Many investors don’t fully understand the intricacies of auditor reporting. For instance, what is a Critical Audit Matter and how does it differ from an internal control weakness? This post will answer all your audit-report related questions.
Where to find an audit report?
In an annual report (aka Form 10-K), you will find the audit report under Item 8, “Financial Statements and Supplementary Data.” The audit report usually precedes the financial statements but occasionally appears elsewhere.
For example, in Apple’s Form 10-K for the year ended September 24, 2022, the audit report appears after the Notes to the Consolidated Financial Statements. Take a look at our post, “How to become an EDGAR power user”, for instructions on how to find a 10-K annual report.
The four different types of audit opinions
Unqualified (clean) audit opinion = good
Qualified audit opinion = not good
Adverse audit opinion = bad
Disclaimer of opinion = not good
Let’s look at each one because they all tell a different story.
Unqualified audit opinion
Also known as “a clean opinion,” an unqualified audit opinion means that the audit firm believes the company’s financial statements are fairly presented and free from material misstatements. This is a good thing.
Qualified audit opinion
A qualified audit opinion states that the audit firm believes the company’s financial statements are fairly presented and free from material misstatement except for the effect of the substance of the qualification. There are two main reasons why an auditor might issue a qualified opinion:
Scope limitation: A scope limitation exists when the audit is restricted in some way. It may be due to the client or by circumstances, such as the timing of the auditor's work, the inability to obtain adequate audit evidence, or insufficient accounting records.
The financial statements depart from GAAP: A material deviation from generally accepted accounting principles may be quantitative or qualitative in nature. For example, a qualified opinion may be warranted if:
A company uses a non-GAAP approach that creates a large, measurable, material difference in some aspect of the financial statements, or
A non-GAAP approach is used on a critical item for a particular company—say, the valuation of investments for a mutual fund.
When a qualified opinion is expressed, a separate paragraph(s) is included in the audit report to explain the nature of the scope limitation or the departure from GAAP.
One particularly notable qualification to an audit report is a “going concern paragraph.” This paragraph is added when there is substantial doubt about the company’s survival over the next year. Bedrock AI is the only service that provides real-time, fully automated information about going concern issues.
Adverse audit opinion
An auditor expresses an adverse opinion when they do not believe the financial statements are fairly presented in accordance with GAAP. In other words, something has caused the auditor to believe that users cannot rely on the financial statements. When expressing an adverse opinion, the audit report will include a paragraph following the opinion paragraph explaining the reasons for the adverse opinion, and the impact that the substance of that opinion has on the financial statements. Adverse opinions on financial statements are very rare.
Disclaimer of opinion
A disclaimer of opinion occurs when an auditor does not express an opinion on the financial statements. An auditor may decide not to express an opinion because they cannot form an opinion on whether the financial statements are fairly presented in conformity with GAAP. For instance, if the business reported owning forests in the Amazon that were inaccessible to the auditor, the auditor may be forced to disclaim their opinion.
When disclaiming an opinion on the financial statements, the audit report should include a paragraph(s) explaining the reasons for declining to express an opinion.
Investors, be on the lookout for these risks and red flags found in an audit report
Users of an audit report should always read it along with the accompanying financial statements and notes to the financial statements. Merely reading the audit report alone will be insufficient to understand a company’s financial position, performance, and cash flows.
With that said, here are some things that readers should make note of in each type of audit report:
Critical Audit Matter (CAM)
As of recently, CAMs are present in all audit reports, regardless of the auditor’s overall opinion on the financial statements. As noted above, CAMs relate to accounts or disclosures that are (1) material to the financial statements and (2) involve especially challenging, subjective, or complex auditor judgment. The fact that an auditor highlighted these could warrant a closer look. We discuss how best to use CAMs as part of your investment process here.
Going concern paragraph
Users should always take note whenever an explanatory going concern paragraph is part of the audit report as this is a serious risk factor which indicates potential bankruptcy risk.
Under normal circumstances, it is the assumption that a company will continue as a going concern. In other words, it is assumed that the company will continue its operations for the foreseeable future.
As part of conducting an audit, an auditor must consider whether there’s any doubt about a company’s ability to continue as a going concern. If an auditor performs its evaluation and determines that there is substantial doubt that the company will continue as a going concern, then the auditor must include an explanatory paragraph describing this uncertainty. Even if the audit report contains an unqualified opinion, there still may be substantial doubt about its ability to continue as a going concern.
Hudson Labs provides real-time information on going concern issues at U.S. companies. Sign up for a trial today.
Whether or not the auditor provides an opinion on internal controls over financial reporting
As we discuss below, not all companies receive an audit on their internal controls over financial reporting (ICOFR). In the U.S., only larger more established companies are required to get an audit over their internal controls. With such an audit, stakeholders can have a much higher degree of confidence in the processes that ensure accurate reporting. Adverse internal control opinions are also a way for auditors to communicate issues they identified before the financial statements went out the door. When these audits don’t exist, it's harder for stakeholders to trust in the transparency and quality of earnings.
An adverse opinion on internal controls over financial reporting
An adverse opinion on internal controls increases the risk of downside events like price collapse, restatement and regulatory action. Learn more about internal control weaknesses here and in the section below.
Note that the auditor’s opinion on the financial statements is separate from their opinion on internal controls (which they may or may not give, depending on the situation). Adverse opinions on internal controls over financial reporting (ICOFR), while still relatively uncommon, do occur much more frequently and are less severe than if it were related to the financial statements more generally.
Other qualifications and scope limitations
As discussed above, an audit report will indicate any qualifiers or scope limitations. Look out for instances where recent acquirees or subsidiaries were excluded from the audit. When this is the case, there will be a major blind spot in an investor’s risk assessment.
The basics of an audit report
Every audit report contains “basic elements.” Let’s go through each.
First paragraph: "Opinion on the Financial Statements"
Yes, this first section includes the audit firm’s opinion on the company’s financial statements. Learn about the 4 different types of opinions above.
The report must also state:
The name of the company whose financial statements were audited;
The financial statements—balance sheet, income statement, etc.—that were audited;
The date or period covered by the financial statements (usually, but not always the most recent fiscal year);
A statement indicating that the financial statements, including the related notes and any related schedules, identified and collectively referred to in the report as the financial statements, were audited, and then, finally,
The auditor’s opinion on the financial statements.
The language of the auditor’s opinion is very precise and, provided that the opinion is clean, it will state:
The financial statements present fairly, in all material respects, the financial position of the company as of the balance sheet date and the results of its operations and its cash flows for the period then ended in conformity with [the applicable financial reporting framework].
For US-listed companies, the applicable financial reporting framework will usually read as “accounting principles generally accepted in the United States of America.” In colloquial terms, this is referred to as “Generally Accepted Accounting Principles,” or “GAAP.”
Second paragraph: "Basis for Opinion"
The second section of the audit report explains the circumstances of the auditor’s work, how the work is performed, the rules that govern the audit procedures performed, and more. For example, in this paragraph, the audit report explicitly states who is responsible for what. That is, the financial statements “are the responsibility of the company's management,” while the audit firm’s responsibility “is to express an opinion on the financial statements based on the audit.”
Third paragraph: Critical Audit Matters
For the third section of the audit report, it is the auditor’s responsibility to determine whether or not there are “critical audit matters” (CAM) for the current audit of financial statements. The Public Company Accounting Oversight Board (PCAOB) defines critical audit matters as:
any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the financial statements and (2) involves especially challenging, subjective, or complex auditor judgment.
A CAM is an aspect of financial reporting that requires a lot of judgment or is inherently complex. The disclosure of CAMs is a relatively new part of the audit report, as auditors were only required to include them starting in 2019.
CAMs are sometimes confused with material control weaknesses but are, in fact, very different. The word “critical” might confuse some readers. CAMs are not an indicator of a problem with the company’s processes or financial reporting, rather they are crucial areas of the audit. We invite you to learn more about CAMs in our blog post: What is a critical audit matter? We give an example below.
Auditor’s signature
The final part of the audit report that must be included is the signature of the audit firm, along with:
A statement that includes the year when the audit firm first started auditing the company.
The city and state where the audit report is being issued.
The date of the audit report.
What are internal controls over financial reporting (ICOFR)?
Internal controls over financial reporting (ICOFR) are policies, procedures, and systems a company uses to ensure the accuracy of its financial statements. ICOFR help prevent errors and fraud, but they cannot guarantee that errors or fraud will not occur. Some common examples of ICOFR include:
Segregation of duties—separating responsibilities among multiple people to prevent errors or fraud. For example, one staff member approves an invoice for payment while another processes the payment.
Reconciliations—the practice of agreeing two sources of financial information to a common balance. For example, ensuring that a company’s cash balance per its accounting records agrees with the balance at its bank after considering any differences due to the timing of transactions.
Physical controls—Securing tangible assets by restricting access to them. For example, locking inventory in a secure section of the warehouse after business hours.
Audit opinion on internal controls over financial reporting
The financial statements are the responsibility of a company’s management. Likewise, management is responsible for implementing and maintaining the company’s internal controls over financial reporting (ICOFR).
In some instances, a company may be required to obtain an audit of its ICOFR, in other instances an audit may not be required. In the U.S., ICOFR audits are required for larger, more mature public companies while new and/or small companies may be exempt.
An audit of ICOFR that is integrated with the audit of financial statements is commonly known as an “integrated audit.” In these engagements, the auditor’s objective is to express an opinion on the financial statements and the effectiveness of the company’s internal control over financial reporting. The auditor may issue one report containing both opinions or two separate reports.
Much like an audit of financial statements, an auditor must obtain appropriate evidence to form a basis for their opinion. When examining ICOFR, an auditor may encounter suboptimal practices, policies, or systems that may qualify as either a “significant deficiency” or a “material weakness.”
Auditing Standard No. 5 defines “material weakness” as:
a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis.
And Auditing Standard No. 5 defines a significant deficiency as:
a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.
As material weaknesses are the more serious of the two offenses, if one or more material weaknesses exist, the company’s internal controls cannot be considered effective. However, it’s important to note that material weaknesses in a company’s ICOFR can exist even when the financial statements are not materially misstated.
The integrated audit report will mention that the auditor has audited the company’s ICOFR and express an opinion in the opinion paragraph. Likewise, the “Basis of Opinion” section of the audit report will state what the auditor did to form the basis of their opinion. Finally, the third section of the integrated audit report is entitled "Definition and Limitations of Internal Control Over Financial Reporting," which includes the definition of ICOFR and a statement concerning the limitations of ICOFR and that they may not always detect or prevent a misstatement in the financial statements.
Conclusion
Understanding an audit report should be simple but in practice, many stakeholders assume there’s nothing to see and don’t bother reading it. While many reports are similar, tools like Hudson Labs can help you seek out pertinent details, and spot red flags, both big and small.