Can an Audit Firm Prepare Financial Statements It Audits?

Sometimes, for a private company, and only with strict safeguards; other audit regimes are stricter. Which answer applies depends on the rule that governs the audit:

• Private company audited under generally accepted auditing standards: allowed if management approves every classification and entry, oversees the work and takes responsibility for the results (AICPA ET 1.295.040 and 1.295.120).
• SEC audit client: bookkeeping impairs independence unless it is reasonable to conclude the results won't be subject to audit procedures (17 CFR 210.2-01(c)(4)(i)).
• Employee benefit plan: barred when the accountant maintains the plan's financial records (29 CFR 2509.2022-01(b)(3)).
• Government Auditing Standards, including single audits: making entries without management's approval impairs independence, and preparing full statements from a trial balance is a significant threat (GAO-24-106786, paragraphs 3.87 and 3.88).
• Insurer under the NAIC model regulation: barred, with a hardship exemption a commissioner may grant (Model 205, sections 7G and 7H).

Finbryn keeps books and does not audit. If Finbryn keeps your books, we refer your audit to an independent CPA practice. The rest of this guide shows the rule behind each line above. The texts were read on 2026-10-19 in the AICPA Code of Professional Conduct, the AICPA's audit standards, the eCFR, the GAO and the NAIC model regulation.

Independence means the auditor has no interest or role that could bend its judgment, and a self-review threat is the risk that an auditor won't fairly check its own work. Under US generally accepted auditing standards the auditor must be independent of the entity, and if it isn't, it can't issue a report under those standards unless a narrow exception applies (AU-C 200.15). The AICPA Code's Independence Rule says a member in public practice shall be independent in performing professional services as standards require (ET 1.200.001.01). The Code defines independence as two elements, independence of mind and independence in appearance (ET 0.400.23).

The Code defines a self-review threat as the threat that a member will not appropriately evaluate the results of a previous judgment made, or service performed or supervised, by the member or someone in the firm, and will rely on it in forming a judgment in an attest engagement (ET 1.210.010.17). It adds that some self-review threats, such as preparing the source documents behind the client's statements, are so significant that no safeguard can reduce them to an acceptable level.

A plain example: a practice posts your year-end accruals to the ledger, then its audit team tests whether those accruals are right. It is checking its own entries. That is the pattern the independence rules exist to stop, and it is why bookkeeping done by an audit's own practice draws so much attention.

A practice may do routine bookkeeping for an audit client only when management approves the inputs and owns the results; it may not decide, authorize or hold anything. ET 1.295.040.01 sets the safeguards: management agrees to assume all management responsibilities, to oversee the service through a designated person with suitable skill, knowledge or experience, to evaluate the results and to accept responsibility for them, and the practice documents that understanding in writing before it starts. ET 1.295.120 then lists examples.

So the three things people ask about land on both sides. Journal entries and account coding are allowed once the client has approved them and impair independence before that. Payment initiation is fine as unsigned checks or client-authorized payroll files, and impairing as soon as the practice authorizes the payment itself.

The same facts can be barred outright under a stricter regime, so check which rule governs the audit before you rely on the AICPA safeguards.

The 2024 Government Auditing Standards apply to financial audits for periods beginning on or after December 15, 2025 (GAO page). The NAIC text is the model regulation as published in a PDF headed third quarter 2015, so each state's adopted version governs, and state boards of accountancy may add to the AICPA Code. The eCFR texts for the SEC rule and the Labor rule were read on 2026-10-19; the NAIC model was read on 2026-10-19 as well.

A review needs an independent practice, so the bookkeeping must stay inside the Code's safeguards; a compilation can be issued by a practice that isn't independent, but the report must say so. AR-C 90.10 requires the accountant to be independent when performing a review and to withdraw if independence is impaired during the engagement. AR-C 80.07 requires the accountant to determine whether it is independent, and AR-C 80.22 requires a final paragraph in the compilation report stating a lack of independence.

The AICPA's Plain English Guide to Independence (2025) puts the compilation point this way: a compilation is an attest engagement, performing it doesn't require independence, but a non-independent firm must indicate that in the report. It also separates attest from nonattest work: financial statement preparation, cash-to-accrual conversions and reconciliations outside the scope of an attest engagement are nonattest services.

Two cautions. If the practice prepared the statements and then compiles them for a lender or surety, the reader sees the disclosure, so ask the requester whether it accepts a compilation that states a lack of independence. And ET 1.520.001.01 bars a commission for referring any product or service to a client when the practice also does a review, or a compilation whose report doesn't disclose a lack of independence, so a practice that takes a commission for recommending products or services to you can't also review your statements for that period. A practice that accepts or pays a fee for a client referral must disclose it to you (1.520.001.04). Standards read 2026-10-19 in the AICPA's AR-C sections.

Not by itself. The sources read for this guide frame independence around the CPA practice's own services and relationships, the businesses it controls and the networks it belongs to. None of the sections read says that a client's separate bookkeeper, unrelated to the practice, blocks an audit or review. What the Code does look at is the tie between the two businesses:

• Shared brand: a common brand name or common initials make entities a network (ET 1.220.010.07).
• Common control or shared profits: both are network characteristics (1.220.010.09 and .10), and a network firm must be independent of the other network firms' audit and review clients (1.220.010.04).
• A separate business a CPA controls: if a member controls it, the Independence Rule applies to that business, its owners and its professional employees (1.810.010.02), and the member should tell clients he or she owns two separate businesses when the other owners aren't CPAs (1.810.010.04).
• Shared business strategy or professional staff: also network characteristics (1.220.010.11 and .13).

So ask your CPA practice, in writing, whether it shares a brand, owners, control, profits or staff with your bookkeeper. If the answer is no, the bookkeeping isn't an independence problem for the audit, though the auditor still has to test the records the bookkeeper keeps (next section). If the answer is yes, the practice has to run the tests above before it accepts the engagement.

Yes, as audit evidence, but the auditor evaluates them first and doesn't take them as given. AU-C 500.07 requires the auditor to weigh the relevance and reliability of information it uses as audit evidence, including its source. AU-C 500.08 adds evaluating whether the information is precise and detailed enough and obtaining evidence about its accuracy and completeness as necessary. How much testing that means depends on the auditor's risk assessment, and the standard leaves the extent to its judgment.

In practice a reconciliation your bookkeeper prepared goes on the provided-by-client (PBC) list with its support: the bank statement, the list of outstanding items and the evidence that earlier items cleared. The auditor then tests it against the ledger and the statement. A reconciliation that arrives complete and tied to the trial balance draws fewer follow-up questions than one that arrives bare.

If the audit's own practice prepared the reconciliation, ET 1.295.120.02i allows a reconciliation that identifies reconciling items for the client's evaluation, inside the safeguards. The practice is then reviewing its own work, which is the self-review threat above, and the safeguards exist to manage it. PBC list management and audit-ready books cover the preparation side.

Because only a licensed CPA practice may offer an audit, and a joint package would tie the two businesses together. Section 14(a) of the Uniform Accountancy Act reserves any offer to render an attest service to licensees, so Finbryn can't sell one. A shared brand, shared profits or a common business strategy can also make a bookkeeper and a CPA practice a network, and a network firm must be independent of the other network firms' audit and review clients (ET 1.220.010.04, .07, .10 and .11). If the bookkeeper is itself an attest client of the practice, marketing a combined package is a cooperative arrangement as well (1.265.010.03c).

Money raises the same issue. ET 1.520.001.01 bars a commission for recommending or referring any product or service to a client, or for receiving one, when the practice also performs an audit or review for that client. Section .04 requires a member who accepts or pays for a referral of a client to disclose that payment to the client.

That is the reason for the line Finbryn draws. Finbryn receives no fee or commission tied to any audit. It doesn't market bookkeeping and an audit together, and the practice you pick isn't part of any Finbryn package. You choose it, you sign its engagement letter and you pay it directly.

Finbryn keeps books and prepares statements, and it refers any audit of those books to a CPA practice independent of Finbryn. The wording we use on every page:

• Finbryn is not a CPA firm and does not issue audit, review or compilation reports.
• If Finbryn keeps your books, we refer your audit to an independent CPA practice.
• Finbryn receives no fee or commission tied to any audit.
• We prepare financial statements. We have not audited or reviewed them and give no assurance.
• On request we introduce independent licensed CPA practices; you engage the one you choose directly, under its own engagement letter.

Independent of Finbryn means a CPA practice that has no name, brand, owner or partner in common with Finbryn, isn't controlled by Finbryn or by anyone who owns Finbryn, shares no staff, profits or costs with Finbryn, and pays Finbryn no fee and receives none from it. Those are the ties the Code's network and separate-business rules test (ET 1.220.010 and 1.810.010). What Finbryn does for an audit is the preparation: reconciled accounts, supporting schedules and the practice's provided-by-client list tracked item by item. See audit-ready books, PBC list management and financial statement preparation. Which level of report you need is a separate question, covered in audit vs review vs compilation, and what each costs is in the cost guide.

Ask for the answers in writing before you sign an engagement letter. Six questions cover the points in this guide:

1. Besides the audit, which services do you perform or have you performed for us or our affiliates?
2. Do you share a brand, owners, control, profits, staff or systems with our bookkeeper or any other provider we use?
3. How will you evaluate the reliability of the records our bookkeeper keeps, and what do you need from us to do it (AU-C 500.07 and 500.08)?
4. Who in our management must oversee any nonattest service you provide, and where is the written understanding (ET 1.295.040.01)?
5. Will you confirm in writing that you are independent of us under the rule that governs this audit: the AICPA Code, SEC rules, Labor Department rules for a plan, Government Auditing Standards or a state insurance regulation?
6. Do you receive any fee or commission for recommending products or services to us (ET 1.520.001)?

Add the credential checks in how to choose an audit support provider, which covers license lookups and peer review. A practice that answers all six plainly, and whose answers match the rule that governs your audit, is a practice that has thought about independence before you raised it.