Can a Fractional CFO Do Your Audit

All right, here is the plain answer. No. A fractional CFO cannot do your audit. An audit is attest work, and attest work can only be performed by a licensed CPA firm that is independent of you. A fractional CFO can get you ready for the audit, then sit beside you through it. Those are two different jobs.

I want to say that clearly because the market does not. Look at any directory of finance providers and you will find bookkeeping, CFO advisory, tax filing and audit listed as though they were four items on one menu, orderable in any combination. Some of those firms genuinely hold the licence for all of it. Many do not, and a founder reading the list has no way to tell which is which. So the question in the title is not naive. It is the right question, asked by someone who noticed the categories are blurry and would rather find out now than during diligence.

The reason the answer is a flat no is not modesty. The whole value of an audit depends on the auditor being somebody other than the person who did the accounting. Take that away and you have not saved money. You have bought a document that means nothing, from a firm that cannot issue it, and you will find that out the week a lead investor's diligence team asks who signed it.

So let me walk you through it the way I would on a call. What an audit actually is and who may perform one. Why the same firm cannot both prepare and audit, in the regulators' own words. What audit readiness genuinely is, and where the line sits. How to hire the audit firm and tell a real one from a claim. What I do while your auditor is in the file. And whether you even need an audit this year, because a surprising number of companies pay for one nobody required.

An audit is a narrow legal product, not a thorough look at the books

People use "audit" to mean careful. In our profession it means something much more specific. AU-C Section 200, the AICPA standard that governs the whole enterprise, describes the purpose of an audit as producing "an opinion by the auditor on whether the financial statements are presented fairly, in all material respects."¹² That opinion is the product. Not the tidy books, not the schedules, not the advice along the way. A signed opinion, addressed to whoever is going to rely on it, backed by the auditor's licence and their liability.

And an opinion is only the top rung of a ladder. Underneath it sits the review, where the practitioner "performs certain procedures (analytics and inquiries) in order to obtain review evidence to support the limited assurance conclusion."¹⁴ Below that sits the compilation, where, as one plain summary puts it, "The output is formatted financial statements, not an assurance."¹⁵ At the bottom sits the preparation engagement under AR-C Section 70, which requires the words "no assurance is provided" on the face of the statements.¹³ That bottom rung is where ordinary monthly close work stands. It is honest, it is useful, and it is not an audit.

Who may climb the ladder is a licensing question, decided state by state. The Uniform Accountancy Act, the model act state boards draw from, was amended so that its definition of attest requires that "only CPAs operating within a CPA firm can perform" audits under the auditing standards, reviews under SSARS, and examinations and agreed-upon procedures under the attestation standards, plus anything done under PCAOB standards.⁸ The individual licence is not enough on its own. The work has to run through a permitted firm.²² In Arizona, where we are formed, the statute is blunt about the label too: a person or firm "shall not assume or use the CPA designation unless the individual or firm is qualified," and a firm may not call itself a CPA firm without a simple majority of licensed ownership.⁹

Which is why our own boundary is written into the footer of every page on this site rather than buried in an engagement letter. We are not a CPA firm and we perform no attest work, no audit, review, compilation or assurance, and no legal or investment advice. I am not a CPA, and that is a deliberate choice rather than an unfinished errand. My work is running finance functions, not signing opinions on them, and the two skills point in different directions.

Why the firm that closes your books cannot be the firm that audits them

Here is the mechanism, and once you see it you will never unsee it. The SEC's independence rule, Rule 2-01 of Regulation S-X, tells the Commission what to look at first when deciding whether an accountant is independent, and one of the four things is whether a relationship "places the accountant in the position of auditing his or her own work."¹²⁶ That is the self-review threat, and it is fatal to the value of the opinion. Charles Hall, a CPA who has spent about forty years auditing governments and small businesses, puts it in one sentence: "You are auditing something (the financial statements) that you created."⁷

The rule then names the specific services that break independence, and the first one on the list is the work a fractional finance team does every month. Rule 2-01(c)(4)(i) prohibits bookkeeping or other services related to the accounting records or financial statements of the audit client, spelled out as maintaining or preparing the client's accounting records, preparing the financial statements themselves, and preparing or originating the source data underneath them.¹ Paragraph (c)(4)(vi) adds management functions, defined as acting as a director, officer or employee, or "performing any decision-making, supervisory, or ongoing monitoring function for the audit client."¹ Read those two together and you have described a fractional CFO's job description almost line for line. That is not an accident. Those are exactly the services that make the person doing them unable to audit the result.

The government sector reaches the same conclusion by a different road. GAO's Yellow Book, in paragraph 3.88, says preparing financial statements in their entirety from a client-provided trial balance or the underlying records "creates significant threats" to independence, which the auditor must document and safeguard against or else decline the work.⁷ Note what that does not say. It does not say the client's competence solves it. The AICPA has been explicit that a client's skill, knowledge and experience "should not be viewed as a safeguard, but rather a mandatory condition" before any non-audit service is provided.⁷ Your controller being sharp is the price of admission, not the cure.

And this is not a technicality nobody enforces. In September 2019 the SEC charged a Big Four firm over 19 engagements for 15 registered issuers, finding it had exercised decision-making authority over an audit client's financial reporting software and engaged in management functions, with monetary relief over $7.9 million and a censure. The enforcement division's Anita Bandy said auditors "must ensure that non-audit services do not come at the cost of their independence on audits of public companies."³ A month earlier, a national firm was charged over more than 100 audit reports involving at least 15 clients, where the prohibited services included payroll outsourcing, loaned staff, financial system implementation and bookkeeping, settled at $950,000 and a censure. "The SEC's auditor independence rules specifically prohibit audit firms from providing certain non-audit services," said Carolyn Welshhans of the enforcement division.⁴

The SEC's then Acting Chief Accountant, Paul Munter, went further in 2022, warning firms not to treat the enumerated prohibitions as a box-ticking exercise, because "compliance with the prohibitions enumerated in Rule 2-01(c) is necessary but not sufficient."² The general standard, whether a reasonable investor would think you could be objective, always applies. If you want to see how seriously the profession takes the split, read the legal footer on any large advisory firm's own website: the licensed entity that provides attest services and the advisory entity that does not are deliberately kept as separate legal persons.¹¹ Firms with thousands of partners build corporate structures around this line. It is not a line a solo provider talks their way across.

What I can do for your audit, and what I cannot

Now the useful part, because none of the above means a fractional CFO is a bystander. The distinction is between preparing the company and rendering the opinion, and the brief version fits in a table you can screenshot for your next board call.

Everything in the left column is preparation, which is a non-attest service and carries no independence requirement at all.¹³ Everything in the right column requires a licence, a firm permit, and independence from you. The left column is where the money is saved, incidentally, because most of what makes a first audit expensive and slow is not the auditing. It is the auditor waiting on you.

How to hire the audit firm, and how to tell a real one

Start with what the opinion has to satisfy, because that determines who is eligible. If you are heading for a public offering, the audit must be performed by a firm registered with the PCAOB under PCAOB standards, and a GAAS audit will not substitute. Those standards moved recently: AS 1000 was adopted in May 2024, approved by the SEC that August, and applies to audits of fiscal years beginning on or after December 15, 2024, replacing four older standards including the one that used to carry the independence requirement on its own.¹⁹ If you expend federal awards, the relevant rule is 2 CFR 200.501, under which an entity crossing the threshold "must have a single or program-specific audit conducted for that year in accordance with the provisions of this part."⁵ If you are a government or a recipient of government assistance, your auditor is working under the 2024 Yellow Book, which GAO issued in February 2024²⁵ and which is "effective for financial audits, attestation engagements, and reviews of financial statements for periods beginning on or after December 15, 2025."⁶

Then ask three questions and listen carefully to the answers. First, what is the name of the licensed firm that will issue the opinion, and in which state is the firm permit held. A real answer is a firm name and a jurisdiction, and a vague answer is also an answer. Second, is the firm independent of us under the standard that applies to our situation, and has anyone on their side done bookkeeping, systems implementation or management work for us. Third, who signs, and what does their peer review or inspection history look like. None of that is rude. Audit committees ask it as routine, and a founder without an audit committee has to ask it themselves.

One more thing I would tell you as a friend. If a provider offers to both close your books and audit them, that is not a bargain, it is a red flag, and the flag is theirs rather than yours. It says they either do not know the rule or have decided it does not apply to them, and neither is someone you want holding your general ledger.

What I am actually doing while your auditor is in the file

My job during an audit is to make the auditor's work boring. That is the whole objective. An audit becomes expensive and long in exactly one way: the auditor asks a question, nobody can answer it from the records, so somebody reconstructs history under time pressure and the auditor then has to test the reconstruction. Multiply that by forty requests and you have a fire drill and an invoice nobody planned for.

So we work backwards from the request list. Every balance sheet account gets a rollforward schedule that ties to the ledger and carries its own support, built during the year rather than in March. Judgment areas get a memo written while the facts are fresh, with the policy, the inputs and the conclusion in one place. Estimates get a documented method that does not change shape each quarter. And the request list gets one owner, me, so your engineers and scientists are not fielding accounting questions in the middle of their own work.

The data on what goes wrong supports that emphasis. Baker Tilly's people, analysing SEC filings from 2020 through 2024 across more than five thousand management assessments and over three thousand auditor assessments, found the leading causes of material weaknesses to be a lack of qualified accounting personnel, segregation of duties, IT controls, disclosure controls and non-routine transactions, with revenue recognition the largest accounting-related contributor. Their most sobering finding is about repeats: "Over 60% of adverse reports are from repeat filers, with nearly 70% in the last two years."¹¹ Notice that almost none of those are auditing failures. They are accounting capacity failures. That is the fixable side of the ledger, and it is the side a fractional CFO lives on.

I learned this part the hard way rather than from a textbook. My first assignment at a specialty pharmacy was a three-year lookback, restating books that had been wrong the whole time, and that company later grew from about $50 million to about $500 million in revenue and reached a clean audit and a sale. Later, providing pharmaceutical clinical trial accounting for a client, I learned the rigor of FDA clinical trial accrual methodologies for human and animal clinical trials, which is an unforgiving school for anyone who thinks accruals are approximate. Both times I sat on the company's side of the table, building the file the auditors then tested. Never the other side. That is the distinction this whole article is about.

Do you even need an audit this year

Ask this before you spend anything, because plenty of companies buy an audit no one required and skip a review that would have satisfied the actual reader. Audits get triggered by a rule or by a contract, so find out which one is pointing at you.

Contract triggers are the common ones for venture-backed companies, and they live in the financing documents. Information rights in the standard venture forms treat audited financials as a negotiated item, typically phrased as "audited financial statements, certified by independent public accountants of a nationally recognized firm," and early-stage companies routinely negotiate the timing or the level of assurance because the cost lands at the same moment every public accounting firm is busiest.¹⁶ Those forms are the templates most institutional financings are drafted from, so the clause in your own agreement is the authority, not anyone's rule of thumb.²⁰²¹ Read yours. I mean that literally: open the investors' rights agreement and read the reporting covenant, because I have watched founders commission an audit that their own document did not ask for.

Rule triggers are more varied than founders expect. Federal award spending crosses the single audit threshold at $1,000,000, and below that an entity is exempt from federal audit requirements while still having to make records available to the agency and to GAO.⁵ Charitable registration can do it: in New York the threshold moved "from $750,000 to more than $1 million" of gross annual revenue and support, with a CPA review report required in the band beneath that.¹⁰ Your benefit plan can do it without any investor involved, because under federal law most plans with 100 or more participants "must submit audited plan financial statements" with the Form 5500, and choosing that accountant is itself a fiduciary act.¹⁷ Even there the detail matters, since from the 2023 plan year the participant count is based on participants with account balances rather than everyone eligible, which took some plans back out of the requirement.²³ And if you are filing with the SEC, independence applies across every year in the filing, not just the latest one.²²⁴

The honest answer for a lot of seed and Series A companies is that nothing requires an audit yet, and the right spend is clean accrual books with real schedules, so that when an audit is required it is a confirmation rather than an excavation. That sequence is cheaper and calmer. It also keeps the option open, because a company with a defensible file can start an audit whenever the board asks, and a company without one cannot, no matter what it is willing to pay in a hurry.