Financial Reporting

What Your First Audit Actually Tests About Your 409A

Your first audit doesn't test what your 409A cost. Under AU-C 540 it tests the method, the significant assumptions, and the data behind every number in it.

By 409.AI Team - 2026-08-28

# What Your First Audit Actually Tests About Your 409A

The Series B closes, and somewhere in the deal documents is a line requiring audited financial statements within 120 days. You hire a firm, they send a request list, and you drop the 409A report you bought last spring into the shared folder. It has a cover page, a signature, and 40-odd pages of exhibits. You assume it's a credential.

It isn't. To an auditor it's a piece of evidence supporting a number in your income statement, and it's about to be tested the way evidence gets tested. Most founders find this out in week three of their first audit, usually in an email that starts "can you walk us through how the volatility input was selected."

Nobody audits your 409A

No auditor signs an opinion on a valuation report. The opinion covers the financial statements, and that distinction does more work than it looks like it should.

The 409A gets pulled into scope through the accounting. ASC 718 requires share-based payment awards to be measured at the grant-date fair value of the award, and for a private company, the fair value of an option depends on the fair value of the underlying common stock. Your 409A supplies that input. It then flows into stock compensation expense, which sits on your income statement and in your equity footnote. [How that mechanism works, in detail, is worth understanding before your first audit](https://409.ai/articles/asc-718-stock-based-compensation-startup-guide).

So the auditor's question is never "is this a good 409A?" It's narrower and considerably harder to answer: is the stock compensation expense in these statements materially correct, and does the evidence behind it hold together?

That reframing matters, because a report can clear one bar and fail the other. The IRS safe harbor is essentially a conditions test about who performed the valuation, how they were qualified, and how recently they did it. [It says nothing about what the report cost, and nothing about how thoroughly the assumptions were documented](https://409.ai/articles/409a-safe-harbor-price-vs-qualified-appraiser). The audit asks a different question entirely: can each significant number in this report be traced back to something real?

Which standard your auditor is actually applying

A persistent confusion is worth clearing up first, because it changes what you should expect from the process.

PCAOB standards apply to audits of issuers and SEC-registered brokers and dealers. That includes [AS 2501, Auditing Accounting Estimates, Including Fair Value Measurements](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2501), which has been effective for audits of fiscal years ending on or after December 15, 2020. A venture-backed private company is not an issuer, so AS 2501 is not the standard governing its audit.

Your first institutional audit is a nonissuer audit under AICPA generally accepted auditing standards. The relevant standard is AU-C section 540, Auditing Accounting Estimates and Related Disclosures, issued as [SAS No. 143](https://www.aicpa-cima.com/resources/download/aicpa-statement-on-auditing-standards-no-143) and effective for audits of financial statements for periods ending on or after December 15, 2023. If your fiscal 2024 or 2025 financials are being audited for the first time now, this is the standard your 409A is being read under.

One more clarification, since the date gets misquoted: the PCAOB effective date of fiscal years beginning on or after December 15, 2025 belongs to the [technology-assisted analysis amendments](https://pcaobus.org/oversight/standards/implementation-resources-PCAOB-standards-rules/amendments-related-to-aspects-of-designing-and-performing-audit-procedures-that-involve-technology-assisted-analysis-of-information-in-electronic-form) to AS 1105 and AS 2301, which address how auditors use technology to analyze information in electronic form. Those carry conforming changes into AS 2501, but they are not a rewrite of how estimates get audited, and they still only reach issuer audits.

AS 2501 does become your problem, and it arrives fast. Financial statements included in a registration statement have to be audited by a PCAOB-registered firm under PCAOB standards, so the years you already had audited under AICPA standards get examined again through a stricter lens on the way to an IPO. Companies that got soft answers accepted in year one tend to meet them again in the S-1 process, which is [where cheap stock findings come from](https://409.ai/articles/cheap-stock-pre-ipo-409a-sec-option-grants).

Three things get tested, separately

AU-C 540 pushes the auditor to evaluate the method, the significant assumptions, and the data behind an estimate as distinct items. That structure is the reason audit questions feel relentless: each one has its own evidence trail.

Take a concrete case. Your Series B closes at $60 million post-money, $3.00 per Series B preferred share, 1x non-participating liquidation preference. The valuation firm runs an option pricing model backsolved to that $3.00 price, allocates the resulting equity value across the preference stack, and lands common at roughly $1.05 before discounts. A 25% marketability discount takes it to $0.79. Grants go out at a $0.79 strike.

Method. Why the option pricing model, and why backsolve to the round? If you were in acquisition conversations four months later, a [probability-weighted or hybrid approach might have fit the facts better](https://409.ai/articles/409a-allocation-methods-opm-pwerm-backsolve), and the auditor will want to see that the choice was reasoned rather than default.

Assumptions. Volatility of 55% came from somewhere. Which guideline public companies, and why those? What lookback period, and does it match the expected term? Time to liquidity of 3.5 years came from somewhere too. Risk-free rate should tie to the same horizon. The 25% marketability discount needs a model and inputs behind it, not a range pulled from a study summary. [The discount is often the single largest adjustment in the report](https://409.ai/articles/discount-lack-marketability-dlom-409a-valuation), which is exactly why it draws the most attention.

Data. The cap table as of the valuation date, the executed round documents, and the financial forecast. This is where first audits actually break, and it's rarely the modeling. The valuation used a $14 million revenue projection for the following year. The board deck the auditor also received, because they asked for board minutes and materials, shows $22 million. Now there are two forecasts, and the one that produced a lower common value is the one in the valuation.

That's not a formatting problem. Under AU-C 540 the auditor is required to look for indicators of possible management bias, and an assumption set that consistently runs conservative in the direction that lowers the strike price is close to a textbook indicator.

Suppose the auditor works through it and concludes that a shorter time to liquidity and a smaller marketability discount are better supported, putting common nearer $1.05 than $0.79. That doesn't translate one-for-one into an expense adjustment, since option fair value moves less than the underlying. But it moves in the same direction, across every grant made off that valuation, and the audit team will size it as a potential misstatement and decide whether it matters to the statements as a whole.

Your appraiser is "management's specialist"

There's a second requirement that founders almost never anticipate. When information used as audit evidence has been prepared using the work of a specialist engaged by management, AU-C 500 requires the auditor to evaluate that specialist's competence, capabilities, and objectivity, understand the work performed, and evaluate whether it's appropriate as audit evidence for the assertion. [SAS No. 144 sharpened this guidance](https://www.aicpa-cima.com/resources/download/aicpa-statement-on-auditing-standards-no-144), effective on the same timeline as SAS 143.

Read that against a report with no named appraiser, no credential, and no description of who did what. There's nothing for the auditor to evaluate. They're not being difficult when they ask for the analyst's name and qualifications. The standard obliges them to ask.

Objectivity is the piece that catches people. If the provider is also your cap table vendor, or the report came bundled at no cost with a subscription, the auditor has to consider that relationship. It isn't disqualifying. It is a question you'd rather have your file answer than have to answer live. The Appraisal Standards Board made a related point about who can stand behind a valuation when it concluded that [a tool cannot comply with USPAP, only an appraiser can](https://409.ai/articles/ao-41-uspap-ai-valuation-tools-409a-appraiser).

The look back

AU-C 540 also has the auditor review prior-period estimates against how they actually turned out. This is where a stale valuation surfaces.

Say your prior common FMV was $0.31, and nine months later you closed a round that implies common at $1.05. The auditor will ask what changed, when it became knowable, and whether the earlier estimate was still reasonable at the grant dates it covered. If the honest answer is that nothing changed except that you hadn't refreshed, the prior year can reopen. [The IRS asks a related but different set of questions in an equity compensation exam](https://409.ai/articles/irs-audit-409a-valuation-document-request), and a file built to satisfy one usually satisfies the other.

What to have ready before fieldwork

Six items, and you can assemble all of them before anyone asks:

The signed report, with the appraiser named and credentialed, and the scope of work described.
The valuation date, and every grant date it was used for, tied to board consents.
The cap table as of the valuation date, reconciling to the share counts in the report.
The forecast used in the valuation, and evidence it's the same forecast the board saw.
Support for each significant assumption: the comparable company set, the volatility lookback, the expected term, the marketability discount model and its inputs.
A record of any material event after the valuation date, and what you did about it.

If a request on that list sends you back to the provider, you've found the gap while you can still fix it cheaply.

The number that actually gets compared

The arithmetic nobody runs before buying is this one. An audit doesn't cost you the price of the report. It costs you the price of the argument. When an audit team can't get comfortable, the firm brings in its own valuation specialist, billed to you as audit hours. You commission a rework valuation. The close slips past the date in your investor agreement, and the [AICPA's updated cheap stock guidance](https://409.ai/articles/aicpa-cheap-stock-guide-2026-update-409a-valuation) means the bar for that documentation is rising, not falling.

An auditor will never ask what your 409A cost. They'll ask where six or seven specific numbers came from, and they'll ask about each one separately. A report that answers those questions inside its own pages is worth whatever it cost. A report that can't answer them gets answered by your finance team, at billable rates, about grants you already made.

Whoever you hire, buy the file, not the PDF. [409.ai builds its 409A reports](https://409.ai/products/409a) around the assumption documentation an audit asks for, and its [ASC 718 work](https://409.ai/products/asc-718) picks up where the fair value estimate ends.