All three services start with the same financial information and produce documents that may look similar. What changes is the level of assurance provided to those who rely on them—and that makes all the difference.

This is one of the most common questions accounting firms receive, and it is almost always asked incorrectly. A client says the bank requested "audited financial statements" when, in fact, it only requested financial statements signed by a Certified Public Accountant (CPA). Or a company requests an audit when what it actually needs is someone to prepare properly organized financial statements for the first time. Choosing the wrong service costs money, takes time, and often results in a report that does not meet the requirements of the process for which it was commissioned.

Audits, reviews, and compilations all begin with the same input—the financial information provided by the company—but they do not pursue the same objectives, follow the same procedures, or, most importantly, provide the same level of assurance. That last word, assurance, is what truly distinguishes them, and understanding it is essential before signing an engagement letter.

Figure 1. Comparison of the three engagements based on the level of assurance they provide.

Audit: The Only Engagement That Results in an Opinion

An audit is a reasonable assurance engagement. The auditor obtains sufficient appropriate audit evidence through procedures designed to achieve a high level of assurance—high, but never absolute—that the financial statements, taken as a whole, are free from material misstatement, whether due to fraud or error. The work is performed in accordance with the International Standards on Auditing (ISA).

In practice, this means the auditor gains an understanding of the business and its relevant internal controls, identifies areas where significant errors are most likely to occur, and designs procedures to address those risks. These procedures may include confirming balances directly with banks, customers, suppliers, and legal counsel; observing physical inventory counts; inspecting contracts and supporting documentation; and recalculating figures and testing transactions. The auditor does not examine every transaction, nor is the audit designed to do so. Instead, the work is based on materiality and risk.

The final deliverable is an auditor's report expressing an opinion on whether the financial statements present fairly, in all material respects, the company's financial position, financial performance, and cash flows in accordance with the applicable financial reporting framework.

Of the three services, an audit is the only one that results in an audit opinion. That is why it is generally required by banks, regulators, investors, and parties involved in mergers and acquisitions.

Review: Limited Assurance with a Narrower Scope

A review provides a limited level of assurance. The practitioner relies primarily on inquiries of company personnel and analytical procedures, such as comparisons between reporting periods, trend analyses, financial ratios, and expected relationships between financial statement items. Additional procedures are performed when something appears inconsistent with what would reasonably be expected.

The applicable standard is ISRE 2400 (Revised). When a review of interim financial information is performed by the entity's independent auditor, ISRE 2410 applies.

The conclusion is expressed in negative form, and that wording is not merely a formality. The practitioner does not affirm that the financial statements are fairly presented. Instead, the practitioner states that, based on the procedures performed, nothing has come to their attention that causes them to believe otherwise.

In simpler terms, a review communicates, "I found no indications of material misstatement," while an audit communicates, "I obtained sufficient evidence to express an opinion."

For an external user, that distinction is significant and should be clearly explained before the report is delivered.

Compilation: Professional Assistance Without Assurance

A compilation is not an assurance engagement. Under ISRS 4410 (Revised), its purpose is for the practitioner to apply accounting and financial reporting expertise to assist management in preparing and presenting historical financial information, without expressing an audit opinion or a review conclusion.

The practitioner does not confirm balances with third parties, test account balances, or obtain evidence to support a level of assurance that the engagement does not provide.

However, this does not make compilation a passive service. If the practitioner becomes aware that information is incorrect, incomplete, or misleading, they must request the additional information or corrections needed. If management refuses to address those issues, the practitioner must withdraw from the engagement.

What the practitioner cannot do is sign a report suggesting a level of assurance that was never obtained.

Responsibility for the financial statements—and for decisions made based on them—remains entirely with management. The compilation report explicitly states that no assurance is provided.

Key Differences at a Glance

The following table summarizes the factors that most frequently determine which of the three services a company should engage.

Aspect	Audit	Review	Compilation
Engagement objective	Express an opinion on whether the financial statements fairly present the company's financial position.	Conclude whether anything has come to the practitioner's attention indicating a material misstatement.	Assist management in preparing and presenting financial statements.
Is independence required?	Yes. It is an assurance engagement.	Yes. It is an assurance engagement.	Not inherently required by the engagement, unless applicable laws or users require it.
Who is responsible for the figures?	Management. The auditor is responsible for the audit opinion.	Management. The practitioner is responsible for the review conclusion.	Management retains full responsibility. The practitioner provides no assurance.
Is it accepted by banks or regulators?	Yes. It is generally the level of assurance they require.	It depends. Some accept reviews for specific purposes or interim periods.	Generally not when assurance is required.
Typical use	Legal, contractual, or regulatory requirements; investors; mergers and acquisitions.	Interim financial information; users who require professional assurance without a full audit.	Internal management, procedures that do not require assurance, and organizing financial information before an audit.
Relative effort, timeline, and cost	High	Moderate	Low

What Businesses in Panama Should Know

This discussion would be less useful if it remained purely international, because the questions accounting firms receive are almost always tied to local requirements.

These are the issues that most frequently cause confusion in Panama:

Countersigning is not the same as auditing. The countersigning (refrendo) of a sworn income tax return is a professional act reserved for Certified Public Accountants. It is required when the gross amount to be declared exceeds B/.11,000.00 and must be performed by an independent CPA with no ties to the company. Countersigning a tax return does not constitute an audit of the financial statements and does not result in an audit opinion.
The accounting profession is regulated by Law 280 of December 30, 2021. This law repealed Law 57 of 1978 and establishes the professional activities reserved for CPAs. Professional authorization is granted by the Technical Accounting Board (Junta Técnica de Contabilidad) and is required to sign any of these engagements.
Engagements involving larger clients. For audit or review engagements involving financial statements of clients with gross revenues exceeding one million balboas, the law requires identifying the engagement partner and the engagement team alongside the report, as well as declaring that the work was physically performed within Panamanian territory.
Free zones. Legal entities established in free zones or free trade zones must prepare and maintain annual financial statements countersigned by a Certified Public Accountant. These statements must be issued within 90 days following the close of the fiscal period and made available to the General Directorate of Revenue (Dirección General de Ingresos, DGI).
Who requires an audit? An audit is not universally mandatory. The requirement may arise from a sector-specific regulator—such as those overseeing banking, securities, insurance, or cooperatives—from special legislation, a loan agreement, or the terms of a public tender. Before engaging an accounting firm, companies should verify exactly what the requesting document requires, because it does not always call for an audit.

What None of These Three Services Does

Understanding the differences between these services is just as important as knowing what not to expect from them. Many subsequent disputes arise from expectations that were never clearly established at the beginning of the engagement.

None is a forensic audit or is designed to detect every instance of fraud. An audit considers the risk of fraud and applies procedures accordingly, but its objective is to address material misstatements in the financial statements, not to investigate a specific incident.
None replaces the company's accounting function or internal controls. The practitioner works with the information and systems that already exist; the engagement does not involve building the entity's accounting information system.
None can turn nonexistent information into reliable information. If supporting documentation is missing, no type of engagement can compensate for that absence.
None constitutes a rating of the company's financial health. An unmodified audit opinion does not mean a business is financially healthy. It means that its financial statements are fairly presented, in all material respects.

How to Choose the Right Service

The decision comes down to one fundamental question: Who will use the financial statements, and what does that party require from the company?

If the intended user is an external party that needs to rely on the financial information to make a decision, the required level of assurance generally increases.

If the statements are intended for internal use, or the relevant procedure does not require professional assurance, a less extensive engagement may meet the need at a fraction of the cost.

Figure 2. A sequence of questions to identify the appropriate engagement.

A COSTLY MISTAKE. Choosing a service that provides less assurance than required does not save money—it means the work may have to be repeated.

A compilation cannot simply be converted into an audit by adding procedures at the end. If the bank ultimately requires an audit opinion, a new engagement must be initiated, with its own scope, evidence requirements, and professional fees.

In Summary

An audit provides reasonable assurance and results in an audit opinion.

A review provides limited assurance and results in a conclusion expressed in negative form.

A compilation provides no assurance; it assists the entity in preparing and presenting its financial statements.

None of these services is inherently "more complete" than the others in every situation. Each serves a different purpose, and the costly mistake is choosing one that does not meet the actual requirement.

Professional Standards and Legal References:

International Standards on Auditing (ISA), issued by the International Auditing and Assurance Standards Board (IAASB); ISRE 2400 (Revised), Engagements to Review Historical Financial Statements; ISRE 2410, Review of Interim Financial Information Performed by the Independent Auditor of the Entity; and ISRS 4410 (Revised), Compilation Engagements.

In Panama: Law 280 of December 30, 2021, governing the practice of Certified Public Accountants, and the provisions of the Tax Code concerning the countersigning of tax returns and financial statements.

The current version of each standard and the applicable sector-specific regulations should always be verified.

At our firm, we provide all three services. Before recommending one, we review the actual requirements stated in the document that prompted the request.

If you are unsure what your bank, regulator, or investor is asking for, send us their communication. We will help you identify the appropriate service at no cost.