If your company is preparing for an IPO, completing a de-SPAC transaction, or filing its first annual report, you will hear the term "SEC audit" constantly. The phrase is slightly misleading. The SEC does not audit your books. An independent auditor does, under rules of the SEC and the PCAOB set.

This guide explains what an SEC audit actually is, which requirements apply based on your company's size and status, how the process runs across a year, and what tends to go wrong for first-time public companies.

What Is an SEC Audit?

An SEC audit is an independent financial statement audit of a public company, performed by a PCAOB-registered public accounting firm under PCAOB auditing standards, so the company can meet SEC financial reporting requirements. The resulting audit report is filed with the SEC, most commonly in the annual report on Form 10-K or in a registration statement such as Form S-1, F-1 or S-4.

Three features separate an SEC audit from an ordinary audit:

1. The auditor must be registered with the PCAOB. Section 102 of the Sarbanes-Oxley Act of 2002 prohibits unregistered firms from preparing audit reports for issuers.

2. The audit follows PCAOB standards, not the AICPA standards used for most private company audits.

3. The auditor must meet SEC and PCAOB independence rules, which are stricter than the rules for private engagements.

The three things people mean by "SEC audit"

Much of the confusion around this term comes from it being used for three different activities:

This article focuses on the first meaning. It is worth knowing the second exists, though: Section 408 of Sarbanes-Oxley requires the SEC to review each reporting company's filings at least once every three years, and weak financial statement disclosures are a common source of comment letters.

Who Needs an SEC Audit?

Any company that files periodic reports with the SEC under the Securities Exchange Act of 1934 needs audited financial statements. That includes:

• Domestic companies listed on NYSE, Nasdaq or other exchanges

• Companies registering securities for an IPO

• SPACs and the private companies they acquire (the target's financial statements must be audited under PCAOB standards for the S-4 or proxy filing)

• Foreign private issuers filing Form 20-F

• Companies with registered debt or that crossed registration thresholds

A private company planning to go public often has years of AICPA-standard audits that cannot simply be reused. The historical periods included in the registration statement generally need to be audited (or re-audited) under PCAOB standards by a firm that meets SEC independence rules for those periods. For a deeper comparison of the two standards, see our guide on what a PCAOB audit is and how it differs from a private company audit.

SEC Audit Requirements by Filer Status

Your obligations depend heavily on filer status, which is largely determined by public float and revenue. This is where most generic explanations fall short.

A few practical implications follow from this table:

• Growing out of a category changes the audit. A company that becomes an accelerated filer must obtain an integrated audit of internal control over financial reporting. That roughly means a second opinion, more testing, and more documentation, often on a tighter deadline.

• Losing EGC status is a trigger event. EGC status ends at the earliest of several triggers, including five years after the IPO or crossing the revenue threshold. Companies that plan for this a year in advance avoid a scramble.

• Exemption from 404(b) is not exemption from controls. Management still has to assess and report on ICFR, and any material weakness must be disclosed.

Thresholds reflect SEC rules as last verified by the author; confirm current figures on SEC.gov before relying on them, as thresholds and reporting rules are periodically amended.

Core Rules That Shape an SEC Audit

PCAOB auditing standards

The PCAOB issues the standards that govern public company audits. Several matter directly to management:

• AS 2201 governs the integrated audit of ICFR alongside the financial statements.

• AS 3101 sets the form of the auditor's report, including critical audit matters (CAMs): areas involving especially challenging, subjective or complex auditor judgment that were communicated to the audit committee.

• AS 1215 governs audit documentation. The auditor must assemble a complete set of workpapers within 45 days after the report release date and retain them for seven years.

• AS 4105 covers the auditor's review of interim (quarterly) financial information.

The PCAOB also inspects registered firms: annually for firms that audit more than 100 issuers, and at least every three years for smaller firms.

SEC auditor independence rules

Independence is the rule set most likely to surprise a company new to the public markets. Rule 2-01 of Regulation S-X and PCAOB independence rules together require that the auditor be independent "in fact and in appearance." In practice that means:

• Prohibited non-audit services. Your auditor cannot perform bookkeeping, financial information system design, valuation services, internal audit outsourcing, management functions, legal services or several other services for you.

• Audit committee pre-approval. Every audit and permitted non-audit service must be pre-approved by the audit committee.

• Partner rotation. The lead and concurring audit partners must rotate off the engagement after five consecutive years.

• Financial and employment relationships. Certain investments, loans and hiring relationships between the company and audit personnel can impair independence.

Why this matters before an IPO: if your current accounting firm keeps your books or built your valuation models, it may not be able to audit periods included in your registration statement. Identifying that conflict early can save months.

The audit committee's role

Under Section 301 of Sarbanes-Oxley and Exchange Act Rule 10A-3, the audit committee of a listed company is directly responsible for appointing, compensating and overseeing the external auditor. The auditor reports to the audit committee, not to management. Expect regular private sessions between the two, and expect the auditor to communicate CAMs, significant deficiencies and material weaknesses directly to the committee.

The SEC Audit Process, Step by Step

An SEC audit is a year-round cycle rather than a single event. For a calendar-year company, a typical sequence looks like this:

Planning and risk assessment

The auditor identifies where material misstatement is most likely, sets materiality, and decides how much to rely on internal controls. Revenue recognition, complex financial instruments (such as SPAC warrants), business combinations, and impairment are frequent high-risk areas.

Internal control testing

For companies subject to 404(b), the auditor tests whether key controls are designed and operating effectively. For other companies, the auditor still evaluates controls relevant to the audit, and any deficiencies found will be communicated.

Substantive testing and audit evidence

The auditor gathers audit evidence through confirmations with banks and customers, recalculation, inspection of contracts, analytical procedures and detailed sampling. Evidence quality matters as much as quantity: a signed contract carries more weight than an internal spreadsheet.

Reporting

The audit concludes with the SEC audit report: an opinion on whether the financial statements are fairly presented in accordance with U.S. GAAP (or IFRS as issued by the IASB for eligible foreign private issuers), plus an ICFR opinion where required.

To understand what each phase feels like from the client side, our article on what to expect from a financial statement audit walks through the experience in more detail.

Material Weaknesses: The Finding That Matters Most

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. That definition comes from PCAOB AS 2201.

A material weakness does not automatically mean the financial statements are wrong. It means the controls cannot be relied on to catch errors. Its consequences tend to follow a predictable chain:

1. Disclosure. The weakness must be disclosed in the 10-K, along with management's conclusion that ICFR is not effective.

2. Adverse ICFR opinion. For 404(b) filers, the auditor issues an adverse opinion on internal control.

3. More audit work. The auditor cannot rely on the affected controls, so substantive testing expands, increasing time and fees.

4. Market and lender scrutiny. Investors, underwriters and lenders read these disclosures closely.

5. Remediation reporting. The company discloses its remediation plan and progress until the weakness is resolved.

Common causes in newly public companies include insufficient accounting staff with SEC reporting experience, lack of segregation of duties, weak IT general controls, and no formal review over complex accounting judgments. Our SOX compliance checklist for growth-stage public companies covers the practical steps for closing these gaps.

Common Mistakes First-Time Public Companies Make

• Assuming a private company audit transfers. AICPA audits generally must be redone under PCAOB standards for SEC filings.

• Discovering independence conflicts late. Non-audit services from the intended auditor during the audit period can disqualify the firm.

• Underestimating disclosure work. SEC filings require segment, equity, earnings per share, and MD&A-related information that private statements often lack.

• Treating the quarterly review as a formality. Problems caught at Q3 are far cheaper to fix than problems found in January.

• No technical accounting position papers. Auditors expect written support for significant judgments, especially warrants, convertible instruments and business combinations.

• Changing auditors without planning. A change in auditor requires a Form 8-K under Item 4.01 within four business days, including disclosure of any disagreements.

SEC Audit Readiness Checklist

Use this checklist 6 to 12 months before your first SEC filing:

• Confirm your expected filer status and EGC eligibility

• Engage a PCAOB-registered firm and confirm independence for every period to be audited

• Identify all periods requiring PCAOB-standard audits for the registration statement

• Document key financial reporting processes and controls

• Assess IT general controls over systems that feed the financial statements

• Prepare technical accounting memos for complex transactions

• Establish or plan the audit committee and its charter

• Build a quarterly close calendar that supports 10-Q deadlines

• Assign an owner for SEC reporting and disclosure controls

• Agree on a PBC (prepared-by-client) request list and timeline with the auditor

Independence rules mean your auditor cannot design these controls or prepare these memos for you. Many companies use a separate advisor for that work. MBP Global's IPO readiness and SEC reporting advisory services are offered to non-audit clients for exactly this reason.

Choosing an Independent Auditor for SEC Work

When evaluating firms, ask:

• Is the firm registered with the PCAOB, and what have recent PCAOB inspection reports found?

• How many SEC registrants does it audit in your industry and size range?

• Does it have experience with your transaction type, such as a traditional IPO, de-SPAC or foreign private issuer filing?

• Who is the engagement partner, and how involved will they be?

• Can it meet your filing deadlines with realistic staffing?

Conclusion

An SEC audit is not an examination by the SEC. It is an independent audit by a PCAOB-registered firm, shaped by your filer status, PCAOB standards, and strict independence rules. Companies that understand those requirements early, build controls before they are tested, and plan the year as a cycle rather than a year-end sprint tend to experience fewer surprises and cleaner reports.

MBP Global LLP is a PCAOB-registered firm that has served SEC registrants since 1983, including companies listed on NYSE and Nasdaq, with partner-led engagements. If you are preparing for an IPO, a business combination, or your first annual report, explore our SEC audit and assurance services to discuss your timeline with a partner.

FAQ

Does the SEC audit public companies directly? 

No. A PCAOB-registered independent auditor performs the audit. The SEC reviews filings and enforces securities laws, but does not audit company financial statements.

What is the difference between an SEC audit and a PCAOB audit? 

They usually describe the same engagement. "SEC audit" refers to the purpose (filing with the SEC); "PCAOB audit" refers to the standards and the regulator overseeing the auditor.

How long does an SEC audit take? 

Year-end fieldwork usually runs several weeks, but the full cycle spans the year, including three quarterly reviews and interim control testing. Filing deadlines range from 60 to 90 days after year-end.

Are quarterly financial statements audited? 

No. Quarterly 10-Q financial statements are reviewed, not audited. A review provides limited assurance and involves inquiry and analytical procedures.

Can our current CPA firm perform our SEC audit? 

Only if it is PCAOB-registered and meets SEC independence rules for every period being audited, including any prior years in a registration statement.

What happens if the auditor finds a material weakness? 

It must be disclosed in the 10-K, management must conclude ICFR is not effective, and 404(b) filers receive an adverse ICFR opinion. Remediation progress is then reported in later filings.