separate from the GAAP books.
• Income taxes. A tax provision under ASC 740 (current and deferred, valuation allowance) and support for any uncertain positions.
• Board minutes and contracts. Minutes for every meeting in the period and through the report date, plus a list of related-party transactions.

If four or more items on this list are not done, the audit is not the next step. A GAAP cleanup project is.

A first audit of a typical seed-to-Series B company takes two to four months from engagement letter to signed opinion if the books are clean, and longer when the auditor finds adjustments. Work back from the date the audited statements are due (to an investor, lender or in a Form C) and start six months ahead.

1. Month 6. Read every agreement that mentions financial statements and write down the exact requirement, standard and deadline. Decide AICPA or PCAOB. Request proposals from two or three audit firms that audit venture-backed companies in your sector.
2. Month 5. Engage the auditor. Agree the periods in scope. If the auditor was not present for the prior year-end, it needs to get comfortable with opening balances, which can mean auditing two years or doing extra opening-balance procedures. Price that explicitly.
3. Month 4. Run the readiness checklist above. Close any GAAP gaps (ASC 606 memos, ASC 842 schedules, the ASC 718 report) and book the adjustments.
4. Month 3. Hold a planning meeting. Get the auditor's request list (often called a PBC, prepared-by-client list) and assign an owner and date to every item. Schedule the inventory count if you have inventory.
5. Month 2. Year-end close. Close the books within your normal timetable, then do a second, harder review of accruals and cutoff.
6. Month 1. Fieldwork. Answer questions within 24 to 48 hours; slow responses are where audit timelines stretch. Draft the financial statements and footnotes yourself (or have your accountant do it), not the auditor.

Also expect a management representation letter signed by the CEO and CFO, and a letter to the board on any control deficiencies the auditor found.

Audit fees are not published, so the ranges below are typical market ranges for US venture-backed companies in late 2026, not quotes. Use them for budgeting only and get proposals.

• Preparation or compilation: typically $1,500 to $5,000 per year for a simple startup.
• Review: typically $5,000 to $15,000 per year.
• First-year AICPA audit, seed to Series B, under roughly $20 million of revenue: typically $20,000 to $50,000. Simpler pre-revenue companies can come in below that; companies with inventory, multiple entities or foreign subsidiaries come in above it.
• PCAOB-standard audits and IPO-track companies: materially higher, often several times the private-company fee, because of the added documentation and independence requirements.

What moves the fee, roughly in order of impact:

1. Number of audit adjustments the auditor proposes. Each one means more testing.
2. Revenue complexity (multiple performance obligations, usage-based pricing, resellers, hardware plus software).
3. Whether opening balances must be audited (a first audit often covers two years).
4. Entity count and foreign subsidiaries.
5. Inventory, which adds observation and costing work.
6. Equity complexity: SAFEs, notes, warrants, secondary sales, tender offers.
7. Turnaround time demanded.

Worked example, labelled hypothetical: a Series A SaaS company gets a quoted first-year audit fee of $30,000 assuming clean books. The auditor finds that annual prepaid contracts were recognized as revenue on invoice and commissions were expensed when paid. Fixing ASC 606 and ASC 340-40 takes the company's accountant 60 hours at $175 per hour, or $10,500, and the auditor bills an extra 40 hours at $250 per hour, or $10,000, for the added testing. The first audit costs $50,500 instead of $30,000. Doing the same cleanup six months earlier would have cost the $10,500 and avoided most of the auditor's overrun.

These are the issues that turn a two-month audit into a five-month one, or produce a qualified opinion that a lender or investor will not accept:

• Promising a deadline before engaging an auditor. Investors and lenders accept extensions far more readily when asked early. Ask before the deadline, in writing.
• Hiring the firm that keeps your books. Even where allowed, it raises questions in diligence and forces a change before an IPO.
• No year-end inventory count. If the auditor could not observe it, you may get a qualified opinion on inventory and cost of goods sold.
• Cap table does not tie to the general ledger. Common with SAFEs converted in a priced round but never reclassified in the books.
• Missing contracts. Revenue recognized on deals with no signed order form, or with side letters that change terms.
• Cash-basis expenses. Large unrecorded liabilities discovered in the post-year-end search.
• Stock comp booked from an outdated report. The ASC 718 expense must use the 409A in effect on each grant date, including modifications and repricings.
• Choosing on price alone. The cheapest proposal often assumes perfect books and bills overruns hourly. Ask for the assumptions behind the fee.

Questions to ask an audit firm before you sign: How many venture-backed audits in our industry did you sign last year? Are you PCAOB-registered? Who on the team will be on site and for how many years? What assumptions in the fee would trigger overruns, and at what hourly rate? What is your typical turnaround from final PBC delivery to signed opinion?

This guide is general and current as of October 2026. It is not accounting, tax or legal advice for your specific facts; your agreements and your auditor's engagement letter control what you actually owe.