How to Choose an Audit Support Provider in the USA

Audit support is the preparation work around an audit: reconciled accounts, supporting schedules, a tracked answer to every line of the auditor's provided-by-client (PBC) list, and quick factual replies once fieldwork starts. In the USA it comes from your own finance staff, a local accounting practice, a national outsourced firm, a freelancer or a provider like Finbryn.

The audit itself is a separate job. The audit report comes from an independent public accounting firm whose partners hold state CPA licenses, and for an audit of a public company (an issuer), broker or dealer that firm must also be registered with the PCAOB (15 U.S.C. 7212(a)). No support provider issues that report. Finbryn doesn't either.

This guide won't name a winner, because an honest ranking doesn't exist. The right provider depends on your auditor, the standard your audit follows and how clean your books are today. What follows is twelve checks, each with a way to verify it yourself and the primary source behind it. Every source was opened on 2026-10-08.

Run them in order. Checks 1 to 4 decide whether a provider can work next to your auditor at all. Checks 5 to 12 decide whether the work will be any good.

1. Independence from your audit firm. The AICPA's Plain English Guide to Independence (2025) says a member may provide bookkeeping to an attest client only if the client oversees the work and carries every management responsibility around it: approving all account classifications, supplying the source documents and taking responsibility for the resulting statements. For an SEC audit client the bar is higher. Rule 2-01(c)(4)(i) of Regulation S-X lists maintaining or preparing accounting records as a service that impairs independence unless the results won't be subject to audit procedures, and the AICPA guide describes a rebuttable presumption that they will be. *Verify:* ask your audit firm in writing whether the provider you're hiring creates an independence threat. A support provider that never audits anyone keeps that conversation short; if it also keeps your books, ask whether it shares an owner, partner, brand or fee with your audit firm, because those ties can impair the auditor's independence (AICPA ET 1.220.010, 1.265.010).

2. The CPA license, for the person and the firm. NASBA's CPAverify is a CPA and accounting firm license search fed by the state boards of accountancy. A NASBA post dated March 12, 2026 says 53 jurisdictions contribute data and that the tool shows enforcement and disciplinary markers issued by state boards. *Verify:* search each named partner and the firm in the state that issued the license, and read the discipline markers as well as the status.

3. Peer review. Firms in the AICPA Peer Review Program are reviewed every three years. A firm that audits gets a system review, and the report carries one of three ratings: Pass, Pass with deficiencies or Fail (CalCPA's 2025 annual report, for the program it administers in California, Arizona and Alaska). The AICPA Peer Review Public File lists firms with their enrollment status, and it shows accepted review documents for firms in certain AICPA quality centers or firms that chose to publish. *Verify:* look the firm up, then ask for its latest report and read the rating and any deficiencies, not the cover letter.

4. PCAOB registration, only if it applies. Under 15 U.S.C. 7212(a), it's unlawful for a firm that isn't a registered public accounting firm to prepare or issue, or take part in preparing or issuing, an audit report on an issuer, broker or dealer. A private company's audit carries no such rule, so ask for registration only when your audit falls into those categories.

5. The standard behind your audit. Most private-company audits follow generally accepted auditing standards. A nonprofit, school or other non-federal entity that spends $1,000,000 or more in federal awards in a fiscal year must have a single audit (2 CFR 200.501), and 2 CFR 200.514 requires it to follow Government Auditing Standards, the Yellow Book. The reporting package is due within 30 calendar days after you receive the auditor's report or nine months after the audit period ends, whichever is earlier (2 CFR 200.512). Someone on your own leadership team signs the statement that goes with the data collection form; the rule names a chief financial officer as one example. *Verify:* ask the provider how it supports a single audit, including who prepares the schedule of expenditures of federal awards.

6. Who owns each line of the PBC list. The list your auditor sends is the work plan. *Verify:* ask for a redacted sample tracker. You should see a named owner on every line, a due date, a status of delivered, pending or blocked, and a note whenever a document was replaced by a newer version. A tracker in a shared sheet you can open yourself is easier to trust than a weekly email.

7. Where management judgment stays. AICPA guidance tells its members they "may not assume management responsibilities or even appear to assume management responsibilities." A support provider isn't bound by that unless it's a CPA practice, but your audit rests on the same line: estimates and classification calls are yours. *Verify:* ask for the provider's written rule on which requests it answers alone and which it sends back to you first.

8. Ownership of the accounting file. Intuit's help article on the primary admin, updated September 8, 2026, describes that role as "the main person who has access to every part of a QuickBooks account" who can "manage everyone." That should be you, with the provider added as a user. Xero's equivalent is the subscriber. *Verify:* open Manage users yourself and see whose name holds the top role.

9. Data security you can see. The FTC's Safeguards Rule, 16 CFR 314.4, asks covered businesses to encrypt customer information in transit and at rest and to require multi-factor authentication for anyone accessing an information system. It also calls for a written incident response plan. The FTC's guidance (December 2024) lists tax preparation firms and other financial advisors among covered businesses, so whether it reaches your provider depends on what they do. Use it as the yardstick either way. A SOC 2 report is an examination performed by a CPA practice: a Type 1 report describes controls as of one date, and a Type 2 report covers a period of time. *Verify:* ask for the written security program and, if the provider has one, its latest SOC 2 Type 2 report. Read the period it covers and every exception it notes.

10. Subcontractors. Paragraph (f) of 16 CFR 314.4 tells a covered business to choose service providers able to maintain safeguards, require those safeguards by contract and reassess the providers periodically. Apply the same test to your provider's own vendors. *Verify:* get the list of everyone else who touches your data and the contract term that binds each one.

11. How the price is built. Audit support is usually quoted against scope: the size of the PBC list, the number of entities and the follow-up rounds the fee covers. The AICPA guide asks its members to document the objectives, the services, each side's responsibilities and any limitations in an engagement letter (general requirement 3), and that list works as a test for any provider. *Verify:* get the fee basis and the follow-up rounds included in writing before work starts, plus the events that trigger a change order.

12. The exit pack. On the last day you should receive the final tracker, every schedule in its native format, an index of source documents and a list of open items. The IRS record retention guidance (updated June 30, 2026) sets a 3-year baseline from the date a return was filed, 6 years when you leave out more than 25% of gross income, and 7 years for a bad debt or worthless securities claim. *Verify:* ask what the exit pack contains and who holds the master copy while the engagement runs.

Cost figures appear only where an agency publishes them. Nothing here is a quote.

A hire costs more than the salary. The BLS figure for wages and salaries (70.0 percent of private-industry employer costs, June 2026) means a rough floor is the salary divided by 0.70. It still leaves out recruiting and software, plus the time of whoever manages the person.

Finbryn is one option, and for some companies it's the wrong one. Skip it if:

• You need an audit, review or compilation report. Finbryn doesn't issue them. A licensed CPA practice does.
• You want the firm that keeps your books to audit them too. If Finbryn keeps your books, we refer your audit to an independent CPA practice. Finbryn receives no fee or commission tied to any audit.
• A lender, investor or customer contract requires your vendors to hold a SOC 2 report today. Finbryn doesn't hold one, and its security page lists the examination as planned (status as of 2026-10-08).
• You want someone to make management decisions for you, such as classifying balances or approving estimates. Those stay with you and your auditor.
• You need a person at your site during fieldwork. Finbryn works remotely, inside your accounting software.
• Your books are months behind and fieldwork starts soon. Catch-up comes first, so start with catch-up bookkeeping, then audit support.

If none of those apply, the audit and compliance support service and its PBC list management page explain exactly what Finbryn prepares.

Ask for four documents before the call: a sample engagement letter, a redacted PBC tracker, the security program summary and an outline of the exit pack. Then spend the half hour like this.

1. Minutes 0 to 5. Say which standard your audit follows and when fieldwork starts. A provider that doesn't ask is guessing.
2. Minutes 5 to 12. Walk the tracker. Pick one line and ask who owns it, what happens when the document runs late and who tells the auditor.
3. Minutes 12 to 18. Independence and judgment. Ask which of your auditor's requests the provider would answer alone and which would come back to you.
4. Minutes 18 to 24. Access and security. Ask who holds admin rights, whether multi-factor authentication is on for every person and who else touches the data.
5. Minutes 24 to 30. Price and exit. Get the fee basis, the follow-up rounds included, what triggers a change order and what arrives on the last day.

Run the same call with Finbryn. Its written answers sit on the security page and the audit support service page, so you can compare them with every other provider's before anyone books time.

Nonprofits should also see nonprofit bookkeeping for fund accounting.

The actuarial equivalent is how to choose an actuarial support provider.