For a US small business, being audit-ready means one thing: any number on your financial statements or tax returns can be traced to a source document, through a reconciled account, by someone who can explain it — whether the request comes from an outside CPA firm, the Internal Revenue Service (IRS), or a lender. The practical path is a scope check (which “audit” are you facing?), a records check against IRS retention rules, a 30-day preparation plan, and a prepared-by-client (PBC) register that assigns every requested item to a named owner. The biggest limitation to accept up front: preparation improves the process, it does not guarantee an outcome — no checklist can promise an unqualified opinion, a no-change IRS letter, or continued credit.
Quick answer
Work through five steps, in order: (1) confirm which engagement you are preparing for — a financial statement audit, a review, an IRS examination, or a lender field exam — because each asks for different evidence; (2) verify you hold the records federal law expects, for the periods it expects; (3) run a 30-day readiness plan that closes the books, reconciles every balance sheet account, and assembles documents before the requester arrives; (4) log every request and delivery in a PBC register with a responsible owner; and (5) fix internal-control gaps, especially anywhere one person can move money and record it. This page sits within our Accounting Operations and Reporting hub, which covers the monthly-close and reporting disciplines that make audit prep routine instead of heroic.
Which “audit” are you actually preparing for?
“Audit” covers at least four different engagements for a US small business, and preparing for the wrong one wastes weeks. A financial statement audit is performed by an independent certified public accountant (CPA) and ends in an opinion on whether your statements follow a stated financial reporting framework — usually US Generally Accepted Accounting Principles (GAAP), sometimes a cash or tax basis. A review is a lighter CPA engagement: according to the American Institute of CPAs (AICPA), the CPA “is required to perform inquiry and analytical procedures as a basis for obtaining limited assurance,” without the verification and substantiation testing of an audit. An IRS examination tests whether your tax return was reported correctly under the tax law — a different question from whether your books follow GAAP. And a lender field examination verifies the collateral behind an asset-based loan, not your statements as a whole.
Table 1: Scope differences — financial statement audit vs. review vs. IRS examination vs. lender field exam.
| Dimension | Financial statement audit | Review | IRS examination | Lender field exam |
|---|---|---|---|---|
| Who performs it | Independent CPA firm | Independent CPA | IRS examiner | Lender or its exam firm |
| Question answered | Are the statements fairly presented under the framework (e.g., US GAAP)? | Do the statements appear free of material modification? | Is the tax reported correct under tax law? | Does the pledged collateral (receivables, inventory) exist and qualify? |
| Assurance level | High, not absolute (opinion) | Limited | Determination: no change, agreed, or disagreed | Collateral valuation and eligibility findings |
| Typical trigger | Investor, lender, buyer, or covenant requirement | Growing financing needs | Random screening, related-party exams, or return anomalies | New or renewed asset-based credit line |
| What they ask for first | Trial balance, reconciliations, contracts, subsequent events | Trial balance, statements, inquiry responses | The specific records behind return items, requested in writing | Receivable agings, invoices, inventory records, borrowing-base reports |
Interpretation: notice that only the first two rows opine on your financial statements. An IRS examination reaches book records only as evidence for tax positions, and a field exam reaches your records only as evidence for collateral. Match your preparation to the row you are actually in — and remember that for a review or an audit, the AICPA notes the CPA must be independent, so your own bookkeeper cannot audit or review the books they keep.
What records must you keep, and for how long?
Federal tax law sets the floor. The IRS recordkeeping guidance makes the burden of proof explicit: the duty to substantiate the entries, deductions, and statements on a tax return sits with the taxpayer, not with the examiner. The same IRS page directs businesses to:
“Keep all records of employment taxes for at least four years.” — Internal Revenue Service
For income tax records, the IRS retention schedule (accessed July 27, 2026) ties retention to the period of limitations — the window in which you can amend a return or the IRS can assess additional tax:
Table 2: IRS minimum retention periods for income tax and employment records (federal rules, as of July 2026).
| Situation | Keep records at least |
|---|---|
| Standard return, no special circumstances | 3 years after filing |
| Claim for credit or refund after filing | 3 years from filing or 2 years from payment, whichever is later |
| Worthless securities or bad-debt deduction claim | 7 years |
| Unreported income exceeding 25% of gross income shown | 6 years |
| No return filed, or fraudulent return | Indefinitely |
| Employment tax records | 4 years after the tax becomes due or is paid, whichever is later |
| Records connected to property | Until the period of limitations expires for the year you dispose of the property |
Interpretation: “3 years” is a floor, not a target. The IRS itself warns not to discard records after the tax window closes until you confirm insurers and creditors do not require them longer — and lenders, investors, and state rules often do. State retention rules for payroll, sales tax, and corporate records vary and can exceed federal minimums, so confirm the states where you operate. Organizing books against these periods is the core of financial audit preparation as an ongoing discipline rather than an annual scramble.
What does a 30-day audit readiness plan look like?
Thirty days is realistic for a business that closes its books monthly; if your books are months behind, the plan still works — the first two weeks just get longer. Assign each window a single accountable owner. In a small business the owners below are typically the business owner or president, the bookkeeper or controller (in-house or outsourced), the outside CPA, and the payroll provider.
Table 3: 30-day audit readiness plan with responsible owners (a template — adapt names and dates to your engagement).
| Window | Focus | Key tasks | Accountable owner |
|---|---|---|---|
| Days 1–7 | Scope and request list | Confirm engagement type, period, and basis (US GAAP, cash, or tax); get the requester’s document list; open the PBC register; assign owners and due dates | Owner/president, with outside CPA |
| Days 8–14 | Close and reconcile | Complete the close through the audit period; reconcile every balance sheet account (cash, receivables, inventory, payables, debt, equity); clear stale items | Bookkeeper/controller |
| Days 15–21 | Documents and support | Pull source documents: bank statements, invoices, contracts, loan agreements, payroll filings, fixed-asset schedules, tax returns; match each PBC item to evidence | Bookkeeper/controller |
| Days 22–26 | Controls walk-through | Document who approves payments, who can add vendors, who reconciles the bank, who has system access; note where one person controls a full transaction | Owner/president |
| Days 27–30 | Self-review and delivery | Review the register for completeness; spot-check that report totals tie to the trial balance; deliver the package and log what was sent, when, and to whom | Owner/president and bookkeeper/controller |
Interpretation: the plan front-loads reconciliation because examiners and auditors start from your balances, and it ends with a logged delivery because “we sent it” is only provable if the register says so. Run the same plan every year and the days 8–14 window shrinks to a checklist review instead of a cleanup.
What goes on the PBC register?
A prepared-by-client (PBC) list is the requester’s inventory of everything they want from you — schedules, statements, reconciliations, contracts, confirmations. A PBC register is your working copy of that list with management columns added: who owns each item, where it lives, and whether it has been delivered. Keeping the register is what turns an inbox of ad hoc requests into a controlled process.
Table 4: Sample PBC register extract for a first-year financial statement audit (illustrative rows; actual requests come from your auditor or examiner).
| Ref | Requested item | Source system | Period | Owner | Status |
|---|---|---|---|---|---|
| PBC-01 | Trial balance and general ledger detail | Accounting software | FY 2025 | Controller | Delivered 08/04/2026 |
| PBC-02 | Bank statements and reconciliations, all accounts | Bank portal + rec workpapers | Jan–Dec 2025 | Bookkeeper | Delivered 08/06/2026 |
| PBC-03 | Accounts receivable aging and subsequent receipts | Accounting software | 12/31/2025 | Bookkeeper | In progress |
| PBC-04 | Accounts payable aging and subsequent payments | Accounting software | 12/31/2025 | Bookkeeper | In progress |
| PBC-05 | Loan agreements, amortization schedules, lender statements | Document vault + lender portal | FY 2025 | Owner | Not started |
| PBC-06 | Payroll tax filings (Forms 940/941) and W-2/W-3 | Payroll provider | FY 2025 | Payroll provider contact | Requested |
| PBC-07 | Fixed-asset additions/disposals with invoices | Fixed-asset register | FY 2025 | Controller | Not started |
| PBC-08 | Material customer and vendor contracts | Document vault | Active in FY 2025 | Owner | In progress |
Interpretation: three columns do the heavy lifting — owner, status, and source system. If any row lacks a named owner or a source, it will be the row that stalls the engagement. For an IRS examination the same register works, but scope it tightly: the IRS audit process page (accessed July 27, 2026) notes the IRS “will provide you with a written request for the specific documents we want to see,” so respond to the items requested rather than volunteering your entire file room. The IRS also accepts some electronic records in lieu of or in addition to paper, per the same page — confirm acceptable formats with the assigned examiner.
Which reconciliations and controls get checked first?
Auditors and examiners tend to start where errors concentrate. Work this reconciliation and control checklist before they do:
- Cash. Reconcile every bank and credit card account through the period end; investigate unreconciled differences, stale outstanding checks, and deposits in transit older than a few business days.
- Accounts receivable. Tie the aging to the general ledger; review old balances for collectibility; confirm credit memos and write-offs have approval.
- Accounts payable. Tie the aging to the general ledger; search for unrecorded liabilities (invoices received after period end for pre-period goods or services).
- Payroll. Tie payroll registers to the ledger and to filed payroll tax returns; confirm employer tax deposits match filing periods.
- Debt. Tie loan balances to lender statements; confirm interest expense and any covenant calculations.
- Equity and revenue. Reconcile equity movements to documents (contributions, distributions, stock activity); tie reported revenue to invoices and deposits.
- Controls. No single person should be able to initiate a payment, approve it, and reconcile the account; vendor additions and bank-detail changes need a second approval; system access should match current roles; someone other than the bookkeeper should review the monthly bank reconciliation.
In very small teams, full separation of duties is not always possible; the compensating control is owner review — the owner personally reviewing bank statements, reconciliations, and payment runs each month, documented so an auditor can see it happened.
Worked example: is this reconciliation audit-ready?
The following is a hypothetical illustration with made-up inputs for a fictional US services company reconciling its operating account at June 30, 2026. It is a bookkeeping workpaper, not a tax computation or a GAAP adjustment schedule.
Table 5: Hypothetical bank reconciliation, June 30, 2026 (USD; all inputs invented).
| Step | Line | Amount |
|---|---|---|
| Bank side | Bank statement balance, June 30 | $48,200.00 |
| Add: deposits in transit | $3,400.00 | |
| Less: outstanding checks | ($5,150.00) | |
| Adjusted bank balance | $46,450.00 | |
| Book side | Cash per general ledger | $45,910.00 |
| Less: bank service charge not yet booked | ($85.00) | |
| Less: customer check returned for non-sufficient funds (NSF), not yet recorded | ($625.00) | |
| Add: note collected by bank, not yet recorded | $1,000.00 | |
| Adjusted book balance | $46,200.00 | |
| Gap | Adjusted bank minus adjusted book | $250.00 |
Method and output: the bank side computes $48,200.00 + $3,400.00 − $5,150.00 = $46,450.00; the book side computes $45,910.00 − $85.00 − $625.00 + $1,000.00 = $46,200.00; the unexplained difference is $46,450.00 − $46,200.00 = $250.00.
Interpretation: $250 is about 0.5% of the $46,200 adjusted book balance — immaterial in dollars, but material as a process signal. A reconciliation that ends with an unexplained plug is not finished; an auditor will ask what the $250 is, and common answers (an unrecorded receipt, a duplicated expense entry, a transposed digit) each point to a different control gap. Audit-ready means every reconciling item is identified, supported, and cleared — not merely small. One anonymized RFS engagement involved exactly this kind of mismatch, where an early-stage company’s IRS-filed statements did not agree with its bank records; reconciling and re-preparing the financials was the core of the work described in our investor-readiness reconciliation case study. That is one client’s experience, not a promised result.
What about the IRS specifically?
An IRS examination is narrower and more procedural than a financial statement audit. Per the IRS audits page (accessed July 27, 2026), it reviews the organization’s or individual’s books, accounts, and financial records to verify that:
“information reported on their tax return is reported correctly according to the tax laws” — Internal Revenue Service, IRS audits page
The same page adds that the examination also verifies the reported amount of tax is correct. The IRS conducts audits by mail or through an in-person interview (office or field), notifies you by mail first — never by telephone to initiate an audit — and generally includes returns filed within the last three years, usually not going back more than six. It concludes an audit one of three ways: no change, agreed, or disagreed. The same checklist above prepares you, with two adjustments: answer only the written request’s items, and track response deadlines, since the IRS completes the audit with proposed changes if you do not respond. What raises the odds of being selected in the first place — return anomalies and related-party examinations — is a separate question covered in our guide to red flags that can trigger an IRS audit; this page deliberately stays on the preparation workflow, not tax defense.
And what does a lender field exam involve?
If your credit line is asset-based, the lender’s collateral — usually your receivables and inventory — gets examined instead of your whole business. Bank of America Business Capital’s asset-based lending overview (accessed July 27, 2026) explains:
“The field examination and inventory appraisal determine the eligible collateral and the advance rates against them.” — Bank of America Business Capital
In practice, the same overview says your company “will undergo field examinations to determine the level and quality of its financial and physical assets,” starting with accounts receivable and inventory, and that borrowers typically provide monthly reports updating the borrowing base — so your agings, invoices, inventory records, and borrowing-base certificates must all tie back to the ledger. Note the eligibility detail that catches borrowers off guard: lenders commonly count only current receivables (less than 90 days from invoice date or no more than 60 days past due), and the overview cautions that lenders may not be comfortable lending against construction receivables involving progress billings, retention, or bonding requirements. Field-exam readiness therefore means your aging is accurate, your invoices are documented, and your borrowing-base certificate ties to the ledger before the examiner arrives.
FAQs
How far back can the IRS audit my business?
Generally, the IRS can include returns filed within the last three years, and it usually does not go back more than six years, even when it identifies a substantial error; most audits cover returns filed within the last two years, per the IRS audits page cited above. The retention table in this article mirrors those windows, which is why three years is a floor, not a target.
Can my bookkeeper perform the audit for me?
No. Your bookkeeper prepares the books; an audit or review must be performed by an independent CPA, and the AICPA states independence is required for both. What your bookkeeper can and should do is everything in the 30-day plan — close, reconcile, assemble documents, and manage the PBC register.
Are digital records acceptable, or do I need paper?
The IRS accepts some electronic records in lieu of or in addition to paper records; confirm the acceptable formats with your assigned examiner or auditor. Whatever the format, the records must clearly show income and expenses and be producible on request.
How long does audit preparation take?
For a business with monthly closes and current reconciliations, the 30-day plan above is a realistic template. If the books are behind, expect the close-and-reconcile window to expand; that is a reason to fix the monthly process, not just the audit package.
Does being audit-ready guarantee a clean outcome?
No. Preparation affects speed, cost, and stress; it does not determine the auditor’s opinion, the IRS’s determination, or the lender’s collateral findings. Those depend on your facts, your records, and the applicable standards and law.
The bottom line
Pick your scope row in Table 1, verify your records against the federal retention floor in Table 2, then run the 30-day plan: close and reconcile first, assemble documents second, walk your controls third, and log everything in a PBC register with named owners. Repeat annually and audit prep becomes an export of work you have already done. If your books are not reconciled monthly or no one owns the register, that is the gap to close first — our remote bookkeeping services run that close-and-reconciliation discipline year-round, and a readiness review will tell you where your books stand before a CPA firm, the IRS, or a lender asks.
This article is general educational information for US small businesses, not tax, legal, audit, or accounting advice. Retention periods, examination procedures, engagement standards, and lender practices change and vary by state, industry, and contract; consult a qualified CPA or tax professional about your specific facts before acting.