To prepare for an external audit, work backward from the planning meeting date: reconcile the balance sheet, organize the evidence the auditor will ask for, and document the key controls and the processes behind them. Then test the IT general controls before the auditor does. When an audit runs long, accounting questions are rarely the cause. The usual causes are late evidence, a system report nobody can prove is complete, or a control the auditor planned to rely on failing halfway through fieldwork.
This guide is written from the side of the table that does the testing. It covers what auditors decide early, what slows them down, and how to divide the work between your team, your auditor and outside help. It is general information. Your auditor, your counsel and your lenders are the right people to confirm how it applies to you.
What the auditor is deciding before fieldwork starts
Early in planning, the auditor decides how much to rely on your controls. If a control is well designed and the evidence shows it operated, the auditor can assess control risk lower and do less detailed testing of balances. If the auditor can't rely on controls, every number has to be proved directly. That means larger samples, more documents and a longer request list.
That decision isn't final. A deviation in a key control during interim testing can push the auditor toward a fully substantive approach in the weeks before the opinion is due, when your team has the least time to respond.
Deficiencies come in two kinds. A design deficiency means the control is missing, or wouldn't achieve its objective even if it ran perfectly. An operating deficiency means a sound control didn't run as designed, or the person running it lacked the authority or competence to do it well. Each is then weighed for severity. A material weakness creates a reasonable possibility that a material misstatement won't be prevented or detected on time. A significant deficiency is less severe but still important enough to merit the attention of those who oversee financial reporting. The auditor must communicate both in writing to management and the audit committee before the report is issued.
A timeline from planning meeting to fieldwork
Every audit has its own calendar. The sequence below is a common one, so adjust the spacing to yours.
Before the planning meeting. Read last year's findings, management letter comments and adjustments, and decide what you want to say about each one. List what changed during the year: acquisitions, new systems, new revenue streams, departures in finance or IT. The auditor will find these changes. Telling them first keeps the conversation about scope rather than surprise.
At the planning meeting. Ask where the auditor intends to rely on controls and where they plan to go substantive. Ask when interim work happens, when the request list arrives and when each item is due. Agree on one liaison on your side and one on theirs.
Between planning and interim. Document the key controls. Walk them through yourself. Test the IT general controls and a sample of each key control. Fix what fails, and give a new control time to operate before anyone tests it.
Interim fieldwork. The auditor runs walkthroughs, following a transaction from initiation to the general ledger using the same documents and systems your staff use. They test controls for the period so far. Have control owners available and evidence ready before the auditor arrives.
Year end close and final fieldwork. Reconciliations, balance testing, the period end financial reporting process and the roll forward of controls tested at interim. For public company audits, a PCAOB change effective December 15, 2026 shortens the time auditors have to assemble final documentation from 45 days to 14 days after the report is released. Expect requests for complete, final evidence earlier in the closing timeline than in past years.
Managing the PBC list and the quality of evidence
The list of items provided by client (PBC) is where most of the friction lives. Three habits help.
First, give every request an owner and a date, and track them in one place both sides can see. A shared tracker beats a chain of emails.
Second, label every file so it explains itself: the request number, what it is, the period it covers. An auditor who has to ask what a file is will ask again about the next one.
Third, prove your reports. When you hand over a system report or a spreadsheet, the auditor has to establish that it is complete and accurate before using it. In both the 2021 and 2022 inspection cycles, about 17 percent of the deficiency notices PCAOB inspectors issued involved auditors who had not done enough to test this kind of company-produced information for completeness and accuracy. Expect auditors to press on it. For each key report, keep:
- the system and module it came from
- the parameters used to run it, with a screen capture showing them
- a tie of its totals to the general ledger or another independent source
- where logic is custom built, a description of the logic and evidence it hasn't changed
A spreadsheet used in a control needs the same treatment: who owns it, how its inputs are checked, and how changes to formulas are controlled.
Reconciliations and how the support is organized
Reconcile every balance sheet account before the auditor asks, not because the auditor asked. A reconciliation is only useful as evidence if it ties to the trial balance and explains reconciling items with dates and amounts. It also needs to show who prepared it and who reviewed it, and when.
Organize support by account, in the same order as the trial balance. Old reconciling items that carry forward from month to month draw questions. Clear them or explain them. Your accounting team or advisers own the accounting answers. The readiness question is whether the evidence behind those answers is complete, dated and easy to follow.
Documenting key controls and process narratives
A control description should say who performs it, what they do, how often, with what information, and what they do when something looks wrong. A narrative for each significant process (revenue, purchasing, payroll, the financial close) should connect those controls to the risks they address. Without that link, the auditor has to work out the reasoning alone.
Management review controls deserve extra care. A review is only as precise as its threshold for investigation. A review that only follows up differences near financial statement materiality is less likely to catch a misstatement. Write down the threshold, what the reviewer looked at and what they followed up, or the auditor will have little to test.
The period end financial reporting process is also in scope: how totals reach the general ledger, how accounting policies are chosen, and how journal entries and adjustments are initiated, approved and recorded. Manual journal entries without evidence of review are a frequent finding.
The IT general controls that commonly create findings
Business process controls, automated controls and the reports they use all depend on the IT general controls underneath them. When an IT general control fails, the controls built on top of it can lose reliance too. That makes these the first place to look.
- Access. Terminated employees whose accounts stayed active. User access reviews signed without changes being made. Privileged and administrator accounts nobody reviews. Shared accounts.
- Program changes. Changes promoted to production without documented approval or testing. Developers who can move their own code into production. Where change runs through pull requests and deployment pipelines, the evidence lives there, and it has to show who approved what.
- IT operations. Failed scheduled jobs and interfaces with no record of follow-up.
- Service organizations. For systems run by a third party, obtain the SOC 1 report. Check its period, scope, opinion and exceptions. Confirm your team actually operates the complementary user entity controls the report assumes. Get a bridge letter covering the gap to your year end.
Effective IT general controls bring a further benefit. Where they are tested and an automated control hasn't changed since its baseline test, the auditor may not need to repeat that control's full test each year.
Common pitfalls, and the knowledge that leaves with people
The pitfalls repeat across companies:
- Prior year findings marked "remediated" with no evidence the fix operated.
- Controls that exist in a matrix but not in practice.
- Reviews performed but not evidenced.
- An ERP change or acquisition the auditor heard about in fieldwork.
- One person who knows how every report is run.
Turnover turns that last risk into a finding. When the controller or the person who ran compliance leaves, the reasoning behind the controls often leaves too. Narratives, documented report parameters, a dated evidence index and a calendar of control activities let a new person pick up the program without rebuilding it from memory.
Working with your auditors on communication and scope
Treat the audit as a project with two teams. A short standing meeting each week during fieldwork, with open requests and open questions on one page, prevents most late escalations. Raise disagreements about a finding or a classification early, in writing, with your evidence. Waiting for the closing meeting is too late.
Scrutiny rose after 2020. The PCAOB's aggregate inspection deficiency rate at the U.S. Big Four firms roughly doubled between 2020 and 2022 and held there in 2023, and firms responded by asking clients for more and better evidence. The rate has since fallen, to 20 percent in 2024 and 8 percent in 2025.
Banks, lenders and first audits
A first audit
A first audit is heavier than a recurring one. If the company has never been audited, the auditor has no prior workpapers to start from. Either way, a new auditor usually has to get comfortable with opening balances as well as the current year. For a PE backed company, the audit often exists because a sponsor or lender requires it. The deadline then comes from a contract, not from the auditor's preference. Start earlier than feels necessary, and expect more walkthroughs and more questions about how things have always been done.
Lenders and debt covenants
Read the credit agreement before the planning meeting. Note when audited statements are due, what the compliance certificate requires, and whether any audit outcome (a qualified opinion, a going concern paragraph, a reported weakness) has consequences under it. Late audit adjustments can move a covenant calculation after the certificate has been drafted. Practice varies by agreement, so your counsel and your lender relationship manager should confirm what applies.
Banks, insurers and grant recipients
Some internal control mandates come from a regulator rather than the SEC. For banks, the FDIC's updated thresholds took effect on 1 January 2026. FDICIA annual audit and audit committee requirements now start at one billion dollars of total assets, measured at the beginning of the fiscal year. Management's internal control assessment and the auditor's attestation start at five billion. The FDIC will adjust these thresholds for inflation going forward. Under the Model Audit Rule as adopted by the states, insurers with five hundred million dollars or more of annual direct written and assumed premium must file a management report on internal control over financial reporting. Non-federal entities, such as governments and nonprofits, that spend one million dollars or more of federal awards in a fiscal year beginning on or after October 1, 2024 generally need a Single Audit.
IPO candidates
A newly public company generally doesn't report on internal control in its first annual report. An emerging growth company is exempt from the auditor's attestation on internal control while it keeps that status, but management still has to assess its own controls. A weakness found before the offering may still have to be disclosed. Finding it early is the point.
When to bring in a readiness consultant, and why not your auditor
Your auditor can tell you a control failed. Independence rules, which are strictest for public companies, keep the auditor from designing your controls, building your financial systems, running your internal audit function or performing management functions. Even permitted control-related services for a public company need audit committee pre-approval, after the auditor describes the scope in writing and discusses the independence implications with the committee. Asking the auditor to help get ready for their own test puts both of you in a difficult position.
Bring in outside help when the planning meeting is close and the documentation is thin. The same goes for prior year findings that are still open, a first audit or IPO on the calendar, an ERP go live, or the departure of whoever ran the program. That is the work we do at Faulkner Governance Risk & Compliance. We work for management, and we are not a CPA firm. The audit, and the opinion, stay with your auditor.
Typical scopes are listed on our services page:
- SOX and ICFR readiness, usually three to five weeks, leaving a gap list with an owner and a date on every line
- Documentation and testing of IT general controls and business process controls, built so your auditor can use the workpapers
- Key report and SOC 1 reviews
- Deficiency remediation with a retest before the auditor's
- Pre IPO readiness
- A fractional compliance lead on a monthly retainer
The standard comes from years defending audit work through PCAOB inspections. You can read about that on our experience page and about Gray Faulkner.
Every engagement starts with a free two hour scoping call. A short letter follows, naming the deliverables, the dates and a fixed fee. Each week you get one page on what was done, what is blocked and what you need to decide. If your auditor writes up a deficiency on a control we documented and tested, we remediate it at no charge. Twenty percent of each fixed fee is held back until the controls in scope pass testing.
Book a scoping call. Tell us when the planning meeting is and what you're worried about.
Frequently asked questions
How far ahead should we start preparing for an external audit?
Start as soon as the audit date is known. Leave enough time to document controls, test them, fix what fails and let a fixed control run before the auditor tests it. A first audit or a remediation year needs more lead time than a routine one.
What does an audit readiness consultant actually do?
A readiness consultant works for management. That means finding which controls and processes are in scope, documenting and testing them the way the auditor will, organizing evidence, designing fixes for what fails and retesting. The consultant doesn't perform the audit or issue an opinion.
Can our external auditor help us get ready?
Within limits. The auditor can explain what they plan to test and what they found. Independence rules prevent them from designing or implementing your controls or doing management's work, which is why that help usually comes from a separate firm.
Do you do our bookkeeping or technical accounting memos?
No. We work on the controls, documentation and evidence behind the numbers. Your accounting team or accounting advisers own the books and the accounting positions.
What if the auditor finds a deficiency anyway?
You'll receive it in writing, with a classification. Ask how it was evaluated. If the classification looks wrong, respond with evidence. Our two day deficiency second opinion looks at whether the classification holds and what a credible response looks like.
Does this apply to a PE backed company that isn't public?
Yes. Whether or not your auditor reports on internal control, weak controls mean more substantive testing, more requests and a slower audit, and lenders and sponsors care about the outcome.