How a statutory audit works

A statutory audit runs in a set order: the auditor is appointed and agrees terms, plans the work around the risks of material misstatement, tests the figures and controls, evaluates the errors found, obtains written representations and then signs a report on whether the accounts give a true and fair view. The Companies Act 2006 sets the legal framework and the FRC’s International Standards on Auditing (UK) set out how each stage must be done. The client’s job is to produce complete records, draft accounts and explanations on time.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Who needs a statutory audit and who appoints the auditor?

A company needs an audit unless it qualifies for an exemption. Most small private companies are exempt, and the conditions are covered in our guide to audit exemption for small companies. Even an exempt company can be pushed into an audit: under section 476 of the Companies Act 2006, members holding at least 10% in nominal value of the issued share capital (or of any class of it) can require one by notice, given no earlier than the start of the financial year and no later than one month before its end.

Section 485 says a private company must appoint an auditor for each financial year unless the directors reasonably resolve that audited accounts are unlikely to be required. Apart from the first year, the appointment is made within the “period for appointing auditors”, which is 28 days beginning with the end of the time allowed for sending out the previous year’s accounts, or the day they were actually sent out if earlier. The directors can appoint the first auditor, fill a casual vacancy or appoint after a period of exemption; otherwise the members appoint by ordinary resolution. Under section 487 an existing auditor is usually deemed to be reappointed if nobody is appointed, unless one of the listed exceptions applies, such as the auditor having been appointed by the directors.

What happens before the audit work starts?

ISA (UK) 210 requires the auditor to establish that the preconditions for an audit are present. That means checking that the financial reporting framework is acceptable and getting management to acknowledge its responsibility for preparing the accounts, for the internal control needed to prevent material misstatement, and for giving the auditor access to all relevant information, any additional information requested and unrestricted access to people in the business.

The agreed terms go into an engagement letter. Paragraph 10 of ISA (UK) 210 requires it to cover, among other things, the objective and scope of the audit, the auditor’s responsibilities and management’s responsibilities. Read it properly: it is the document that later shows who promised to do what.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

How does the auditor plan the audit?

ISA (UK) 300 requires an overall audit strategy setting the scope, timing and direction of the work, and a detailed audit plan describing the risk assessment procedures and the further procedures to be performed. The engagement partner must review both, and they are updated as the audit progresses.

Risk assessment is governed by ISA (UK) 315 (Revised July 2020), which deals with identifying and assessing the risks of material misstatement. In practice the auditor learns how the business makes money, how its systems record transactions and where the figures depend on judgement, such as stock valuation, revenue cut off or provisions.

The auditor also sets materiality under ISA (UK) 320. The standard describes applying a percentage to a benchmark as a starting point, and gives as an example that five percent of profit before tax from continuing operations may be appropriate for a profit oriented manufacturing entity, while one percent of revenue or expenses may suit a not for profit entity. A lower “performance materiality” is then set to reduce the risk that uncorrected and undetected errors add up to more than overall materiality.

What does the auditor actually test?

ISA (UK) 330 requires the auditor to design further audit procedures that respond to the assessed risks. These are a mix of tests of controls, where the auditor relies on the client’s systems, and substantive procedures, which test the figures directly. Paragraph 18 says that, whatever the assessed risks, substantive procedures must be performed for each material class of transactions, account balance and disclosure, and paragraph 19 requires the auditor to consider external confirmations, such as letters to banks or customers.

If stock is material, ISA (UK) 501 requires the auditor to attend the physical stock count unless that is impracticable, to evaluate the count instructions, observe the count, inspect the stock and perform test counts. Clients who forget to tell the auditor the count date create a real problem, which is explained in our page on types of audit opinion.

The auditor has legal backing. Section 499 gives a right of access at all times to the company’s books, accounts and vouchers, and lets the auditor require information and explanations from officers and employees. Section 501 makes it an offence to knowingly or recklessly give the auditor a statement that is misleading, false or deceptive in a material particular, punishable on indictment by up to two years’ imprisonment, a fine or both.

What does the client need to provide?

A well run audit depends on the client. The usual list includes:

a trial balance and draft accounts, with the accounting policies used;
bank, sales ledger, purchase ledger and VAT reconciliations agreed to the ledgers (see our guide to bank reconciliations);
a fixed asset register, stock count sheets and the basis of stock valuation;
loan agreements, leases, significant contracts and board minutes;
schedules supporting accruals, prepayments, provisions and related party transactions;
cash flow forecasts supporting the going concern assessment, because ISA (UK) 570 requires the auditor to ask management to extend any assessment covering less than twelve months from the date the accounts are approved;
access to the staff who can explain the numbers.

Good source documents and an audit trail are what allow the auditor to trace a figure back to an invoice, contract or bank statement.

What happens to the errors the auditor finds?

ISA (UK) 450 requires the auditor to accumulate misstatements found during the audit, other than those that are clearly trivial, to communicate them to the appropriate level of management on a timely basis and to ask management to correct them. If management refuses to correct some or all of them, the auditor must understand why and take that into account when deciding whether the accounts as a whole are free from material misstatement. Uncorrected errors that are material are the most common route to a modified opinion.

How is the audit completed and signed?

Near the end, the auditor requests written representations from management under ISA (UK) 580. Paragraph 14 says they must be dated as near as practicable to, but not after, the date of the auditor’s report. The directors then approve the accounts, as described in our guide to approving and signing company accounts.

Paragraph 49 of ISA (UK) 700 says the report cannot be dated before the auditor has sufficient appropriate evidence, including evidence that all the statements and disclosures have been prepared and that those with authority have taken responsibility for them. Under section 503 the report must state the auditor’s name and be signed and dated; where the auditor is a firm, the senior statutory auditor signs in their own name on behalf of the firm.

What does the audit report say and when is it filed?

Section 495 requires the report to state clearly whether, in the auditor’s opinion, the accounts give a true and fair view, have been properly prepared under the relevant financial reporting framework and comply with the Act. The meaning of the first test is explained in our guide to the true and fair view. Section 498 adds points that are reported only by exception, for example where adequate accounting records have not been kept or the auditor did not get all the information and explanations needed.

The audited accounts then go to members and to Companies House. Section 442 gives a private company nine months, and a public company six months, after the end of the accounting reference period to file, subject to special rules for first periods and shortened periods.

What are the common mistakes that slow an audit down?

Not appointing the auditor in time to attend the stock count.
Sending draft accounts that do not agree to the trial balance.
Leaving reconciliations, accruals and loan schedules to be prepared during fieldwork.
Producing going concern forecasts only when the auditor asks, rather than with the draft accounts.
Treating the representation letter as a formality; it is a signed statement by management about the accounts.

Illustration only. A company with a 31 March year end appoints its auditor in January, books a stock count for 31 March, sends draft accounts and schedules in June, has fieldwork in July, clears adjustments in August and approves the accounts with a signed report in September, well inside the nine month filing window to 31 December.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.