What your auditor is actually checking

For most Executive Directors, the audit is the least legible thing on the calendar. A team arrives, asks for forty invoices and the board minutes, disappears for three weeks, and returns with an opinion and a letter about things that could be better.

The requests feel arbitrary. They are not. Every one of them maps to something specific the auditor has to be able to say about your financial statements, and once you can see the mapping, the whole process gets easier to prepare for and much easier to sit through.

The auditor is not looking for mistakes

This is the most common misunderstanding, and it shapes everything else.

An audit is not an exhaustive review of your transactions. Your auditor is forming an opinion on whether the financial statements, taken as a whole, are fairly stated. That is a narrower job than most people assume, and a different one from catching every error.

It is also why an audit is not designed to find fraud, and why the engagement letter says so explicitly. A well-concealed scheme involving a few thousand dollars can pass an audit of a ten million dollar organization without the auditor having done anything wrong.

What they are actually testing

Behind every request is one of a handful of questions. In plain terms:

• Does this exist? The cash says four hundred thousand. Is the money there? Hence the bank confirmations sent directly to your bank rather than accepted from you.
• Is anything missing? Recorded liabilities are easy. Unrecorded ones are the risk, which is why they review payments you made after year end, looking for invoices that belonged in the prior year.
• Is it worth what you say? Pledges receivable at full value when some will never be collected. Donated goods valued optimistically.
• Is it yours, and are there strings? Grant money in the bank may be a liability rather than revenue, depending on the agreement.
• Is it described correctly? Mostly a nonprofit question, and mostly about net assets.

For nonprofits, revenue is where the attention goes

In a business, auditors worry about whether revenue was recorded too early. In a nonprofit, they worry about whether it was classified correctly, which is harder and more consequential.

Expect scrutiny of:

• Contributions with conditions. A grant with a barrier the organization has not yet met is not revenue yet, no matter that the cash arrived. Getting this wrong moves money between years and is one of the most frequent restatements.
• Net asset classification. With donor restriction, without donor restriction, and whether releases were recorded in the right period. This is why they want to read the actual grant agreements rather than your summary of them.
• Functional expense allocation. The statement of functional expenses requires splitting costs across program, management, and fundraising. Auditors will ask how you derived the percentages and whether the method is applied consistently.
• Contributed services and in-kind. Recognized only under specific conditions, which organizations routinely apply too loosely.

Why they ask for the board minutes

This one puzzles people more than any other request, and the reason is straightforward. The auditor is looking for things that should be reflected in the financial statements and might not be anywhere else: a new lease, a line of credit, a legal matter, a change in a reserve policy, a commitment made verbally and recorded only in minutes.

They are not reviewing your governance. They are checking whether anything financially significant was decided that never made it into the accounting.

Why forty invoices and not all of them

Testing everything would cost more than the information is worth. So auditors sample, and the sample size comes from their assessment of risk in that area rather than from a fixed rule.

The useful implication: strong internal controls reduce the sample. When an auditor can rely on your approval process, they test fewer transactions. When they cannot, they compensate by testing more, and the fee reflects it. Control weaknesses cost money directly, not just in the abstract.

What a management letter comment actually means

A management letter comment is not a finding against you, and it is not a failed audit. It is the auditor telling you about a weakness they are required to communicate.

What matters is the repeat. One comment is an observation. The same comment three years running tells the board, and any funder who reads the audited statements, that nobody owned fixing it. That inference is usually correct, and it is the one worth preventing.

And why they cannot just fix it

Auditors find a misallocated expense or a reconciliation that does not tie, and the obvious question is why they do not correct it.

They cannot. An auditor who prepares the accounting then audits it is auditing their own work, and independence is the entire basis of the opinion’s value. They can tell you what is wrong. Someone else has to put it right.

That gap, between identifying a problem once a year and having someone responsible for addressing it, is where most repeat findings live.