Key topics covered in this article:

• • Financial statement audits provide important assurance, but they are not designed to uncover every operational, technology, or fraud-related risk affecting a club. Leadership should proactively share changes in staffing, systems, suspicious activity, and unresolved control issues so the CPA has the context needed to assess matters relevant to the audit.
  • Several areas deserve discussion before the next audit, including shifts in personnel that affect segregation of duties, new systems or vendors that change how data is processed and protected, suspicious transactions or near misses, and follow-up on previously identified deficiencies. Better two-way communication can help management and boards understand what falls within the audit and what may require a separate review.
  • The broader lesson is that stronger CPA conversations lead to better governance decisions. By surfacing risks earlier and assigning follow-up responsibility, club leadership can strengthen internal controls, improve oversight, and identify where more focused evaluation may be needed beyond the annual audit.

What Doesn’t Make It Into the Financial Statements?

Imagine your club recently implemented a new membership management system.

Member statements are going out, payments are processing, and the transition appears successful. But behind the scenes, the accounting team is still reconciling transferred balances, certain employees have broader system access than before, and management is unsure whether all transactions are flowing accurately into the general ledger.

Would your club’s CPA know about those changes before the audit began?

A financial statement audit may identify matters related to these changes, but management and leadership should not assume the auditor will independently identify every operational or technology-related issue.

The AICPA’s guidance on communication with those charged with governance recognizes the importance of two-way communication in helping auditors understand an organization and obtain information relevant to the audit.

A more productive CPA relationship starts with a simple shift: Don’t wait for your auditor to ask about something leadership already knows has changed.

Five Conversations Worth Having Before Your Next Audit

1. Have Changes in Personnel Created New Financial Control Risks?

When a long-tenured controller retires or an accounting position remains vacant, responsibilities often shift.

A single employee may temporarily handle vendor setup, payment processing, and bank reconciliations. That arrangement may keep operations moving, but it can also reduce the separation of duties that helps prevent or detect errors and inappropriate transactions.

Your club’s leadership should understand how management is addressing those risks, including whether additional review or approval procedures are necessary.

Ask your CPA: Have recent staffing or responsibility changes affected controls relevant to our financial reporting?

2. Are New Systems Changing How Information Is Processed and Protected?

Membership billing, point-of-sale systems, payroll platforms, accounting software, and other cloud-based technologies are increasingly interconnected.

A new system may improve efficiency while introducing questions about data accuracy, access permissions, transaction completeness, cybersecurity, and operational resilience.

If your club moves to a new membership platform, who verifies the accuracy of transferred balances? Are transaction interfaces reconciled? Have user permissions been reviewed? How is sensitive member information protected, and what would happen if the system became unavailable during a critical business period?

Many clubs rely on third-party service providers to support financial, operational, and technology functions. Depending on the services provided, a vendor’s independent assurance reports may provide valuable insight into the controls surrounding financial reporting, security, availability, processing integrity, confidentiality, and privacy. SOC 1 reports focus on controls relevant to financial reporting, while SOC 2 reports address broader technology and cybersecurity controls that may affect the club’s operations and data.

Ask your CPA: Which technology changes, cloud platforms, or outsourced service providers could affect the reliability of our financial information, the security of our data, or our ability to continue operations?

3. What Should Leadership Be Discussing Beyond the Audit?

Your annual financial statement audit provides valuable assurance about your club’s financial statements. It can also be a starting point for broader conversations about the risks, changes, and opportunities that may warrant a more focused evaluation.

While the audit remains focused on the financial statements, recent developments in auditing standards have placed additional emphasis on fraud-risk assessment, professional skepticism, and communication. The AICPA’s 2026 announcement of an enhanced fraud auditing standard reflects that direction, while reaffirming that management retains primary responsibility for preventing and detecting fraud.

For your board and management team, the goal isn’t to expect the audit to address every risk. It’s to understand which concerns fall within the audit and which may require a separate evaluation.

Ask your CPA: What matters were considered within the financial statement audit, and what concerns would require a separately scoped engagement?

4. Are We Sharing Suspicious Transactions and Near Misses?

An employee catches a suspicious payment request before funds are transferred. A vendor’s banking information changes unexpectedly. A reimbursement is questioned because the supporting documentation doesn’t match.

Perhaps a finance committee member notices an unfamiliar vendor receiving substantial payments, or invoices are approved without sufficient supporting documentation. These observations deserve attention, even when no fraud has been established.

Member complaints may also signal broader concerns. Repeated unauthorized charges or suspicious messages appearing to come from the club should prompt management to investigate whether financial reporting, payment security or other risks require further evaluation. Matters relevant to the financial statement audit should also be communicated to your CPA.

Even when a loss is prevented, these situations may reveal gaps in financial controls or opportunities for fraud.

The Association of Certified Fraud Examiners’ 2024 Report to the Nations identified inadequate internal controls and the override of existing controls as the primary contributing factors in 51% of the occupational fraud cases examined.

Management should investigate concerns, determine whether corrective action is needed, and communicate information relevant to financial reporting or potential material misstatement.

Ask your CPA: Are there suspicious transactions, control failures or near misses we should discuss because they may affect the audit’s fraud-risk assessment?

5. Are We Following Through on Concerns Raised in Prior Discussions?

A productive conversation should lead to more than meeting minutes.

Perhaps your CPA previously communicated a financial reporting control deficiency. Maybe your management team identified inconsistent vendor approval procedures or difficulties reconciling membership accounts.

Who owns the corrective action? Has management established a target completion date? Does the board receive updates on whether the issue has been addressed?

Board and finance committee discussions should go beyond reviewing financial statements and acknowledging findings. Ask what communicated control deficiencies mean for your club, whether management has addressed their underlying causes and how leadership will know that corrective actions are working.

The AICPA’s auditor communications resource center provides guidance on communicating internal control matters identified during a financial statement audit. Those communications can provide an important starting point for management’s evaluation and follow-up.

Ask your CPA: What matters from our previous discussions remain unresolved, and what information would demonstrate that management has addressed them?

Make the Conversation Useful Before, During and After the Audit

These discussions should not be limited to the annual presentation of audited financial statements.

Not every concern changes the audit approach or requires a separate engagement. The value comes from ensuring the right information reaches the right people at the right time.

A Practical Way to Start the Conversation

If you’re unsure which issues deserve a closer look, start with the Private Club Risk Readiness Checklist.

Developed by PBMares, this complimentary resource includes 15 questions covering payment fraud, financial controls, member information, technology access, incident preparedness and governance oversight.

It also includes a worksheet to help leadership identify unanswered questions, assign responsibility and establish follow-up priorities.

The checklist is a discussion aid, not a cybersecurity assessment, fraud examination, or substitute for a financial statement audit.

Better Communication Leads to More Informed Decisions

Even the most effective financial statement audit depends on timely communication. Your CPA cannot address concerns that have not been communicated, and the audit itself is not intended to identify every operational, technology or fraud-related risk facing the club.

But meaningful discussions about changes, unusual transactions, financial controls and emerging concerns can help leadership make better decisions about what deserves attention.

PBMares works with private clubs and hospitality organizations across financial statement assurance, cybersecurity, IT risk, fraud and internal controls. When concerns warrant additional evaluation, specialized services can be separately scoped.

What has changed at your club since your last meaningful conversation with your CPA?

Start by downloading the Private Club Risk Readiness Checklist to identify potential gaps, surface overlooked concerns and guide more productive conversations among club leadership, management and your CPA. Bring the results to your next leadership discussion and connect with Antonina McAvoy, Partner, Cyber & Risk Advisory, or Robert Parker, Partner and Hospitality Team Member, to explore practical next steps based on your club’s specific risks and priorities.