Financial AtlasTo the mapУкраїнська

SERVICE INFRASTRUCTURE

Audit & Assurance

Independently checks a company's accounts so its numbers can be trusted.

Open on the interactive map →

This page is the text version of one zone of the interactive map.

Its role in the system

The independent check that lets investors, lenders and regulators believe the figures in a company's accounts. The company prepares its own statements; the auditor publicly confirms that they are not misleading. Without that certificate of trust, capital would cost more and equity and bond markets would run on rumour.

Functions

  1. External audit of financial statements — reviewing the annual accounts and issuing an opinion: unqualified ("clean"), qualified, or a disclaimer.
  2. Audit of internal control — whether the procedures that keep errors and fraud out of the accounts actually work (🇺🇸 SOX 404 for listed companies).
  3. Internal audit — the third line under 🌍 the IIA's Three Lines Model (formerly the three lines of defence): inside the organisation but independent of management, it tests processes, risks and compliance and reports to the board (🌍 IIA standards).
  4. Auditing financial institutions — banks, insurers, funds: valuing financial instruments, loan loss provisions, and the reporting and capital submitted to the regulator.
  5. Forensics — fraud investigation, tracing assets that have been moved out, expert evidence for courts.
  6. Other assurance — verifying sustainability reporting (ESG) and the IT controls of service providers (SOC 1 / SOC 2 reports). 🇪🇺 For companies required to report on sustainability this check is mandatory, but at the level of limited assurance — lower than in a financial audit: the auditor states that nothing came to their attention suggesting a material misstatement, not that the report is true and fair.

What makes it special

  • Who pays: the auditor is hired and paid by the very company being audited. Hence the permanent conflict of interest and the hard independence rules: 🇪🇺 mandatory rotation of the audit firm at public interest entities (as a baseline, every ten years) and a cap on non-audit fees; 🇺🇸 SOX banned auditors from providing a list of consulting services to their audit clients.
  • Standards, and who watches the auditors: accounts are prepared under 🌍 IFRS (issued by the IASB) or 🇺🇸 US GAAP (FASB), and audited under 🌍 the International Standards on Auditing (IAASB) or 🇺🇸 PCAOB standards. After Enron, audit stopped being self-regulated: 🇺🇸 the PCAOB was created by the Sarbanes-Oxley Act of 2002; 🇪🇺 each member state has a public oversight body (🇩🇪 APAS, 🇫🇷 the H2A, which took over from the H3C in 2024), and 🇬🇧 audit is overseen by the FRC. Bank supervisors typically impose extra requirements on the auditors of banks.
  • Concentration: the accounts of the world's largest companies are audited overwhelmingly by the Big Four (Deloitte, PwC, EY, KPMG), with the mid-tier networks (BDO, Grant Thornton, Forvis Mazars) behind them. The large networks also earn from tax work and consulting.
  • The limits of an audit: an auditor gives reasonable assurance, not a guarantee — the testing is sample-based and leans heavily on the company's own documents. That is why big frauds are often first exposed by journalists, whistleblowers or short sellers.
  • 🇨🇳 China: its own standards and exemplary punishments: the finance ministry writes the accounting rules (the national ASBE standards are largely converged with IFRS but not identical to them), audits of listed companies are policed by the ministry and the CSRC, and the penalties can be demonstrative: in September 2024 PwC's Chinese arm was suspended for six months and fined 116 million yuan by the ministry plus another 297 million by the CSRC over its audit of the collapsed developer Evergrande. A separate thread is access for a foreign inspector: under the US HFCAA (2020), Chinese companies faced delisting if the PCAOB could not inspect their auditors; in August 2022 the PCAOB signed a protocol with the CSRC and the Chinese finance ministry, and in December 2022 it confirmed for the first time that it had obtained full access to inspections in mainland China and Hong Kong.
  • 🇯🇵 Japan: the profession checks itself, and the state checks the check: membership of the institute JICPA is compulsory for a practising auditor, and the institute itself reviews the quality of firms' work. Above it sits the CPAAOB, an independent board attached to the regulator FSA since 2004, which inspects audit firms, examines how JICPA performs its part and recommends enforcement action to the FSA. Two floors of oversight instead of one.

Why it matters

When an audit fails, investors and lenders make decisions on invented numbers; after every large failure, trust in the whole market falls and regulators rewrite the rules for the entire profession.

🇺🇸 Enron and Arthur Andersen, 2001–2002

The energy giant hid debt for years in related entities, while its auditor Arthur Andersen earned from it both as auditor and as consultant. After Enron collapsed, the firm was convicted of destroying documents in 2002 — a verdict the US Supreme Court later overturned — but the clients had already gone, and one of the Big Five simply disappeared. The response was the Sarbanes-Oxley Act and state oversight of auditors through the PCAOB.

🇩🇪 Wirecard, 2020

A payments company in the DAX index admitted that one point nine billion euros supposedly sitting in Asian bank accounts most likely did not exist, and filed for insolvency. EY had signed clean opinions for around a decade without, for years, confirming the balances directly with the banks. The scandal triggered a reform of financial reporting and audit oversight in Germany.

🇺🇸 Colonial Bank and PwC, 2009–2019

Colonial Bank collapsed in August 2009 in the sixth-largest bank failure in US history, brought down by a years-long fraud at its biggest mortgage client, Taylor, Bean & Whitaker, that cost more than a billion dollars. PwC, the bank's auditor, had issued clean opinions throughout. In December 2017 a federal judge found that PwC had not designed its audits to detect fraud, in breach of auditing standards, and awarded the FDIC six hundred and twenty-five million dollars; in March 2019 the parties settled at three hundred and thirty-five million. An audit signature on a bank's accounts is a claim that supervisors, depositors and investors actually rely on.

Links to other zones · 13

  • Anti-Money LaunderingAudit & Assurance supports Anti-Money Laundering: auditors and forensic specialists uncover fraud and laundering, and in the 🇪🇺 EU auditors carry reporting duties of their own.
  • Banking & Credit InstitutionsThe audit of Banking & Credit Institutions is mandatory: Audit & Assurance tests loan loss provisions under IFRS 9, asset valuations and the reports sent to the supervisor.
  • Consulting & AdvisoryThe Big Four combine Audit & Assurance with Consulting & Advisory, and independence rules bar them from selling a range of advisory services to a company whose accounts they audit.
  • Corporations & Corporate FinanceCorporations & Corporate Finance are the main clients of Audit & Assurance: the annual audit, internal controls, and checks before deals and financing.
  • Debt marketAudit & Assurance is not only for shareholders: Debt market buyers test covenants against audited statements, and no prospectus is registered without an audit opinion.
  • Education & CertificationAudit & Assurance is shaped by Education & Certification: ACCA, CPA, CIA and national statutory auditor qualifications decide who may sign an opinion.
  • Financial Media & DataAudit & Assurance and Financial Media & Data check the same numbers from opposite sides: the auditor gives sampled assurance under a standard and is paid by the client, while a journalist follows signals and clears the conclusion with no one.
  • Fiscal PolicyNext to the audit of companies sits the audit of the state: supreme audit institutions in Audit & Assurance work to INTOSAI standards and examine the budget of Fiscal Policy — the European Court of Auditors on the EU accounts, the GAO on US federal finances. Same craft, different client.
  • InsuranceAn audit of Insurance turns on reserves: whether enough is set aside for claims that will only be known years later. Audit & Assurance therefore follows IFRS 17 and works with actuaries.
  • Investment & Pension FundsAuditing Investment & Pension Funds is above all about valuation and existence: does the asset exist and is it really held at the custodian. This is where Audit & Assurance caught the loudest investment frauds.
  • Regulation & SupervisionAudit & Assurance is both a tool and a subject of Regulation & Supervision: supervisors rely on audit opinions and also oversee the auditors themselves.
  • Stock marketWithout an opinion from Audit & Assurance a company cannot float and cannot keep its listing; audit is the foundation of trust in Stock market issuers.
  • Technology & InfrastructureSOC 1 and SOC 2 reports are audits of a technology provider's controls: SOC 1 covers how its systems affect clients' financial reporting, SOC 2 covers security and availability — without one, a financial firm will not let a Technology & Infrastructure vendor near its data.

Careers in this zone · 6

External auditor (financial institutions practice)

Plans and runs the audit of a client's accounts: tests transactions and balances, works with the finance team and management, documents the evidence and forms the opinion. In the financial practice, audits banks, insurers and funds — provisions, valuation of financial instruments, regulatory capital. The path runs from assistant to the partner who signs the opinion.

What you need to know

  • IFRS (IFRS 9, IFRS 17 for insurers) and US GAAP
  • ISAs and audit methodology: materiality, sampling, the risk-based approach
  • Accounting for financial instruments and expected credit losses
  • Regulatory requirements for financial institutions: capital, reporting
  • Ethics and independence (the IESBA code)

Skills

  • Excel and data analytics in audit
  • Professional scepticism
  • Documenting evidence cleanly
  • Handling the client under busy-season deadlines

Certifications: ACCA, CPA (🇺🇸) or ACA (🇬🇧 ICAEW); to sign an opinion, the national statutory auditor qualification of the country you work in

Internal auditor

Works inside a company or bank but independently of management: tests whether processes, controls and risk management actually work, and reports to the board's audit committee. In a bank this is the third line, after the business and after risk and compliance.

What you need to know

  • 🌍 IIA standards
  • The COSO internal control framework
  • The risks and processes of a financial institution
  • Regulatory requirements for the internal control system
  • The basics of IT audit

Skills

  • Process analysis and interviewing
  • Data analysis (SQL, ACL/IDEA)
  • Independence — not flinching from an inconvenient finding
  • Board reports in plain language

Certifications: CIA (IIA); CISA for IT audit; CFA or FRM are a plus in banks

IT auditor

Audits the IT environment the accounts depend on: who has access to the systems, how changes are made, whether data moves correctly from core banking into the ledger. Produces the SOC 1 / SOC 2 reports that service providers show to their financial-sector clients.

What you need to know

  • IT general controls (ITGC)
  • COBIT, ISO 27001
  • SOC 1 / SOC 2 reports
  • Cybersecurity and access management
  • Databases and banking systems

Skills

  • SQL, log analysis
  • Understanding a business process through the system
  • Documenting tests
  • Working with IT teams

Certifications: CISA (ISACA); also CISSP, ISO 27001 Lead Auditor

Forensic analyst (forensic accountant)

Investigates fraud, corruption and asset stripping: reconstructs how money moved through chains of companies, analyses transactions and correspondence, and establishes who is connected to whom. The findings go to court, to a regulator or to creditors — it is how, after a bank collapses, anyone works out where the money went.

What you need to know

  • Fraud schemes and accounting manipulation
  • Accounting and financial statement analysis
  • Corporate structures and beneficial ownership
  • Evidentiary requirements in court
  • eDiscovery — searching electronic datasets

Skills

  • Analysing large transaction datasets
  • Interviewing witnesses and suspects
  • Expert reports for court
  • Confidentiality

Certifications: CFE (ACFE); ACCA or CPA; CAMS for AML investigations

IFRS specialist (technical accounting)

Interprets complex standards for specific situations: how to account for derivatives, a lease, an acquisition, an insurance contract. Helps companies move to new standards and agrees the accounting position with the auditor.

What you need to know

  • IFRS 9, 15, 16, 17
  • Consolidation and business combinations
  • The differences between IFRS and US GAAP
  • Hedge accounting

Skills

  • Technical memos
  • Calculation models in Excel
  • Explaining accounting to non-accountants

Certifications: ACCA, CPA; DipIFR (ACCA)

Sustainability reporting auditor (ESG assurance)

Verifies non-financial reporting: greenhouse gas emissions, climate risk, social metrics. 🇪🇺 The CSRD introduced mandatory independent limited assurance over such reporting; after the Omnibus I simplification in 2026 it applies only to the largest companies (over one thousand employees and four hundred and fifty million euros of turnover). A new field at the intersection of audit, environmental science and data.

What you need to know

  • The GHG Protocol (emissions accounting)
  • ESRS and ISSB reporting standards (IFRS S1, S2)
  • Assurance standards ISSA 5000 (for periods from 15 December 2026), ISAE 3000 / 3410
  • Climate and social risks by sector

Skills

  • Working with non-financial data
  • Scepticism towards green marketing
  • Communicating with engineers and environmental specialists

Certifications: Still forming: ACCA/CPA plus specialist courses in ESRS/ISSB and the GHG Protocol

All zones of the Atlas