For nonprofit leaders and boards, deciding between an audit and a financial statement review often starts with a simple question:

How much assurance do we actually need?

An audit provides reasonable assurance that the financial statements are free from material misstatement and results in the CPA expressing an opinion on the financial statements.

A review provides limited assurance and is substantially narrower in scope. The CPA primarily performs analytical procedures and inquiries and reports whether the accountant is aware of any material modifications that should be made for the financial statements to conform with the applicable financial reporting framework.

For some nonprofits, the decision is optional.

For others, an audit is required by Washington or other state law, federal funding requirements, grant agreements, lenders, contracts, bylaws, or other stakeholders—in which case a review generally cannot be substituted simply because it is less extensive or less expensive.

The right engagement depends on both what is required and what level of assurance the organization's financial statement users actually need.

What Is the Difference Between an Audit and a Review?

The biggest difference is the level of assurance provided by the CPA.

Both engagements involve professional standards, independence, financial statements, and a CPA report.

But they are not interchangeable engagements.

What Does an Audit Provide?

A financial statement audit is designed to provide reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by error or fraud.

Reasonable assurance is a high—but not absolute—level of assurance.

The auditor performs procedures based on an understanding of the organization and an assessment of where material misstatements could occur.

Depending on the organization and the risks identified, audit procedures may include:

• understanding the organization and its environment;

• understanding relevant internal controls;

• identifying and assessing risks of material misstatement;

• performing analytical procedures;

• examining supporting documentation;

• testing transactions and account balances;

• confirming certain balances or information with third parties;

• evaluating accounting estimates;

• evaluating financial statement presentation and disclosures;

• considering fraud risks;

• reviewing subsequent events;

• obtaining management representations; and

• performing other procedures responsive to assessed risks.

At the conclusion of the engagement, the independent CPA expresses an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.

An audit does not guarantee that every error, fraud, control deficiency, or improper transaction will be discovered.

Rather, the engagement is designed to reduce audit risk to an appropriately low level so the CPA can provide reasonable assurance on the financial statements.

What Does a Financial Statement Review Provide?

A review provides limited assurance, which is lower than the reasonable assurance provided by an audit.

Under applicable CPA standards, review procedures primarily consist of inquiries and analytical procedures, along with other procedures when the accountant determines they are necessary based on information identified during the engagement. AICPA guidance specifically describes limited assurance as less than the reasonable assurance obtained in an audit.

For example, the CPA may:

• compare current-year financial results with prior periods;

• compare actual results with budgets;

• analyze relationships among revenue and expenses;

• investigate unexpected fluctuations;

• evaluate financial ratios;

• inquire about significant transactions;

• discuss accounting policies and estimates;

• inquire about subsequent events;

• inquire about related-party activity; and

• ask management about matters affecting the financial statements.

If something unusual or inconsistent is identified, additional inquiry or procedures may be necessary.

The resulting report does not contain an audit opinion.

Instead, the accountant concludes whether the accountant is aware of any material modifications that should be made to the financial statements for them to conform with the applicable financial reporting framework.

The AICPA describes reviews as providing limited assurance through inquiry and analytical procedures rather than the more extensive procedures required in an audit.

Is a Review Just a Smaller Audit?

No.

This distinction is important.

A review is sometimes casually described as an “audit-lite,” but that description can create the wrong expectation.

A review has a different objective and different procedures.

The CPA is not simply performing 50% of an audit or taking an audit checklist and removing half of the procedures.

A review is designed from the beginning as a limited-assurance engagement.

That generally means the CPA does not perform the same level of:

• risk assessment;

• transaction testing;

• balance testing;

• third-party confirmation;

• inspection of supporting documentation; or

• internal-control work

that would be expected in a financial statement audit.

As a result, a review can provide meaningful independent assurance while requiring less time and cost than an audit—but it also provides a lower level of assurance.

When Is a Nonprofit Required to Have an Audit?

Before deciding whether a review is sufficient, determine whether the nonprofit is required to obtain an audit.

Potential audit triggers include:

• Washington charitable organization requirements;

• federal Single Audit requirements;

• grant agreements;

• government contracts;

• lending agreements;

• foundation requirements;

• organizational bylaws;

• board policies; and

• other contractual or regulatory requirements.

If an audit is specifically required, a review generally does not satisfy that requirement.

Washington Nonprofit Audit Requirements

For Washington charitable organizations subject to the state's tiered financial reporting rules, the audit requirement generally depends on average annual gross revenue over the three preceding completed accounting years.

Washington currently establishes three tiers.

Organizations with more than $3 million in average annual gross revenue generally must obtain an independent third-party audit of their financial records for the preceding accounting year.

That is an important distinction for organizations considering a review:

A financial statement review does not replace the Tier Three audit required by Washington law.

For organizations with more than $1 million but not more than $3 million in average annual gross revenue, Washington's Tier Two rules generally require the organization to make available either:

1. its applicable federal financial reporting form—such as Form 990—prepared by a CPA or other professional who normally prepares such forms; or

2. an audited financial statement prepared by an independent CPA.

A financial statement review is not listed as one of those two Tier Two alternatives.

Organizations should therefore avoid assuming that obtaining a review automatically satisfies Washington's charitable reporting requirements.

Related Resource: When Does a Washington Nonprofit Need an Audit? →

What About a Single Audit?

A Single Audit is another reason a nonprofit may need an audit regardless of whether management or the board would otherwise prefer a review.

Organizations that expend federal awards above the applicable federal threshold can become subject to the Single Audit requirements under the Uniform Guidance.

A standard financial statement review cannot substitute for a required Single Audit.

This is why organizations receiving significant federal funding should evaluate their federal expenditures early rather than waiting until the financial statements are ready.

Related Resource: When Does a Nonprofit Need a Single Audit? →

When Might a Review Be Appropriate for a Nonprofit?

A review can be an effective option when an audit is not required but the organization wants independent CPA assurance over its financial statements.

For example, a review may make sense when:

The board wants greater financial credibility

Management may prepare reliable financial statements internally, but the board may want an independent CPA involved before relying on those statements for governance and decision-making.

A review can provide an additional layer of credibility without requiring the scope of a full audit.

A funder requests CPA-reviewed financial statements

Some foundations and grantmakers may accept reviewed financial statements rather than audited statements.

The organization should confirm the exact wording of the requirement before engaging a CPA.

A lender accepts a review

Banks and other lenders sometimes establish different financial reporting requirements based on loan size, risk, and the borrower's financial condition.

A lender might require:

• internally prepared statements;

• compiled financial statements;

• reviewed financial statements; or

• audited financial statements.

If a review satisfies the loan agreement, there may be no reason to commission a more extensive audit solely for the lender.

The organization is growing

A nonprofit approaching greater financial complexity may decide that a review is an appropriate intermediate step between internally prepared or compiled financial statements and a future audit.

This can be especially useful when:

• revenue is growing;

• new programs are being added;

• significant grants are being pursued;

• debt is being considered;

• the board is becoming more sophisticated; or

• stakeholders are requesting greater financial transparency.

The nonprofit wants independent assurance but does not need an audit

Sometimes there is no statutory or contractual requirement at all.

The board may simply conclude that independent limited assurance provides meaningful value to donors, funders, management, or other financial statement users.

When Might an Audit Be the Better Choice Even If It Is Not Required?

Not every audit is driven by a legal requirement.

Some organizations voluntarily choose an audit because the additional assurance supports their strategic objectives.

An audit may make sense when:

• the organization expects substantial growth;

• significant new grants are being pursued;

• a major capital campaign is planned;

• lenders or investors in affiliated activities want stronger financial reporting;

• the organization is considering a merger or significant transaction;

• financial reporting has become increasingly complex;

• the board or audit committee wants greater assurance;

• management has experienced significant accounting turnover;

• the organization expects to cross an audit threshold soon; or

• stakeholders place significant reliance on the financial statements.

In those circumstances, the question becomes less about minimum compliance and more about the value of additional assurance.

Does an Audit Evaluate Internal Controls?

Yes—but this point requires some nuance.

As part of a financial statement audit, the auditor obtains an understanding of relevant internal controls to help identify and assess risks of material misstatement and design appropriate audit procedures.

That does not necessarily mean the auditor is expressing an opinion on the effectiveness of the nonprofit's internal control system.

In a standard financial statement audit, the auditor's primary objective is to express an opinion on the financial statements.

However, the audit process may identify certain control deficiencies that are required to be communicated to management and those charged with governance.

A review does not involve the same audit-level understanding and assessment of internal controls.

For nonprofits specifically seeking a comprehensive evaluation of internal controls, additional advisory or agreed-upon procedures may be more appropriate depending on the objective.

Will an Audit Find Fraud?

An audit is designed to provide reasonable assurance that the financial statements are free of material misstatement, whether caused by fraud or error.

But an audit is not a guarantee that all fraud will be discovered.

This is another area where boards should have realistic expectations.

Management and the board remain responsible for designing and maintaining appropriate internal controls and for the prevention and detection of fraud.

A CPA audit provides important independent assurance, but it does not replace good governance or an effective system of financial controls.

Does a Review Find Errors?

Potentially—but detecting every error is not the objective of a review.

Analytical procedures may identify unexpected relationships or fluctuations, and management's responses may lead the CPA to investigate further.

For example:

If contribution revenue increases 60% while cash receipts remain flat, that relationship may warrant further inquiry.

If payroll expenses fall significantly despite an increase in staffing, the accountant may ask additional questions.

If restricted net assets change in a way that does not align with grant activity, further investigation may be appropriate.

But because the procedures are less extensive than an audit, nonprofit leaders should not expect a review to identify issues that would require detailed transaction testing or examination of underlying documentation to discover.

Audit vs. Review vs. Compilation

There is also a third commonly used CPA financial statement service: a compilation.

A compilation provides no assurance on the financial statements.

The CPA assists management in presenting financial information in financial statement form and issues a compilation report, but does not perform the inquiry and analytical procedures required in a review or the extensive procedures required in an audit.

The AICPA distinguishes the three services primarily by the assurance provided: an audit provides reasonable assurance, a review provides limited assurance, and a compilation provides no assurance.

A simplified continuum looks like this:

Compilation → No assurance

Review → Limited assurance

Audit → Reasonable assurance

The right answer is not automatically the engagement with the highest level of assurance.

It is the engagement that satisfies the organization's requirements and provides the level of assurance its financial statement users need.

Example: A Growing Washington Nonprofit

Consider a Washington nonprofit with:

• $2.2 million of average annual gross revenue;

• no significant federal awards;

• no audit requirement in its bylaws;

• no debt;

• several private foundation grants; and

• a board seeking greater confidence in the organization's annual financial statements.

Based solely on Washington's Tier Three threshold, an audit may not be required.

Suppose its major foundations also do not require audited financial statements.

The board could evaluate whether a review provides sufficient assurance for its needs.

Now assume that same nonprofit enters into a new grant agreement requiring annual audited financial statements.

The analysis changes immediately.

Even though Washington law may not independently require the audit, the contractual requirement does.

A review would not ordinarily satisfy a grant agreement that specifically calls for audited financial statements.

Example: A Nonprofit Approaching the Washington Audit Threshold

Consider another organization with average annual gross revenue of approximately $2.8 million that expects substantial growth during the next two years.

A review might satisfy current stakeholder needs.

But leadership should also consider where the organization is heading.

If its rolling three-year average is likely to exceed Washington's $3 million Tier Three threshold, management may benefit from preparing its accounting processes for audit-level scrutiny before an audit becomes mandatory.

That might include:

• strengthening monthly reconciliations;

• improving grant accounting;

• documenting accounting policies;

• formalizing internal controls;

• maintaining fixed-asset schedules;

• improving support for restricted contributions;

• organizing board documentation; and

• shortening the year-end close.

The question is not necessarily whether the nonprofit should voluntarily pay for an audit early.

The better question may be:

Are our financial systems ready for the level of reporting our organization is growing into?

Questions a Nonprofit Board Should Ask Before Choosing

When deciding between an audit and a review, boards and finance committees should work through these questions in order.

1. Is an audit legally required?

Evaluate state and federal requirements first.

2. Does any agreement require an audit?

Review:

• grant agreements;

• government contracts;

• loan agreements;

• foundation requirements;

• leases or other significant contracts.

3. Do our bylaws or policies require one?

An internal governance requirement can be just as determinative until it is appropriately changed.

4. What do our financial statement users actually need?

Consider:

• the board;

• grantors;

• major donors;

• banks;

• regulators;

• government agencies;

• prospective funders; and

• other stakeholders.

5. How complex is the organization?

Complexity may arise from:

• multiple programs;

• restricted grants;

• federal funding;

• investments;

• affiliated entities;

• significant estimates;

• multiple locations;

• contributed nonfinancial assets; or

• unusual transactions.

6. What assurance will provide meaningful value?

If no audit requirement exists, determine whether reasonable assurance is worth the additional cost relative to limited assurance.

7. Where is the organization going?

The service appropriate for a $1,500,000 organization may not remain appropriate as it becomes a $3 million or $10 million organization.

Financial reporting should evolve with the nonprofit.

Does a Review Cost Less Than an Audit?

Generally, yes.

Because a review involves substantially fewer procedures than an audit, review engagements typically require fewer professional hours and therefore cost less.

But pricing should not be the first factor considered.

The sequence should be:

Requirement → Stakeholder need → Appropriate assurance → Cost

Not:

Cost → Choose the cheapest engagement

A lower-cost review provides no savings if a grantor, regulator, lender, or state requirement ultimately requires an audit and the organization must commission a second engagement.

Related Resource: How Much Does a Nonprofit Audit Cost? →

How Can a Nonprofit Reduce the Cost and Disruption of Either Engagement?

Audit and review efficiency both start with the quality of the underlying accounting.

Organizations can improve readiness by:

• reconciling balance-sheet accounts monthly;

• maintaining organized supporting documentation;

• tracking grants consistently;

• maintaining accurate donor-restriction records;

• reconciling payroll;

• maintaining fixed-asset and debt schedules;

• documenting significant accounting estimates;

• maintaining board minutes;

• resolving old reconciling items;

• establishing a disciplined monthly close; and

• assigning clear responsibility for CPA requests.

Strong financial processes benefit the organization regardless of whether the annual CPA engagement is an audit or a review.

Related Resource: How Should a Nonprofit Prepare for Its First Audit? →

Related Resource: What Should Be on a Nonprofit Audit PBC List? →

Frequently Asked Questions

Is a financial statement review the same as an audit?

No.

An audit provides reasonable assurance and results in the CPA expressing an opinion on the financial statements.

A review provides limited assurance and primarily involves inquiries and analytical procedures. The CPA does not express an audit opinion.

Is a review sufficient for a Washington nonprofit with more than $3 million of revenue?

Generally, no, if the organization is subject to Washington's Tier Three charitable reporting requirement.

Tier Three organizations with more than $3 million in annual gross revenue averaged over the three preceding completed accounting years generally must obtain an independent third-party audit.

Can a Washington Tier Two nonprofit use a review instead of an audit?

A review is not one of the two financial reporting alternatives specifically identified in Washington's Tier Two statute.

Tier Two organizations generally must make available either an applicable federal financial reporting form prepared by a qualified professional or an audited financial statement.

A nonprofit considering a review should separately determine whether the engagement satisfies any other funder, lender, contractual, or governance requirements.

Does a review require the CPA to be independent?

Yes.

CPA independence is required for a financial statement review.

Does an audit provide absolute assurance?

No.

An audit provides reasonable assurance, not absolute assurance.

Is a review always cheaper?

A review will generally cost less than a comparable audit because its scope and procedures are narrower.

Actual fees depend on factors including organization size, complexity, accounting quality, financial statement preparation, timing, and readiness.

Can our CPA prepare the financial statements and also perform the audit or review?

In many circumstances, a CPA firm can assist with financial statement preparation while also performing an audit or review, provided applicable independence requirements and professional standards are satisfied.

The specific facts and services involved should be evaluated as part of engagement acceptance and independence considerations.

The Bottom Line

An audit and a review both add independent CPA involvement to a nonprofit's financial reporting—but they solve different needs.

An audit provides reasonable assurance and an opinion on the financial statements.

A review provides limited assurance based primarily on inquiry and analytical procedures.

If an audit is required by law, federal funding, a grant agreement, lender, contract, or governance requirement, a review generally cannot take its place.

If an audit is not required, a review can be an effective option for organizations that want greater credibility and independent assurance without the scope and cost of a full financial statement audit.

For nonprofit boards, the best decision starts by answering three questions:

What are we required to obtain?

Who relies on our financial statements?

What level of assurance do they need?

Only then should cost enter the conversation.

How Bilotta & Company Can Help

Bilotta & Company, CPAs, LLC provides financial statement audits, reviews, Single Audits, tax compliance, and financial advisory services for nonprofit organizations.

We help nonprofit boards and leadership teams determine the appropriate financial reporting path based on the organization's regulatory requirements, funding environment, stakeholder expectations, and stage of growth.

And when the challenge extends beyond the annual financial statement engagement, our Nonprofit Navigator® Financial Stewardship program provides ongoing accounting, controllership, forecasting, board reporting, compliance coordination, and fractional financial leadership.

The objective is not simply to produce a report once a year.

It is to build financial information and systems that support accountability, better decisions, and the organization's mission throughout the year.

Explore Nonprofit Audit & Assurance Services →

Explore Nonprofit Navigator® →

Visit the Nonprofit Financial Resource Center →

This article is provided for general educational purposes and should not be considered accounting, tax, or legal advice for a specific organization. Audit and financial reporting requirements vary based on an organization's facts, regulatory status, funding agreements, contracts, and other circumstances.