GAAS

Also known as: Generally Accepted Auditing Standards

framework · accounting · regulatory-standard

AICPA's body of auditing standards governing US private company audits, organized into general, fieldwork, and reporting standards.

Generally Accepted Auditing Standards are the auditing standards followed by US Certified Public Accountants when auditing the financial statements of nonissuers (private companies, employee benefit plans, not-for-profits, and entities not subject to PCAOB jurisdiction). GAAS is issued by the AICPA's Auditing Standards Board (ASB) as Statements on Auditing Standards (SAS). The current GAAS structure, extensively redrafted in the 2010s as part of the Clarity Project, organizes standards into sections paralleling the International Standards on Auditing (ISA) for international convergence purposes. SAS 122 (issued 2011) implemented the Clarity Project recodification. SAS 134-140 substantially revised auditor reporting and other aspects in 2019-2020. After the Sarbanes-Oxley Act of 2002, GAAS no longer applies to audits of SEC-registered issuers, which are now governed by PCAOB Auditing Standards.

Originators

AICPA Auditing Standards Board (current standard-setter); antecedents in AICPA Committee on Auditing Procedure (1939) and earlier informal professional practice high

Year / Decade

1939 (Statements on Auditing Procedure series began); 1972 (SAS series began with SAS 1); 2011 (Clarity Project recodification) high

Primary sources

AICPA. AU-C Codification of Statements on Auditing Standards (continuously updated), AICPA (2011). SAS 122, Clarification and Recodification, AICPA (2019). SAS 134, Auditor Reporting and Amendments high

Core components

Statements on Auditing Standards (SAS) — current authoritative GAAS
AU-C section codification (post-Clarity Project)
General principles and responsibilities (independence, due care, professional skepticism)
Risk assessment and response (parallel to ISA 315, 330)
Audit evidence and documentation
Use of work of others (component auditors, internal audit, specialists)
Auditor reporting (significantly revised by SAS 134)
Ethics (referenced via AICPA Code of Professional Conduct, separate from GAAS)

Primary use case

Audits of US private companies, employee benefit plans, not-for-profits, and other nonissuers; basis for unqualified, qualified, adverse, and disclaimer opinions on non-public-company financial statements; reference standard in state CPA licensure and AICPA peer review; input to lender credit decisions, regulatory filings (state, not federal), and private-equity transactions.

Common criticisms

GAAS has been criticized as a 'floor' rather than 'ceiling' standard whose general nature accommodates wide variation in actual audit quality
AICPA self-regulation through peer review faced sustained empirical challenges showing weak detection of audit deficiencies (see Hilary and Lennox 2005, Fogarty 1996)
the post-SOX bifurcation between GAAS and PCAOB AS produced two parallel US audit standards with overlapping content but divergent enforcement, complicating firm operations and academic research
convergence with ISA through the Clarity Project improved structure but left substantive differences whose justification is contested
auditor independence rules within and adjacent to GAAS have been challenged as insufficiently restrictive of consulting and tax services to audit clients (a debate revived after Wirecard and similar 21st-century failures)
expectation gap (Liggio 1974, Porter 1993) — what users expect auditors to detect vs what GAAS requires — remains a chronic profession-wide problem.

Lineage

Siblings: PCAOB Auditing Standards, ISA, Yellow Book