Audit vs Review vs Compilation: What Level of Assurance Does Your Company Need?

If you're a business owner or finance professional in South Africa, there's a good chance you've been told your company needs "an audit" when what you need might be something quite different. The Companies Act, No. 71 of 2008, doesn't apply a one-size-fits-all approach to financial reporting. Instead, it establishes a tiered system where the level of external scrutiny your financial statements receive depends on your company's size, structure, and public impact.

Getting this wrong can be costly. Pay for a full audit when a compilation would suffice, and you're spending money unnecessarily. Assuming a compilation is sufficient when you need an audit exposes your company to regulatory penalties and reputational damage. This guide breaks down all three engagement types, explains who needs what under South African law, and helps you determine the right fit for your business.

The Three Levels of Assurance: A Quick Orientation

Before diving into the legal requirements, it helps to understand what each engagement actually delivers. Think of it as a spectrum of confidence.

An audit provides reasonable assurance, the highest level available. A registered auditor examines your financial statements in detail, tests transactions, inspects supporting documents, evaluates internal controls, and expresses an opinion on whether the statements present a true and fair view. The work is governed by International Standards on Auditing (ISAs), and the conclusion takes the form of: "In our opinion, the financial statements present fairly, in all material respects..."

An independent review provides limited assurance. A qualified practitioner (either a registered auditor or an accredited independent reviewer) performs enquiry and analytical procedures under ISRE 2400 (Revised), but does not dig into the same depth of evidence as an audit. The conclusion is expressed in the negative: "Based on our review, nothing has come to the attention that causes us to believe that the financial statements are not presented fairly..." This is sometimes called "negative assurance."

A compilation provides no assurance. A practitioner uses information provided by management to prepare financial statements in accordance with the applicable reporting framework, following ISRS 4410 (Revised). The practitioner does not verify the underlying data. The report makes clear that no opinion or conclusion is expressed on the financial statements.

How the Companies Act Determines What You Need

The Companies Act uses a points-based system called the Public Interest Score (PIS) to determine the level of reporting your company requires. Calculated annually under Regulation 26(2), the PIS reflects your company's social and economic footprint. The higher the score, the greater the public interest in your financial reporting, and the more rigorous the external scrutiny.

Calculating Your Public Interest Score

Your PIS is the sum of four components, each measured at the end of your financial year:

Employees: One point for every person, based on the average number of employees during the financial year.

Third-party liabilities: One point for every R1 million (or part thereof) in third-party liabilities at year-end. This generally excludes intercompany loans and shareholder loans, focusing on external obligations.

Turnover: One point for every R1 million (or part thereof) in annual turnover.

Shareholders/members: One point for every individual who directly or indirectly holds a beneficial interest in the company's issued securities. For non-profit companies, this includes members.

A practical example: a private company with 45 employees, R12 million in third-party liabilities, R28 million in turnover, and 3 shareholders would have a PIS of 88 (45 + 12 + 28 + 3). That company would fall below the 100-point threshold.

The Decision Matrix: PIS Thresholds and Company Type

The interaction between your PIS, your company type, and how your financial statements are prepared determines your reporting obligation. Here's how it works for private and personal liability companies (the most common scenario for South African SMEs):

PIS of 350 or more:

An audit is required. No exceptions.

Your financial statements must be audited by a registered auditor, regardless of who prepared them or whether the company is owner-managed.

PIS between 100 and 349:

This is where it gets nuanced. If your financial statements are internally compiled (prepared by your own staff, such as your financial director or bookkeeper), an audit is required even at this level.

If your financial statements are independently compiled by an external accounting professional, an independent review is sufficient, unless the company is owner-managed.

PIS below 100:

Generally, only a compilation is required. However, if financial statements are internally compiled and the company is not owner-managed, an independent review may still be needed.

Owner-managed companies receive further relief.

A company qualifies as owner-managed if every person who holds a beneficial interest in its securities is also a director. Owner-managed companies with a PIS below 100 whose financial statements are independently compiled are generally exempt from both audit and review requirements, meaning only a compilation is needed.

Companies That Always Need an Audit

Regardless of PIS, certain entities must always have their financial statements audited. These include all public companies (listed and unlisted), state-owned companies, and any company whose Memorandum of Incorporation (MOI) specifically requires an audit.

Additionally, any private or personal liability company that holds assets in a fiduciary capacity for unrelated persons, where the aggregate value exceeds R5 million during the financial year, must be audited. Non-profit companies incorporated directly or indirectly by the state or an organ of state also fall into this category.

What Each Engagement Actually Involves

Understanding the legal thresholds is one thing. Understanding what happens during each engagement helps you prepare properly and appreciate the value you're getting.

The Audit Process

An audit is the most comprehensive engagement. The registered auditor plans the work by gaining a thorough understanding of your business, its environment, and its internal controls. They assess the risks of material misstatement (whether from error or fraud), then design and perform procedures to address those risks.

This typically involves inspecting source documents, confirming balances with third parties such as banks and debtors, observing physical inventory counts, recalculating key figures, and testing whether transactions have been recorded correctly.

The auditor evaluates accounting policies, reviews management's estimates and judgements, and assesses the overall presentation of the financial statements against the applicable financial reporting framework (IFRS, IFRS for SMEs, or another framework, as appropriate).

The output is an auditor's report expressing either an unmodified opinion (a "clean" report), or a modified opinion if problems are found. The entire process is governed by ISAs, which are adopted in South Africa by the Independent Regulatory Board for Auditors (IRBA).

The Independent Review Process

An independent review follows a structured process under ISRE 2400, but the nature and depth of work is fundamentally different from an audit. The reviewer gains an understanding of the entity and its environment, makes enquiries of management and relevant staff, and performs analytical procedures, comparing financial data against expectations, prior periods, and industry norms.

If something looks inconsistent or concerning, the reviewer follows up. But the engagement does not involve the systematic testing of transactions, detailed inspection of source documents, or third-party confirmations that characterise an audit. The reviewer is looking for anything that suggests the financial statements may be materially misstated, rather than seeking positive evidence that they are correct.

The result is a review report expressing a limited assurance conclusion. In South Africa, the review can be performed by a registered auditor or by a member of a professional body accredited by IRBA, provided the reviewer was not involved in preparing the financial statements under review.

The Compilation Process

A compilation is essentially the preparation of financial statements by an external professional, based on information provided by management. The practitioner applies their accounting and financial reporting expertise to present the information in the correct format but does not verify the accuracy or completeness of the underlying data.

The compilation report explicitly states that no assurance is provided. The financial statements carry a disclaimer noting that they have been compiled without audit or review, and readers should interpret them accordingly.

Choosing the Right Level: Beyond Legal Compliance

While the Companies Act sets the minimum requirements, there are good reasons to consider a higher level of assurance voluntarily.

Banks and funders often require audited financial statements before extending credit facilities, even if the company's PIS does not mandate an audit. If you're planning to approach lenders or investors soon, a voluntary audit may significantly strengthen your position.
Shareholders who aren't directors may want the comfort that comes with an independent review or audit, particularly if they are not involved in the day-to-day management of the business. This is especially relevant in family businesses where some shareholders are passive.
Potential acquirers and due diligence processes will almost always require audited statements. If a sale or merger is on the horizon, a history of audited financial statements simplifies the process and builds buyer confidence.
SARS and regulatory scrutiny can be another factor. While SARS does not require audited financial statements for all taxpayers, audited financials carry greater weight in the event of a tax dispute or investigation.

On the other hand, if your company is a small, owner-managed business with a low PIS, straightforward operations, and no external shareholders or funding requirements, a compilation may be sufficient. There's no benefit to overspending on assurance that no one requires or values.

Common Mistakes and Misconceptions

"My accountant does my financials, so I don't need an audit."

Having an external accountant compile your financial statements may reduce your reporting requirement from an audit to a review (if your PIS is between 100 and 349), but it does not eliminate the need for external scrutiny entirely unless you're owner-managed or below the relevant thresholds.

"My company is small, so none of this applies to me."

Every company in South Africa has a PIS. Even if it's low, you need to calculate it annually and retain the calculation in your compliance records. And the PIS can shift significantly from year to year if your turnover grows, you take on more debt, or your headcount changes.

"An audit and a review are basically the same thing."

They are not. The procedures, the depth of work, the standards applied, the qualifications required, and the level of assurance provided are all materially different. A review conclusion does not carry the same weight as an audit opinion, and stakeholders who need reasonable assurance will not accept a review report as a substitute.

"We were reviewed last year, so we can be reviewed again this year."

Not necessarily. If your PIS has crossed the 350 threshold, or if your financial statements are now being prepared internally rather than by an independent professional, your reporting obligation may have changed. This is something to check every year.

Practical Steps for Getting It Right

Calculate your PIS annually, ideally as part of your year-end close process. Don't leave it to your auditor or reviewer to flag: it's the company's responsibility under the Regulations.
Review your MOI. Your Memorandum of Incorporation may impose audit requirements that go beyond what the Companies Act mandates. If so, those provisions apply regardless of your PIS.
Consider your stakeholders' expectations. The legal minimum may not align with what your bank, your investors, or your co-shareholders expect. An early conversation in the financial year can prevent surprises later.
Engage your service provider early. Whether you need an audit, review, or compilation, starting the engagement early gives your practitioner time to plan properly and gives you time to prepare the documentation they'll need. Last-minute engagements are more expensive and more stressful for everyone.
Document the decision. Keep a record of your PIS calculation, the reasoning behind the level of assurance engaged, and any relevant board resolutions. This demonstrates good governance and provides a clear trail if the decision is ever questioned.

How BVA Can Help

Navigating the assurance landscape doesn't have to be complicated, but it does require getting the details right. Whether your company needs a full ISA audit, is considering an independent review, or simply needs professionally compiled financial statements, our team can help you determine the appropriate level of assurance and deliver it efficiently.

Not sure where your company falls? Book a free initial consultation with our advisory team, or explore our audit and assurance services to learn more

This article is for general informational purposes only and does not constitute professional tax, legal, or audit advice. The Companies Act requirements summarised here are based on the legislation and regulations in force as at the date of publication. For guidance specific to your company's circumstances, please consult a qualified professional.