When Does a Startup Need Reviewed or Audited Financial Statements? Triggers, Rules, and Readiness
How AICPA service levels, investor and lender terms, SBA 8(a) rules, and SEC crowdfunding and Regulation A tiers decide which CPA report a founder needs, and what to fix before the engagement starts.
Most startups do not need a CPA report on their financial statements until someone with leverage asks for one: a lead investor, a bank, a federal program, an acquirer, or a securities rule. When that request arrives, the deadline usually belongs to someone else, and the gap between founder-grade books and statements a CPA can review or audit becomes the critical path.
This guide covers the common triggers, the accounting areas that slow a first engagement, and two questions founders rarely ask early enough: whether the CPA who handles the company's tax or books can issue the report, and whether that firm is enrolled in peer review. For the basics, see audit vs. review vs. compilation and which report a lender needs.
Bottom Line
A startup generally needs reviewed or audited financial statements because a contract, lender, federal program, or securities rule requires them; for a private company, size alone rarely creates the obligation. Under Regulation Crowdfunding, an offering above $124,000 requires at least reviewed statements and one above $618,000 generally requires an audit, with a first-time-issuer exception up to $1,235,000, all measured on the maximum accepted. A Regulation A Tier 2 offering requires an audit, and SBA's 8(a) program requires reviewed statements from participants with $7.5 million to $20 million of gross annual receipts and audited statements above $20 million. Reviews and audits both require an independent accountant, so line up the firm and the GAAP cleanup early.
1. Four Levels of CPA Involvement, Three Kinds of Reports
The Statements on Standards for Accounting and Review Services (SSARS) govern preparation, compilation, and review engagements in AR-C sections 70, 80, and 90. Private-company audits follow the AICPA's generally accepted auditing standards (GAAS); SEC registrants need PCAOB-standard audits.
| Service | Standard | Assurance | Independence required? | Typical founder use |
|---|---|---|---|---|
| Preparation | SSARS, AR-C 70 | None; each page states that no assurance is provided, or a disclaimer is issued | No | Internal reporting, board packages, some small credit lines |
| Compilation | SSARS, AR-C 80 | None; an accountant's report is issued | No, but a lack of independence must be disclosed in the report | Users that want an accountant's report without assurance; SBA 8(a) participants under $7.5 million |
| Review | SSARS, AR-C 90 | Limited, based primarily on inquiry and analytical procedures | Yes | Reg CF middle tier, mid-size SBA 8(a) participants, many bank facilities |
| Audit | AICPA GAAS or PCAOB standards | Reasonable: high, but not absolute | Yes | Reg CF upper tier, Reg A Tier 2, institutional investors, larger loans, acquirers |
A review is not a smaller audit. AR-C 90 states that a review does not contemplate obtaining an understanding of internal control, assessing fraud risk, or testing records through inspection, observation, or confirmation.
2. Triggers That Commonly Require a Review or an Audit
Equity investors and acquirers
Priced rounds usually come with information rights in an investor rights agreement or side letter. Read three terms: the report level, the delivery deadline after fiscal year-end, and whether an audit is automatic or only on request of the board or major investors. In an acquisition, a quality-of-earnings report does not replace audited statements that a purchase agreement requires, or that a public buyer may need to file for a significant acquired business under Rule 3-05 of Regulation S-X.
Banks and venture lenders
Loan agreements typically specify the report level, the deadline, and a compliance certificate. A missed reporting covenant can be a default even when every payment is current, so negotiate both terms before signing.
SBA's 8(a) Business Development program
For 8(a) participants, 13 CFR 124.602 sets the requirement by gross annual receipts: audited statements above $20 million, due within 120 days of fiscal year-end; reviewed statements from $7.5 million to $20 million, due within 90 days; and in-house or compiled statements, verified by an authorized officer, below $7.5 million. The rule has a first-year audit transition and good-cause waivers, and SBA may require reviewed or audited statements at any receipts level when it needs them.
Securities offerings
Regulation Crowdfunding allows up to $5,000,000 in 12 months (17 CFR 227.100), and 17 CFR 227.201(t) sets the financial statement tier.
| Amount offered, plus Reg CF sales in the prior 12 months | Minimum financial statements | If higher-level statements exist |
|---|---|---|
| $124,000 or less | Statements certified by the principal executive officer, plus total income, taxable income, and total tax from the federal return | Provide the reviewed or audited statements instead |
| More than $124,000, up to $618,000 | Reviewed by an independent public accountant | Provide the audited statements instead |
| More than $618,000, up to $1,235,000, first-time Reg CF issuer | Reviewed by an independent public accountant | Provide the audited statements instead |
| More than $618,000 (more than $1,235,000 for a first-time issuer) | Audited by an independent public accountant | Not applicable |
The tier is measured on the maximum the issuer will accept, not the target. Statements must follow U.S. GAAP and cover the two most recently completed fiscal years, or the period since inception if shorter; once more than 120 days have passed after year-end, the year just ended must be included. Under SEC staff guidance dated February 17, 2026 (Regulation Crowdfunding C&DI 201.03), an offering with a rolling closing that is still open past that point needs a Form C amendment with updated statements. A modified review report or a qualified, adverse, or disclaimed audit opinion does not comply, and the accountant may meet either SEC or AICPA independence standards. The annual report under 17 CFR 227.202 is due within 120 days of year-end and must include any reviewed or audited statements that exist. Securities Act Section 4A(h) requires inflation adjustments to these amounts at least every five years; the last took effect in September 2022, so confirm them before launch.
Under Regulation A, Tier 1 offerings (up to $20 million in 12 months) need not include audited statements, but an audit obtained for another purpose must be filed. Tier 2 offerings (up to $75 million) require audited statements under AICPA GAAS or PCAOB standards, with the accountant's qualifications governed by Article 2 of Regulation S-X; the firm need not be PCAOB-registered.
A private placement can carry similar requirements: if a Rule 506(b) offering sells to any non-accredited investor, Rule 502(b) calls for Form 1-A-style statements: Tier 1-style up to $20 million and audited Tier 2-style above that.
3. Independence When Your CPA Also Does Tax or Books
Reviews and audits require independence, and AR-C 90 requires withdrawal from a review if independence becomes impaired. A compilation does not, but the report must disclose the lack of independence.
Under the AICPA Code of Professional Conduct, nonattest services for an attest client do not impair independence when ET 1.295.040 is met: management assumes all management responsibilities, designates an individual with suitable skill, knowledge, and/or experience to oversee the service, evaluates the results, and accepts responsibility for them. The understanding must be documented in writing before the work begins (ET 1.295.050), and the cumulative effect of multiple services must be evaluated (ET 1.295.020).
- Bookkeeping (ET 1.295.120). A CPA may post client-approved entries and prepare statements from the client's trial balance. Independence is impaired if the CPA determines entries without approval, authorizes transactions, or prepares source documents.
- Tax services (ET 1.295.160). Return preparation generally fits within the same safeguards if the CPA has no custody or control of client funds and the client's designee approves the return and signs it where required.
- The designee. The individual need not be able to perform the work but must understand it well enough to oversee it, which can be hard in a five-person company.
The SEC standard is stricter. Rule 2-01(c)(4)(i) of Regulation S-X generally treats an accountant as not independent if it maintains or prepares the audit client's accounting records, prepares its SEC financial statements, or originates source data. That rule governs a Regulation A Tier 2 audit and any later SEC registration, and independence is tested across the audited periods; for a first registration statement, Rule 2-01(f)(5)(iii) limits the look-back to the last fiscal year before filing if earlier periods met the applicable independence standards. A company expecting to move to Reg A or an IPO should consider separating bookkeeping from the attest firm at least a fiscal year ahead.
4. Readiness: What a First Review or Audit Tests First
- GAAP basis. Reg CF, Reg A, and reviewed or audited 8(a) submissions require U.S. GAAP. Converting from cash or tax basis means booking accruals, deferred revenue, and prepaids.
- Revenue recognition (ASC 606). Contracts, performance obligations, standalone selling prices, and deferred revenue roll-forwards; see the ASC 606 guide for SaaS companies.
- SAFEs and convertible notes. Many SAFEs are classified as liabilities under ASC 480 because events outside the company's control can require cash settlement, and convertible notes need ASC 470-20 and ASC 815 analysis. Recording every instrument in equity by default can produce material adjustments.
- Equity and stock compensation (ASC 718). Reconcile the cap table to board consents, grant agreements, and 409A valuations, and measure expense at grant-date fair value.
- Inventory (ASC 330). When inventory is material, AU-C section 501 calls for the auditor to attend the physical count unless that is impracticable.
- Income taxes (ASC 740). Deferred taxes, valuation allowances, and domestic research expenditures under Section 174A, added by P.L. 119-21, belong in the provision; see R&D credit basics and Section 174A.
A first audit is easiest to scope before fiscal year-end, while counts can still be observed. Carry the fee and internal hours in the runway and tax cash calendar, because a late report can delay a closing, a loan draw, or a Reg CF launch.
5. Hypothetical Example: Sizing a Crowdfunding Raise Around the Audit Threshold
Hypothetical example: target versus maximum
A calendar-year company formed in 2024 has never sold securities under Regulation Crowdfunding. It plans a November 2026 offering with an $800,000 target and wants to accept oversubscriptions up to $1,500,000. Because the tier is measured on the maximum, the offering exceeds the $1,235,000 first-time ceiling and requires audited statements. Because more than 120 days have passed since December 31, 2025, they must cover 2025 and the 2024 period from inception.
If the company caps the maximum at $1,200,000 and has no existing audit, reviewed statements satisfy the rule. Assume, for illustration only, a $15,000 review fee and a $40,000 audit fee. The audit adds $25,000 of cost for $300,000 of extra capacity ($1,500,000 minus $1,200,000), about 8.3% of the added capacity, before platform fees. If the raise closes at $1,000,000, that $25,000 bought nothing. An offering with a rolling closing that stays open after April 30, 2027 would also need updated statements. These figures are assumptions, not quotes.
6. Check the Firm: Peer Review and Standing
AICPA members in public practice must practice with a firm enrolled in the AICPA Peer Review Program if the firm performs audits, SSARS reviews or compilations, or SSAE engagements and issues reports under AICPA standards; preparation-only firms need not enroll. Under PR-C section 100, a firm should enroll no later than the date it issues the report on its first in-scope engagement, its first peer review is generally due within 18 months after that report, and reviews then recur every three years. A firm whose highest level of service is an audit or SSAE examination receives a system review; one whose highest level is SSARS or other SSAE work receives an engagement review, which does not cover audits. State boards generally require peer review as well.
Before engaging a firm, ask for its most recent peer review report and acceptance letter, or evidence of enrollment if its first review is not yet due, and check its status in the AICPA's Peer Review Public File. For Reg CF, the accountant must be in good standing as a CPA, or entitled to practice as a public accountant, where the accountant resides or has a principal office.
Common Mistakes
- Treating a review as a cheaper audit. If a document says audited, a review will not satisfy it unless the counterparty agrees in writing.
- Sizing Reg CF on the target. The tier is measured on the maximum accepted, plus prior 12-month Reg CF sales.
- Assuming the bookkeeping firm can issue the report. AICPA safeguards may permit it; SEC independence rules generally will not.
- Ordering a higher-level report without a plan. Once reviewed or audited statements exist, Reg CF requires them to be provided, and a Reg A Tier 1 offering must file an existing audit.
Source-Backed Proof Notes
- 17 CFR 227.201(t) sets the Reg CF tiers, the maximum-amount rule, GAAP and 120-day rules, review and audit standards, and the independence test.
- SEC Form 1-A, Part F/S confirms Tier 1 statements need not be audited and Tier 2 audits follow GAAS or PCAOB standards under Article 2 of Regulation S-X.
- 13 CFR 124.602 sets the SBA 8(a) statement thresholds, deadlines, and waivers.
- 17 CFR 210.2-01 contains the SEC bookkeeping prohibition and the first-filing look-back.
- AICPA SSARS, AR-C sections support the preparation, compilation, and review requirements.
- AICPA Ethics and Code of Professional Conduct provides the nonattest services interpretations at ET 1.295.
- AICPA peer review standards support enrollment timing, the review cycle, and review types.
The Bottom Line
Investor rights agreements, loan covenants, SBA program rules, and SEC offering exemptions decide when a startup needs reviewed or audited statements. Read the requirement literally, size crowdfunding raises on the maximum rather than the target, convert to GAAP before the engagement starts, and confirm that the firm issuing the report is independent under the applicable standard and enrolled in peer review. Settled a quarter or two ahead, the report becomes routine instead of a closing risk.
Need to Pin Down a Reporting Requirement?
Schedule a consultation to review who will rely on your financial statements, what the agreement requires, and how to get the records ready.
This article provides general educational information about financial statement engagements and U.S. securities and SBA program requirements as of October 17, 2026. It is not legal, securities, or accounting advice; the example is hypothetical, and contract terms, offering documents, state accountancy rules, and current SEC and SBA requirements require review for specific facts.