By GreenGrowth CPAs Audit & Assurance Team · Updated October 2026 · Audit & Assurance
The audit vs assurance question has a simple answer. Assurance is the broad category of independent work that makes information more reliable, and an audit is the most rigorous type of assurance. Every audit is an assurance engagement, but many assurance engagements are not audits.
The confusion is understandable. Lenders ask for "reviewed" statements, and customers ask for a SOC 2 report. Each request sits on the same assurance ladder. Knowing where helps you avoid paying for more than you need.
This guide walks through each rung and what drives its cost.
QUICK ANSWER
Assurance is any independent engagement that raises the reliability of information for the people who rely on it. An audit is the highest level of assurance for financial statements. It ends in an opinion backed by reasonable assurance. A review gives limited assurance. A compilation gives none. Attestation engagements, such as SOC reports, apply the same assurance levels to subjects other than financial statements.
Audit vs Assurance: At a Glance
- Assurance is the umbrella: Audits, reviews, and attestation examinations all fall under it.
- An audit is one type: It is the most thorough assurance engagement on financial statements and ends in a formal opinion.
- Levels differ: Audits and examinations give reasonable assurance. Reviews give limited assurance. Compilations and agreed-upon procedures give none.
- Who decides: Usually the reader of the report. That means lenders, investors, regulators, customers, or the SEC.
- Our role: We match the engagement to the requirement, then deliver it. Talk to our audit team →
Audit vs Assurance Quick Definition
Assurance is the outcome. An independent professional gathers evidence and reports on whether information meets a set of criteria. Decision makers then rely on that information with more confidence. The AICPA's Special Committee on Assurance Services described these as independent professional services that improve the quality of information, or its context, for decision makers.
An audit is the deepest form of that service applied to financial statements. The auditor tests the numbers, evaluates controls, and gives an opinion on fair presentation under a framework such as US GAAP. In short, an audit is assurance, but assurance is not always an audit.
What Is an Audit?
The Financial Statement Audit
A financial statement audit gives reasonable assurance that the statements are free of material misstatement. AICPA standards describe reasonable assurance as a high, but not absolute, level of assurance. Auditors test samples, so no audit can promise to catch everything.
The auditor confirms balances with third parties, observes inventory, tests transactions, and evaluates estimates. The work ends in a written opinion. AICPA standards, often called GAAS, govern private company audits. PCAOB standards govern public company audits. Our guide to audit and accounting standards explains how those rule sets relate.
What Is Not a Financial Statement Audit
People also say "audit" for IRS and state examinations. Those check your tax or regulatory compliance for the government. They are enforcement, not assurance for outside users.
What Is Assurance?
The Three Parties and the Criteria
Every assurance engagement has the same basic shape. Management is usually the responsible party. An independent practitioner does the work. Intended users, such as a bank, rely on the report. The practitioner measures a subject matter against suitable criteria, such as US GAAP or the AICPA Trust Services Criteria.
Reasonable vs Limited Assurance
Reasonable assurance comes from audits and examinations, and the report gives a positive opinion. Limited assurance comes from reviews. A review relies mainly on inquiry and analytical procedures. The accountant then states whether they are aware of any material modifications needed.
Assurance Does Not Require an Outside Firm
Many people assume only outside CPA firms provide assurance. The Institute of Internal Auditors defines internal auditing as an independent, objective assurance and consulting activity. Internal audit teams give assurance to management and the board on risk, controls, and governance. External CPAs give assurance to outside users such as lenders and investors.
Audit vs Assurance vs Attestation
Attestation is the CPA term for assurance engagements under the AICPA attestation standards (the AT-C sections). They cover subjects other than historical financial statements. A SOC 2 report on security controls is an attestation examination. So is a report on a compliance assertion. Our guide to SOC 1, SOC 2, and SOC 3 reports covers the most common example.
Attestation follows the same ladder as financial statement work. An examination gives reasonable assurance, like an audit. A review gives limited assurance. Agreed-upon procedures give no assurance at all. The CPA performs the steps you specify and reports findings, without an opinion or conclusion.
Side-by-Side: Level of Assurance by Service
▶ Audit vs Review vs Compilation vs Attestation
| Service | Standard (US) | Level of assurance | Typical use | Who usually requires it |
|---|---|---|---|---|
| Financial statement audit | AICPA GAAS (AU-C) for private entities; PCAOB AS for public companies | Reasonable assurance; opinion | Annual statements for investors, lenders, and regulators | SEC for public companies; lenders, investors, bonding companies, federal grant rules |
| Review | SSARS AR-C 90 (private); PCAOB AS 4105 for public quarterly reviews | Limited assurance; conclusion | Bank covenants, smaller credit lines, quarterly filings | Lenders and sureties; SEC for 10-Q interim reviews |
| Compilation | SSARS AR-C 80 | No assurance; compilation report | Presenting management's numbers in proper statement form | Some lenders and landlords, or internal use |
| Preparation | SSARS AR-C 70 | No assurance; no report | Bookkeeping-level statement preparation | Management only |
| Attestation examination | SSAE AT-C 205 (SOC 2), AT-C 320 (SOC 1) | Reasonable assurance; opinion | Controls, compliance, or other non-financial subjects | Customers, vendors, and regulators |
| Agreed-upon procedures | SSAE AT-C 215 | No assurance; findings only | Testing specific items, such as royalties or grant terms | Contract parties, franchisors, agencies |
| Internal audit | IIA Global Internal Audit Standards | Assurance to management and the board | Risk, controls, and governance reviews | Boards, audit committees, management |
💬 The Conversation Worth Having
Owners often ask for "an audit" when the reader would accept less. Before you sign an engagement letter, get the lender's or investor's requirement in writing. If a review satisfies the covenant, you save time and fees. If an audit is coming later anyway, starting now avoids a first-year scramble.
When You Need Each
The report reader usually decides the level. Here are the common triggers.
Audit: Public companies file audited statements with the SEC, and their audits follow PCAOB standards. Private companies often need audits for equity investors, larger loans, an acquisition, or a planned IPO. Nonprofits and governments that spend $1,000,000 or more in federal awards in a fiscal year beginning on or after October 1, 2024 need a Single Audit.
Review: Lenders often accept reviewed statements for mid-sized credit lines. A review costs less than an audit and still gives the bank an independent conclusion.
Compilation: Use one when a reader wants statements prepared by a CPA but does not need assurance. It is common for smaller loans and internal reporting.
Attestation: SaaS providers, payroll processors, and other service companies need SOC reports when customers rely on their controls. Contract parties may ask for agreed-upon procedures on specific items.
Our audit preparation guide shows what each level asks of your team.
Not sure whether you need an audit, a review, or a SOC report? We will read the requirement with you.
Ask Our Team →Cost Comparison
Fees vary too widely to quote a reliable range, but the order is consistent. An audit costs more than a review, and a review costs more than a compilation. The difference comes from the work required. An audit needs confirmations, testing, and control evaluation. A review relies mainly on inquiry and analytics.
These factors move the price most:
- Size and complexity: More entities, locations, revenue streams, and estimates mean more testing.
- Quality of your close: Clean reconciliations and a ready schedule list cut hours sharply.
- Inventory: Physical counts and costing tests add fieldwork.
- First year vs recurring: A first audit must also test opening balances.
- Framework: PCAOB audits add steps such as an engagement quality review, and larger filers generally also need an audit of internal control.
For a public company or a company heading toward an IPO, see our public company audit services.
Cannabis MSO Audit vs Assurance
Multi-state cannabis operators climb the same ladder. Investors and lenders usually expect audits, and SEC registrants need PCAOB audits. Federal tax status matters too. State-licensed medical marijuana moved to Schedule III effective April 28, 2026. Adult-use cannabis remains Schedule I, so Section 280E still applies to it. Auditors will test how an MSO handles that split. Learn more on our cannabis industry page.
KEY TAKEAWAYS
- ›Assurance is the category. An audit is its most rigorous form for financial statements.
- ›Audits and examinations give reasonable assurance. Reviews give limited assurance. Compilations and agreed-upon procedures give none.
- ›Attestation covers other subjects, such as SOC reports on controls.
- ›Let the reader of the report set the level, and confirm it in writing before you engage a firm.
Frequently Asked Questions
The basics
Assurance is the broad category, and an audit is one type within it. Assurance covers any independent engagement that makes information more reliable for the people who use it. An audit is the most rigorous assurance engagement on financial statements.
It ends in an opinion backed by reasonable assurance. Other assurance services include reviews, which give limited assurance, and attestation examinations such as SOC 2 reports. Every audit is assurance, but not every assurance engagement is an audit.
In accounting, assurance means an independent professional evaluates information against set criteria and reports on it. Users gain confidence in that information as a result. The work can cover financial statements, internal controls, compliance, or other subjects.
The level varies. Audits and examinations provide reasonable assurance, a high but not absolute level. Reviews provide limited assurance. Compilations and agreed-upon procedures provide no assurance. CPA firms perform most external assurance, while internal audit teams provide assurance inside the organization.
Audit and assurance is the name many CPA firms give to their practice that checks information for outside users. It includes financial statement audits, reviews, and attestation work such as SOC reports and agreed-upon procedures. Some firms shorten it to "Assurance."
The practice exists so lenders, investors, regulators, and customers can rely on a company's numbers and controls. It is separate from tax and advisory work. Independence rules apply, so the firm must stay objective about the client it reports on.
Choosing a service
Assurance is the umbrella term for independent engagements that raise confidence in information. An audit is the assurance engagement for historical financial statements. Attestation is the CPA term for assurance engagements under the AICPA attestation standards.
Those engagements usually cover other subjects, such as controls in a SOC 2 report or compliance with a contract. Attestation comes in three forms. Examinations give reasonable assurance, reviews give limited assurance, and agreed-upon procedures report findings without any assurance.
You need an audit when the reader requires one. Common examples include the SEC for public companies, outside equity investors, and larger loans. A planned IPO or sale often calls for one too, as do federal grant rules.
A review is often enough for a bank credit line or a surety bond. It gives limited assurance at a lower fee. Always check the loan agreement or investor terms first. If you expect to need an audit within a year or two, starting early can make the transition easier.
An audit costs more than a review, and a review costs more than a compilation. The gap reflects the work. Audits require confirmations, detailed testing, and control evaluation, while reviews rely mainly on inquiry and analytics.
Exact fees depend on your size, complexity, inventory, number of entities, and how clean your books are at year end. A first-year audit costs more because opening balances also need testing. PCAOB audits of public companies add extra required steps. Ask any firm for a written scope and fee estimate.
Where to Go From Here
Get the Right Level of Assurance, Not the Most Expensive One
Lender, investor, or customer: we scope the engagement to what your reader actually requires.
KEY FACTS
Audit, Review, or Attestation? Start With the Right Question.
Book a free consultation with our audit and assurance team. We will review what your lender, investors, or customers require and recommend the right engagement.
Book Your Free Consultation →GreenGrowth CPAs · Audit & Assurance Team
Get more GreenGrowth CPAs insights in Google Search and AI Mode.
