An audit engagement letter is not merely an administrative appointment note. Under SA 210, it is the written record of the agreed basis on which an audit will be performed. For a statutory auditor, getting this document right at the beginning helps prevent later disputes about scope, management responsibilities, access to information and the nature of the auditor's report.
ICAI lists SA 210, Agreeing the Terms of Audit Engagements among its current Standards on Auditing and also provides an Implementation Guide to SA 210. For company audits, ICAI has separately published illustrative engagement-letter formats under the Companies Act, 2013.
What is the purpose of an audit engagement letter?
SA 210 requires the auditor to agree the terms of the audit engagement with management or those charged with governance, as appropriate. The engagement letter converts that understanding into a written record. Its purpose is not to transfer the auditor's statutory responsibilities to management; rather, it makes clear what the audit is intended to cover, what the auditor will do, what management remains responsible for and what reporting framework applies.
A well-drafted engagement letter is especially useful when management assumes that an audit guarantees detection of every fraud, expects the auditor to prepare records that management itself is responsible for, or later disputes the information and access that the audit team needs.
Preconditions the auditor should establish before accepting the audit
SA 210 starts before the letter itself. The auditor needs to determine whether the financial reporting framework to be applied in preparing the financial statements is acceptable. The auditor must also obtain management's agreement that it acknowledges and understands its responsibilities.
Those responsibilities include preparation of the financial statements in accordance with the applicable financial reporting framework, such internal control as management determines necessary to enable preparation of financial statements free from material misstatement, and providing the auditor with access to relevant information, additional information requested for the audit and unrestricted access to persons within the entity from whom the auditor considers it necessary to obtain audit evidence.
If these basic preconditions are absent, simply issuing an engagement letter does not cure the problem. The acceptance decision itself needs attention.
What should the agreed audit terms contain?
SA 210 identifies core matters that should be recorded in an audit engagement letter or other suitable written agreement, subject to the standard's provisions where law or regulation already prescribes the terms in sufficient detail.
- Objective and scope of the audit: identify that the engagement is an audit of the specified financial statements and define the relevant period and reporting context.
- Auditor's responsibilities: explain the auditor's role under the applicable auditing requirements without suggesting that the auditor assumes management's responsibilities.
- Management's responsibilities: clearly record responsibility for financial statements, internal control and provision of information and access.
- Applicable financial reporting framework: identify the framework used to prepare the financial statements.
- Expected reports: refer to the expected form and content of reports to be issued and recognise that circumstances can cause the actual report to differ from the expected form.
Engagement letter versus appointment letter
The two documents serve different purposes. An appointment or consent process establishes the auditor's appointment under the applicable legal framework. The audit engagement letter records the agreed terms on which the audit work will be conducted. In a company audit, legal appointment requirements therefore should not be treated as a substitute for thinking through the SA 210 engagement terms.
Likewise, an engagement letter is not the same as a management representation letter. The engagement letter is agreed at the engagement stage and sets the basis of the audit. Written representations are audit evidence obtained from management in relation to specified matters during the audit process.
Company-audit formats: use the right illustration
ICAI's company-audit engagement-letter page provides two illustrative formats: one where reporting under section 143(3)(i) of the Companies Act, 2013 is applicable and another where it is not applicable. This is a useful reminder that an engagement letter should reflect the actual reporting obligations of the engagement rather than being copied unchanged from a generic precedent.
A firm should treat an illustrative format as a starting point. Entity-specific matters such as the financial statements covered, applicable framework, additional reporting responsibilities and practical communication arrangements should be checked before issue.
What if management imposes a scope limitation before acceptance?
SA 210 specifically addresses a management-imposed limitation on the scope of the proposed audit. Where management or those charged with governance impose a limitation that would lead the auditor to disclaim an opinion on the financial statements, the auditor should not accept such a limited audit engagement unless law or regulation requires acceptance.
This is a critical acceptance control. A restrictive engagement letter should not be used to legitimise a scope limitation that is fundamentally inconsistent with performing the audit.
Do recurring audits need a fresh engagement letter every year?
SA 210 does not turn recurring audits into a mechanical annual re-signing exercise. On recurring audits, the auditor assesses whether circumstances require the engagement terms to be revised and whether there is a need to remind the entity of the existing terms.
A practical annual review should consider whether there has been a change in senior management or ownership, a significant change in the nature or size of the business, revised legal or regulatory requirements, a change in the financial reporting framework, or misunderstandings about the previous engagement. Where the terms need revision, the documentation should be updated rather than relying blindly on an old letter.
Can an audit engagement be changed midway?
A request to change the engagement should not be accepted automatically. SA 210 requires the auditor not to agree to a change in the terms where there is no reasonable justification. If a justified change is accepted, the new terms should be agreed and recorded appropriately.
This matters particularly where a client asks to convert an audit into an engagement providing a lower level of assurance after difficulties emerge. The auditor should evaluate the reason for the request, not merely amend the title of the engagement.
Practical engagement-letter checklist for audit firms
- Confirm acceptance prerequisites first: evaluate the reporting framework and obtain management's acknowledgement of its responsibilities.
- Identify the exact financial statements and period: avoid vague descriptions that could create uncertainty over scope.
- Map legal and professional reporting obligations: for company audits, check whether the relevant Companies Act reporting requirements, including section 143(3)(i) where applicable, are reflected in the selected precedent.
- Separate responsibilities clearly: do not draft language that makes the auditor responsible for preparation of the financial statements or management's internal control.
- State information and access expectations: ensure management understands the audit team's need for records, explanations and access to relevant persons.
- Describe expected reporting without promising an outcome: an engagement letter should not imply that an unmodified opinion is guaranteed.
- Review recurring engagements for change: compare the current facts with the previous year's terms before deciding whether a revised or reminder letter is appropriate.
- Retain the agreed document in the audit file: the signed or otherwise properly agreed terms form part of the engagement documentation.
Example: why a copied old engagement letter can fail
Assume an audit firm has audited a private company for several years and simply rolls forward last year's engagement letter. During the year, the company's reporting circumstances change and an additional statutory reporting responsibility becomes applicable. If the firm never reviews the old letter, the written terms may no longer accurately describe the reporting context. SA 210's recurring-audit requirement is designed to prompt exactly this review: determine whether the terms need revision and whether management should be reminded of the existing terms.
Common mistakes to avoid
- Using an appointment letter as though it automatically covers all SA 210 engagement terms.
- Copying a standard precedent without checking the entity's applicable reporting framework and statutory reporting requirements.
- Failing to document management's responsibilities for financial statements, internal control, information and access.
- Wording the expected audit report as if an unmodified opinion were predetermined.
- Ignoring a management-imposed scope restriction during acceptance and trying to solve it only through wording in the letter.
- Rolling forward the same letter indefinitely without considering changes in a recurring audit.
Practical takeaway
A strong audit engagement letter begins with a sound acceptance decision. Under SA 210, the auditor first establishes the audit preconditions and a common understanding with management or those charged with governance, then records the objective and scope, respective responsibilities, applicable reporting framework and expected reporting. ICAI's company-audit illustrations are useful precedents, but they should be adapted to the actual engagement and revisited when circumstances change.
