#audit
Independent audit and assurance engagements — SOC 2, financial statement audits, internal controls testing, evidence collection, and audit readiness for service organizations and growing businesses
A certificate of insurance you cannot produce on audit day turns subcontractor payments into your own payroll, billed at your trade rates. Here are the seven things every subcontractor COI must show, the five triggers for demanding a new one, and why certificate holder status is not the same as being an additional insured.
A personnel file should hold job records only — medical documents, Forms I-9, and investigation notes belong in separate files. Practical rules for a five-file system, state access deadlines, and the stacked retention periods: EEOC one year, FLSA payroll three years, and I-9s three years after hire or one year after termination, whichever is later.
Congress set a 10-year statute of limitations for PPP fraud, so a loan funded in 2020 can be charged until 2030 and forgiveness is not a defense. This guide covers False Claims Act liability, the five eligibility tripwires still generating cases, and the six-year record-retention rule borrowers must meet.
The IRS normally has three years from the filing date to assess additional tax under IRC 6501(a), six years if you omit more than 25% of gross income, and unlimited time if you never filed or filed fraudulently. Parallel clocks run alongside it - 10 years to collect, 3 years to claim a refund, 4 years for employment tax records, and property basis until disposition plus 3 - which is why most CPAs tell small businesses to default financial records to six years.
ASC 850 requires four things in the footnote for every material related-party transaction — the nature of the relationship, a description, dollar amounts for each period presented, and any change in how terms were set — and it applies even when the price is fair. This guide identifies who counts as a related party for a small business (10%+ owners, officers, immediate family, and entities they control), shows a model two-paragraph footnote, and gives a 10-step year-end checklist plus a Beancount account structure that turns disclosure into a query.
Employers using electronic Form I-9 systems must update to the 05/31/2027 expiration date by July 31, 2026. This guide covers which editions stay valid, what changed in the 01/20/25 revision, the three-years-after-hire-or-one-year-after-termination retention rule, and which paperwork errors ICE now treats as substantive rather than technical.
The IRS has no single seven-year rule. Income tax records run 3 years, employment tax records 4, substantial income omissions 6, bad-debt and worthless-security losses 7, and unfiled or fraudulent returns never expire — while property records run until the limitations period closes on the year you sell. This guide maps each clock to the documents it governs and gives a retention schedule small business owners can follow.
A workers' comp premium is payroll ÷ 100 × class rate × experience mod, so the year-end audit re-tests both variables against your actual records. This guide covers the three audit types and what triggers each, the documents auditors request, why overtime premium is only excludable when recorded separately by employee and week under NCCI Rule 2-B-2, the 2026 NCCI officer caps of $3,400 weekly maximum and $1,700 minimum, and why payments to a subcontractor without a current certificate of insurance get charged to you as payroll.
Companies House ECCTA reforms require verified director and PSC identities since November 2025, ACSP-gated filing from late 2026, and software-only iXBRL accounts with no abridged option — learn timelines, corporate-director limits, and the bookkeeping changes small companies must make now.
A workers' comp premium audit reconciles your estimated payroll against actual payroll, job classification codes, and subcontractor payments. Missing a subcontractor's certificate of insurance can add the entire contract amount to your auditable payroll — plus a 25–50% non-compliance surcharge. Here are the records to keep monthly, and the 30–60 day dispute window to know.
OMB's proposed Uniform Grants Regulation would replace 2 CFR Part 200 by October 1, 2026 — making the rules binding regulation, eliminating most fixed-amount awards in favor of cost-reimbursement, and adding termination-for-convenience authority. Here's what nonprofit finance teams should do about the 30–60 day reimbursement lag, indirect cost documentation, and new allowability limits before the final rule lands.
The AICPA's SAS 150, issued July 2026, requires auditors to independently confirm cash and cash equivalents held by third parties — payment processor balances, PEO trust accounts, and escrow arrangements — effective for audits of periods ending on or after December 15, 2028. Here is what the standard changes, why it exists, and how audited businesses should prepare.
