Church Money, Donations & Financial Controls

Should Your Church Get an Audit, Review or Compilation?

Published 2026-10-02 · Church Money, Donations & Financial Controls

Short answer: these are three levels of outside assurance. A compilation presents your numbers in proper financial-statement form with no testing at all. A review applies analytical procedures and inquiry, giving limited assurance. An audit tests the underlying records and controls, gives the highest level of assurance, and costs the most by a wide margin. Most churches don't need an audit. Most churches do need something more than nothing, and almost all of them need better internal controls first.

A board member has said the word "audit" in a meeting, and now everyone's nodding as though that settles something. It doesn't. Half the room means a full external audit by a CPA firm. The other half means "someone from outside should look at the books." Those are very different projects with very different price tags.

The church audit vs review question usually gets settled before anyone defines the terms. Start somewhere else: none of these three is primarily a fraud-detection tool, and none of them substitutes for basic internal controls. If your offering is counted by one person alone, an annual audit isn't the answer to that problem. Fixing the counting is.

What are the three levels, actually?

They differ in one dimension: how much work the accountant does, and therefore what they're willing to say about your numbers.

Compilation. The accountant takes the information management provides and puts it into the format of financial statements. They don't test it, don't verify it, and express no assurance. It's a presentation service. What you get is a clean, professionally formatted set of statements, which is often exactly what a bank or a small grantmaker wants.

Review. The accountant performs analytical procedures, comparing this year to last and checking that relationships between figures make sense, then makes inquiries of staff. If something looks odd, they follow it. They express limited assurance: nothing came to their attention suggesting the statements need material modification. Less than an audit, meaningfully more than a compilation.

Audit. The accountant obtains evidence about the amounts and disclosures. That means confirming balances with third parties, testing samples of transactions, examining documentation, evaluating internal controls, and assessing the risk that the statements are materially misstated. They express an opinion on whether the statements are fairly presented. Highest level, highest cost.

There's also an agreed-upon procedures engagement, which is none of the three. You and the accountant agree in advance on specific tests: count the offering blind for four Sundays, trace every disbursement over a set amount to an approved invoice. They report the findings without an opinion. For a church with a specific worry rather than a general one, that's often the most useful money spent, and boards rarely know it exists.

Which one does your church actually need?

Start by asking who is requiring it, because a requirement is easier to answer than a preference.

A lender or a bond issuer. Ask what level they require, in writing. Some will accept reviewed statements. Some require audited.

A grantmaker or foundation. Same question, same answer: ask before you commission anything.

Your state's charitable registration. Some states set an assurance requirement tied to the level of contributions an organization receives, and some exempt churches from charitable registration entirely. Check your own state's current thresholds rather than assuming, and check whether the church exemption applies to you.

Your denomination or association. Many have their own requirements. They're usually specific and easy to obtain.

Your bylaws. Read them. A surprising number of churches have a bylaw requiring an annual audit that's been ignored for a decade. Either do it or amend the bylaw. A standing requirement you knowingly ignore is worse for the board than no requirement at all.

Nobody, and the board just wants comfort. Then you have a real choice, and the honest answer for most small and mid-size churches is that the money buys more safety spent elsewhere. In rough order of value per dollar: fix the controls, then an agreed-upon procedures engagement on the areas that worry you, then a review, then an audit.

Comparing the three

Two things that table can't show. First, cost varies enormously with the state of your records. A church with clean, reconciled books pays far less than one that hands over a shoebox. Second, an audit consumes real staff time. A part-time bookkeeper facing an audit request list is under genuine strain, and boards should plan for that rather than discovering it in March.

What none of these will do

This is the section that saves churches money.

They won't reliably catch fraud. An audit is designed to give reasonable assurance that the financial statements are free of material misstatement. Small, sustained theft, cash skimmed before it's ever recorded or a fictitious vendor paid modest amounts monthly, sits below the threshold an audit is built to detect. Cash that was never recorded leaves no record to test.

They won't fix your controls. An auditor may write a management letter noting control weaknesses, and that letter is often the most valuable thing you receive. Noting a weakness isn't fixing it.

They won't tell you whether the spending was wise. That's the board's job.

They won't substitute for a board that reads the financials. The most effective fraud prevention in a church isn't an annual engagement. It's two people counting the offering, a second signature on disbursements, bank statements going unopened to someone other than the bookkeeper, and monthly reconciliations that a board member actually looks at.

If those controls aren't in place, do that first. Counting the offering with a two-person procedure covers the single highest-risk moment in a church's week, and separation of duties in a small church covers what to do when you don't have enough people to separate anything.

A worked example

A church with an annual budget in the low seven figures has never had an outside engagement. A new treasurer asks about an audit. The board gets three quotes and is startled by the range.

Rather than choosing immediately, the treasurer asks a different question: what are we actually worried about?

The answers turn out to be specific. Nobody outside the finance office sees the bank statements. The bookkeeper prepares the deposits and reconciles the account. There's no second signature on checks. And the youth pastor's card statements haven't been reviewed in two years.

So the board does four things. It has the bank statements sent to the board chair's home, unopened, for review before they go to the office. It requires two unrelated counters for every offering. It moves reconciliation to a volunteer with an accounting background who isn't the bookkeeper. And it engages a CPA for an agreed-upon procedures engagement covering card spending and disbursements over a set threshold.

The following year, with those controls running and clean records, the church commissions a review, which costs meaningfully less than the audit quotes because the books are in order.

Nothing dramatic happened. That's the point. The money went to the thing that reduces risk rather than the thing that sounds most serious.

What about an internal audit committee?

Many churches form a small committee of members with financial backgrounds to look over the books annually. It's worth doing, and it isn't an audit. The word causes confusion, so call it a finance review committee.

Done well, it involves reviewing bank reconciliations for the year, sampling disbursements and tracing them to approvals and invoices, checking that counting procedures were followed, confirming that restricted gifts were spent on their restriction, reviewing payroll against the employer rules that actually apply (IRS Publication 15 (Circular E), Employer's Tax Guide), testing contractor classifications (IRS, Independent contractor or employee), and confirming that the housing allowance was designated in advance of the pay it covered for the year in question (IRS, Ministers' Compensation & Housing Allowance).

Two rules. The committee can't include anyone who handles money or signs checks. And it has to produce a short written report to the board, kept with the minutes. A review nobody wrote down didn't happen.

Common questions

Are churches legally required to have an audit?

There's no general federal requirement that a church have an annual audit (IRS Publication 1828, Tax Guide for Churches). Requirements come from elsewhere: your state's charitable registration rules where they apply, a lender, a grantmaker, a denomination, or your own bylaws. Identify which of those applies to you before spending anything. An IRS examination of a church is a different animal again, with its own statutory procedures (IRC §7611, Church tax inquiries and examinations).

How much does each one cost?

It varies by size, complexity, region and the condition of your records, and quotes for the same church can differ substantially. Get three, ask each firm exactly what level of service they're quoting, and ask what would make the fee go up. Don't accept a quote that doesn't name the level of assurance.

Can our accountant who does the bookkeeping also do the audit?

No. Independence is the whole basis of the opinion. The person who keeps your books can't audit them. For a compilation the rules are different, but the same instinct applies: if you want outside eyes, the eyes have to be outside.

How often should we do this?

If an outside party requires it, at their frequency. If it's the board's own decision, many mid-size churches do a review every year, or a review every second or third year with strong controls in between. A church that's never had any outside look at its finances should do something, at least once, and then decide.

What do we do with the management letter?

Read it in a board meeting, assign every point to a person with a date, and follow up at the next meeting. An unaddressed management letter is a written record that the board was told and did nothing, which is the worst document in your file if something later goes wrong.

We think something is already wrong. Should we order an audit?

No. If you suspect misconduct, an annual engagement is the wrong tool on the wrong timeline. Secure the records first, don't tip off the person involved, and talk to a licensed attorney before you take any other step. Whether you then need a forensic engagement, which is a different service again, is a decision to make with counsel rather than from a blog post.

The practical wrap

Find out whether anyone actually requires an assurance engagement, and at what level. If someone does, get three quotes and match the level exactly. If nobody does, spend the first money on controls, then consider agreed-upon procedures aimed at whatever genuinely worries you, then a review.

Whatever you commission, remember the limit: outside accountants report on numbers. Two people counting the offering, statements opened by someone independent, and a board that reads the reconciliation are what actually protect a church.

---

Building out your financial controls? Browse the full catalog to see what's available today, or start with the church money and governance documents most boards need first.

*Faith Docs provides self-help document templates, not legal advice. We are not a law firm. For representation, consult a licensed attorney.*