How an audit actually runs: the seven stages

Most of the unpleasant surprises in an audit come not from the numbers but from the client not knowing how the process works: when the questions arrive, how many there will be, what “sampling” means and why the auditor asks the bank to confirm a balance that is plainly visible on the statement. Below are the seven stages, in the order they actually happen.

1. The conversation and scoping

Before any documents, the auditor has to understand what they are dealing with: the activity, turnover, number of accounting areas, cross-border transactions, the state of the ledger. This is where the fee is formed. A firm that quotes a price without looking at anything is showing you something, and it is not confidence.

2. The engagement letter

The engagement letter fixes what later protects both sides: the subject of the audit, the standards applied, management’s responsibility for the statements and the auditor’s responsibility for the opinion. This is also where the reporting language and the deadline belong. Verbal deadline agreements do not work.

3. Planning and risk assessment

The auditor sets materiality, the amount above which an error would change a user’s decision, and decides which areas need deeper work. This is not a formality: materiality drives the sample size, and therefore how many documents you will be asked for.

4. The document request

The first list arrives right after the engagement letter and covers the basics: constitutional documents, the trial balance, the general ledger, bank statements, contracts, the fixed asset register and payroll summaries. Later lists get narrower and more specific, because they are built around the sample.

A practical tip: appoint one person who gathers documents and is authorised to write to counterparties. Audits where documents arrive from five different people take twice as long.

5. Substantive procedures

This is the bulk of the work, and it consists of four types of action.

• Testing a sample of transactions. The auditor does not look at every document, which is physically impossible. A sample is drawn under the standard and a conclusion about the population is drawn from it.
• External confirmations. Requests to banks, counterparties and sometimes lawyers. Yes, the balance is on the statement, but the standard requires confirmation from the bank itself, because a statement can in theory be altered while the bank’s reply bypasses the client.
• Attending the stock count. Where inventory is material, the auditor has to be present during the count rather than read the count sheet afterwards.
• Analytical procedures. Comparisons with prior periods and with the industry. These are usually what shows where to look next.

6. Discussing the findings

Good practice is questions as the work goes, not a list of surprises at the end. Before the final report you should see the findings and have time to explain or correct what can be corrected. A separate management letter covers things that do not affect the opinion but deserve attention, such as weaknesses in internal control.

7. The report

The auditor’s report carries an opinion: unmodified, qualified, adverse, or a disclaimer of opinion. Before signing, management provides a written representation about the completeness of the information given. The report is then signed and issued.

For a typical medium-sized company the work takes two to four weeks of active effort, and the timeline is almost always set by how fast documents arrive rather than by the auditor.

What we do here

We perform voluntary audits commissioned by an owner, a bank or a buyer, grant and donor project audits, tax audits and HR records audits. We do not perform statutory audits of financial statements at present, while our quality control review is in progress, but we check the statutory audit criteria free of charge within one business day.