Auditing Standards for the CPA Exam: SAS, PCAOB, GAGAS, SSARS, and SSAE

Auditing standards are the rules auditors follow to plan an audit, gather evidence, and report their opinion. In the U.S., the AICPA issues Statements on Auditing Standards (SAS) for private company and nonprofit audits, the PCAOB sets the standards for public company and broker-dealer audits, and the GAO issues the Yellow Book (GAGAS) for government-related audits.

For the CPA exam, you’ll also need two related frameworks that aren’t audit standards: SSARS (Statements on Standards for Accounting and Review Services), which cover preparation, compilation, and review engagements, and SSAE (Statements on Standards for Attestation Engagements), which cover examinations, reviews, and agreed-upon procedures. Together, these are the five frameworks this guide compares.

The applicable framework depends on the entity, the service requested, and any additional legal or contractual requirements. This guide compares the five frameworks, explains assurance levels, and provides original practice scenarios to help you apply the distinctions.

Which Auditing Standards Apply? The Quick Answer

• Audit of a private company, nonprofit, or other nonissuer: SAS (AICPA)
• Audit of a public company (issuer) or an SEC-registered broker-dealer: PCAOB auditing standards
• Financial statement audit that a law, grant, or contract requires to follow the Yellow Book: GAGAS (GAO), which incorporates applicable AICPA auditing standards and adds requirements
• Preparation, compilation, or review of a private company’s financial statements: SSARS (AICPA)
• Examination, review, or agreed-upon procedures on other subject matter: SSAE (AICPA)

What Are Auditing Standards?

Auditing standards tell an auditor what to do and how to report it. They cover the auditor’s responsibilities, how to plan and perform the work, how much evidence is enough, and what the audit report has to say. They don’t tell a company how to account for its transactions. That’s the job of accounting standards like GAAP.

Here are the terms you’ll see throughout this guide:

• Issuer: In plain terms, a company that has securities registered with the SEC or that files reports with the SEC. Most public companies are issuers, and their audits follow PCAOB standards.
• Nonissuer: Any entity that isn’t an issuer, such as a private company, a nonprofit, or a state or local government. Most nonissuer audits follow the AICPA’s Statements on Auditing Standards (SAS).
• GAAS: Generally accepted auditing standards. For nonissuer audits, GAAS means the SAS issued by the AICPA’s Auditing Standards Board (ASB).
• Assurance: How much confidence a CPA’s report gives the reader. An audit gives reasonable assurance (high, but not absolute). A review gives limited assurance. A compilation or preparation gives none.
• Attestation: An engagement where a CPA reports on subject matter, or on an assertion about it, that another party is responsible for. A company’s internal control or its compliance with a contract are common examples.

Which guidance counts? Under the AICPA framework, the SAS come first, and the auditor must comply with every SAS that’s relevant to the audit. Interpretive publications come next. These include auditing interpretations and the auditing guidance in AICPA Audit and Accounting Guides, and the auditor should consider them when they apply. Other auditing publications, like journal articles and textbooks, have no authoritative status. They can still help, but the auditor has to judge whether they’re relevant and appropriate.

Watch out for older material. Older study materials may still list the “ten generally accepted auditing standards” (three general, three fieldwork, and four reporting standards). The AICPA’s clarity project folded those requirements into the clarified standards, which took effect in December 2012, so don’t memorize the ten as the current AICPA framework.

Outside the U.S., many countries use the International Standards on Auditing (ISAs) issued by the International Auditing and Assurance Standards Board (IAASB). The clarity project brought many SAS requirements closer to the ISAs, but some differences remain, and the AICPA publishes an analysis of them.

Auditing Standards Compared: SAS, PCAOB, GAGAS, SSARS, and SSAE

Use this comparison as a starting point. Before you pick a standard, figure out what the accountant was hired to do. The client’s name, size, or industry alone won’t tell you.

This table isn’t a ranking. No framework automatically overrides the others, and some engagements follow more than one set of standards at the same time. Also distinguish GAAS, which addresses auditing, from GAAP, which addresses financial reporting.

How These Standards Are Cited

You’ll often see these frameworks cited by section number, so it helps to recognize the prefixes:

• AU-C: clarified SAS for nonissuer audits. For example, AU-C 700 covers forming an opinion and reporting on financial statements.
• AR-C: SSARS. AR-C 70 covers preparation engagements, AR-C 80 covers compilations, and AR-C 90 covers reviews.
• AT-C: SSAE. AT-C 205 and 206 cover examinations, AT-C 210 covers reviews, and AT-C 215 covers agreed-upon procedures.
• AS: PCAOB auditing standards. For example, AS 3101 covers the auditor’s report when the auditor expresses an unqualified opinion, and AS 2201 covers an integrated audit of internal control over financial reporting.

Want to go straight to the source? You can browse the AICPA’s list of currently effective SAS, the PCAOB’s auditing and related standards, and the GAO’s 2024 Yellow Book.

For the foundational explanation, study Farhat’s Auditing Standards and Guidelines lesson. The overview video below introduces the organizations and engagement categories.

What the video covers (11:27):

• 0:00 Introduction
• 2:04 Statements on Auditing Standards (SAS) from the AICPA
• 3:25 PCAOB auditing standards
• 4:18 Government Auditing Standards (GAGAS)
• 5:42 Attestation standards (SSAE)
• 6:27 Accounting and review standards (SSARS)
• 7:55 AICPA Code of Professional Conduct
• 8:30 Quality control standards (SQCS)
• 9:12 The hierarchy of audit guidance

Watch the Farhat Lectures auditing standards video on the official Farhat Lectures YouTube channel.

Quick update: This video was recorded in 2021, so the segment on quality control standards (SQCS) at 8:30 reflects the older framework. For AICPA engagements, SQMS No. 1 replaced those standards as of December 15, 2025. The quality management section below covers what’s current.

How Do You Choose the Right Auditing Standards?

A reliable approach is to classify the engagement in four steps. This prevents a familiar acronym in an answer choice from distracting you from the facts.

1. Identify the service. Is the request for an audit, review, compilation, preparation, examination, or agreed-upon procedures? “The CPA will issue a report” is not enough information to classify the engagement.
2. Identify the entity and regulatory setting. Determine whether the client is an issuer, a nonissuer, or an entity subject to a specific regulatory framework. A privately owned broker-dealer illustrates why “private company” alone is not a complete decision rule.
3. Check for additional requirements. Look for explicit references to GAGAS, a grant agreement, a law, or another requirement affecting the engagement. Government funding is a clue to investigate, rather than automatic proof that every engagement follows the Yellow Book.
4. Match the report and assurance level. An audit opinion, a review conclusion, and a report of findings communicate different results. Your chosen framework should be consistent with the requested service.

For example, a private business asking for a compilation does not need a financial statement audit simply because a bank will read the statements. The requested service remains central to selecting the applicable standards. Read the entire question before deciding.

SAS vs. PCAOB Standards: What’s the Difference?

SAS: Financial Statement Audits of Nonissuers

The AICPA Auditing Standards Board issues Statements on Auditing Standards. SAS establish requirements for financial statement audits of nonissuers under GAAS. Nonissuers include many privately held businesses, nonprofit organizations, and governmental entities; the term is broader than “small private companies.”

In a financial statement audit, the auditor obtains reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. Reasonable assurance is a high level of assurance, but it is not absolute assurance or a guarantee that every error will be found.

Example: A regional manufacturer hires a CPA firm to audit its annual financial statements for a lender. The company is a nonissuer, and no special regulatory framework is specified. SAS is the appropriate starting point for the financial statement audit.

PCAOB Standards: Issuers and Other Covered Entities

PCAOB auditing standards govern audits of issuers and certain other entities under PCAOB jurisdiction. Public company audits are the main introductory example, but broker-dealer audits are an important reason to avoid the absolute rule “PCAOB applies only to public companies.”

Both SAS and PCAOB auditing standards address audit planning, evidence, risk, and reporting. Their shared subject matter does not make their requirements or reporting language interchangeable. Establish the applicable framework before answering a detailed reporting question.

Example: A public company needs an annual financial statement audit. The issuer status points to PCAOB auditing standards. The company’s size does not determine whether the engagement follows SAS or PCAOB requirements.

Review Farhat’s lesson on the PCAOB’s role in auditing to connect standard setting, oversight, and the auditor’s responsibilities.

When Do Government Auditing Standards (GAGAS) Apply?

Government Auditing Standards, commonly called GAGAS or the Yellow Book, are issued by the GAO. They address financial audits, attestation engagements, reviews of financial statements, and performance audits within the government auditing framework.

GAGAS can apply because a law, regulation, contract, grant agreement, or policy requires it. An organization may also elect to follow it. A nonprofit or private entity can therefore have a GAGAS engagement; the client does not have to be a government agency.

For a financial audit conducted under GAGAS, the requirements include the applicable AICPA auditing standards plus additional government auditing requirements. In other words, the auditor doesn’t drop SAS and switch to a completely different rulebook. GAGAS adds requirements on top of SAS.

Those additional requirements address matters such as ethics, independence, professional competence, quality management, and reporting. A GAGAS financial audit also involves reporting on internal control and compliance. That reporting does not automatically mean the auditor expresses an opinion on the effectiveness of internal control or on compliance.

Example: A nonprofit’s grant agreement requires an audit under Government Auditing Standards. The engagement must address the applicable financial statement audit requirements and the additional GAGAS requirements. The grant agreement provides the decisive fact—not the organization’s nonprofit label alone.

A GAGAS financial audit and a Single Audit are related but distinct. Under 2 CFR 200.501, a non-federal entity expending $1,000,000 or more in federal awards during its fiscal year must generally obtain a Single Audit, unless it qualifies for and elects a program-specific audit. The threshold applies to fiscal years beginning on or after October 1, 2024; the previous threshold was $750,000. A Single Audit combines a GAGAS financial statement audit with an audit of compliance for major federal programs. Identify the stated engagement requirements before assuming federal award compliance work is included. Farhat’s Government Auditing Standards lesson develops this distinction.

SSARS vs. SSAE: Services and Assurance

The word “review” appears in more than one professional framework. To distinguish SSARS from SSAE, identify the subject matter and the service being performed. Do not select standards from the assurance level alone.

SSARS: Preparation, Compilation, and Review

SSARS govern preparation, compilation, and review engagements within their scope. These services differ from a financial statement audit in both the accountant’s work and the assurance provided.

A compilation report does not provide limited assurance merely because the accountant signs a report. A review provides limited assurance; an audit provides reasonable assurance. Neither a preparation nor a compilation becomes an audit because the financial statements will be used by a lender.

Independence is required for a review. A compilation may be performed when the accountant is not independent, but the lack of independence must be disclosed in the compilation report. A preparation engagement does not require the accountant to determine whether the accountant is independent. Other applicable ethical responsibilities still matter.

Also avoid assuming every review of a nonissuer’s interim financial information follows SSARS. The engagement circumstances, including the auditor’s relationship to the annual financial statements, can affect the governing standards.

Continue with Farhat’s lessons on preparation and compilation engagements under SSARS and review engagements under SSARS.

SSAE: Examinations, Reviews, and Agreed-Upon Procedures

SSAE govern attestation engagements involving subject matter within their scope. The ASB issues these standards. The subject matter can extend beyond a complete set of historical financial statements, so SSAE should not be treated as another name for a financial statement audit.

• Examination: Provides reasonable assurance and results in an opinion on the subject matter or assertion, as applicable.
• Review: Provides limited assurance and results in a conclusion. Review engagements are not available for every type of subject matter.
• Agreed-upon procedures: Reports the procedures performed and the resulting findings. The practitioner does not provide an opinion or a conclusion that supplies assurance.

Example: Parties agree that a CPA will compare specified records and report the exceptions found. That describes an agreed-upon procedures engagement, assuming it falls within SSAE. The CPA reports findings rather than converting the work into an audit opinion.

Use Farhat’s introduction to Standards for Attestation Engagements to study these engagement types and their reporting differences.

Professional Ethics and Quality Management

Auditing standards operate alongside ethical requirements and the firm’s system for achieving quality. These responsibilities are connected, but they answer different questions.

Professional Conduct and Independence

Professional ethics address matters such as integrity, objectivity, confidentiality, and independence where required. The AICPA Code of Professional Conduct applies to AICPA members; other applicable laws, regulators, and licensing requirements may also impose responsibilities.

An audit team cannot solve an independence problem simply by collecting more evidence. In a question about a financial interest, prohibited relationship, or conflicting responsibility, evaluate the applicable ethical requirement as well as the engagement standards. Farhat’s AICPA independence rules and interpretations lesson develops these distinctions.

The Firm’s System of Quality Management

Quality management is the current approach for firms that follow AICPA standards. The AICPA’s Statement on Quality Management Standards (SQMS) No. 1 required firms to design and implement a risk-based system of quality management by December 15, 2025. It replaced the older Statements on Quality Control Standards (SQCS), so study material that teaches only the old quality control “elements” is out of date for AICPA engagements.

Two other frameworks made similar moves. The 2024 Yellow Book introduced quality management and generally required audit organizations to design and implement a compliant system by December 15, 2025. The GAO provided a special extension to March 16, 2026, for federal government audit organizations affected by the lapse in appropriations; their system evaluation is due within one year of implementation. See the GAO’s current Yellow Book guidance. QC 1000, A Firm’s System of Quality Control, takes effect for PCAOB-registered firms on December 15, 2026. It is risk-based, although its title retains “quality control.”

Quality management addresses how a firm establishes quality objectives, identifies and assesses quality risks, responds to those risks, and monitors and remediates deficiencies. Under SQMS No. 1, a firm’s system has eight components: the firm’s risk assessment process; governance and leadership; relevant ethical requirements; acceptance and continuance of client relationships and specific engagements; engagement performance; resources; information and communication; and the monitoring and remediation process.

Study distinction: Engagement standards guide the work on a particular assignment. Ethical requirements guide professional conduct. Quality management concerns the firm’s system for consistently supporting quality engagements.

Farhat’s Elements of Quality Management lesson is a useful next step. The Auditing Course also includes introductory quality management and system of quality management topics.

What’s New in Auditing Standards for 2026

Standards keep changing, and the CPA exam follows a set schedule for testing new ones. Under the AICPA’s Policy on New Pronouncements, a new auditing standard becomes eligible for testing on the later of two dates: the first calendar quarter that starts after its earliest mandatory effective date, or the first calendar quarter that starts six months after it was issued. Once a new standard becomes eligible, the content it replaces comes off the exam.

Here’s what that means for the standards changing right now:

*Calculated earliest testing eligibility dates based on the AICPA policy above; these are not confirmations of exam coverage. Confirm the guidance applicable to your exam date against current AICPA CPA Exam materials and your review course.

One note on SAS No. 151: it doesn’t change the definition of fraud or the auditor’s overall goal of obtaining reasonable assurance. It adds more specific requirements for professional skepticism, fraud risk assessment, documentation, and communication.

Common Mistakes to Avoid

• Treating “nonissuer” as “small business.” Entity status and the applicable framework matter more than size.
• Assuming government funding automatically determines the standards. Identify the actual engagement requirement and any additional government audit obligations.
• Confusing reporting with assurance. Compilation and agreed-upon procedures reports do not provide assurance.
• Choosing SSARS for every review. Read the subject matter and engagement context; reviews also occur under other frameworks.
• Using one universal hierarchy. First establish the applicable standards. Educational lectures, textbooks, and examples help explain the requirements but are not themselves authoritative auditing standards.
• Memorizing acronyms without applying them. State the service, entity, assurance level, and decisive fact before choosing an answer.
• Studying outdated standards. For AICPA engagements, SQMS No. 1 replaced the old quality control standards. Newer SAS such as No. 150 and No. 151 won’t be tested until their testing dates arrive, so check the table above.

Original CPA-Style Practice Scenarios

These are original learning examples prepared for this guide, not questions reproduced from the CPA exam. Try to identify the framework and explain the decisive fact before reading each answer.

1. A Private Manufacturer Needs an Audit

Scenario: A privately held manufacturer engages a CPA to audit its annual financial statements because its bank lender asks for audited statements. It is not a broker-dealer, and the question specifies no additional government or regulatory requirements. Which standards apply?

Answer: SAS. The engagement is a financial statement audit of a nonissuer. The lender’s interest in the statements does not change the engagement into a compilation or review.

2. A Public Company Requests an Annual Audit

Scenario: An issuer engages an audit firm to express an opinion on its annual financial statements. Should the auditor select SSARS, SAS, or PCAOB auditing standards?

Answer: PCAOB auditing standards. Issuer status and the requested audit identify the framework. SSARS does not govern the public company’s annual financial statement audit.

3. A Grant Agreement Requires the Yellow Book

Scenario: A nonprofit’s grant agreement requires its financial statement audit to comply with GAGAS. Does the auditor disregard the applicable AICPA auditing standards?

Answer: No. A GAGAS financial audit incorporates the applicable AICPA auditing standards and adds requirements. The explicit grant condition establishes why the Yellow Book applies.

4. A Private Company Requests Limited Assurance

Scenario: A private company requests a review of its annual financial statements under SSARS. The accountant plans inquiry and analytical procedures. What assurance should the report provide?

Answer: Limited assurance. A compilation provides no assurance, while an audit provides reasonable assurance. The accountant must also address the review engagement’s independence requirements.

5. A CPA Reports Specified Procedures and Findings

Scenario: A CPA is engaged under SSAE to perform agreed-upon procedures on specified information and report the findings. Does the report provide reasonable assurance?

Answer: No. An agreed-upon procedures report describes the procedures and findings without an assurance opinion or conclusion. Do not confuse the existence of a written report with the provision of assurance.

Want more practice like this? Work through engagement-type questions in the AUD CPA Test Bank, then come back to this guide whenever you miss one.

FAQs About Auditing Standards

What is the difference between GAAS and GAAP?

GAAS governs the auditor’s work and reporting; GAAP governs accounting and financial statement presentation.

How do I distinguish a SSARS review from an SSAE review?

Identify the subject matter and engagement scope. A review of a private company’s annual financial statements generally follows SSARS; an attestation review of other eligible subject matter follows SSAE. Limited assurance alone does not identify the framework.

Does government funding automatically require a GAGAS audit?

No. Determine whether a law, regulation, grant, contract, or other requirement calls for GAGAS. Entity type or government funding alone does not answer the question.

Does a written report always provide assurance?

No. Compilation and agreed-upon procedures reports provide no assurance. A review provides limited assurance, and an audit or examination provides reasonable assurance.

When is a Single Audit required?

A non-federal entity expending at least $1,000,000 in federal awards during its fiscal year generally needs a Single Audit, unless it qualifies for and elects a program-specific audit. This threshold applies to fiscal years beginning on or after October 1, 2024.

Are SAS No. 150 and SAS No. 151 currently tested?

As of October 2026, no. Both are effective for audits of periods ending on or after December 15, 2028. Applying the AICPA’s testing policy gives January 1, 2029, as the earliest eligibility date; this is a calculated date, not a confirmation of exam coverage.

Continue Studying with Farhat Lectures

Use the Farhat Lectures Auditing Course to work through the linked lessons in this order: standards and guidelines, SAS and PCAOB distinctions, government auditing, SSARS, SSAE, and professional responsibilities. Access to individual lessons depends on the course and your enrollment.

Then reinforce the distinctions with the AUD CPA Test Bank. For every missed question, record the service requested, the applicable framework, the assurance level, and the fact that rules out the closest alternative.

New to Farhat Lectures? Try the Free Sample Course to explore the teaching approach before enrolling.

Key takeaway: Selecting auditing standards begins with understanding the engagement. Match the service and entity to the framework, check for additional requirements, and confirm that the proposed report provides the appropriate assurance.

About the author: Mansour Farhat, DBA, CPA, CIA, is an accounting professor and the founder of Farhat Lectures and its YouTube channel. He holds a Doctor of Business Administration from Temple University and a Master of Accountancy from Bloomsburg University. He’s a veteran accounting educator who helps students prepare for college accounting courses and the CPA, CMA, and EA exams. The practice scenarios in this guide are original examples written for Farhat Lectures students. Last reviewed: October 2026.