How do you audit financial statements for discrepancies step by step?

What "Auditing Financial Statements for Discrepancies" Actually Means

Auditing financial statements for discrepancies is the process of independently examining a company's books, records, and supporting documents to identify misstatements, omissions, errors, or irregularities before the statements are issued to investors, lenders, or regulators. The purpose is not to guarantee that every number is correct, but to provide reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by error or fraud. Materiality is judged in context: under U.S. Generally Accepted Auditing Standards (GAAS) and International Standards on Auditing (ISA), a misstatement is material if it would influence the economic decisions of a reasonable user of the statements.

Also worth reading: How do auditors detect financial discrepancies, and what methods catch fraud before it becomes a scandal? · What are the best practices for auditing financial records to find discrepancies? · How accurate are AI systems at detecting discrepancies in financial audits in 2026?

In practice, auditors rarely chase every rounding difference. They focus on areas where misstatement is most likely: revenue recognition, estimates, related-party transactions, and unusual one-time entries. Public-company audits must follow PCAOB Auditing Standards in the U.S., while private companies follow AICPA SAS standards, and cross-border issuers follow the IFRS-compatible ISAs. The international framework matters because IFRS was explicitly designed to make financial statements "understandable and comparable" across borders, so deviations from expected presentation are themselves a red flag.

The Core Framework: Planning, Evidence, and Reporting

Every financial-statement audit follows the same backbone. First, the auditor performs risk assessment procedures: understanding the entity, its environment, and its internal controls. This is required by ISA 315 and PCAOB AS 2110. Next, the auditor designs responses to those risks, including tests of controls and substantive procedures. Fieldwork then consists of gathering audit evidence—every figure must be tied to a source document, third-party confirmation, recomputation, or analytical comparison. Finally, the auditor forms an opinion based on whether the evidence supports each material account balance and disclosure.

The evidence step is where discrepancies are caught. Audit evidence is anything the auditor uses to draw conclusions, including source documents, accounting records, confirmations from third parties, and analytical relationships. PCAOB enforcement actions against former Big Four firm Arthur Andersen in 2002 and the later $97.3 million in financial reporting errors at the North Carolina Department of Public Safety show what happens when evidence is inadequate or when management overrides controls without the auditor catching it.

The Step-by-Step Audit Procedure for Finding Discrepancies

Step one is engagement setup. The auditor confirms independence, identifies the reporting framework (U.S. GAAP, IFRS, or another basis), sets materiality, and agrees on a timeline. Materiality is often calculated as a percentage of revenue, total assets, or profit before tax, with 5% of pre-tax income and 0.5%–1% of total assets being common benchmarks for private-company audits.

Step two is risk identification. The auditor walks through the major transaction cycles—revenue, purchases, payroll, inventory, fixed assets, cash—and asks, "What could go wrong?" For revenue, common risks include cut-off errors (recognizing December sales in January), bill-and-hold transactions, and side agreements that change the substance of a sale. For fixed assets, the 2024 state audit of the City of Edmonds, Washington found discrepancies specifically in asset depreciation, illustrating how easily a multi-year schedule can drift when useful lives or salvage values are not updated.

Step three is internal control testing. The auditor identifies controls that prevent or detect errors and tests whether they actually worked. A weak control in a high-risk area pushes the auditor toward more substantive testing. Iowa City schools' 2024 accounting review surfaced "fundamental errors" only after staff raised concerns, a reminder that external auditors can also rely on whistleblower tips and management letters.

Step four is substantive testing. The auditor performs analytical procedures (comparing this year to last year, to budget, and to industry data) and test of details. Detail tests include tracing from a sample of recorded transactions to source documents and vice versa, confirming bank balances and customer receivables, physically observing inventory, and recomputing depreciation and accruals. If the general ledger shows $4.2 million in legal expense but legal confirmations reveal only $3.1 million in incurred fees, that $1.1 million gap is a discrepancy worth investigating.

Step five is evaluation. The auditor aggregates known misstatements and projects likely errors from the sample to the population. If projected errors exceed materiality, the auditor asks management to adjust the statements. If management refuses and the errors are material and pervasive, the audit opinion is qualified or adverse.

How to Audit Your Own Books Before the Auditor Arrives (Self-Audit)

If you are a small-business owner or controller who wants to clean up the books before hiring a CPA, the same logic applies at lower formality. Start by reconciling every bank account, credit card, and loan to the general ledger as of the period-end date. Tie the ending cash balance on the balance sheet to the bank statement's adjusted balance. Next, confirm that accounts receivable and accounts payable detail reports agree to the control totals in the subledger, and that the subledger agrees to the general ledger.

Run an analytical review: compute the current ratio (current assets ÷ current liabilities), gross margin percentage, days sales outstanding, and inventory turnover, then compare to prior periods. A sudden drop in gross margin from 42% to 31% without a clear business reason often points to inventory or revenue-cutoff errors. Recompute depreciation for a sample of fixed assets using the company's stated policy; one of the most common discrepancies found in small audits is depreciation that has not been updated when assets are disposed of or reclassified.

Finally, scan journal entries for unusual entries posted in the last week of the period. Manual adjusting entries to revenue, unusual manual credits to expense, and entries posted by the CFO near year-end are statistically more likely to be misstatements, whether intentional or not. The 2025 Port Arthur, Texas audit was clean overall but left a recurring finance issue unresolved, which is the more typical pattern: the statements are accurate, but a control weakness persists.

Common Methods Auditors Use to Find Discrecnpancies (Comparison)

The most effective audits combine at least two methods in each significant area, because no single test catches every type of error.

Common Discrepancies Found in Real Audits

A review of recent public-sector audits shows the same handful of error types repeating across very different organizations. The 2025 Halbur, Iowa state audit flagged internal control and financial reporting errors typical of a small municipality with limited staff. The Sodus, New York comptroller audit found missing financial reports, meaning the underlying records needed for the audit simply were not produced. The North Carolina DPS audit uncovered $97.3 million in financial reporting errors, demonstrating that even large state agencies are not immune. The Iowa City schools' 2024 review produced emails referring to "fundamental errors" in the accounting, an unusually candid description.

Across these cases, recurring categories include misclassified expenses (capital vs. operating), unrecorded liabilities at year-end, depreciation calculated on disposed assets, interfund balances that do not offset, and grant revenues recognized before the grant's eligibility conditions were met. In the private sector, the Enron scandal showed what happens when special-purpose entities are not consolidated and the related disclosures are suppressed—an extreme example, but instructive. A Malaysian watchdog group also flagged an RM4.8 billion audit discrepancy in 2024, reinforcing that the scale of a reporting failure is not a reliable indicator of whether one will be caught.

Mistakes Auditors and Clients Make That Hide Discrepancies

One common mistake is accepting management's representations without verification. Representations from management are required by ISA 580, but they are not a substitute for independent evidence. Another mistake is setting materiality too high to reduce work, which leaves smaller-but-cumulatively-significant errors in the statements. Auditors also sometimes rely excessively on prior-year working papers, especially when staff turnover is high, which is how a 2022 error can survive untouched into the 2024 audit.

On the client side, a frequent mistake is treating the audit as a once-a-year event rather than a continuous process. The concept of continuous auditing exists precisely to address this: financial information is checked in real time or near real time, allowing discrepancies to be addressed as they arise rather than at year-end, when adjustments are messier and more visible. Small organizations rarely implement full continuous auditing, but a monthly close with reconciliations is a workable proxy.

When to Act, How Long It Takes, and What It Costs

Acting earlier is almost always cheaper. A discrepancy caught during the year-end preparation can be researched, documented, and corrected in days. A discrepancy caught by the auditor in fieldwork often triggers extended testing, additional fees, and possible restatement. Public-company restatements between 2010 and 2020 frequently cost the issuer $1–$5 million in direct audit and legal fees, plus indirect costs in share price and management time.

For a private company, a first-year audit of a mid-sized business typically takes 4–10 weeks of fieldwork plus 2–4 weeks of reporting, depending on the number of locations and the quality of the records. Audit fees in the U.S. for a private company with $10–$50 million in revenue commonly range from $40,000 to $150,000. A smaller review or compilation engagement costs a fraction of that, but a review provides only limited assurance and a compilation provides none—neither is an audit and neither will catch most discrepancies on its own.

For internal investigations, forensic accountants often bill $300–$600 per hour, and a focused investigation into a suspected $1 million discrepancy can take 80–200 hours. The cost-benefit threshold for opening a forensic engagement is usually around 0.5%–1% of the suspected amount, or where regulators or lenders are already involved.

Practical Steps You Can Take This Week

Reconcile every cash and debt account to its bank or lender statement as of the latest period end. Run a trial balance and scan the largest ten accounts for unexpected balances, such as negative accumulated depreciation or a credit balance in an expense account. Recompute depreciation for one asset per asset class and compare to the ledger. Confirm at least the top five customer balances and top five vendor balances by direct email or letter. Review the last 20 journal entries posted in the closing week for unusual accounts, amounts, or preparers. Document any discrepancies found, the dollar amount, and whether management agrees they need adjustment. If discrepancies total more than your established materiality threshold—often 5% of pre-tax income for private companies—escalate the issue and consider involving external auditors before the year-end audit begins.

Key Takeaways Without Overpromising

Auditing financial statements for discrepancies is not a single technique but a layered process of risk assessment, evidence gathering, and professional judgment. It catches most material errors when performed properly, but it is not an absolute guarantee; the 2008 financial crisis demonstrated how entire categories of risk can be missed when systemic issues go unrecognized. For organizations that want stronger assurance, layering internal monthly reviews, an annual independent audit, and selective forensic reviews provides a more reliable defense against undetected discrepancies than relying on any single procedure.