How It Works
Accounting professionals, usually Certified Public Accountants (CPAs), can be auditors. They must be independent, unbiased and qualified to provide an auditor's report (also called an opinion).
Auditors are responsible for four things:
Defining the terms of the engagement between the auditor and the client
Planning the scope and conduct of the audit
Compiling the audited information
Reporting the results of the audit
Quite often the company's audit committee (primarily composed of board members) selects the auditor and reviews the auditor's work.
One of the auditor's primary goals is to find and correct any material misstatements, which are statements that are wrong, missing or incomplete whether made deliberately or accidentally. This is why auditors must be able to drill down to the source of each piece of data (this is called the audit trail). To compile the information necessary to do this, an auditor does many things. For example, the auditor tests the transactions and account balances that make up the financial statements as well as the design and operation of the systems that generated those statements.
Auditors also employ sampling techniques, whereby they evaluate less than 100% of the items within an account or class of transactions as a way to understand the nature of the entire account or class of transactions. For example, an auditor usually will not check every expense report in a large company to make sure each has receipts attached; rather, the auditor will pull a random sample of the reports, examine those and draw conclusions about the quality of the information and controls related to expense reports. Auditors also analyze significant trends or ratios and question changes or variances from predicted amounts. Further, they investigate the reasonableness of management's accounting estimates of uncertain events or events that are likely to occur (such as the outcome of litigation).
Auditors perform their audit procedures in accordance with the International Auditing and Assurance Standards Board (IAASB), which is a committee of the International Federation of Accountants (IFAC). The IAASB develops standards and guidance that are considered best practices for auditors. The IFAC also sets ethical and independence standards for auditors and in particular emphasizes that auditors should be, and be seen to be, free from any influence that might jeopardize their independence. The Securities and Exchange Commission (SEC) and other regulatory bodies determine which types of entities are subject to audit as well as the kind of information on which the auditor should report. Further, the Public Company Accounting Oversight Board (PCAOB), which was created through the Sarbanes-Oxley Act of 2002, oversees auditors to make sure they prepare "informative, fair, and independent audit reports." The PCAOB regularly inspects public accounting firms for compliance with the Sarbanes-Oxley Act, PCAOB rules, SEC rules and other professional audit standards. The PCAOB also disciplines accounting firms found to be in violation of these rules.
When the audit is complete, the auditor publishes the audit findings in the auditor's report, which prefaces the financial statements in the company's public reports and filings. This report is usually the only public document available about the audit process, but the auditor often issues private reports to the company's management or audit committee as well as to regulatory authorities. The auditor keeps extensive written records, called working papers, which provide the basis and support for each of its opinions.
When an auditor feels that a company's financial statements are fair and accurate, the auditor issues an unqualified opinion and does so using a standard reporting template (this is why many opinions read the same way). An audit report also includes a statement that the audit was conducted in accordance with GAAP. When the auditor cannot give an unqualified opinion, it issues a qualified opinion, which lists the reasons for the auditor's concern about the company's financial statements and controls and the possible effects on the financial statements. The auditor is not responsible for auditing transactions that occur after the date of the audit report.