Common examples of business audits include financial (internal and external), tax, operational, compliance, IT and information security, payroll, and forensic audits. Each serves a distinct purpose, and knowing which applies to your situation is the first practical step.
Here is a quick reference before we go deeper:
- External financial audit: Independent review of your financial statements. Commission one when lenders, investors, or Companies House require it, or when your company meets the UK statutory audit threshold.
- Internal audit: An in-house or consultant-led review of controls and processes. Use it to identify weaknesses before an external auditor does.
- Tax audit: HMRC-led enquiry or a voluntary internal review of tax filings. Triggered by inconsistencies in returns or selected at random by HMRC.
- Operational audit: Systematic review of workflows and efficiency. Commission one when costs are rising without clear cause or when a process is producing errors.
- Compliance audit: Checks adherence to regulations, contracts, or industry standards. Relevant whenever you operate in a regulated sector or hold licences.
- IT and information security audit: Reviews data controls, access rights, and cyber risk. Particularly relevant after a security incident or before a major system change.
- Payroll audit: Verifies payroll calculations, tax filings, and benefit allocations. Recommended annually or semi-annually to maintain compliance and strengthen financial controls.
- Forensic audit: Detailed investigation into suspected fraud or financial irregularities. Commission one when fraud is suspected or when legal proceedings are likely.
- Environmental or supplier audit: Assesses supply chain compliance with environmental, ethical, or contractual standards. Relevant for businesses with ESG commitments or complex supplier networks.
Under UK company law, a statutory external audit is required when a company exceeds certain thresholds related to turnover, balance sheet total, or employee count. Standards governing external audits in the UK are set by the Financial Reporting Council (FRC) under ISA(UK), while HMRC governs tax enquiries and Companies House oversees filing obligations.
Table of Contents
- What is a business audit and why do companies commission them?
- Examples of business audits: a detailed look at each type
- What does the audit process look like for an SME?
- Who performs audits in the UK and what are the regulatory requirements?
- What does an audit deliver and how do you act on the findings?
- How to choose the right audit and prepare effectively
- Common preparation mistakes and the value of operational audits
- Key takeaways
- Why audits are worth more than most managers expect
What is a business audit and why do companies commission them?
A business audit is a systematic, documented review of a company's records, controls, operations, or regulatory compliance. The term covers a broad family of formal reviews, from a statutory examination of financial statements to a targeted look at a single payroll process. What all types of business audits share is a structured methodology: evidence is gathered, tested against a standard or expectation, and the findings are reported with recommendations.
Companies commission audits for four principal reasons. First, statutory compliance: UK law requires certain companies to have their financial statements independently audited each year. Second, investor and lender assurance: banks and equity investors routinely require audited accounts before extending credit or capital. Third, fraud detection: an independent review creates a credible deterrent and can surface irregularities that internal management may miss. Fourth, operational improvement: an audit can identify process gaps, control weaknesses, and efficiency losses that cost money every month they go unaddressed.
"Many business owners mistakenly treat audits as punitive. Experts recommend reframing them as health checks that build creditor and investor confidence while uncovering efficiency gains." — Doeren Mayhew
Three UK bodies and standards are worth knowing by name. The Financial Reporting Council (FRC) sets auditing standards in the UK, including the ISA(UK) suite that external auditors must follow. HMRC administers tax law and can open enquiries into any business's tax returns. Companies House requires annual accounts to be filed and, for companies above the statutory threshold, those accounts must carry an auditor's report.
A few terms you will encounter repeatedly:
- Audit opinion: The auditor's formal conclusion on whether the financial statements give a true and fair view.
- Management letter: A separate communication from the auditor to management, listing control weaknesses and recommendations that fall outside the formal opinion.
- PBC list (Prepared-by-Client): The schedule of documents and schedules the auditor requests from your team before fieldwork begins.
Examples of business audits: a detailed look at each type
Common audit types span financial, operational, compliance, and specialist categories. The table below summarises each, then the sections that follow give you a practical SME scenario for each one.
| Audit type | Primary purpose | Usual lead | Statutory trigger (UK) | Typical scope |
|---|---|---|---|---|
| External financial | Assurance on financial statements | Independent registered auditor | Yes — Companies Act thresholds | Full financial statements |
| Internal | Controls and process improvement | Internal team or consultant | No | Selected processes or all operations |
| Tax | Accuracy of tax filings | HMRC or internal accountant | HMRC enquiry or voluntary | Tax returns, supporting records |
| Operational | Efficiency and workflow quality | Internal team or specialist | No | Specific processes or departments |
| Compliance | Regulatory and contractual adherence | Internal or specialist firm | Sector-dependent | Licences, regulations, contracts |
| IT / information security | Data controls and cyber risk | CISA-qualified specialist | No (unless sector-regulated) | Systems, access rights, data flows |
| Payroll | Payroll accuracy and tax compliance | Internal or external payroll specialist | No | Payroll calculations, PAYE, benefits |
| Forensic | Fraud investigation | Forensic accountant | No (often litigation-linked) | Specific transactions or individuals |
| Environmental / supplier | Supply chain and ESG compliance | Internal or third-party auditor | Sector-dependent | Supplier contracts, environmental data |
External financial audit
An external financial audit is an independent examination of your company's financial statements by a registered auditor. The auditor tests whether the statements present a true and fair view in accordance with UK GAAP or IFRS. External audits are required for publicly-held entities and for UK private companies that exceed the Companies Act thresholds. Lenders and investors also frequently require audited accounts as a condition of financing, even when a company falls below the statutory threshold.
UK SME scenario: A manufacturing company exceeding the statutory thresholds is required by law to have its annual accounts audited. The auditor issues an unqualified opinion, which the company's bank accepts as part of its annual loan review.
When to choose it: When you meet the statutory threshold, when a lender or investor requires it, or when you want independent assurance for a significant transaction such as a sale or acquisition.
Internal audit
Internal audits are typically performed by employees or consultants to improve controls and processes and to safeguard assets. Unlike external audits, they are not governed by ISA(UK) and their scope is set by management. They are most valuable as a continuous improvement tool, catching control gaps before an external auditor or regulator does.
UK SME scenario: A retail business asks its finance manager and an external consultant to review its stock management and purchase-approval process. The review finds that purchase orders above £5,000 are being approved without a second signatory, a gap that is corrected before the year-end external audit.
When to choose it: Before an external audit, after a period of rapid growth, or whenever you suspect a process is not working as intended.
Tax audit
A tax audit is either an HMRC-initiated enquiry into your tax returns or a voluntary internal review of your tax position. HMRC can open a full enquiry or a more limited aspect enquiry at any time, though certain triggers, such as large year-on-year profit swings or inconsistencies between VAT and corporation tax returns, increase the likelihood. A voluntary internal tax review, conducted by your accountant, can identify errors before HMRC does.
UK SME scenario: A professional services firm notices that its VAT return for Q3 shows a significant input tax claim that is higher than prior periods. Rather than wait for an HMRC query, the directors commission an internal tax review, which identifies a coding error and allows a voluntary correction before the next filing deadline.
When to choose it: Annually as a preventive measure, or immediately if you receive an HMRC enquiry notice or suspect a filing error.
Operational audit
An operational audit reviews the efficiency, effectiveness, and economy of business processes. It is not about financial accuracy but about whether your operations are delivering the outcomes you expect at the cost you expect. Auditing workflows such as client onboarding or vendor procurement reveals bottlenecks where automation could replace manual, error-prone tasks.
UK SME scenario: A logistics company notices that its driver onboarding takes three weeks on average. An operational audit maps each step and finds that two approval stages are duplicated and one document check is performed manually when the system already holds the data. Removing the duplication cuts onboarding to nine days.
When to choose it: When costs are rising without clear cause, when error rates in a process are climbing, or when you are preparing for growth and need to know which processes will not scale.
Compliance audit
A compliance audit checks whether your business adheres to relevant laws, regulations, contracts, or internal policies. The scope depends entirely on your sector. A financial services firm faces FCA requirements; a food business faces Food Standards Agency rules; a business holding personal data must comply with UK GDPR.
UK SME scenario: A healthcare staffing agency commissions an annual compliance audit covering its CQC registration requirements, right-to-work checks, and data retention policies. The audit finds that right-to-work documents for three agency workers are stored beyond the required retention period, a finding that is corrected before the next CQC inspection.
When to choose it: Annually in regulated sectors, before a regulatory inspection, or when entering a new market with different compliance requirements.
IT and information security audit
An IT audit reviews your systems, data controls, access rights, and cyber risk posture. For businesses that hold customer data or rely on cloud-based systems, this type of review is increasingly expected by clients and insurers, not just regulators. A CISA-qualified specialist typically leads this work.
UK SME scenario: An e-commerce business preparing to renew its cyber insurance policy commissions an IT audit. The auditor finds that three former employees still have active system credentials, and that database backups have not been tested for six months. Both issues are resolved before the renewal date, and the insurer accepts the audit report as evidence of due diligence.
When to choose it: After a security incident, before a major system migration, when renewing cyber insurance, or when a client contract requires evidence of security controls.
Payroll audit
A payroll audit verifies that payroll calculations, PAYE deductions, National Insurance contributions, and benefit allocations are accurate and correctly reported to HMRC. Errors in payroll are common and can result in penalties, back-payments, and employee disputes. Many businesses schedule payroll audits annually or semi-annually.
UK SME scenario: A hospitality business performs a payroll audit and discovers underpayment issues related to variable hours not captured accurately. The error is corrected, back-pay is issued, and the payroll process is updated to prevent recurrence.
When to choose it: Annually as standard practice, after a payroll system change, or when employee complaints about pay accuracy increase.
Forensic audit
A forensic audit is a detailed investigation into suspected fraud, financial misconduct, or disputed transactions. It is conducted by a forensic accountant and its findings are often used in legal proceedings. The scope is narrow and evidence-focused, unlike a standard financial audit.
UK SME scenario: A construction firm suspects that a project manager has been approving inflated invoices from a supplier. A forensic accountant is engaged to trace payment flows, compare invoice values against market rates, and document findings in a format suitable for use in an employment tribunal.
When to choose it: When fraud is suspected, when a dispute is likely to result in litigation, or when an insurance claim requires independent financial evidence.
Environmental and supplier audit
An environmental or supplier audit assesses whether your supply chain meets contractual, ethical, or environmental standards. These audits are increasingly required by large corporate clients and are central to ESG reporting.
UK SME scenario: A food manufacturer requires its packaging supplier to undergo an annual environmental audit as a condition of the supply contract. The audit checks waste disposal records, energy consumption data, and compliance with ISO 14001. A minor non-conformance in waste documentation is noted and corrected within 30 days.
When to choose it: When a client contract requires it, when you are building an ESG report, or when you want to verify that your supply chain meets the standards you have committed to publicly.
What does the audit process look like for an SME?
Most formal audits follow four phases: planning, fieldwork, reporting, and follow-up. Understanding what happens at each stage helps you allocate time and resources without surprises.
Planning is where the auditor agrees scope, materiality, and timeline with management. You will receive a PBC list, which is the schedule of documents and schedules the auditor needs before fieldwork begins. Assembling these documents in advance materially reduces fieldwork time and, consequently, audit fees.
Fieldwork involves the auditor testing transactions, reviewing controls, and conducting walkthroughs of key processes. Expect requests for bank statements, invoices, contracts, payroll records, and board minutes. Auditors will sample transactions rather than review every one, but they will focus on areas where controls appear weak or where variances are unexplained.
Reporting produces the formal audit opinion and, separately, a management letter with findings and recommendations. The opinion is the document that goes to Companies House or your lender. The management letter is for internal use and is where the auditor's practical recommendations appear.
Follow-up is where many businesses lose value. Acting on management letter recommendations within agreed timescales reduces risk and typically shortens the next audit cycle.
For a small to mid-sized business facing an annual financial audit, a 90-day preparation window is recommended, divided into 30 days for gathering documents, 30 days for reconciliations, and 30 days for compiling the PBC list and logistics.
Pre-fieldwork tasks that reduce cost and delay:
- Confirm the audit scope and materiality threshold with the auditor in writing.
- Assign one named person as the internal audit liaison for all auditor queries.
- Reconcile bank accounts, debtors, creditors, and fixed assets to supporting schedules.
- Prepare written explanations for any balance-sheet variance greater than 20% year-on-year.
- Ensure board minutes are signed and filed for all meetings in the period under review.
- Confirm that all supplier and customer contracts are accessible in one location.
Who performs audits in the UK and what are the regulatory requirements?
The person or team conducting an audit depends on the audit type and whether it is statutory.
Internal audit functions are staffed by employees or consultants appointed by management. They report to the board or audit committee and are not required to hold a specific licence, though professional membership of the Chartered Institute of Internal Auditors (CIIA) is the recognised standard.
External auditors must be registered with a recognised supervisory body, such as the Institute of Chartered Accountants in England and Wales (ICAEW) or the Association of Chartered Certified Accountants (ACCA). For statutory audits, the engagement partner must hold an audit practising certificate. When hiring an external auditor, look for ACA or ACCA qualification and, for IT audits, CISA (Certified Information Systems Auditor) certification.
Regulator-led audits are conducted by HMRC (for tax), the FCA (for financial services firms), the CQC (for health and social care), and other sector regulators. You do not choose these; they are initiated by the regulator.
UK statutory audit thresholds under the Companies Act 2006 exempt small companies, which meet at least two of the thresholds relating to turnover, balance sheet total, and employee number. Companies that exceed two of these thresholds must have their annual accounts audited by a registered auditor. Certain entities, including public companies, banks, insurers, and companies that are part of a group that is not small, are required to have a statutory audit regardless of size.
External audits are also required for charities, large non-profits, and entities receiving significant government funding, even when they fall below the Companies Act thresholds.
Regulatory checklist for communicating audit requirements to stakeholders:
- HMRC: Governs tax enquiries, PAYE compliance, and VAT. Reference HMRC guidance when explaining tax audit triggers.
- Companies House: Requires annual accounts and, for auditable companies, an auditor's report. Reference the Companies Act 2006 thresholds.
- Financial Reporting Council (FRC): Sets ISA(UK) standards that external auditors must follow. Reference FRC guidance when discussing audit quality or auditor independence.
- Sector regulators (FCA, CQC, etc.): Set additional audit or assurance requirements for regulated businesses. Always check the specific regulator's current guidance for your sector.
What does an audit deliver and how do you act on the findings?
The primary output of an external financial audit is the auditor's report, which contains the audit opinion. There are four possible opinion types:
| Opinion type | What it means |
|---|---|
| Unqualified (clean) | Financial statements give a true and fair view with no material misstatements. |
| Qualified | Statements are fairly presented except for a specific, described matter. |
| Adverse | Statements do not give a true and fair view. |
| Disclaimer of opinion | Auditor was unable to obtain sufficient evidence to form an opinion. |
Beyond the formal opinion, a standard audit report includes: basis for opinion, key audit matters (for larger companies), going concern assessment, and the auditor's responsibilities statement.
The management letter is equally important for operational improvement. It lists control weaknesses, process gaps, and recommendations that the auditor observed during fieldwork. These are not part of the formal opinion but they carry significant weight: a finding that recurs in two consecutive management letters suggests a systemic problem.
Pro Tip: Respond to every management letter finding in writing within 30 days, even if your response is simply to confirm the timeline for remediation. Auditors note management responsiveness, and a prompt written response reduces the likelihood that the same finding is escalated in the following year's audit.
Triaging findings is straightforward. Group them into three categories:
- Immediate risks: Control failures that could result in financial loss, regulatory breach, or fraud. Address these within 30 days.
- Process improvements: Inefficiencies or weak controls that increase risk over time. Set a 90-day remediation timeline.
- Longer-term projects: Structural changes, system upgrades, or policy rewrites that require planning. Assign an owner and a target date.
Document your management response for each finding and share it with the auditor before the next engagement begins. This demonstrates governance and typically shortens the planning phase of the next audit.
How to choose the right audit and prepare effectively
Matching your situation to the right audit type
Start with the trigger, not the audit type. Four triggers cover most situations:
- Statutory requirement: You meet the Companies Act thresholds or operate in a regulated sector. Commission an external financial or compliance audit.
- Investor or lender requirement: A bank or investor requires audited accounts. Commission an external financial audit.
- Fraud suspicion or dispute: You suspect financial misconduct or face litigation. Commission a forensic audit.
- Operational concern: Costs are rising, errors are increasing, or a process is not scaling. Commission an operational or internal audit.
Preparation checklist
- Confirm the audit type, scope, and period under review with the auditor in writing.
- Assign a single named audit liaison who will handle all auditor queries.
- Create a centralised document repository (a shared drive or secure portal) and organise files by category.
- Gather all bank statements, invoices, contracts, payroll records, and board minutes for the period.
- Reconcile every balance-sheet account to supporting schedules and document explanations for variances.
- Prepare a written summary of your key internal controls (who approves what, at what value, and how it is evidenced).
- Confirm that all statutory filings (VAT returns, PAYE submissions, Companies House filings) are up to date.
- Review the prior year's management letter and confirm that all findings have been addressed.
Questions to ask a potential auditor
Before signing an engagement letter, ask these questions:
- What is the proposed scope and what is explicitly excluded?
- How do you determine materiality and sample sizes?
- What is the expected timeline from planning to report delivery?
- What will the management letter cover and how are findings classified?
- How is the fee structured and what triggers additional charges?
- How will you access our systems and data, and what security protocols do you follow?
Red flags in audit proposals: a fee that is significantly below market without a clear explanation of reduced scope; an auditor who cannot name the ISA(UK) standards applicable to your engagement; a proposal that does not mention a management letter; and any suggestion that the auditor will also prepare the financial statements they are auditing, which compromises independence.
Common preparation mistakes and the value of operational audits
The most frequent reason small businesses struggle during an audit is not fraud or deliberate misrepresentation. Businesses often fail audits because of basic record-keeping gaps such as incomplete petty cash logs, missing IP filings, or mismatched inventory counts. These are fixable problems, but only if you know about them before the auditor arrives.
Failing to document internal controls is one of the costliest preparation mistakes. Auditors rely on written trails to verify authorisations and approvals. If your purchase approval process exists only in practice and not on paper, the auditor cannot confirm it is operating as intended, which increases the scope of testing and the time spent on your engagement.
Pro Tip: When full segregation of duties is not practical for a small team, document compensating controls instead. For example, if the same person raises and approves purchase orders, a monthly management review of all orders above a set threshold is a compensating control. Write it down, evidence it, and tell your auditor about it upfront.
Reconciliations are the second most common gap. Auditors prioritise reviewing variances greater than 20% year-on-year; having written explanations ready saves time and reduces scrutiny. A pre-audit reconciliation that explains significant variances usually reduces the scope of substantive testing and shortens fieldwork.
Operational audits, in particular, tend to pay for themselves. Consider a simple example: a professional services firm runs an operational audit of its client onboarding process and finds that the average time from signed contract to first deliverable is 18 days, with most of the delay caused by manual document collection and a sequential (rather than parallel) approval chain. Restructuring the process to run approvals in parallel and introducing a client portal for document submission cuts the average to seven days. That improvement reduces the cost of each onboarding and frees capacity for additional clients without additional headcount.
The SBA's management audit instrument groups small-business functions into seven areas: planning, bookkeeping, financial planning, sales and marketing, advertising, personnel, and production. Running a structured self-assessment across these areas before commissioning a formal audit helps you identify where the gaps are most likely to appear, which makes the formal engagement faster and more targeted.
Key takeaways
A business audit is most useful when you match the audit type to a specific trigger: statutory requirement, investor demand, fraud suspicion, or operational concern.
| Point | Details |
|---|---|
| Match audit to trigger | Identify whether your need is statutory, investor-driven, fraud-related, or operational before choosing an audit type. |
| Start preparation 90 days out | For small to mid-sized businesses, plan for 30 days of document collection, 30 days for reconciliations, and 30 days for packaging and logistics, as recommended for annual financial audits. |
| Document internal controls | Written evidence of who approves what is the single most effective way to reduce auditor scrutiny and fieldwork time. |
| Act on management letter findings | Respond in writing within 30 days and set remediation timelines to reduce risk and shorten the next audit cycle. |
| Know the statutory thresholds | UK companies exceeding the statutory thresholds related to turnover, balance sheet total, or employee count require a statutory external audit. |
Why audits are worth more than most managers expect
Most of the businesses we work with at Finovate approach their first formal audit with a degree of apprehension. The concern is understandable: an external reviewer examining your records feels exposing. What we consistently observe, however, is that the businesses that prepare thoroughly and engage openly with the process come away with something genuinely useful, not just a signed opinion.
The documentation gaps that auditors surface most often are not signs of poor management. They are signs of a business that has grown faster than its processes. A purchase approval that worked informally when there were five employees becomes a control risk at 25. An inventory count that was accurate when stock was held in one location becomes unreliable across three. An audit makes these gaps visible at a point when they are still straightforward to fix.
The operational audit example is worth taking seriously. A structured review of one process, conducted over a few weeks, can identify efficiency gains that reduce cost and error rates in ways that compound over time. The engagement pays for itself, often within a single quarter.
If you are preparing for an audit and want support with bookkeeping, reconciliations, or financial reporting, Finovate's accounting and advisory services are designed for exactly this situation. For businesses that want to reduce the administrative burden of invoicing and documentation ahead of an audit, our invoicing service keeps records organised and audit-ready throughout the year.
Useful sources and further reading
For authoritative guidance on UK audit standards and obligations, the following sources are worth bookmarking:
- Financial Reporting Council (FRC) — ISA(UK) standards, auditor registration, and audit quality guidance.
- HMRC — Tax enquiry procedures, PAYE compliance, and VAT obligations.
- Companies House — Filing requirements, statutory audit thresholds, and annual accounts guidance.
- What is a financial audit? — Finovate's guide to financial audit purpose, statutory triggers, and what auditors test.
- Auditing for SMEs: a practical guide — Practical steps and templates for SME audit readiness.
- Top accounting compliance tips for SMEs — Compliance and internal-control advice to support audit preparation.
- Payroll compliance checklist — Checklist content for payroll audit preparation.
This article provides general information about business audits and is not a substitute for professional accounting or legal advice. Statutory thresholds and regulatory requirements can change; confirm current rules with Companies House, HMRC, or a qualified professional before making decisions.