SA 220, Quality Control for an Audit of Financial Statements, is an engagement-level standard. ICAI's current Engagement and Quality Control Standards repository lists SA 220, and the official SA 220 text sets out the engagement partner's responsibilities from acceptance and independence through supervision, consultation, review and documentation.
SA 220 versus the firm's quality-control system
SA 220 deals with quality control on an individual audit engagement. The standard explains that the firm's quality-control system is a firm-level responsibility, while the engagement team implements the procedures applicable to the audit. The team may ordinarily rely on the firm's system unless information from the firm or elsewhere suggests otherwise.
So an audit file cannot demonstrate compliance merely by referring to a firm manual. The engagement partner still has to take responsibility for overall quality on the particular audit and respond when engagement facts require more than the standard process.
1. Leadership, ethics and independence
The engagement partner is responsible for overall quality on each assigned audit. Throughout the engagement, the partner must remain alert for evidence that team members are not complying with relevant ethical requirements and determine appropriate action when a problem comes to attention.
The partner must also form a conclusion on compliance with applicable independence requirements. This includes obtaining relevant information, evaluating identified breaches, and taking appropriate action to eliminate threats or reduce them to an acceptable level. An inability to resolve an independence matter must be reported promptly to the firm.
2. Acceptance and continuance are not a one-time form
The engagement partner must be satisfied that appropriate acceptance and continuance procedures were followed and that the conclusions are appropriate. If information later emerges that would have caused the firm to decline the audit had it been known earlier, the partner must communicate it promptly to the firm so necessary action can be considered.
Practically, changes in ownership, integrity concerns, major disputes, unusual transactions or management behaviour can justify renewed attention even after fieldwork has begun.
3. Match team competence to the actual audit
The partner must be satisfied that the engagement team, together with any auditor's experts outside the team, collectively has the competence and capabilities needed to perform the audit under professional standards and legal or regulatory requirements and to enable an appropriate auditor's report to be issued.
A difficult valuation, specialised IT environment or complex group structure may therefore require more experienced personnel or specialist input. If the risk profile changes during fieldwork, the staffing response may also need to change.
4. Direct, supervise and review before signing
SA 220 makes the partner responsible for direction, supervision and performance of the audit and for reviews being performed under the firm's review policies. On or before the date of the auditor's report, the partner must, through review of audit documentation and discussion with the team, be satisfied that sufficient appropriate audit evidence supports the conclusions and the report.
A completion checklist is not enough. Significant judgments, unusual transactions, difficult estimates and contradictory evidence deserve review attention proportionate to their risk.
5. Consult on difficult or contentious matters
The engagement partner must take responsibility for appropriate consultation on difficult or contentious matters, be satisfied that the nature, scope and conclusions of the consultation are agreed with the person consulted, and determine that the resulting conclusions have been implemented.
Example: an audit team faces a material valuation issue for an unquoted investment with competing methodologies. A defensible process identifies the issue early, involves the appropriate technical or valuation resource, records the facts and question, documents the conclusion, and shows how that conclusion changed or confirmed the audit work and reporting decision.
6. Engagement quality control review: when and what
For audits of financial statements of listed entities, and for other audit engagements for which the firm has determined that an engagement quality control review is required, the partner must ensure a reviewer is appointed, discuss significant matters with that reviewer and not date the auditor's report until the review is complete.
The reviewer objectively evaluates significant judgments and the conclusions used in forming the report. The review includes discussion of significant matters, review of the financial statements and proposed report, review of selected documentation relating to significant judgments, and evaluation of whether the proposed report is appropriate. For listed-entity audits, the reviewer also considers the team's independence evaluation, relevant consultations and whether selected documentation supports the significant judgments and conclusions.
7. Differences of opinion and monitoring findings
If differences arise within the team, with persons consulted, or between the engagement partner and the engagement quality control reviewer, the team must follow the firm's procedures for resolving them. An unresolved technical disagreement should not be left for post-signing clean-up.
The partner must also consider the latest information from the firm's monitoring process and whether identified deficiencies may affect the current engagement. A recurring inspection finding may therefore call for additional direction, review, documentation or another response on the present file.
What SA 220 specifically requires to be documented
The auditor must document ethical-compliance issues and how they were resolved, conclusions on engagement independence and supporting discussions with the firm, conclusions on acceptance and continuance, and the nature, scope and conclusions of consultations undertaken during the audit.
Where an engagement quality control review applies, the reviewer must document that required procedures were performed, the review was completed on or before the auditor's report date, and no unresolved matter is known that would make the significant judgments or conclusions inappropriate.
Practical SA 220 checklist
- Confirm responsibility: identify the engagement partner and communicate quality expectations.
- Reassess ethics and independence: capture threats, breaches, safeguards and unresolved matters throughout the audit.
- Validate acceptance and continuance: revisit the conclusion if new information changes the client-risk assessment.
- Staff for competence: match experience and specialist support to the engagement's complexity.
- Plan direction and supervision: identify areas needing partner or senior review and when that review should occur.
- Review evidence before reporting: ensure significant conclusions are supported before the report date.
- Escalate difficult matters: consult, agree the conclusion and show that it was implemented.
- Complete the quality control review where required: do not date the report before completion.
- Resolve differences: close substantive disagreements under firm procedures.
- Document the quality trail: preserve clear evidence of ethics, independence, continuance, consultation and review conclusions.
Worked example: listed manufacturer
Assume a listed manufacturer has a difficult year-end inventory valuation issue, a new ERP implementation and a significant impairment judgment. The partner should confirm appropriate accounting and IT capabilities, remain satisfied on independence, direct senior attention to the significant judgments, require consultation where conclusions are contentious, review the relevant evidence before signing, and ensure the engagement quality control review is completed before the auditor's report is dated. The file should show how the issues were resolved, not merely that review boxes were ticked.
Practical takeaway
SA 220 turns audit quality into accountable engagement decisions. The partner owns overall quality; the team must be competent and properly directed; difficult matters must be consulted on and resolved; significant evidence must be reviewed before reporting; applicable engagement quality control review must be completed on time; and the file must preserve the conclusions. For current applicability and the official text, use ICAI's standards repository and the SA 220 PDF.
