Audit vs. Review vs. Compilation: Which Level of Assurance Does Your Lender or Investor Require?

Start with the covenant, not the catalog

Most businesses commission the wrong engagement for the same reason: they decide what to buy before reading what was asked for. A loan agreement that requires audited financial statements is not satisfied by a review, and discovering that in month eleven of a facility is an expensive way to learn the distinction.

So the sequence is: read the requirement, identify who relies on it, then scope the engagement.

The three levels, precisely

Compilation. Governed by AR-C Section 80 of the AICPA's Statements on Standards for Accounting and Review Services. The CPA assists management in presenting financial information in the form of financial statements and reads them for obvious material errors. No assurance is expressed. Independence is not required, though any lack of independence must be disclosed in the report. Footnote disclosures are optional.

Review. Governed by AR-C Section 90. The CPA performs inquiry and analytical procedures and issues a conclusion stating that nothing came to the accountant's attention indicating that material modifications are needed for the statements to conform with the applicable framework. That is limited, or negative, assurance. Independence is strictly required.

Audit. Governed by Generally Accepted Auditing Standards, codified in the AU-C sections. The auditor issues an opinion on whether the statements are free from material misstatement, whether from error or fraud, which represents reasonable assurance. Reaching that opinion requires testing internal controls, sampling transactions, examining source documents, obtaining third-party confirmations such as bank and receivable confirmations, and formally assessing fraud risk. Independence is required.

There is a fourth level that gets forgotten. AR-C Section 70 covers preparation of financial statements, where the CPA prepares statements without issuing any report at all, subject to a disclaimer. It is the right answer more often than the market assumes, particularly for internal use.

Who typically asks for what

Requirements vary by lender and by transaction, so the list below describes common practice rather than a rule.

• Internal management use only, no outside reliance. Preparation or compilation is usually sufficient.
• Smaller credit facilities and lines of credit. Compilations are often accepted; some lenders require a review.
• Mid-market lending and surety bonding. Reviews are common, and many mid-market covenants are written to a review standard.
• Institutional lenders, private equity owners, M&A buyers. Audits, because the reliance is large and the buyer's own diligence depends on it.
• Employee benefit plans. ERISA imposes its own audit requirements once participant counts cross the applicable threshold.
• Entities expending federal awards. OMB Uniform Guidance triggers a Single Audit above the spending threshold, which is a separate and more demanding engagement.

The cost and time gap is real

Higher assurance costs more because it requires more evidence. Published 2026 mid-market ranges place audits well above reviews, and reviews well above compilations, with the spread widening for technology, multi-entity, and regulated businesses. Timing widens too. A compilation can follow a closed year quickly. An audit involves planning, interim fieldwork in some cases, confirmations that depend on third parties responding, and a management representation letter at the end.

Two practical consequences. First, an audit requested in February for a December year-end on a thirty-day deadline is often not achievable at any price, because confirmation response times are outside the firm's control. Second, the first-year audit of a business that has never been audited costs more than subsequent years, since opening balances have to be established.

Where higher assurance is the wrong answer

It is worth saying plainly, because the profession rarely does: more assurance is not automatically better.

An audit of a business that nobody outside it relies on spends money to solve a problem that does not exist. The cost is not only the fee. It is management time, document production, and a several-week distraction during the exact period the team is also closing the year and filing returns.

The counterweight is that assurance levels are difficult to move downward once a lender has seen them. A business that voluntarily audits for one year and then proposes a review the following year invites a question it would rather not answer. Choosing the level is a multi-year decision, not an annual one.

One further constraint governs who can perform the work. Firms performing audits and reviews are subject to the AICPA peer review program, under which an independent firm periodically evaluates the quality of the practice. Rakesh Jain, CPA PC is a peer-reviewed firm, which is a baseline expectation for audit and assurance services rather than a distinguishing feature, and worth confirming with any provider.

Choosing the level before someone chooses it for you

The practical sequence: obtain the written requirement from the lender, investor, or regulator; confirm whether it specifies audited, reviewed, or compiled statements and under which framework; check whether it names a deadline and a submission format; then commission the engagement with enough runway to meet it.

Where no external party requires anything, the honest answer is often the least expensive one.

FAQs