What Does Audit Mean? Financial Audits, IRS Audits and What Small Businesses Need (2026)

"Audit" is one of those words that means something slightly different depending on who says it. Your banker means a CPA's opinion on your financial statements. The IRS means an examination of your tax return. This guide explains both meanings for a US small business owner: the difference between an audit, a review and a compilation, when a lender, investor or federal rule actually forces you to get one, how IRS audits work, the real odds from the IRS's own 2026 data, what tends to draw attention, and how long to keep your records.

Quick answer

An audit is an independent examination of records to check they're accurate. For a business it usually means either a financial statement audit — an outside CPA tests your books and issues an opinion — or a tax audit, where the IRS or a state re-checks a filed return. Most private small businesses never need a financial audit unless a lender, investor or federal program requires it, and IRS audit rates are low.

• Audit = reasonable assurance; review = limited assurance; compilation = no assurance

• IRS examined about 0.3% of individual returns for tax year 2021

• 81% of IRS audits closed in FY2025 were done entirely by mail

• Keep tax records at least 3 years; 4 years for payroll records

• The IRS starts audits by letter, never by an unexpected phone call

What does audit mean?

At its simplest, an audit is a systematic, independent check of whether something is what it claims to be. The word comes from the Latin for "hearing," because early audits were literally read aloud to the person checking them. Today the person doing the checking is independent of the people who prepared the records, and the result is a written conclusion other people can rely on.

In a small business you'll run into the word in three main ways. A financial statement audit is performed by a licensed CPA firm, which tests your balance sheet, income statement and cash flow statement and then gives an opinion on whether they're presented fairly under an accounting framework such as US GAAP. A tax audit is an examination of a return by the IRS or a state revenue department. And an internal or operational audit is a check you run yourself, or hire someone to run, on a process such as inventory counts, payroll, sales tax collection or cybersecurity. None of these is a punishment in itself; each is a way of testing whether the numbers can be trusted.

The meanings get mixed up because the same records feed all three. Your general ledger, bank statements, invoices and payroll reports are what a CPA tests, what the IRS asks for, and what you'd review internally. That's the practical point of this guide: if your bookkeeping holds up to one kind of audit, it will usually hold up to the others.

Private US companies that do get audited are audited under generally accepted auditing standards (GAAS) issued by the AICPA's Auditing Standards Board. Public companies are audited under standards set by the Public Company Accounting Oversight Board (PCAOB). For the vast majority of small businesses, PCAOB rules never come into play.

Audit vs review vs compilation: the levels of CPA service

When a bank or investor asks for "CPA-prepared financials," they may not mean an audit at all. The AICPA's Statements on Standards for Accounting and Review Services (SSARS) cover three cheaper services for private companies, and an audit sits above them. Knowing the difference can save you a large fee, because a review or compilation is often enough for a smaller loan.

A preparation engagement is the lightest touch. The CPA turns your trial balance into financial statements but doesn't give any assurance. The AICPA's SSARS 27 clarified in 2025 that statements prepared as part of a consulting engagement under the consulting standards fall outside AR-C 70, so the label on your engagement letter matters.

A compilation goes one step further: the CPA issues a short report saying the statements were compiled, and that no audit or review was done. A CPA who isn't independent of your business, perhaps because they also keep your books, can still do a compilation as long as the report says so.

A review is where assurance starts. The CPA asks your management a structured set of questions, compares this year's numbers and ratios with expectations, and chases anything unusual. A review doesn't test internal controls, confirm balances with your bank or customers, or watch an inventory count. Independence is required, so the firm that does your bookkeeping usually can't also do your review.

An audit is the full examination. The auditor plans the work around the risk of material misstatement, tests samples of transactions back to invoices and bank records, sends confirmation letters to banks and customers, observes physical inventory, and looks at how your internal controls work. The opinion can be unmodified (a "clean" opinion), qualified, adverse, or a disclaimer if the auditor couldn't get enough evidence.

When does a small business actually need an audit?

No federal law requires a privately owned small business to have its annual financial statements audited. You need one when a contract, a program or a securities rule says so. These are the situations small owners hit most often.

Bank loans and lines of credit. Lenders set the level of financial reporting in the loan agreement. Smaller loans, or loans with strong collateral, often only need tax returns or compiled statements; larger commercial loans frequently need reviewed statements, and big credit facilities may need audited ones. The requirement is usually written as a covenant with a deadline, such as delivering statements within 90 or 120 days after year-end, and missing it can put the loan in technical default. Ask for the requirement in writing before you sign, and negotiate the level down if your loan size doesn't justify an audit.

SBA programs. A standard SBA 7(a) loan application asks for business tax returns and financial statements rather than an audit; check our SBA loan requirements guide for the document list. The rule that does bite is in the 8(a) Business Development program: participants with gross annual receipts above $20 million must file audited annual statements within 120 days of year-end, those between $7.5 million and $20 million need reviewed statements, and smaller participants can use compiled or in-house statements.

Investors and crowdfunding. Angel and venture investors often require audited statements as a condition of a priced round or before a later round. Under Regulation Crowdfunding, which lets you raise up to $5 million in 12 months, the financial statement level is set by the size of the raise: reviewed statements above $124,000, and audited statements above $618,000, except that a first-time crowdfunding issuer can use reviewed statements up to $1,235,000.

Federal grants and awards. A nonprofit, college or other non-federal entity that spends $1,000,000 or more of federal award money in a fiscal year needs a single audit under the Uniform Guidance. The threshold was raised from $750,000 for fiscal years beginning on or after October 1, 2024. For-profit contractors are generally outside this rule, but the awarding agency can impose its own audit terms.

Retirement plans. If you sponsor a 401(k) or other pension plan, the plan itself generally needs an annual audit by an independent qualified public accountant once it has 100 or more participants at the start of the plan year. The Department of Labor's 80-to-120 participant rule lets a plan that filed as a small plan last year keep doing so while its count stays between 80 and 120.

Selling the business. A buyer, especially one using SBA or bank financing, will run due diligence on your numbers. An audit isn't mandatory, but a quality-of-earnings review or audited statements can support your asking price, particularly if you're quoting a multiple of EBITDA.

Who asks for what level of financial statements

Situation	Usual requirement	Rule or source
Small bank loan or line of credit	Tax returns or compilation	Loan agreement (negotiable)
Larger commercial loan	Review, sometimes audit	Loan covenant
SBA 8(a) receipts above $20 million	Audit within 120 days	13 CFR 124.602
SBA 8(a) receipts $7.5 million–$20 million	Review within 90 days	13 CFR 124.602
Reg CF raise above $618,000	Audit (first-timers: review up to $1,235,000)	17 CFR 227.201(t)
Federal awards of $1,000,000+ a year	Single audit	2 CFR 200.501
401(k) plan with 100+ participants	Plan audit by an IQPA	29 CFR 2520.104-46

Small bank loan or line of credit

Usual requirement

Tax returns or compilation

Rule or source

Loan agreement (negotiable)

Larger commercial loan

Usual requirement

Review, sometimes audit

Rule or source

Loan covenant

SBA 8(a) receipts above $20 million

Usual requirement

Audit within 120 days

Rule or source

13 CFR 124.602

SBA 8(a) receipts $7.5 million–$20 million

Usual requirement

Review within 90 days

Rule or source

13 CFR 124.602

Reg CF raise above $618,000

Usual requirement

Audit (first-timers: review up to $1,235,000)

Rule or source

17 CFR 227.201(t)

Federal awards of $1,000,000+ a year

Usual requirement

Single audit

Rule or source

2 CFR 200.501

401(k) plan with 100+ participants

Usual requirement

Plan audit by an IQPA

Rule or source

29 CFR 2520.104-46

What happens during a financial statement audit

If you've never been through one, the process is more predictable than people expect. It runs in four phases, and most of the stress comes from records that weren't ready rather than from anything the auditor finds.

First, the firm sends an engagement letter setting out the scope, the framework (usually US GAAP), the deadline and the fee. Before signing it, the auditor has to confirm it's independent of your business, which is why your bookkeeper or tax preparer's firm may not be able to take the job.

Second comes planning and risk assessment. The auditor learns how your business makes money, where errors or fraud are most likely, and how your controls work. For a restaurant that might be cash handling and inventory; for a contractor, revenue recognition on long jobs.

Third is fieldwork. Expect a request list (often called a "PBC" list, for prepared by client) covering bank reconciliations, aged receivables and payables, fixed-asset schedules, loan agreements, payroll reports and inventory counts. The auditor will sample transactions and trace them to source documents, send confirmation requests to your bank and some customers, and may attend your year-end inventory count.

Finally, the auditor proposes any adjusting entries, you sign a management representation letter, and the firm issues its report. A clean, or unmodified, opinion is what lenders want. Fees vary widely with size and complexity, so get two or three quotes and compare the hours and staffing behind them rather than the headline number.

What is an IRS audit?

An IRS audit, formally an examination, is a review of a return to make sure income, deductions and credits are reported correctly. Being selected doesn't mean anyone suspects wrongdoing; many audits end with no change. The IRS describes three formats:

• Correspondence (mail) audit. The IRS sends a letter asking for documents to support specific items, such as a deduction or a credit. You reply by mail or fax. In FY2025, 81% of all audits closed were done this way.
• Office audit. You, or your representative, meet an examiner at a local IRS office and bring the records listed in the letter.
• Field audit. A revenue agent comes to your home, business or accountant's office. Field audits are used for more complex returns and accounted for 19% of FY2025 audits, but brought in most of the recommended additional tax.

IRS audits by the numbers (IRS Data Book 2025)

497,621

Tax return audits closed in FY2025

$26.8 billion

Recommended additional tax from those audits

81%

Done entirely by mail

the rest were field exams

2.5%

Taxpayers who didn't agree with the result

If you have too many records to mail, you can ask for a face-to-face audit instead. The IRS also stresses one point that protects you from scams: it starts every audit by mail and won't initiate an audit by telephone. A call or email claiming you're under audit and demanding payment is a red flag; check the notice number on IRS.gov and contact the IRS through the numbers listed there.

It helps to know what an audit is not. A CP2000 notice from the Automated Underreporter program, which says the income on your return doesn't match the W-2s and 1099s the IRS received, is technically not an audit, though you should answer it just as seriously. A math-error notice is also separate. Both are far more common than examinations.

IRS audit odds: what the Data Book shows

The most reliable numbers come from the IRS Data Book, published each spring. The latest edition, covering fiscal year 2025, reports coverage rates by tax year. Tax year 2021 is the most useful row because it's the latest year outside the normal three-year statute of limitations, so its rate is close to final. More recent years look lower simply because the IRS can still open audits on them.

Across all individual returns for tax years 2015 through 2023, the IRS has examined 0.36%. For tax year 2021 alone the rate was 0.3%, or about 3 returns in 1,000. The pattern by income is U-shaped: higher at the very bottom, where refundable credits such as the earned income tax credit are checked, lowest in the middle, and much higher at the top.

Sole proprietors file Schedule C with their Form 1040, so their odds sit inside the individual figures. Two cautions apply. First, these are averages; a return with an unusual pattern carries far higher odds than the headline rate. Second, the numbers move with IRS staffing and priorities, and the agency's workforce and enforcement plans have changed several times since 2022. Treat the rates as a sense of scale, and recheck them each spring when the new Data Book appears.

What triggers an IRS audit?

The IRS doesn't publish a list of triggers, but it does explain how returns are chosen. Three methods do most of the work.

Computer scoring. The Discriminant Inventory Function (DIF) system gives each return a score based on how its figures compare with norms built from randomly audited returns. A high score suggests a change is likely, and an examiner then screens the return before anything is opened.

Information matching. The IRS receives billions of information returns each year, including W-2s, 1099-NECs, 1099-Ks and 1099-INTs. When the income on your return doesn't match, the mismatch is usually handled by a CP2000 notice, but it can lead to an audit.

Related examinations. If a business partner, investor or company you deal with is being audited, your return can be pulled because it involves the same transactions.

Beyond those official methods, tax practitioners consistently point to patterns that raise a return's profile. These aren't IRS rules, but they line up with how DIF scoring and matching work:

• Gross receipts lower than the 1099 income the IRS has on file
• Schedule C losses year after year, which can raise the question of whether the activity is a business or a hobby
• Deductions that are large relative to income, especially travel, meals and vehicle expenses claimed at or near 100% business use
• Round-number expenses that look estimated rather than recorded
• Cash-heavy businesses with deposits that don't line up with reported sales
• Workers paid on 1099s who look like employees (see our 1099 vs W-2 guide)
• Large charitable contributions or refundable credits without documentation

None of these means you shouldn't claim what you're entitled to. It means you should have the paperwork that proves it, because in an audit the burden is on you to support each item.

How to prepare for and respond to an IRS audit

The audit letter tells you which tax year, which items and which documents the IRS wants. Read it carefully, because your response should answer exactly those questions and nothing more. Here is the usual sequence.

Responding to an IRS audit letter

1. 1

   Confirm the letter is genuine

   Check the notice or letter number and the tax year against your records, and look it up on IRS.gov. Don't call a number printed in a suspicious letter or email.

   Tip: Real IRS payments are made to the United States Treasury, never to a person or by gift card.

2. 2

   Note the deadline and ask for time if needed

   Mail audits usually allow a one-time 30-day extension. Missing the date leads to a report based only on what the IRS already has.

3. 3

   Decide on representation

   You can handle it yourself, or authorize a CPA, enrolled agent or attorney with Form 2848 so they can deal with the IRS for you.

   Form 2848 on IRS.gov
4. 4

   Gather only the records requested

   Pull bank statements, receipts, invoices, mileage logs and contracts for the items listed. Send copies, never originals, and keep a record of what you sent.

5. 5

   Review the result

   The audit ends with no change, a change you agree to and sign, or a change you dispute. If you disagree you can ask for a manager conference, mediation or an appeal.

6. 6

   Watch the deadlines after a disagreement

   A 30-day letter gives you time to appeal within the IRS. A notice of deficiency gives you 90 days to petition the US Tax Court.

If the amount in dispute is $50,000 or less for a tax year, you can use the Tax Court's simpler small tax case procedure. Interest generally runs on any additional tax from the original due date, so if you agree with a change, paying promptly limits the cost.

A few habits make audits shorter. Organize documents by the line items in the letter, not by month. Write a short cover note that explains each item and points to the supporting page. Answer questions factually without volunteering opinions about other years. And if the examiner asks to extend the statute of limitations on Form 872, talk to your representative before signing; you can decline, but the examiner may then close the case with whatever information is available.

State audits run on similar lines but on their own rules and timelines. Sales tax audits in particular are common for retailers and restaurants, and states can usually look back further if you never registered or filed. Your state revenue department's website lists its audit process and appeal steps.

How long to keep business records

Record retention is the cheapest audit protection you can buy. The IRS ties its guidance to the period of limitations, the window in which it can assess more tax or you can claim a refund.

The IRS periods in the table below are tax minimums. Your lender, insurer, landlord or state may require longer, and many accountants recommend keeping year-end financial statements, filed returns, formation documents and major contracts permanently. Digital copies are acceptable if they're legible and complete, so a scanned-receipt system linked to your accounting software is both lighter and easier to search when a letter arrives.

An audit-ready file for a small business is not complicated: signed-off monthly bank and card reconciliations, invoices matched to deposits and payments, payroll reports with the Forms 941, 940, W-2 and 1099 you filed, a mileage log, a fixed-asset register with purchase documents, loan agreements, sales tax returns with any resale or exemption certificates you accepted, and copies of every filed return with its workpapers.

Common audit mistakes and how to avoid them

Mixing personal and business money. Paying personal bills from the business account, or business costs from your personal card, is the most common reason a simple audit grows. A separate business bank account, and a habit of recording owner draws and contributions, fixes most of it.

Reconstructing records after the letter arrives. Examiners can usually tell when a mileage log or receipt set was rebuilt from memory. Recording expenses as they happen, with a note of the business purpose, is far more persuasive.

Ignoring a notice. An unanswered letter doesn't go away; it becomes an assessment, then a balance due with interest and penalties. Even if you can't gather everything in time, reply or ask for more time.

Treating a CPA review as an audit. If your loan agreement says "audited," a review report won't satisfy it. Check the wording before you engage a firm. And in an IRS exam, provide only the years and items requested; volunteering more can widen the scope.

What to do next

If you're facing a lender or investor request, ask exactly which level of statements they need, then get quotes from two or three CPA firms for that level. If you're worried about an IRS audit, the best preparation is clean books: reconcile monthly, keep receipts with notes, and pay quarterly estimated taxes on time. Use our federal tax calculator to sanity-check what you owe, and review the business tax filing guide for the returns and deadlines that apply to your entity.

Official links

• IRS audits overviewAudit types, selection, rights and appeals
• IRS Data BookAnnual audit coverage and enforcement statistics
• How long should I keep records?IRS record retention periods
• Publication 556Examination of returns, appeal rights and refund claims
• Taxpayer Advocate ServiceFree help if an IRS problem isn't being resolved
• 13 CFR 124.602 (8(a) financial statements)Audited, reviewed and compiled thresholds

This is general information, not legal or tax advice — confirm on the official source or with a professional.

Frequently asked questions

What does audit mean in simple terms?

An audit is an independent check of whether records and reports are accurate. In business it usually means one of two things: a financial statement audit, where an outside CPA tests your books and gives an opinion on whether the statements are fairly presented, or a tax audit, where the IRS or a state examines a return to confirm the income, deductions and credits reported are correct.

What does tax audit mean?

A tax audit, which the IRS calls an examination, is a review of a filed return to check that income was fully reported and that deductions and credits are allowed. The IRS starts every audit by mail. Most are handled entirely by letter; the rest happen at an IRS office or at your business. The outcome is no change, a change you agree to, or a change you can appeal.

What are my chances of being audited by the IRS?

Low for most filers. The IRS Data Book shows it has examined about 0.3% of individual returns for tax year 2021, the most recent year outside the normal three-year window. Odds rise sharply at the top: 6.6% for people reporting $10 million or more. Returns claiming the earned income tax credit and those with no positive income are also examined more often than average.

How far back can the IRS audit a small business?

Generally three years from the date you filed. The window stretches to six years if you left out more than 25% of the gross income shown on the return, and there is no limit if you never filed or filed a fraudulent return. The IRS says most audits cover returns filed in the last two years and it usually does not go back more than six.

Do small businesses need an audit every year?

No federal law requires a private small business to have its financial statements audited. An audit becomes necessary when someone you deal with demands it: a bank loan covenant, investors, an SBA 8(a) participant with receipts above $20 million, a crowdfunding raise above $618,000, federal award spending of $1,000,000 or more, or a 401(k) plan with 100 or more participants.

What is the difference between an audit and a review?

An audit gives reasonable assurance: the CPA tests transactions, confirms balances with banks and customers, considers internal controls and issues an opinion. A review gives limited assurance: the CPA mainly asks management questions and runs analytical comparisons, then reports whether anything suggests the statements need material changes. Both require the CPA to be independent; a review costs less and takes less time.

Sources & verification

Figures on this page were checked against the sources below when it was last reviewed on 8 October 2026. Each rate and limit is stored once with its own official source and review date, and official update channels are monitored daily so changes are picked up. How we verify

1. 1.IRS Data Book, 2025 (Publication 55-B) — Tables 3-1 and 3-2 — Internal Revenue Service · accessed 8 October 2026
2. 2.IRS audits — Internal Revenue Service · accessed 8 October 2026
3. 3.How long should I keep records? — Internal Revenue Service · accessed 8 October 2026
4. 4.Publication 556 — Examination of Returns, Appeal Rights, and Claims for Refund — Internal Revenue Service · accessed 8 October 2026
5. 5.13 CFR § 124.602 — 8(a) financial statement requirements — Legal Information Institute, Cornell Law School (Code of Federal Regulations) · accessed 8 October 2026
6. 6.17 CFR § 227.201(t) — Regulation Crowdfunding financial statements — Legal Information Institute, Cornell Law School (Code of Federal Regulations) · accessed 8 October 2026
7. 7.Regulation Crowdfunding — U.S. Securities and Exchange Commission · accessed 8 October 2026
8. 8.2 CFR § 200.501 — Audit requirements — eCFR (Office of the Federal Register) · accessed 8 October 2026
9. 9.Frequently Asked Questions on the Small Pension Plan Audit Waiver Regulation — U.S. Department of Labor, EBSA · accessed 8 October 2026
10. 10.SSARS 27: Clarifying the application of AR-C 70 to CAS engagements — AICPA & CIMA · accessed 8 October 2026
11. 11.Guide to Financial Statement Services: Compilation, Audit and Review — AICPA & CIMA · accessed 8 October 2026
12. 12.Review Engagements (AR-C 90) — Open Exam Prep (CPA study guide) · accessed 8 October 2026