Auditor Circle-Ups - A Practical Guide

The High-Level Concept

A "circle-up" is a version of the offering document, typically a prospectus, registration statement, or offering memorandum, that has been marked up to identify every financial figure and table on which the issuer's auditors will be asked to provide comfort. The marking is, almost literally, what the name suggests: each number that needs to be tied back to the audited or reviewed financial statements (or to other supporting accounting records) gets a coloured rectangle drawn around it. Red is the conventional choice, though firms vary.

The purpose is twofold. First, it gives the auditors a precise, unambiguous record of which figures they are being asked to comfort, which matters because the comfort letter they ultimately issue will list each number, the procedure performed, and the level of assurance given. Second, the circle-up forces a discipline on underwriters' counsel: every number in the offering document either gets circled, or there needs to be a defensible reason it does not. The exercise therefore functions both as a due-diligence record for the underwriters and as the auditors' working scope.

The term "circle-up" stuck because for several decades the practice was conducted on paper, in printers' offices, with red pens. The marks-up still look broadly the same on screen as they did on paper. Some firms call the same exercise "tick-and-tie", referring to what the auditors do once the circle-up is delivered to them.

Who Prepares One, and Who Reads It?

The circle-up is prepared by underwriters' counsel. That is the market convention in the United States and in most international offerings that follow the US comfort-letter model. Issuer's counsel and the issuer review it, the auditors respond to it, and the underwriting bankers rely on it, but the pen is held by the underwriters' lawyers because the comfort letter is, ultimately, their due-diligence record. (See section 3 for why this is so.)

The auditor's role is to receive the circle-up, evaluate each marked item, and respond, typically by assigning a tick mark or query letter to each circled figure. The audit firm's national office or capital markets group will usually be involved in setting the firm's position on contested items. Several rounds of negotiation are normal: the auditors will push back on items that fall outside the scope of what they are professionally permitted to comfort, and counsel will press for as much coverage as possible to support the underwriters' due-diligence defence.

Once the working group has agreed the marked-up document and the corresponding comfort matrix, the auditors prepare the comfort letter itself. The bankers, particularly their internal counsel and capital-markets lawyers, then read the circle-up alongside the comfort letter to assess what they can rely on at pricing and at closing.

What a Circled Document Looks Like

A finished circle-up generally has three visible features. The first is the rectangles: thin red boxes drawn tightly around inline numbers within prose, and around the data regions of tables and charts. Headings, axis labels, and other contextual text are usually left alone. The second is the tick marks, letters, numbers, or short codes (commonly "A", "B", "F", "U", and so on) placed adjacent to each circled item, keyed to a separate comfort matrix that explains what each code means. The third is marginalia, handwritten or commented annotations recording queries, responses, and resolutions as the document evolves through drafts.

Conventions are not perfectly uniform. Firms differ on colour (red is most common), on whether to circle the entire data region of a table or each cell individually, on how to mark items that are intentionally not being comforted (some firms use a separate colour or a strikethrough), and on how to handle figures that appear more than once. International firms working on cross-border deals may follow local conventions when reporting accountants are involved in addition to a US-style auditor.

How the Practice Began

The comfort letter, and with it the circle-up, is a creature of the Securities Act of 1933. Section 11 of that Act imposes near-strict liability on underwriters and others who sign a registration statement for material misstatements or omissions. It also gives those defendants an affirmative escape route: the due-diligence defence, available to a person who can show they conducted a reasonable investigation and had reasonable grounds to believe the registration statement was accurate.

For most of the 1933 Act's first three decades, the meaning of "reasonable investigation" was not extensively tested in court. That changed in 1968 with Escott v. BarChris Construction Corp., a decision of the Southern District of New York that subjected the diligence performed by directors, underwriters, accountants, and counsel in a small bowling-alley financing to detailed scrutiny, and found nearly everyone wanting. The case made clear that taking management's word for it was not enough: underwriters were expected to verify, to probe, and to follow up on red flags. The court was particularly critical of underwriter diligence that had been delegated to counsel and not independently checked, and of an accountant's review that had been performed in haste and without scepticism.

After BarChris, underwriters and their counsel sought a more reliable way to evidence the financial-statement portion of their diligence. The mechanism that emerged was the comfort letter: a written communication from the issuer's auditors describing specific procedures performed on specific financial information, addressed to the underwriters and intended to support their reasonable-investigation showing. The American Institute of Certified Public Accountants (AICPA) issued early guidance on these letters in the 1970s and 1980s, culminating in Statement on Auditing Standards No. 72 in 1992, which set out the modern framework.

From Manual Marking to Today's Workflow

For most of the 20th century, circle-ups were done in print shops. Underwriters' counsel would arrive at the financial printer with a red pen and an early proof of the prospectus, mark up every figure that needed to be comforted, and the proofreaders would transmit the marked-up pages to the auditors. Successive drafts produced fresh circle-ups, each requiring re-marking and re-checking.

The migration to PDFs in the 2000s made distribution faster but did not fundamentally change the workflow; counsel simply switched from a red pen to a PDF annotation tool. More recently, structured workflow tools and AI-assisted detection have begun to change the economics: software can now identify candidate numbers automatically, propose tick-mark codes based on historical practice, and flag inconsistencies between drafts. Negotiation and judgement still rest with humans, but the mechanical work of marking up has become substantially less tedious.

SAS No. 72 (and Its Successors)

SAS 72, "Letters for Underwriters and Certain Other Requesting Parties," was the AICPA's defining statement on comfort letters when it was issued in 1992. It set out who could request a comfort letter, what assurances an auditor could give, and the form and content of the letter itself, including the negative-assurance language that has been the workhorse of the practice ever since.

After the Sarbanes-Oxley Act of 2002 created the Public Company Accounting Oversight Board (PCAOB), responsibility for auditing standards split. The PCAOB took over standards applicable to audits of public companies (issuers), while the AICPA retained authority over audits of non-issuers. SAS 72 was carried forward into both regimes:

• For issuers (companies whose securities are registered under the Securities Act or the Exchange Act), the PCAOB initially codified SAS 72 as AU Section 634, and then in 2016 reorganised its standards to renumber it as AS 6101, "Letters for Underwriters and Certain Other Requesting Parties." AS 6101 is now the operative standard in any SEC-registered offering by a public company audited by a PCAOB-registered firm.
• For non-issuers, the AICPA's "Clarity Project" produced AU-C Section 920, with the same title. AU-C 920 was issued as part of SAS 122, amended by SAS 129 in 2014, and applies to comfort letters delivered in offerings by entities whose audits are governed by AICPA standards rather than PCAOB standards.

Although the formal citation has changed several times, market participants still routinely refer to "SAS 72 letters". The term is well understood, and audit firms continue to use the SAS 72 nomenclature in representation letters delivered by initial purchasers and other requesting parties in unregistered offerings.

Practice point. When citing the standard in a deal, default to AS 6101 if the issuer is SEC-registered or otherwise PCAOB-audited, and AU-C 920 otherwise. Calling the document "the SAS 72 letter" remains universal shorthand and is not wrong; it is just out of date.

PCAOB AS 6101

AS 6101 governs the form, scope, and content of comfort letters issued by PCAOB-registered firms in connection with SEC-registered offerings. It identifies who is eligible to receive a letter, and specifies the categories of comfort an auditor may give.

The eligible recipient set falls into three groups:

• Named underwriters and the issuer's board of directors — and, more generally, any party with a statutory Section 11 due-diligence defence in respect of the financial statements. Other agents may also qualify where they produce a written opinion of counsel confirming that the defence is available to them.
• Broker-dealers and other financial intermediaries acting as principal or agent in unregistered or exempt offerings — Reg S, Rule 144A, Reg A, Reg D, and offerings by governmental, municipal, banking, or other exempt issuers — provided they deliver a representation letter to the auditors.
• Buyers and sellers in stock-for-stock acquisitions, again subject to a representation letter.

The representation letter is the audit profession's mechanism for extending comfort to parties that do not have a direct statutory defence. The recipient confirms, in substance, that it is familiar with the diligence that would have been carried out in a registered offering, and that the process it has actually performed is substantially consistent with that. In modern market practice auditors will almost always ask for one, whether or not a strict statutory case for the defence could be made out.

The standard contemplates three principal forms of assurance. Positive assurance, the auditor's opinion, applies only to information that has actually been audited (the audited annual financial statements and certain related schedules) and to the auditor's own independence. Negative assurance, the familiar "nothing came to our attention" language, is available for unaudited interim financial information that has been subjected to a SAS 100 / AS 4105 review, and for changes in specified financial-statement line items during a subsequent change period. Agreed-upon procedures, sometimes called "tick-and-tie" comfort or "circle-up" comfort, describe specific procedures the auditor has performed (typically arithmetic checks and tracing to accounting records) and the findings of those procedures, without offering any assurance on the sufficiency of those procedures for the underwriters' purposes. AS 6101 also sets out form letters and the now-familiar 135-day cut-off (see section 5).

Securities Act §11 and the Due-Diligence Defence

Section 11 of the Securities Act of 1933 imposes civil liability on every person who signs a registration statement that contains a material misstatement or omission. The list of potential defendants is broad: the issuer, every director, every named officer, every underwriter, and every named expert (which, for the financial statements, means the auditor). The plaintiff need not show reliance, scienter, or even negligence: the issuer is strictly liable, and the other defendants bear the burden of proving they were not negligent.

The escape route is the due-diligence defence. With respect to expertised portions of the registration statement (which include the audited financial statements), non-expert defendants generally need only show they had no reasonable ground to believe the expertised portion was untrue. With respect to non-expertised portions (which includes most of the prose, the MD&A, and any financial information not formally covered by the auditor's opinion), they must show, after reasonable investigation, that they had reasonable grounds to believe the information was accurate.

The comfort letter is the document that converts a slice of this non-expertised territory into something the underwriters can credibly say they investigated. The numbers covered by tick-and-tie comfort and negative assurance in the comfort letter are not "expertised" in the technical Section 11 sense, but the auditor's procedures provide an evidentiary basis on which underwriters can claim a reasonable investigation. The post-BarChris case law has reinforced this: courts have consistently treated the obtaining of an appropriately scoped comfort letter as a meaningful component of underwriter diligence, alongside management interviews, customer and supplier checks, document review, and independent verification of key assertions.

International Equivalents

The US comfort-letter model is the dominant one in cross-border practice. Most international offerings that contemplate any US sales (Rule 144A, Reg S, or registered) use a SAS 72 / AS 6101-style letter as the core diligence document. Local frameworks coexist alongside it.

• United Kingdom and Ireland. The Financial Reporting Council issues the Standards for Investment Reporting (SIRs): SIR 1000 sets the basic principles, while SIR 2000 (revised 2020) governs reporting on historical financial information in investment circulars. The SIRs cover related but distinct deliverables (long-form reports, working-capital reports, accountant's reports on historical financial information) rather than the SAS 72-style comfort letter, which UK-listed offerings typically still obtain in addition where US sales are contemplated.
• Australia. The Auditing and Assurance Standards Board issues ASRS 4450, "Comfort Letter Engagements," operative since 1 July 2013. ASRS 4450 was modelled on the international equivalents and is now the binding standard for Australian auditors providing comfort letters in connection with prospectuses and other offering documents. (The earlier AUS 804, which dealt with prospective financial information, is unrelated to the comfort-letter workflow.)
• Canada. The CPA Canada Handbook addresses related-party reporting in Section 7150, "Auditor's Consent to the Use of a Report of the Auditor Included in an Offering Document," with separate provisions for comfort letters delivered in connection with short-form and long-form prospectuses. Canadian short-form practice under National Instrument 44-101 leans more heavily on the auditor's consent and short-form review processes than on full SAS 72-style letters.
• Germany. The Institut der Wirtschaftsprüfer issues IDW PS 910, which operates similarly to SAS 72 and is used in German-law-governed offerings. In practice IDW PS 910 letters and SAS 72 letters often run in parallel on the same deal.
• Hong Kong. HKICPA's HKSIR 400 governs comfort letters issued in connection with Hong Kong Stock Exchange listings.

Practice point. On a cross-border deal, expect parallel comfort letters: one under the local standard for local-law diligence and one SAS 72-style letter to support any US-law due-diligence defence. The circle-up may need to be coordinated across both engagement teams.

The Deal Timeline

In a typical SEC-registered IPO, the comfort and circle-up workflow runs alongside the broader transaction timeline. A simplified view:

1. Organisational meeting. The working group convenes: issuer, issuer's counsel, underwriters, underwriters' counsel, and the auditors. The auditors are formally engaged, and counsel begins to develop the financial sections of the registration statement.
2. Drafting sessions. As S-1 / F-1 drafts circulate, underwriters' counsel begins building the circle-up. Early circle-ups go to the auditors so that scope discussions can begin while the document is still mutable.
3. Initial filing and SEC review. The S-1 / F-1 is filed publicly (or confidentially under JOBS Act provisions). SEC comments may drive changes to the financial sections, requiring the circle-up to be updated.
4. Pricing. This is the first hard deadline for a comfort letter. The underwriting agreement is signed, the offering is priced, and the auditors deliver a comfort letter dated as of the pricing date. The circle-up is, in effect, the appendix that explains what each tick-marked number in that letter represents.
5. Closing (T+1 to T+5). The auditors deliver a bring-down comfort letter dated as of closing. This letter typically does not repeat the full procedural detail of the pricing letter; instead, it confirms that the procedures described in the pricing letter, performed as of an updated cut-off date close to the closing date, would yield the same conclusions.

For shelf takedowns and bond offerings, the timeline compresses dramatically, sometimes to a matter of days or even hours from launch to pricing. The circle-up, however, is largely portable: a well-maintained comfort matrix and circle-up from a recent prior offering can be updated for new figures rather than rebuilt from scratch.

Across Offering Types

The intensity of the circle-up exercise scales with the type of transaction and the diligence stakes:

• Initial public offerings. The most labour-intensive. The S-1 / F-1 is built from scratch, contains five years of selected financial data plus three years of audited statements, and tends to feature dense MD&A. Circle-ups can run to hundreds of marked items.
• Follow-on equity offerings. Significantly lighter, because the issuer is already a reporting company and most of the document is incorporated by reference from existing 10-K and 10-Q filings.
• Registered debt and shelf takedowns. Lighter still: debt offerings often rely heavily on incorporation by reference and on a base prospectus that has already been comforted.
• Rule 144A and Reg S. Although unregistered, these offerings still feature Section 11-style diligence in practice. Initial purchasers expect a SAS 72-style letter and provide a representation letter to the auditors to underpin it. Where a deal has both a Rule 144A tranche (for US qualified institutional buyers) and a Reg S tranche (for offshore investors), it is routine for the auditors to issue two separate comfort letters — one keyed to each tranche, mirroring the bifurcated diligence record. The Reg S letter conventionally carries an express statement that it is not to be used in connection with sales of securities in the United States. Where the offering is also listed in a jurisdiction with its own reporting-accountant standards, a third locally-styled letter may run in parallel. Circle-ups are otherwise essentially identical to those in registered deals.
• Medium-term note (MTN) programmes. Programme establishment carries a comprehensive comfort letter; subsequent takedowns rely on bring-down letters keyed to a stable circle-up of the offering circular.
• Canadian short-form prospectuses. Lighter circle-up exercise, given the short-form regime's reliance on incorporation by reference, but bring-down letters and auditor consents remain central.

The Working Group and Time Pressure

The working group is the cluster of professionals running the deal: issuer (CFO and finance team), issuer's counsel, the underwriters' deal team, underwriters' counsel, and the audit engagement team (often supported by the audit firm's national office for technical questions). The circle-up is one of several documents that must be finalised in the hours before pricing, alongside the underwriting agreement, the legal opinions, and the officers' certificates, and so it frequently lands on the critical path. A late-breaking change to the prospectus, a contested figure that the auditors are unwilling to comfort, or a late discovery of a subsequent-event issue can all push the comfort letter to the very last hour. Experienced working groups invest in early circle-up drafts precisely to avoid this.

Negative Assurance and the Limits of Comfort

The comfort letter is built around the distinction between positive assurance and negative assurance. Positive assurance is the language of an audit opinion: an affirmative statement that the financial statements present fairly, in all material respects, the financial position of the entity. Auditors give positive assurance only on information they have actually audited.

Negative assurance is more limited. It says, in effect: we performed the following procedures, and on the basis of those procedures, nothing came to our attention that caused us to believe the information is materially misstated. It is the language used for unaudited interim financial information that has been subjected to a SAS 100 / AS 4105 review, and for subsequent-changes comfort on specified line items.

There are bright lines around what auditors will not comfort, regardless of how the request is framed. Forward-looking statements, projections, and management's expectations are out of scope as a matter of professional standards. Those standards do not permit negative assurance on outcomes that have not occurred. Non-financial information (such as headcount, units shipped, or square footage), market data sourced from third parties, and management's narrative about competitive dynamics are similarly outside the comfort-letter framework. Auditors will also typically decline to comfort approximate, rounded, or estimated figures unless the underlying records support a more precise number that has been rounded for presentation. (See section 6 for a fuller treatment of in-scope and out-of-scope items.)

Tick Marks and the Comfort Matrix

Each circled number in the offering document is assigned a tick mark: a short letter, number, or symbol that appears next to the circle in the marked-up document. The tick mark is keyed to a separate document, the comfort matrix, which tells the reader exactly what procedure the auditor performed for items bearing that mark and what level of assurance is given.

A typical matrix might include codes such as:

• "A": agreed to the audited consolidated financial statements
• "B": agreed to the unaudited interim financial statements that were subject to a SAS 100 / AS 4105 review
• "C": agreed to underlying accounting records that are subject to the issuer's internal control over financial reporting
• "F": recalculated arithmetically (footings, cross-foots, percentages)
• "U": figures the auditor declines to comfort, with a stated reason

The exact codes vary by firm and by deal, but the structure is universal: every circled item gets a tick, every tick maps to a procedure, and every procedure is described somewhere in the comfort letter or its annex. The matrix is the document that allows the underwriters' counsel (and, in due course, a court evaluating the diligence record) to reconstruct exactly what diligence supports each figure in the prospectus.

The Hierarchy Behind the Tick Marks

Not all tick marks pull equal weight. The procedures behind each code sit on an implicit ladder, and where a circled figure lands on that ladder is what determines how much real diligence the comfort actually represents.

At the top of the ladder are figures that the auditor has been able to agree directly back to audited financial statements, to interim financial statements that have been the subject of a SAS 100 / AS 4105 review, or to accounting records — the general ledger, trial balance, or sub-ledgers — that are themselves subject to the issuer's internal control over financial reporting. In each of these cases the underlying source has already passed through independent scrutiny.

One rung down are figures agreed to a management schedule or analysis prepared by the issuer's finance team. The auditor confirms that the figure in the offering document matches the schedule, but typically expresses no view on how the schedule was put together or on whether anything material has been left out. The comfort is genuine but narrower, and counsel should be alert to which of the circled items sit here rather than higher up. On a more complex schedule, a useful intermediate procedure is to have the auditor sample-trace a subset of the schedule's underlying line items directly to the accounting records — recovering some of the assurance of the top rung without the cost of a full agree-back.

At the bottom of the ladder are procedures that trace a circled figure to a source that has not itself been verified — an unaudited internal report, a press release, a management deck. Tick marks of this kind exist on paper but carry little diligence weight, and they are worth pushing back on where the underlying number is material to the offering.

Cut-Off Dates and the Change Period

The cut-off date is the date through which the auditors have performed the procedures described in the comfort letter. In SEC-registered deals it ordinarily sits no more than three business days before the date of the letter itself, so that the procedures are as fresh as possible at pricing. The cut-off is fixed in the underwriting agreement, which also identifies the period over which subsequent changes are being measured.

That period is the change period: the window over which the auditor is asked to look for movements in specified financial-statement items — typically capital stock, long-term debt, net current assets, stockholders' equity, net sales, and total and per-share income figures. For balance-sheet items, the change period generally runs from the day after the latest balance sheet date in the prospectus through to the cut-off date. For income-statement items, it runs from the day after the close of the latest period for which a P&L is presented. Negative assurance is given on the change period as a whole, not on slices of it: a decrease in one month that is offset by an increase in another may produce no aggregate change to comment on.

For the tail end of the change period — the stretch between the most recent reviewed or audited financials and the cut-off date — the auditor's procedures are necessarily limited. The usual two are reading minutes of board and committee meetings and making inquiries of company officials, and the comfort letter will say so expressly. Anyone evaluating the letter at pricing should read those limitations carefully: the procedures over the tail period are real but light, and the diligence weight assigned to them in the negative-assurance language reflects that.

"Cold Comfort" and Bring-Down Letters

The 135-day rule is the central scheduling constraint in the comfort-letter calendar. Auditors will provide negative assurance on subsequent changes in specified financial-statement items only if the cut-off date of the comfort letter falls within 135 days of the end of the most recent period for which the auditor has performed an audit or a SAS 100 / AS 4105 review. So if the most recent reviewed period ended 31 March, customary negative assurance is available through approximately 13 August.

After the 135-day window closes, the issuer cannot get a customary comfort letter on subsequent changes. Two practical consequences follow. First, deals are often timed to avoid running into the 135-day wall; pricing inside the window, even at some cost to other priorities, is a common goal. Second, where a deal must price after the wall, the underwriters typically receive "cold comfort": a letter limited to procedures that the auditor can perform without giving negative assurance, such as agreed-upon procedures and arithmetic checks, but no negative assurance on subsequent changes in line items.

Bring-down comfort letters are issued to confirm, at the closing date, that the procedures described in the pricing-date letter, performed using a fresh cut-off date, yield the same conclusions. The bring-down letter is much shorter than the pricing letter; it incorporates the earlier letter by reference and updates it for the period between the original cut-off and the new one.

Capsule Financial Information

A particular scheduling problem arises when an offering launches after the issuer's fiscal year-end but before its annual audited financials have been issued — for example, a January or February pricing date for a calendar-year issuer. The registration statement will usually need to carry some fourth-quarter or full-year figures so that investors have current data to look at: this preliminary information, presented in narrative or tabular form alongside the prior-year comparable, is known as capsule financial information.

The difficulty is that the year-end audit is still in flight when the offering launches. The capsule figures are drawn from records the auditor is still working on, and they may yet move before the audit closes out. Auditors are accordingly cautious about giving comfort on them.

The operative framework is a 2005 white paper, originally issued by what was then the AICPA's Center for Public Company Audit Firms and now maintained by its successor, the Center for Audit Quality. The paper draws the following lines:

• Negative assurance on the underlying fourth-quarter financial statements under SAS 100 / AS 4105 is generally only available once the audit fieldwork is substantially complete and the year-end financial statements are in substantially final form. Both phrases are defined terms in the white paper and turn on the auditor's professional judgement.
• Limited subsequent-change comments on specified line items can be given once fieldwork is substantially complete, even where the financial statements are not yet in substantially final form, provided the comments rest on reading subsequent financial statements through the end of the fiscal year and on inquiries made at or after year-end.
• Tick-mark comfort tying capsule figures back to the issuer's accounting records is generally deferred until fieldwork is substantially complete.

Capsule disclosure is, in practice, one of the items most likely to push a January or February pricing date later than the working group would prefer. Where the audit timetable does not line up with the offering window, the choices are typically to delay the deal, to narrow the capsule disclosure to figures the auditor is willing to comfort at the relevant stage, or to accept a more limited form of comfort and flag the constraints in the prospectus.

Items In-Scope

Auditors will comfort, and underwriters' counsel will accordingly circle, financial information that is either (a) drawn directly from audited or reviewed financial statements, or (b) drawn from accounting records that are subject to the issuer's internal control over financial reporting. In practice, this typically includes:

• All historical income statement, balance sheet, and cash-flow line items appearing in the financial statements and in the selected-financial-data, MD&A, and capitalisation sections of the offering document.
• Reconciling notes: segment data that ties to the consolidated totals, components of cost of revenue, geographical revenue breakdowns.
• MD&A historical figures that are repeated from or derivable from the financial statements, including period-over-period comparisons and percentage changes.
• Pro-forma financial information prepared in accordance with Article 11 of Regulation S-X, but only where the auditor has the requisite underlying knowledge of the entity. Negative assurance on pro forma adjustments under AS 6101 / AU-C 920 requires that the auditor have audited or reviewed the historical financial statements of the entity (or, in a business combination, of a significant constituent). Without that anchor, the auditor cannot opine on the application of the adjustments, on the compilation of the pro formas, or on their conformity with Rule 11-02 — and the comfort matrix will reflect the gap.
• Capitalisation tables, debt-maturity schedules, and similar tabulated financial data.
• Non-GAAP measures with caveats. Auditors will generally tick to the underlying GAAP components and will recompute the non-GAAP figure arithmetically. They will not opine on the appropriateness of the non-GAAP measure or its compliance with Regulation G; that is a securities-law question, not an accounting one.
• Specified Regulation S-K conformity assurance. Auditors will give negative assurance on whether certain quantitative S-K disclosures conform as to form with the rule that produced them. The recurring candidates today are Item 302 (supplementary financial information) and Item 402 (executive compensation), with the underlying components drawn from the accounting records. The historical list was longer — older treatments include Item 301 (selected financial data) and Item 503(d) (ratio of earnings to fixed charges), both of which have since been eliminated by SEC simplification amendments. The auditor's view is on form, not substance: they are not opining on whether the disclosure is descriptively complete, only on whether it lines up with the rule's requirements.

Items Out-of-Scope

Categorical exclusions reflect either the limits of the auditor's professional competence or the limits of the underlying records:

• Operational metrics (units shipped, headcount, store count, square footage, web traffic) are not financial information in the AS 6101 / AU-C 920 sense. They are not subject to the issuer's controls over financial reporting and therefore fall outside the auditor's comfort-letter scope, even when they are quantitative.
• Market data sourced from third parties (market-share figures from industry reports, analyst forecasts, demographic data) are by definition outside the issuer's books and records.
• Forward-looking statements of any kind: projections, guidance, growth targets, "expected" cost savings.
• Offering price mechanics (the IPO price range, the discount to the underwriters, the use-of-proceeds allocations expressed as percentages of the offering) are typically left uncircled because they are outputs of the deal itself rather than historical figures.
• Ownership percentages in the principal-stockholders section. These are derived from share registers and beneficial-ownership filings rather than from the accounting records.
• Approximate or rounded figures (phrases like "approximately $1.2 billion" or "more than 10,000 customers") generally cannot be tied to a specific accounting record.
• Sensitivity analyses and other constructed illustrations.

The rationale across these categories is consistent: the auditor's professional standards permit comfort only on information that is either audited, reviewed, or derived from accounting records subject to the entity's internal controls. Material that does not meet that test cannot receive negative assurance, regardless of how willing the underwriters are to accept lighter procedures.

The Grey Areas

In modern practice, the most contested items tend to fall in a handful of recurring categories:

• Non-GAAP measures. Adjusted EBITDA, free cash flow, organic growth: these are everywhere in modern offering documents and are typically circled. The negotiation is over whether the auditor ticks each component and recomputes, or whether the measure as a whole is comforted via agreed-upon procedures.
• Segment data and KPI tables. Where segment results are part of the audited financial statements, comfort is straightforward. Where the issuer reports segment-style breakouts that are not part of the financial-statement footnotes (quarterly segment trends in the MD&A, for example), the question is whether the underlying records support comfort.
• Operating KPIs. Same-store sales, customer-acquisition cost, monthly active users, gross merchandise volume. These often look like financial measures but draw from operational systems. Auditors will sometimes provide agreed-upon procedures comfort if the metrics flow through systems with general IT controls and the procedures can be specified.
• ESG and sustainability disclosures. A growing area of negotiation. Where the issuer has obtained separate sustainability assurance (for example under ISAE 3000 or an equivalent), the comfort matrix may reference that work. Where it has not, ESG figures are typically uncircled.
• Executive compensation tables. Some elements (cash compensation, audited stock-based compensation expense) are within the financial statements; others (perquisites, valuation assumptions) sit at the margin. The matrix usually breaks these down line-by-line.

Working groups resolve these by negotiating the matrix: the auditor proposes the procedure they are willing to perform, counsel accepts, modifies, or substitutes, and the resulting tick mark is recorded against each circled item.

Target Company Financials and Other Non-Issuer Information

Acquisitions and reverse mergers introduce a second set of financial statements into the offering document, and with them a second set of comfort questions.

Where the target is audited by a different firm from the issuer, the underwriters will typically ask for a separate comfort letter from the target's auditor covering the target's historical financials. Ideally the procedures and level of assurance in that second letter mirror those in the principal letter. In practice the target auditor may be reluctant to engage directly with underwriters they have no continuing relationship with, and the negotiation can take longer than expected — it is worth opening the conversation early in the transaction, well before the circle-up is finalised.

Where the target's financial information appears only inside the pro formas (rather than as standalone historical statements in the prospectus), the issuer's auditor is often asked instead to agree the target-derived figures in the pro formas back to the target's audited or reviewed financials. That route avoids enlisting the target's auditor in a direct deliverable to the underwriters, but it works only where the target's financials are available in a form the issuer's auditor can actually use, and only where the issuer's auditor has, or can practicably acquire, the necessary knowledge of the target. Otherwise the working group is back to seeking a second comfort letter from the target's firm.

Why the Workload Keeps Growing

Three forces are pushing circle-up volume up. The first is disclosure complexity: SEC and overseas regulators have steadily expanded what must be said in offering documents: more granular MD&A, more cybersecurity and risk-factor detail, climate disclosure, human-capital metrics. More disclosure means more figures and therefore more circles. The second is the proliferation of non-GAAP measures. A modern issuer routinely presents adjusted EBITDA, adjusted operating income, adjusted free cash flow, and a constellation of segment-level adjusted measures, each with its own reconciliation. Every reconciling item is itself a circle. The third is document length: offering documents have grown materially over the last two decades, and so have circle-ups. An IPO prospectus that ran to 200 pages a generation ago will commonly run to 350+ today, with proportionally more financial content per page.

The cumulative effect is that circle-up workload is becoming a non-trivial line item in transaction budgets, in both cost and time. It is also a frequent source of late-stage friction, because the marginal item to be added, removed, or reclassified often shows up in the last 48 hours before pricing.

Automation and AI

Software is starting to absorb the mechanical layer of circle-up work. Pattern-matching tools, including modern AI-assisted systems, can detect candidate numbers in a draft, propose tick marks based on historical practice and prior deals, flag inconsistencies between drafts, and identify newly-introduced figures that have not yet been circled. This is the workflow GoCircl is built to support.

The judgement layer remains stubbornly human. Decisions about scope (does this metric belong inside the comfort matrix or outside?), about which procedures the auditor will accept, and about how to negotiate borderline items are not amenable to automation in any reasonable timeframe. Designing the comfort matrix itself, drafting the bespoke language for unusual procedures, and defending positions to the audit firm's national office are exercises that depend on practitioner experience and on the specific facts of each transaction.

The realistic near-term picture is one in which the most tedious 60–80% of the marking and matching work is substantially automated, freeing senior counsel and accountants to spend their time where it actually adds value: on the contested 20–40% that determine the quality of the diligence record.

Circle-up. The version of an offering document in which underwriters' counsel has marked, typically with red rectangles, every financial figure on which the auditors are being asked to provide comfort.

Comfort letter. A letter from the issuer's auditors to the underwriters describing procedures performed on financial information in the offering document and the assurance obtained, used to support the underwriters' due-diligence defence under Section 11.

Negative assurance. A statement to the effect that nothing came to the auditor's attention causing them to believe specified information is materially misstated. The standard form of comfort for unaudited interim information that has been reviewed.

Tick mark. A short letter or symbol placed next to a circled item, keyed to a comfort matrix, indicating which procedure the auditor performed for that item.

Comfort matrix. The schedule that maps each tick mark to a description of the corresponding procedure and the level of assurance given.

Bring-down letter. A short comfort letter delivered at closing that updates the pricing-date comfort letter using a more recent cut-off, confirming that the same procedures yield the same conclusions.

Capsule financial information. Preliminary financial figures, in narrative or tabular form, for a period that has ended but whose audited or reviewed statements have not yet been issued. Commonly included in offering documents launched between fiscal year-end and the date the annual audit is finalised.

Change period. The window over which an auditor measures subsequent changes in specified financial-statement items for a comfort letter. Runs from immediately after the latest balance sheet date or P&L period in the prospectus through the cut-off date.

Cold comfort. Comfort given after the 135-day window has closed, limited to procedures the auditor can perform without giving negative assurance on subsequent changes.

Representation letter. A letter from a comfort-letter recipient to the auditor confirming that the recipient has carried out a diligence review substantially consistent with what would have been performed in a registered offering. The standard mechanism for extending comfort to parties without a direct Section 11 statutory defence.

SAS 72. The 1992 AICPA Statement on Auditing Standards that established the modern comfort-letter framework. Superseded in name but still the universal market shorthand.

AS 6101. The current PCAOB standard governing comfort letters in connection with SEC-registered offerings by issuers audited by PCAOB-registered firms.

AU-C 920. The current AICPA standard governing comfort letters issued by audit firms in non-issuer engagements, codified through SAS 122 and amended by SAS 129.

Section 11 due-diligence defence. The affirmative defence to civil liability for material misstatements in a registration statement, available to defendants other than the issuer who can show reasonable investigation and reasonable grounds for belief.

ISRE 2410. The IAASB International Standard on Review Engagements applicable to reviews of interim financial information. Frequently relied on for the underlying review work that supports negative assurance in cross-border deals, but not itself a comfort-letter standard.

SIR 2000. UK Standard for Investment Reporting on engagements relating to historical financial information in investment circulars; issued by the Financial Reporting Council.

ASRS 4450. Australian Standard on Related Services on comfort-letter engagements, issued by the AUASB.

Underwriter. A securities firm that purchases securities from the issuer for resale to investors, or that arranges the offering on a best-efforts basis. Subject to Section 11 strict liability and therefore the principal beneficiary of the comfort letter.

Working group. The combined team running the deal: issuer, issuer's counsel, underwriters, underwriters' counsel, auditors, and any specialists.

MD&A. Management's Discussion and Analysis of Financial Condition and Results of Operations: the narrative section of a registration statement explaining historical results and known trends.

Non-GAAP measure. A financial measure that adjusts a GAAP figure by adding or subtracting items, presented alongside the GAAP measure. Subject to SEC Regulation G and Item 10(e) of Regulation S-K.

Pro-forma financial information. Hypothetical historical financial statements showing the effect of a transaction (such as an acquisition or a reorganisation) as if it had occurred at the start of the relevant period. Governed by Article 11 of Regulation S-X.

Cut-off date. The date through which the auditor has performed the procedures described in the comfort letter. Typically a few business days before the date of the letter itself.

135-day rule. The convention under AS 6101 / AU-C 920 that customary negative assurance on subsequent changes is available only if the cut-off date of the comfort letter is within 135 days of the end of the most recent audited or reviewed period.

A short curated list of authoritative sources, ordered roughly from primary to practitioner-secondary.

• 📜 PCAOB AS 6101, "Letters for Underwriters and Certain Other Requesting Parties." The current PCAOB standard, with sample letters in the appendices. ↗
• 📜 AICPA AU-C Section 920, "Letters for Underwriters and Certain Other Requesting Parties." The current AICPA standard for non-issuer engagements, codified in SAS 122 and amended by SAS 129. ↗
• ⚖️ Escott v. BarChris Construction Corp., 283 F. Supp. 643 (S.D.N.Y. 1968). The foundational case on the underwriter's due-diligence defence under Section 11. ↗
• 📄 AICPA, "Comfort Letter Procedures Relating to Capsule Financial Information" (2005 White Paper). Explains the constraints on negative assurance covering periods after fiscal year-end but before the issuance of audited statements. ↗
• 📄 Mayer Brown, "Top 10 Practice Tips: Comfort Letters." A practical Lexis Practice Advisor guide by Anna Pinedo and colleagues, one of the most widely cited practitioner pieces on the mechanics of the process. ↗
• 📄 Latham & Watkins, "The Latham FPI Guide: Accessing the US Capital Markets from Outside the United States" and the Latham Book of Jargon. Both contain detailed treatments of comfort-letter mechanics for cross-border deals. ↗
• 📖 Edward F. Greene et al., "U.S. Regulation of the International Securities and Derivatives Markets." The leading practitioner treatise; chapters on offering diligence cover comfort-letter practice in cross-border context. ↗
• 📄 Deloitte, "Roadmap: Initial Public Offerings," Chapter 6 (Audit Considerations). Free on the Deloitte Accounting Research Tool, contains a clear auditor's-eye view of the comfort process. ↗
• 📜 FRC Standards for Investment Reporting (SIR 1000–6000). UK reporting accountant standards; SIR 2000 (revised 2020) is the most relevant for historical financial information. ↗
• 📜 AUASB ASRS 4450, "Comfort Letter Engagements." Australian standard; useful comparator for Australian and dual-listed offerings. ↗

📜 Standards · ⚖️ Case law · 📖 Treatise · 📄 Practitioner / firm publication · ↗ external link