An integrated audit tests controls and numbers together

The record

PCAOB Auditing Standard 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, governs how an auditor performs the attestation Sarbanes-Oxley Section 404(b) requires. The standard's own text, on PCAOB's standards page, states in its introduction that it applies when an auditor is engaged to audit management's assessment of internal control effectiveness in an audit integrated with the financial statement audit, and a footnote on the same page states that AS 2201 is the standard on attestation engagements referred to in Section 404(b) itself. The auditor's objective, the standard says, is to express an opinion on whether internal control over financial reporting is effective, which it cannot be if one or more material weaknesses exist.

What the documents establish

Because AS 2201 implements the Section 404(b) attestation, it applies only where that attestation is required, which is not every public company audit; issuers exempted from 404(b), including an emerging growth company within its statutory window, do not receive an AS 2201 integrated audit, only a financial-statement audit. The standard requires the auditor to use the same control framework management uses for its own assessment, and states that the two audits, financial statements and internal control, must be integrated so that evidence from one informs the other, rather than performed as separate engagements. PCAOB's own auditing standards listing confirms AS 2201's current place in that structure, and the standard's page also notes recently adopted amendments, approved by the SEC, that take effect for audits with fiscal years ending on or after 15 December 2026.

The operating read

As an editorial matter, a founder approaching an IPO should treat the arrival of an AS 2201 integrated audit as a marker of a real transition: it does not happen automatically at listing, but only once the company's own 404(b) exemption, if it had one, expires or never applied. A financial-statement-only audit opinion, without an internal-control opinion under this standard, is not evidence that internal control was assessed to the same standard a later filer will be held to.

What to check before you decide

Before assuming a company's audit already covers internal control to AS 2201's standard, check the following against its own filings:

• Does the auditor's report include a separate opinion on internal control over financial reporting, or only on the financial statements?
• Is the company currently within an emerging growth company or other exemption window that excuses the 404(b) attestation?
• If amendments to AS 2201 apply for fiscal years ending on or after 15 December 2026, will this company's next integrated audit fall under the amended standard?

AS 2201 is the mechanism behind a specific opinion, not a universal feature of every public company audit, and knowing whether it applies changes what an audit opinion can be read to say.