Going Concern Assessment Standards and Auditor Disclosure Requirements

Going concern assessment is being rewritten at the same time by three separate bodies working in three separate jurisdictions, and none of them is waiting for the others to finish. The IAASB governs international audits through ISA 570, now revised for the first time in years. Three sets of rules, three different enforcement bodies, one shared subject: whether an entity can keep operating, and who has to say so when the answer is in doubt.

This is not standard-setters chasing a theoretical problem. In practice, the obligations were narrower and more procedural than that assumption suggested, and when companies failed shortly after receiving clean audit opinions, regulators in multiple countries arrived at the same conclusion: the floor needed to be raised around how auditors evaluate management's going concern conclusions.

The economic backdrop makes the timing worse, or better, depending on which side of the engagement letter someone sits on. Interest rates that reset debt service costs, tariff policy that shifts overnight, supply chains still absorbing shocks from the last several years, and refinancing markets that have grown more selective about which borrowers get terms: all of these raise the odds that an ordinary-looking company runs into a liquidity problem inside the next twelve months. That is exactly the condition under which a going concern evaluation stops being a formality and starts determining whether a company's financial statements get a clean opinion or a qualified one. Three regulatory tracks tightening their requirements at once, against an economic backdrop that makes those requirements matter more often: that combination is why this subject deserves attention now rather than whenever the next required reading comes around.

Understanding what follows requires starting where the obligation itself starts, with management, before any auditor is in the room.

What FASB ASC 205-40 Requires of Management

FASB ASC 205-40, Presentation of Financial Statements, Going Concern, did something that U.S. GAAP had never done before it existed: it put an explicit, codified requirement on management's shoulders to evaluate the entity's ability to continue operating and to disclose the results of that evaluation. FASB closed that gap, and the scope is broad by design. FASB considered and rejected the idea of carving out an exemption for private companies, so a closely held manufacturer with no public shareholders carries the same evaluation duty as a listed corporation.

The default assumption in financial reporting is that a company will continue operating, and financial statements get prepared on that basis unless liquidation becomes imminent. But that presumption is not something management gets to assume silently. A company that reports quarterly does this evaluation four times a year, not once. That interim requirement often gets missed by preparers who treat going concern as a year-end exercise, when the standard built it into the normal reporting cadence from the start.

The evaluation itself runs on a specific clock: management looks at conditions and events, taken together, over the one-year period following the date the financial statements are issued. The standard asks for a judgment formed from the aggregate picture, not a checklist with a disqualifying box.

That judgment runs through two distinct steps, and the order matters. Step one asks whether substantial doubt is raised at all, evaluated before anyone considers what management plans to do about it. The word probable here carries its specific FASB meaning, the same threshold used elsewhere in FASB literature for loss contingencies: an outcome that is likely to occur, a standard well above merely possible. Practitioners who read probable in its everyday sense, as something like reasonably plausible, apply a lower bar than the standard actually sets, and that mismatch is one of the more common technical errors in going concern work.

The KPMG Going Concern Handbook, dated December 2025, makes a point that reaches past the mechanics of the two-step test: as forecasting grows less reliable and historical performance stops predicting what comes next, the assessment itself gets harder to perform well, and the disclosures built around it carry more weight for readers trying to understand a company's real position.

Disclosure obligations attach regardless of which way the two-step test comes out. There is no outcome under ASC 205-40 where the question gets evaluated and then goes unmentioned in the notes.

How AU-C 570 defines the auditor's distinct responsibilities for nonissuers under U.S. GAAS

Management's evaluation under ASC 205-40 is the input. AU-C section 570, The Auditor's Consideration of an Entity's Ability to Continue as a Going Concern, is what the auditor does with it on audits of nonissuers conducted under U.S. GAAS. The standard does not ask the auditor to simply agree with whatever conclusion management reached. It builds an independent evidentiary process around that conclusion, with the auditor responsible for reaching an opinion of their own.

The core obligations run in sequence. Separately, and this is the step that keeps the auditor's judgment from simply mirroring management's, the auditor has to form an independent view on whether substantial doubt exists about the entity's ability to continue operating, drawing on the same kind of evidence management considered but not bound to management's framing of it. Every one of these steps feeds into the final reporting decision.

When substantial doubt is identified and not alleviated, the auditor's report carries a going concern section addressing that conclusion directly. The form that section takes matters nearly as much as the conclusion itself: it has to communicate the finding clearly enough that a reader of the financial statements understands the significance of what's being said, rather than a hedge so cautious that the substance gets lost in the qualifying language around it. A going concern section that technically discloses the issue but buries it in boilerplate defeats the purpose the requirement was built for.

AU-C 570 did not arrive in its current form all at once. AU-C 570 was then amended again, first by SAS No. 134, which addressed auditor reporting more broadly, and again by SAS No. 136, which dealt with the reporting requirements specific to employee benefit plans subject to ERISA. That's the current state of play for nonissuer audits under GAAS: a standard that has already gone through one substantial modernization and two further amendments, and that is now under active review again as part of a broader convergence conversation, a conversation the final section of this piece returns to.

What AU-C 570 does not address is how any of this changes once the entity in question is a public company subject to PCAOB oversight instead of GAAS. That's a genuinely different regulatory track, not a variation on the same one.

How PCAOB Standards Handle Going Concern for Issuers

Issuers, meaning public companies whose audits fall under PCAOB standards rather than GAAS, operate under a going concern regime that looks similar to AU-C 570 at a distance but differs in both procedure and reporting form up close. Compliance risk is highest for firms and finance teams that work across both issuer and nonissuer engagements and treat the two as interchangeable, assuming a single mental model covers both.

The core assessment still runs through an independent auditor judgment: the auditor conducts their own evaluation of whether substantial doubt exists, separate from management's own conclusion, much as AU-C 570 requires. The underlying finding can be the same. The document that communicates it is not, and firms that handle both issuer and nonissuer work need standardized review processes that catch the difference before a report goes out the door.

That reporting distinction is not the only moving part for issuer audits right now. The PCAOB is running a parallel quality control reform that touches how firms manage going concern work operationally, even though it is not a going concern standard itself. And AS 1215, as amended alongside AS 1000, shortens the window for completing audit workpapers to 14 days after the report release date, a compression that touches going concern documentation as directly as it touches any other area of the file, given how much judgment and evidence-gathering goes into a substantial doubt conclusion.

None of this has been a smooth rollout. Stakeholder comment letters on QC 1000 raised a consistent concern: building a quality control system that differs meaningfully from ISQM 1, the international standard many firms already use as a reference point, takes real time and real money, and firms said as much when they asked for more runway. For firms auditing issuers, the practical task now is to treat December 15, 2026, as the planning deadline it actually is, since quality control systems, workpaper timelines, and going concern documentation all intersect on that same date, and building each of those pieces separately at the last minute is a harder project than building them together now.

ISA 570 (Revised 2024) and Its December 2026 Effective Date

ISA 570 (Revised 2024) is the most substantial rewrite of going concern auditing standards in years, and it shares its effective date with the PCAOB's QC 1000: audits of periods beginning on or after December 15, 2026. That shared date is not a coincidence of timing so much as a signal that firms working across international and U.S. issuer engagements are facing two major compliance deadlines landing in the same window. The planning work for both needs to happen now, before 2026 arrives.

The IAASB revised ISA 570 for the same reason the PCAOB and the ASB have been active in this space: a pattern of corporate failures that exposed a gap between what stakeholders assumed auditors were checking and what the prior standard actually required of them. The revised standard responds directly to that gap by changing what triggers an auditor's work, not just how that work gets written up afterward.

Under the prior approach, an auditor's going concern work was triggered largely by identified red flags: conditions or events that surfaced during the audit and pointed toward risk. ISA 570 (Revised 2024) changes that sequence. More significantly, auditors must evaluate management's going concern assessment irrespective of whether any such events or conditions have actually been identified. That phrase, irrespective of whether events or conditions have been identified, marks a real procedural shift rather than a wording change: the auditor's obligation to dig into management's assessment no longer waits for a trigger to appear. It's an affirmative inquiry performed on every audit, not a reactive step taken only once something looks wrong.

The revised standard also puts management bias explicitly on the table in a way the prior version did not. New requirements for responding to identified risks of material misstatement tied to going concern, along with strengthened reporting requirements generally, round out the revision.

The international reach of this change is not limited to firms that think of themselves as doing cross-border work. The AUASB approved adopting ISA 570 as ASA 570 at its May 2025 meeting, applying to financial reporting periods commencing on or after December 15, 2026, and built illustrative Corporations Act auditor's reports directly into the local standard to help firms implement it. A domestic Australian audit practice, with no cross-border engagements at all, is working under the same substantive requirements as a firm auditing a multinational, because the local regulator adopted the IAASB's text as written.

The IAASB has also published a Fact Sheet and a Frequently Asked Questions document aimed at auditors working through implementation. Support material of that kind does not get built for a standard that only needs a policy memo circulated internally. Its existence is itself a signal that the IAASB expects firms to need real help translating the revised requirements into engagement-level practice, which is a fair description of what the shift from reactive identification to affirmative inquiry actually demands of an audit team working a file.

Where the Three Frameworks Currently Diverge

Setting FASB and AU-C 570, PCAOB standards, and ISA 570 (Revised 2024) next to each other reveals a pattern: all three use largely the same vocabulary, substantial doubt, mitigation plans, disclosure, but they part ways at the exact points where the practical difference between a compliant audit and a deficient one gets decided. None of the three has converged with the others yet, and no single project currently in motion is positioned to finish that convergence before the December 2026 deadlines land.

The first fault line is timing: when does the auditor's obligation to dig into going concern actually start? AU-C 570's current language is less explicit on that exact point, a gap the ASB's ongoing project is examining directly as part of its broader look at the standard.

The second fault line is management bias. PCAOB standards and AU-C 570 both touch on professional skepticism and bias in general audit terms, but neither currently frames it with the same going-concern-specific directness that the revised international standard now has built in.

The third fault line is the shape of the final product. The same underlying professional judgment, that an entity's ability to continue operating is genuinely in doubt, gets expressed in three different document formats depending entirely on which regulatory track governs the engagement, a detail that matters enormously to anyone reading one of these reports without first checking which standard produced it.

The ASB's work to align AU-C 570 more closely with these developments is active, but it has not finished, and the December 2026 effective dates for ISA 570 (Revised 2024) and for PCAOB's QC 1000 are fixed regardless of where that convergence project stands when the dates arrive. Firms and entities operating across more than one of these frameworks are left to manage the divergence directly rather than wait for a single unified standard to settle the question for them.