Businesses going through a first audit usually expect to be tested on accuracy. They are, but that is rarely where the difficulty lands. Auditors are testing something subtly different: whether your records can demonstrate that a number is right, independently of anyone explaining it.
That distinction is the whole problem. A controller who knows the business can tell you exactly why a figure is what it is. An audit does not accept that as evidence. It wants the system to show the transaction, when it was entered, by whom, what supported it, and whether it could have been altered afterwards without a trace.
Entry-level accounting software is built for producing accurate books, not for proving them to a skeptical third party. That is the gap, and it is why first audits so often cost more and take longer than the quoted fee suggested.
What auditors actually test
Whether entries can be traced end to end. Pick a number in the financial statements, drill to the transactions behind it, then to the source documents behind those. If any step in that chain requires someone to open a spreadsheet or search an inbox, that is a finding.
Whether the records could have been changed. Auditors care about who can edit a posted transaction and whether the system records it when they do. Systems that allow a closed period to be reopened, or a posted entry to be edited without a permanent log, get treated as inherently less reliable, which usually means more testing and a bigger bill.
Whether duties are actually separated. If the same person can create a vendor, approve a bill and release the payment, that is a control weakness regardless of how trustworthy that person is. In small finance teams this is partly unavoidable, but the system is supposed to provide compensating controls, and many entry-level systems cannot.
Whether revenue lands in the right period. Cutoff testing around period end is standard, and it is where businesses with manual invoicing processes most often have issues. If revenue recognition involves a spreadsheet, expect scrutiny.
Whether your estimates are supported. Reserves, allowances, accruals and useful lives all require documented reasoning, not just a number that has been carried forward because it was there last year.
Why first audits run over
Audit fees are quoted against an assumed level of readiness. When the records cannot support efficient testing, the work expands and the fee follows. The two most common causes are both systems issues rather than accounting ones.
The first is volume of manual adjustment. A high number of journal entries at period end, especially round-number or unexplained ones, signals to an auditor that the underlying process is not producing correct numbers on its own. Every one of those entries becomes something to test.
The second is documentation that lives outside the system. Approvals in email threads. Support in a shared drive organized by whoever filed it. Reconciliations in spreadsheets on someone's laptop. None of that is wrong, but retrieving it takes time, and audit time is billed.
The part that surprises people: it repeats
The first audit is usually treated as a project. Get through it, then go back to normal. That works once. It does not work in year two, because the audit becomes annual and the effort does not decline if nothing structural changed.
Worse, year two typically comes with prior-year findings that were noted but not remediated. Auditors follow up on those. A control weakness identified once and left in place tends to attract more testing the second time, not less.
This is the argument for treating a first audit as a systems trigger rather than a one-time compliance exercise. The work of pulling support, reconstructing approvals and documenting estimates is either something you do once by fixing where records live, or something you repeat every year.
What to do before the fieldwork starts
If your audit is already scheduled, there is a sensible order of operations that does not require replacing anything yet.
- Close the period properly and lock it, so balances do not shift underneath the audit while it is in progress
- Reconcile every balance sheet account and keep the working papers somewhere the auditor can be pointed at directly
- Gather approval evidence for significant transactions now rather than retrieving it from inboxes under time pressure
- Write down the reasoning behind every estimate and accrual while the person who made the judgment still remembers it
- List the journal entries made at period end and be ready to explain each one
Doing this will get you through the audit. It will not stop the same work being required next year, which is the decision worth thinking about separately once fieldwork is over.
What an audit exposes that daily operations never did
These gaps are invisible while the only people reading your books are the people who keep them. An audit is the first time they are tested by someone with no context.
An audit trail that does not go far enough
Most systems log something. The question is whether the log survives an edit, covers deletions as well as changes, and captures who approved a transaction rather than only who entered it. Entry-level systems commonly allow a posted entry to be modified with limited permanent record, which auditors treat as a reason to expand testing rather than rely on the system.
Periods that can be reopened after close
If a closed month can be reopened and a prior-period entry posted without a strong control around it, then every balance you reported is provisionally true. Auditors test for this directly, and a system that permits it quietly undermines the reliability of everything built on top of those numbers.
Supporting documents scattered outside the system
Approvals in email, contracts in a shared drive, reconciliations in spreadsheets on individual machines. Each item is retrievable, which is why it never felt like a problem. Retrieving several hundred of them inside an audit window is a different exercise, and it is billed at audit rates.
Revenue recognition handled in a spreadsheet
If recognition schedules, deferrals or multi-element arrangements are calculated outside the accounting system and posted as summary entries, the calculation itself becomes an audit target. The entry in the ledger proves only that somebody posted a number, not that the number was derived correctly.
Questions we hear most often
What does a first audit actually cost?
Fees vary widely by size, complexity and region, so any single figure would be misleading. What is predictable is the direction: the quote assumes a level of readiness, and the final bill reflects the actual state of your records. Businesses whose support lives in email and spreadsheets routinely exceed the initial estimate, because retrieval and additional testing are billed hours.
How long should we allow before the audit starts?
Give yourself at least a full quarter if this is your first one. Reconciling every balance sheet account, gathering approval evidence and documenting estimates takes longer than teams expect, and doing it while also running a normal close is the part that gets underestimated. Starting a month out means doing it under pressure.
Do we need to replace our accounting system before an audit?
No, and doing so immediately before fieldwork is usually a bad idea, since a migration in the audit period creates its own complications. The realistic sequence is to get through the first audit with the system you have, take the findings seriously, and treat them as the specification for what to fix afterwards.
What is the difference between a review and a full audit?
A review provides limited assurance and involves substantially less testing, which is why it costs less. An audit provides reasonable assurance and tests controls and evidence in depth. Lenders and investors increasingly specify which one they require, so confirm what is actually being asked for before scoping the work, because the readiness demands differ significantly.
We passed the audit but got a management letter. How seriously should we take it?
Seriously, because auditors follow up the next year. A control weakness noted once and left unaddressed tends to draw more testing in year two rather than less, and repeated findings are visible to the lender or investor who asked for the audit in the first place. The letter is effectively a prioritized list of what to fix before the next cycle.
Related problems
- Departments disagree on the numbersWhen two systems define the same metric differently, meetings stall.
- Consolidating multiple entitiesWhy group reporting slows down as entities are added, and what fixes it.
- Why your month-end close keeps getting longerThe complete breakdown of what stretches a close and what shortens it.
- Running your business on spreadsheetsWhere spreadsheets break as a business grows and what it costs when they do.
Get a clear picture of where your gaps actually are
The free ERP Readiness Scorecard covers reporting, inventory, purchasing, multi-entity complexity, and more. Get a score based on your specific situation in under 5 minutes.
No sales pitch. No vendor push. Just a clear picture of where your systems stand.