Financial statement audit in Canada: what it is and when your business needs one

Who needs a financial statement audit

Public companies — mandatory

All public companies (reporting issuers) under provincial securities legislation and the Canada Business Corporations Act must have their annual financial statements audited. This includes companies listed on the TSX, TSX Venture Exchange, CSE, and NEX. The audit is required as a condition of maintaining their reporting issuer status, and the audited statements are filed with SEDAR+.

Private companies — when it's required

Most private companies in Canada are not legally required to have an audit. However, an audit is often required by:

• Lenders: Banks and other institutional lenders often require audited financial statements as a condition of credit facilities above a certain threshold (commonly $5–10 million). Your credit agreement will specify the reporting requirements.
• Investors and shareholders: Minority shareholders or institutional investors may require audited statements as a condition of their investment or under a shareholders' agreement.
• Government contracts: Some government procurement processes or grant programs require audited financial statements.
• Specific legislation: Non-profit organizations and charities above certain revenue thresholds, pension plans, credit unions, and other regulated entities may be required to have audits under specific provincial or federal legislation.
• CBCA and provincial corporations acts: The Canada Business Corporations Act and most provincial corporations acts require an audit unless shareholders have unanimously agreed to waive it. The waiver of audit requirement is available to private corporations with fewer than 15 shareholders (or a higher threshold in some provinces). If you have outside shareholders who have not agreed to waive the audit requirement, you may be legally required to have one.

Canadian Auditing Standards (CAS) — the CICA Handbook

Financial statement audits in Canada are conducted in accordance with Canadian Auditing Standards (CAS), which are contained in the CPA Canada Handbook — Assurance. The CAS are closely aligned with the International Standards on Auditing (ISA) issued by the International Auditing and Assurance Standards Board (IAASB), with some Canadian-specific modifications.

The key CAS relevant to most audits include:

• CAS 200–299: General principles and responsibilities — auditor objectives, ethical requirements, audit documentation, and quality control
• CAS 300–499: Risk assessment and response — planning the audit, understanding the entity, assessing risks of material misstatement
• CAS 500–599: Audit evidence — sources and types of evidence, external confirmations, analytical procedures
• CAS 600–699: Using the work of others — reliance on component auditors, internal audit, and experts
• CAS 700–799: Audit conclusions and reporting — forming an opinion, the auditor's report, going concern

Compliance with CAS is required for all members of CPA Canada who perform audits of financial statements of Canadian entities. The standards are regularly updated — CPAs are required to maintain their competency and apply the current standards for each engagement.

Audit vs. review engagement vs. compilation

Many businesses confuse these three levels of assurance, which represent very different levels of work and provide very different levels of comfort:

Audit (highest assurance)

An audit provides the highest level of assurance. The auditor performs procedures sufficient to provide reasonable assurance that the financial statements are free of material misstatement, whether due to error or fraud. The auditor gathers independent evidence, performs tests of controls and substantive procedures, and provides a positive opinion ("In our opinion, the financial statements present fairly..."). The cost is highest and the process is most extensive.

Review engagement (limited assurance)

A review provides limited assurance — less than an audit. The accountant performs inquiry and analytical procedures but does not test transactions or obtain independent external evidence. The accountant provides a negative opinion: "nothing has come to our attention to cause us to believe the financial statements do not present fairly..." Reviews are faster and less expensive than audits. They are often sufficient for smaller lenders or internal management purposes, but are not accepted in place of an audit where one is legally required.

Compilation (no assurance)

A compilation (or notice-to-reader) is not an assurance engagement at all. The accountant assembles financial information provided by management into financial statement format but provides no opinion on whether the statements are accurate. Compilation engagements are appropriate for small businesses preparing internal financial statements or for tax filing purposes, but provide no independent verification.

ASPE vs. IFRS — which applies to your business

Accounting Standards for Private Enterprises (ASPE)

ASPE is the financial reporting framework used by most private companies in Canada. ASPE is contained in Part II of the CPA Canada Handbook and is designed to be practical and cost-effective for private enterprises that do not have public accountability. Key features of ASPE include:

• Simpler fair value measurement requirements — most assets are measured at cost
• More policy choices available — companies can choose between different accounting policies for items like long-term debt, goodwill, and equity instruments
• Reduced disclosure requirements compared to IFRS
• Optional application of hedge accounting is simpler

International Financial Reporting Standards (IFRS)

IFRS, adopted in Canada under Part I of the CPA Canada Handbook, is mandatory for publicly accountable enterprises — publicly listed companies, Crown corporations required to comply, and entities whose securities are in the process of being issued in a public market. Some private companies voluntarily adopt IFRS, typically when they anticipate an IPO, have foreign investors who require IFRS financials, or are subsidiaries of foreign IFRS-reporting parents.

IFRS is more complex and more expensive to apply than ASPE. It requires more fair value measurements, more extensive disclosures, and has fewer accounting policy choices. However, IFRS financials are internationally comparable and accepted by global investors and lenders.

The transition from ASPE to IFRS

When a private company prepares for an IPO or acquires public accountability, transitioning from ASPE to IFRS is a significant undertaking that typically requires 12–24 months of planning, system changes, and staff training. Auditors perform additional procedures to verify the transition was properly applied.

Audit process phases

A financial statement audit follows a structured methodology governed by the Canadian Auditing Standards.

Phase 1: Planning and risk assessment

The auditor develops an overall audit strategy, identifies the most important risk areas (where financial statements are most likely to be materially misstated), and designs audit procedures responsive to those risks. This phase includes understanding the business — its industry, regulatory environment, internal controls, and governance — and developing expectations for key financial metrics using analytical procedures.

Phase 2: Internal controls evaluation

The auditor evaluates the company's internal controls over financial reporting. For larger businesses, strong internal controls allow the auditor to rely on them and reduce the amount of independent transaction testing required. Weaknesses in internal controls are noted as deficiencies, significant deficiencies, or material weaknesses — all of which must be communicated to management and, for material weaknesses, to those charged with governance (typically the audit committee or board).

Phase 3: Fieldwork (substantive testing)

The bulk of audit work. The auditor tests balances and transactions to verify they are correctly recorded. This includes:

• Confirmation of bank balances, accounts receivable, and debt directly with third parties
• Physical inventory counts (for businesses with significant inventory)
• Testing of revenue recognition — examining contracts, invoices, and delivery records
• Testing of expense accruals, especially year-end provisions and estimates
• Verifying the existence and valuation of significant assets
• Testing payroll, including spot-checking employee records and reconciling to T4 filings

Phase 4: Completion

Near the end of the audit, the auditor performs completion procedures: reading minutes of directors' meetings, searching for subsequent events (significant events after year-end that require disclosure), obtaining legal letters from the company's lawyers, and obtaining a management representation letter in which management confirms key facts and representations made to the auditor. The engagement partner reviews all the work and any significant issues before the audit report is signed.

Types of auditor reports

The auditor's report is the formal output of the audit engagement. There are four types:

Unmodified (clean) opinion

The most common outcome. The auditor is satisfied that the financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework. The opinion is unqualified, meaning no exceptions.

Qualified opinion

Issued when the auditor concludes there is a material misstatement in the financial statements, but it does not affect the statements as a whole — the issue is contained. For example, if management has used an accounting policy that is not in accordance with ASPE for one specific item, the auditor would qualify the opinion with an "except for" paragraph describing the issue.

Adverse opinion

Issued when the misstatements are so pervasive that the financial statements do not present fairly as a whole. This is rare and serious — it means the financial statements cannot be relied upon.

Disclaimer of opinion

Issued when the auditor is unable to obtain sufficient appropriate audit evidence — for example, when management restricts the auditor's access to records, or when there is such significant uncertainty that the auditor cannot form any opinion. A disclaimer is also serious and typically indicates a fundamental problem with the engagement.

Emphasis of matter and other matter paragraphs

Even in a clean (unmodified) opinion, the auditor may add emphasis of matter paragraphs to draw readers' attention to a particularly important disclosure — such as a going concern uncertainty, a significant legal contingency, or a major restatement of prior-year figures. These paragraphs do not modify the opinion but signal that something important deserves attention.