Audit Readiness Checklist 2026: How to Get Your Books Audit Ready

Three days before fieldwork starts, your controller finds that Shopify paid out 368,900 dollars for the month while the books show 412,600 dollars in sales. Nobody can explain the gap. The auditor has already asked twice for the fixed asset register. Fieldwork slips two weeks, the lender gets its covenant report late, and the audit fee lands over budget. That is what audit preparation looks like when it starts after the auditor calls. An audit readiness checklist turns the same work into something you finish on your own schedule instead.

This guide covers how to prepare for an audit in the United States. It sets out which businesses are legally required to have one, what changed in 2026, and the exact documents your auditor will ask for first.

Most of the work is bookkeeping, not accounting theory, which is why an outsourced accounting team can close the gap faster than a controller working alone in audit season.

What Audit Readiness Means for a US Business in 2026

Audit readiness is the state in which a company’s books, schedules and supporting documents can be handed to an independent auditor without further work. It is a condition of the accounting records, not a project the finance team runs once a year. A business is audit ready when every balance sheet account ties to an external document and every unusual entry has an explanation attached to it.

The distinction matters because audit fees are priced on auditor hours. Every unreconciled account, missing invoice and unexplained journal entry converts directly into billable time and into a longer close.

A generic business audit checklist stops at telling you to keep receipts. Three things actually separate an audit ready company from one that is not:

• Every account reconciles to a third party document. Bank, merchant processor, loan, payroll and inventory balances all agree to a statement issued by somebody outside the company.
• Every material estimate has written support. Depreciation, allowance for doubtful accounts and accrued liabilities each have a schedule behind them, not a plug figure.
• Every document has a named owner. Somebody specific can produce each item within a day, so fieldwork does not stall while people search shared drives.

Which US Businesses Are Legally Required to Have a Financial Statement Audit

Most privately held US companies are never required by statute to have a financial statement audit. There is no general federal law that forces a profitable private business to be audited, which is the single most common misunderstanding about the subject. An audit becomes mandatory in four specific situations, and each one has its own trigger and its own figure.

Knowing which situation applies to you decides everything else, because the deadline, the scope and the auditor’s report all differ. Here is what actually triggers a required audit in the United States.

Federal Award Recipients and the One Million Dollar Single Audit Threshold

A non-federal entity that expends 1,000,000 dollars or more in federal awards during its fiscal year must have a single audit or a program-specific audit for that year, under 2 CFR 200.501. Below that figure, no federal audit is required, although the records still have to be available for review.

The word that trips organizations up is expended. The test is not revenue, and it is not the size of the award. A nonprofit with 4,000,000 dollars of total revenue that spent 300,000 dollars of federal pass-through money in the year does not cross the threshold. A much smaller organization that drew down 1,100,000 dollars on a construction grant does.

Two practical consequences follow. First, the threshold aggregates across every federal program and every pass-through, so a subrecipient has to add up money arriving from several state agencies. Second, timing controls the answer, because drawing an extra 200,000 dollars in September rather than October can move the audit into the current year.

The threshold rose from 750,000 dollars to 1,000,000 dollars for fiscal years beginning on or after 1 October 2024. Guides published before that change still show the old figure, so check the date on anything you read.

Retirement Plan Sponsors and the 100 Participant Form 5500 Audit Rule

A retirement plan must file an independent auditor’s report with its Form 5500 when it has 100 or more participants with account balances as of the first day of the plan year. For plan years beginning on or after 1 January 2023, defined contribution plans count only participants with account balances, rather than every employee eligible to join, under the Form 5500 revisions published on 24 February 2023.

That single change moved roughly 18,699 defined contribution plans out of the audit requirement. The reason is arithmetic. A company with 140 employees where only 88 have ever contributed now files as a small plan, because the 52 employees with no balance no longer count.

The practical trap is the opposite case. A growing company that crosses 100 participants with balances in January owes a plan audit for that year, and nobody usually notices until the Form 5500 is being prepared in the following summer. Plan auditors book up early, so a late discovery means a filing extension rather than a choice of firm.

Nonprofits Registered in a State With a Charitable Audit Threshold

Nonprofits face state audit requirements that are separate from, and usually stricter than, the federal single audit rule. Preparing for a nonprofit audit therefore starts with a registration check in every state where the organization solicits donations, because the trigger is state law and the figures differ widely.

Two of the largest states show the spread. New York requires an independent certified public accountant’s audit report from a registered charity with gross revenue and support over 1,000,000 dollars, and a review report once revenue reaches 250,000 dollars, under Executive Law 172-b. California sets its audit threshold at 2,000,000 dollars of gross revenue under Government Code 12586.

Note that New York counts revenue and support together, so restricted grants and contributions are inside the measure. An organization at 940,000 dollars of program revenue plus a 200,000 dollar foundation grant is over the line, even though its earned revenue is not.

A nonprofit can therefore owe a state audit, a single audit, both, or neither, and the three tests are measured on three different numbers.

Private Companies With a Lender or Investor Audit Covenant

Private companies are most often audited because a contract says so, not because a statute does. The requirement sits in a credit agreement, a shareholder agreement or an investor side letter, and it usually specifies both the deadline and the standard, such as audited statements prepared under generally accepted accounting principles within 120 days of year end.

Read the covenant before you plan the work, because three details change the entire timetable. The delivery deadline is often shorter than the tax filing deadline. Some agreements name a minimum firm size or require a firm with a specific industry practice. Others step the requirement up as the balance grows, moving a company from a compilation to a review to a full audit as its borrowing increases.

Missing a covenant delivery date is a technical default even when the business is performing well, which is why a private company audit calendar should be built backwards from the credit agreement rather than from the auditor’s availability.

What Changed for Audit Readiness in 2026

The biggest 2026 development for anybody inside the single audit system is that the Office of Management and Budget proposed a full rewrite of the federal grant rules. The proposed Regulation for Federal Financial Assistance was published on 29 May 2026 with comments due on or before 13 July 2026, and it was issued jointly across 45 federal agencies.

Two points matter for planning this year’s audit.

• The 1,000,000 dollar single audit threshold is unchanged. Nothing in the proposal lowers it, so plan the current year against 2 CFR 200.501 as it stands.
• The framework itself is being reclassified. The proposal shifts the Uniform Guidance from guidance toward binding regulation, and it limits agencies, inspectors general and the Government Accountability Office to imposing extra audit requirements only where a law authorises them.

Nothing is final while a proposed rule is open, so the practical response is documentation rather than restructuring. Keep the schedule of expenditures of federal awards reconcilable to the general ledger by program and by award number, because that reconciliation is what any version of the rule will test.

The 30 Day Audit Readiness Checklist, Week by Week

This audit preparation checklist covers 30 days of work in the order an auditor consumes it. Most audit checklists name the same items in a different order. The sequence matters more than the content, because week two cannot be completed until week one is finished, and a small business audit preparation checklist that jumps straight to gathering documents produces a file that does not tie to the ledger.

Each week below names the work, then the failure mode that sends teams back to the start.

Week One: Lock the Trial Balance and Close Every Open Period

1. Close every prior period in the accounting system. Set a hard close date so no back-dated entry can change a balance the auditor has already tested. Failure mode: an open period means every schedule has to be regenerated after fieldwork begins.
2. Print the trial balance and check that it agrees to the financial statements. Retained earnings should tie to last year’s audited or reviewed figure exactly. Failure mode: a difference here is usually a prior period adjustment nobody documented.
3. Clear every suspense, undeposited funds and ask my accountant account to zero. Failure mode: balances parked in these accounts are the first thing an auditor selects for testing.
4. Review the chart of accounts for duplicates. Two accounts for the same merchant fee split one balance in half and hide variances. Failure mode: the analytical review flags a swing that does not exist.

If the books have unreconciled months behind them, this week is where that becomes visible, and a pre-audit bookkeeping cleanup is faster than trying to reconcile forward from a broken opening balance.

Week Two: Reconcile Every Bank, Card and Merchant Account

1. Reconcile every bank and credit card account through the last day of the year. Failure mode: a reconciliation dated three days into the new year does not support the year end balance.
2. Reconcile each payment processor separately. Stripe, Shopify Payments, PayPal, Square and Amazon each settle on their own timetable and each needs its own reconciliation. Failure mode: one combined merchant account makes a timing difference impossible to explain.
3. Investigate every outstanding check older than 90 days. Failure mode: stale checks in the bank book are a standard audit finding and often mask a duplicate payment.
4. Agree the year end cash balance to the bank confirmation, not to the online balance. Failure mode: the online balance moves after year end and will not match the confirmation the auditor receives.

Bank and merchant reconciliation is the single largest cause of delayed fieldwork, because every revenue and expense test starts from cash.

Week Three: Rebuild the Fixed Asset Register and the Depreciation Schedule

1. Reconcile the fixed asset register to the general ledger, line by line. Failure mode: a register that totals differently from the ledger means every depreciation figure is unsupported.
2. Confirm that every capitalised item has an invoice attached to it. Failure mode: unsupported additions are reclassified as expense, which changes the tax return.
3. Remove assets that were sold, scrapped or replaced. Failure mode: ghost assets keep generating depreciation and overstate both the balance sheet and the deduction.
4. Split repairs from capital improvements against a written capitalisation policy. Failure mode: without a stated threshold, the classification looks like a judgement made after the fact.
5. Recalculate depreciation for the year and tie it to the expense account. Failure mode: a difference between the schedule and the ledger is an audit adjustment, not a rounding issue.

The written capitalisation policy is the cheapest document on this list to produce and the one most often missing. It has to exist before the year it governs, because a threshold written after the fact reads as a decision made to suit the outcome.

Week Four: Assign an Owner to Every Piece of Evidence

1. Build one folder per audit area, named the way the auditor names it. Failure mode: documents organised by department force the auditor to ask for the same file twice.
2. Put a person’s name against every item, not a department. Failure mode: shared ownership means nobody answers within the day.
3. Write a one line explanation for every journal entry over your materiality figure. Failure mode: explaining a nine month old entry from memory during fieldwork is how scope expands.
4. Hold a kick-off call with the audit team before fieldwork. Agree the request list, the deadlines and who answers questions. Failure mode: a first meeting on day one of fieldwork loses the first two days.

Ask the audit team for its materiality figure during planning rather than guessing it. Entries above that figure need a written explanation attached to them, and entries below it usually do not, so knowing the number decides how much of week four you actually have to do.

What Auditors Actually Ask For in the Prepared By Client List

The prepared by client list is the schedule of documents the auditor sends before fieldwork, and it is the same list every year with small variations by industry. Treating it as an audit documentation checklist you maintain all year, rather than a request you answer in February, is the difference between a two week fieldwork and a six week one.

Below is what appears on almost every financial audit checklist, and what each item is actually testing.

Which Bookkeeping Software Makes Audit Readiness Easier

A finance audit checklist tells you which documents to collect. Software decides whether you can prove when they were created, and that is the part an auditor tests. Accounting software affects audit readiness through one feature above all others, which is whether it keeps an immutable audit trail of who changed what and when. Everything else is convenience. An auditor testing a sample of entries wants to see the original posting, the user who made it and the date, and a system that silently overwrites history turns a five minute test into a discussion.

Three capabilities are worth checking before an audit year, whatever platform you use. Look for a period lock that genuinely prevents back-dated entries, attachment of source documents at transaction level rather than in a separate drive, and bank feed rules that record a merchant deposit gross with the fee as a separate expense line.

Businesses choosing a platform with a first audit ahead of them should weigh those three features heavily, and a comparison of bookkeeping software for small business is the right place to start that decision.

Internal Audit and External Audit Are Not the Same Review

An internal audit is a management tool for testing whether controls work, and an external financial statement audit is an independent opinion on whether the statements are fairly presented. Readers comparing internal audit and statutory audit are usually looking for this distinction, and outside the United States the external audit is often called a statutory audit.

An internal financial audit checklist tests whether a control operated as designed. The external audit process steps ask a different question, and they follow a fixed order: planning and risk assessment, control walkthroughs, substantive testing of balances, subsequent events review, then the report.

Both reviews assume the underlying records follow GAAP accounting, because that is the framework the external opinion is measured against.

Where Audit Readiness Breaks Down by Industry

Audit readiness fails in industry-specific places, because the account that carries the most judgement differs by business model. The three patterns below account for most first year audit adjustments in the sectors where they appear.

E-commerce: Shopify Payouts That Never Tie to the Bank Deposit

Online sellers post the bank deposit as revenue, which understates sales and hides the processing fee entirely. Here is a real month, with every figure shown.

• Gross Shopify sales for the month: 412,600 dollars
• Refunds and returns: 18,400 dollars, so net sales are 394,200 dollars
• Shopify Payments processing fees withheld: 11,432 dollars
• Chargebacks deducted: 1,150 dollars
• Payouts earned: 394,200 minus 11,432 minus 1,150, which is 381,618 dollars
• Actually deposited during the month: 368,900 dollars
• In transit at month end, the last three days of orders: 12,718 dollars

The deposits plus the in transit balance equal 381,618 dollars, so the month ties. A business that books only the 368,900 dollars of deposits understates revenue by 43,700 dollars and reports no processing fee expense at all. The correct treatment records revenue gross at 412,600 dollars, refunds as a reduction of revenue, fees and chargebacks as expense, and the 12,718 dollars as a receivable from the processor.

Real Estate: Rent Roll Totals That Do Not Match Recognized Revenue

Property companies fail audit testing when the rent roll and the general ledger disagree, because the rent roll is the document the auditor uses to test revenue completeness. The gap usually comes from four places: free rent periods that should be straight-lined over the lease term, tenant reimbursements recorded net of the expense they recover, security deposits posted to income rather than to a liability, and mid-month move-outs prorated in the ledger but not on the roll.

Each of those changes reported revenue, and a difference between the two documents makes every property level income figure unsupported until it is explained.

The fix is a monthly reconciliation of the rent roll to the revenue account rather than an annual one, with the straight-line rent adjustment carried on its own general ledger line. That way the auditor traces one number instead of recalculating every lease, and the reconciliation exists before fieldwork rather than being built during it.

Healthcare Clinics: Contractual Allowances and Payroll for Contracted Providers

Clinics fail on the gap between billed charges and expected reimbursement. Booking revenue at the charge amount and writing the shortfall off later overstates both revenue and receivables at year end, so the contractual allowance has to be estimated in the period the service was delivered. Auditors test that estimate against actual collections after year end.

The second area is payroll for visiting and contracted providers, where worker classification and the timing of accrued compensation both need documentation. Clinics that need this reconciled before fieldwork usually need healthcare audit support rather than a general bookkeeper, and any clinic inside a federal drug pricing program should read the separate requirements for 340B program compliance alongside its financial statement audit.

What makes the contractual allowance estimate defensible is a monthly reconciliation of expected reimbursement to actual remittance advice. The auditor tests the year end estimate against cash collected in the two or three months after year end, so a clinic that only reconciles annually has no evidence to offer when the estimate is challenged.

The Five Audit Readiness Mistakes That Trigger a Qualified Opinion

A qualified opinion is a report in which the auditor states that the financial statements are fairly presented except for a specific matter. It stays on the report permanently, lenders read it first, and it is almost always caused by missing evidence rather than by fraud. These five failures cause most of them, and each one is preventable during the 30 days above.

1. Unreconciled bank and merchant accounts. When cash cannot be agreed to a third party statement, the auditor cannot rely on any test that starts from cash. This is the most common single cause and the reason payment reconciliation belongs in the monthly close rather than in audit season.
2. Missing support for capitalised additions. Without an invoice, the addition is reclassified to expense, which changes both the balance sheet and the tax return.
3. No physical inventory count at year end. An inventory balance that was rolled forward rather than counted cannot be verified after the date has passed, and it is the classic scope limitation.
4. Related party transactions that were never disclosed. Loans to owners, rent paid to an entity the owner controls and management fees between affiliates all require disclosure. Discovering one during fieldwork reopens completed work.
5. An unsigned management representation letter. The auditor cannot issue any report without it, so a disagreement over its wording stops the engagement outright.

Every item on this accounting audit checklist is a documentation failure, not a technical accounting failure, which is why audit readiness is a bookkeeping discipline first.

How Long Does Audit Preparation Take, and When Should You Start

Audit preparation takes 30 to 60 days of finance team effort for a first audit and 15 to 30 days once the process is established. The reason the first one costs more is that opening balances have to be supported as well as the current year, so two years of records come under test at once.

Work backwards from the deadline that binds you, because it is rarely the tax filing date. Single audit filers face the tightest one: the reporting package is due 30 calendar days after the auditee receives the auditor’s report, or nine months after the end of the audit period, whichever is earlier, under 2 CFR 200.512. For a December year end that is 30 September, and the auditor needs several weeks before that.

A workable year end audit checklist timetable looks like this. Select the auditor and sign the engagement letter four to five months before the deadline. Complete the audit planning checklist and the close through to a locked trial balance three months out. Deliver the prepared by client file two months out. Hold fieldwork six to eight weeks before the deadline, leaving room for adjustments and the review of the draft report.

Teams that start the month before the deadline are not preparing for an audit, they are absorbing it, and that is where the fee overruns come from.

Our Compliance and On Time Delivery Guarantees

Audit season is where deadline risk and accuracy risk arrive together, so both are covered in writing.

Regulatory Compliance Assurance. We ensure all tax filings, payroll, and financial reports meet compliance standards. If an error on our part results in a financial penalty, we will cover the cost.

On Time Delivery Guarantee. Monthly, quarterly, and annual reports are delivered without delays. If we miss a compliance deadline due to our fault, we pay a 50 percent fee.

Get Audit Ready in 30 Days

We will run an audit readiness assessment across your last two years of books. You get back a written list of every account that will not survive testing, the reconciliations that need rebuilding, and the documents your auditor will ask for and you do not have yet.

Then we do the work. Reconciliations, fixed asset register, prepared by client file, all of it built to the standard your auditor expects, inside 30 days. Our audit preparation services are priced per engagement, not per hour, so the fee does not grow with the mess.

Book a free consultation.

Audit Readiness Checklist FAQs

What is an audit readiness checklist?

An audit readiness checklist is a sequenced list of the accounting work that has to be finished before an independent auditor begins fieldwork. It covers closing and locking the period, reconciling every account to a third party document, rebuilding the fixed asset and depreciation schedules, and assembling the documents the auditor will request. The order matters, because the document file cannot be built until the trial balance is locked. The same document is sometimes published as a financial audit checklist or a financial statement audit checklist, and the work behind all three names is identical.

Is a financial statement audit required for a US small business?

No general US law requires a privately held small business to have a financial statement audit. An audit becomes mandatory only when a specific trigger applies: expending 1,000,000 dollars or more in federal awards, sponsoring a retirement plan with 100 or more participants holding account balances, registering as a charity in a state that sets an audit threshold, or signing a loan or investor agreement that requires audited statements.

How do you prepare for a nonprofit audit?

Preparing for a nonprofit audit starts by identifying which of three separate tests applies, because each is measured on a different number. Check federal awards expended against the 1,000,000 dollar single audit threshold, check gross revenue against the audit threshold in every state where the organization is registered to solicit, and check any grant agreement for its own audit clause. Then reconcile the schedule of expenditures of federal awards to the general ledger by program and award number, and confirm that restricted contributions are tracked by donor restriction rather than by fund name alone.

How long does audit preparation take?

A first audit takes 30 to 60 days of finance team work before fieldwork begins, and a repeat audit takes 15 to 30 days. The first one costs more because opening balances have to be supported as well as the current year, which puts two years of records under test at the same time.

What documents will the auditor ask for first?

Auditors open with the year end trial balance, the bank statements and reconciliations for every account, and the general ledger detail. Those three establish whether the financial statements were built from the accounting records and whether cash can be verified, and every later test depends on them.

What is the difference between an audit, a review, and a compilation?

An audit gives an opinion that the statements are fairly presented and is supported by testing of the underlying evidence, a review gives limited assurance based mainly on analytical procedures and inquiry, and a compilation gives no assurance because the accountant only presents management’s figures in statement format. The cost difference follows the amount of testing, and a lender or state regulator will name which one it accepts.

What is a qualified opinion, and what causes one?

A qualified opinion states that the financial statements are fairly presented except for one specific matter that the auditor could not resolve. The usual causes are missing evidence rather than error: no year end inventory count, capitalised assets without invoices, unreconciled cash, or undisclosed related party transactions.

Why is this called a statutory audit in some countries?

Outside the United States, a company law audit required of every incorporated company is usually called a statutory audit, and a statutory audit checklist means the same thing as an audit readiness checklist. The United States has no equivalent blanket requirement for private companies, so the audit is described by what triggers it instead, such as a single audit, an employee benefit plan audit or a covenant audit.

Can an outsourced accounting team prepare the books for our auditor?

Yes, and it is common practice, because preparing the records is management’s responsibility and is separate from the audit itself. The one constraint is independence: the firm that prepares the books cannot also issue the audit opinion, so an outsourced accounting provider builds the file and an independent certified public accountant audits it.