Peer Review for CA Firms: Applicability and Checklist

In this article

Is peer review for CA firms mandatory? The four phases
What counts as attestation work
When you must hold the certificate
How the peer review process works now
Peer review checklist: a quick self-check
A working-back plan for 31 December 2026
Five mistakes that delay the certificate
Questions people ask
Sources

Key points

ICAI made peer review mandatory in four phases. Phase IV applies from 31 December 2026 (as announced on 31 December 2025).
Phase IV catches firms that want public sector bank branch audits, and firms with 3 or more partners that render attestation services, before they accept any statutory audit.
No attestation or assurance work means the mandate does not apply, but tax audits and certificates do count as assurance work.
Since 2 July 2026, new applications (Form 1) go only through the PRB Web Portal at prb.icai.org.
Work backwards from your must-hold date: the register, the quality manual and review-ready files take weeks, not days.

Peer review for CA firms is no longer something only large audit firms worry about. ICAI has made a peer review certificate mandatory in phases, and the last phase reaches three-partner firms and firms that want public sector bank branch audits. This guide is for partners of small and mid-sized audit firms. It tells you, in plain words, whether the mandate applies to you, from which date, how the process now runs, and what to get ready first.

Read the wording before you worry, and before you relax. Many firms do one of the two without checking.

Is peer review for CA firms mandatory? The four phases

ICAI's Council made peer review mandatory in four phases, starting 1 April 2022. Several dates were deferred on the way. The table below uses ICAI's categories, shortened, with the dates as last announced.

Phase	Firms covered (shortened)	Mandatory from
I	Firms that propose to take the statutory audit of entities whose equity or debt securities are listed in India or abroad	1 April 2022
II	Statutory audit of large unlisted public companies (paid-up capital of Rs. 500 crore or more, or turnover of Rs. 1,000 crore or more, or aggregate outstanding loans, debentures and deposits of Rs. 500 crore or more as at 31 March of the immediately preceding financial year), OR firms rendering attestation services with 5 or more partners, before accepting any statutory audit	1 July 2024
III	Statutory audit of entities that raised funds of over Rs. 50 crore from the public, banks or financial institutions in the review period, or of any body corporate including trusts covered as public interest entities, OR firms with 4 or more partners rendering attestation services	1 July 2025
IV	Audits of branches of public sector banks, OR firms with 3 or more partners rendering attestation services, before accepting any statutory audit	31 December 2026

Phase IV was earlier set for 1 April 2025, then moved to 1 January 2026, and on 31 December 2025 ICAI extended it to 31 December 2026. Dates have moved before, so check the Peer Review Mandate page on icai.org each quarter.

Phase IV has two separate limbs

Bank branch limb: if your firm wants statutory branch audits of public sector banks, a peer review certificate is a pre-requisite. ICAI's FAQ says statutory branch audits of co-operative banks are not covered by Phase IV.
Partner-count limb: if your firm renders attestation services and has three or more partners, it needs a certificate before accepting any statutory audit. "We only do small audits" does not help here. The partner count is reckoned on the date the relevant phase becomes mandatory, and onwards. Record the firm's constitution and check the current PRB FAQ before relying on the threshold.

What counts as attestation work

ICAI's FAQ says a certificate is not required under the mandate if the firm does not render attestation services or assurance engagements. So the next question is which of your work counts.

Counts as assurance (ICAI's examples)	Does not count (ICAI's list, shortened)
Central statutory audit, statutory audit, tax audit, internal audit, certification work	Management consultancy; representation before authorities; preparing tax returns or tax advice; compiling financial statements; helping a client collate other information; expert witness; expert opinion on points of principle; due diligence

So a three-partner firm that signs tax audit reports and a few company audits renders attestation services. A three-partner firm that only files returns, writes books and handles notices does not.

Illustrative example At a lunch meeting, Malini says, "We only do small audits, this is not for us." Her partner Sudhir pulls up the list of reports the firm signed last year: company audits, society audits, forty tax audits and a pile of certificates. Three partners, attestation work. Phase IV applies to them from 31 December 2026, and they have one audit already accepted that will be signed after that date.

When you must hold the certificate

Three timing rules catch firms out.

Before accepting, and when signing. ICAI's FAQ says a firm should have a valid certificate before accepting the statutory audit and at the time of signing the report. For audits accepted before a phase became mandatory, the firm must hold a valid certificate when it signs.
Validity. The Peer Review Guidelines 2022 say a certificate is valid for three years, or another period the Board decides. So once you have it, the next review is already on the calendar.
New firms. A firm set up less than 12 months before it applies, or an older firm that renders no assurance services, applies as a "new unit". New Units must meet the Board's additional criteria. Current PRB guidance provides an 18-month certificate, with further 18-month certificates until a full three-year review period is covered.

The reviewer looks at the review period: the three financial years before the year in which the firm is selected or applies, unless the Board sets another period. You cannot change those files now. You can only present them well and fix your system going forward.

Course: Peer Review ReadyPrepare for peer review without last-minute pressure

Peer Review Ready is 13 short lessons for audit firms: the applicability test, Form 1 and choosing a reviewer, the assurance register, a quality control manual, what the reviewer samples, the visit and keeping the certificate, with a readiness kit.

Try the first lesson free See the course

How the peer review process works now

From 2 July 2026, ICAI processes all new peer review applications (Form 1) only through the PRB Web Portal at prb.icai.org. Applications on paper or by email are not accepted. The portal handles the application, the panel of reviewers, the reports and the certificate.

ICAI's illustrative time schedule, in short:

The firm submits Form 1, the application cum questionnaire.
The Board sends a panel of three reviewers and the fee notification, within 3 working days.
The firm chooses one reviewer within 1 working day. Check independence before you choose: check the PRB eligibility rule first: the reviewer must not have accepted a professional assignment from your firm or its partners in the two years before appointment, and must not accept one for two years after.
The reviewer confirms acceptance and confidentiality, then sends the proposed visit and the sample of assurance engagements.
The on-site review, then a preliminary report if any, and the firm's reply.
The reviewer submits the final report. For a Practice Unit other than a New Unit, the Guidelines expect the whole review to be completed within 20 working days. For a New Unit, the stated period is 7 working days.
The Board considers the report. It issues a certificate after an unqualified report and confirmation of fee receipt; a qualified report can lead to a follow-on review instead. ICAI does not publish a fixed time for the Board's step, so keep a margin.

The fee is agreed between the firm and the reviewer. The Board publishes a minimum recommended fee scale based on the firm's assurance receipts; read the current scale before you agree. Travel is agreed separately.

Within the rules The Peer Review Guidelines say all practice units must comply with them, and non-compliance can attract disciplinary action under the Chartered Accountants Act, 1949. Form 1 is signed by a partner, so every answer is that partner's responsibility. Never leave out a client or overstate a policy to make the form look cleaner.

Peer review checklist: a quick self-check

A reviewer tests whether your quality control system exists and is used. Form 1 asks questions organised around SQC 1, which still applies: on 31 March 2026 ICAI deferred SQM 1 and SQM 2 "until further announcement". Answer these five questions honestly before you apply.

Self-check

Do we have an assurance register of every assurance engagement in the review period, year-wise, with the signing partner and UDIN?
Do we have a short, true quality control manual on the six SQC 1 elements, approved by all partners? Our guide on the Quality Control Manual for CA Firm: SOPs and Reviews explains what goes in it.
Do we have independence declarations from everyone who must be independent, at least once a year?
Does each engagement file show who prepared, who reviewed, and when?
Have the partners downloaded and read the current Form 1?

If two or more answers are "no", start this week. The self-check tells you where you stand; it does not tell you how far you are from ready, or which files the reviewer is likely to pick. That needs a readiness checklist across every area, a complete file index and an internal mock review of two or three files to find the gaps, all of which the course provides. None of this predicts or influences which files the reviewer picks.

One firm rule matters more than the rest: do not quietly "fix" old files. The reviewer looks at the review period. Write what you do from today, with dates, and show the reviewer an honest system that is improving. The working papers and review habits behind this are taught in /learnings/firmsystems/?utm_source=blog&utm_medium=article&utm_campaign=peer-review-for-ca-firms.

Reviewers look for evidence of who reviewed each file and when. If your system keeps a dated record of who prepared and who reviewed each file (our own SignReady records partner sign-off for accounts finalisation), keep it in the engagement file. It may support the review trail, but it does not replace the firm's quality control policies or the engagement documentation.

A working-back plan for 31 December 2026

Most peer review panic is a calendar problem. Write your must-hold date at the top of a page: the date you will accept your next statutory audit, or 31 December 2026 if Phase IV is your trigger. Then count back.

In outline, the order is always the same. Decide applicability in writing and build the assurance register first. Then write and approve the manual, and start the declarations, acceptance forms and training records. Then index the files and run a mock review. Then apply on the portal and choose the reviewer. Leave a buffer of several weeks after the visit for the Board to consider the report and issue the certificate. Allow enough time for the application, the review and the Board's consideration: individual steps are counted in working days, but there is no fixed published time for the certificate, and each needs a named owner.

If today is late in 2026 and you have not started, the plan is tight. Start with applicability and the register this week, and keep the visit away from your heaviest audit weeks.

Tip Pin your dated plan next to your work register and tick one line every Monday. Partners stop asking "where are we on peer review?" because the plan answers it.

Five mistakes that delay the certificate

Assuming size keeps you out. The partner-count limbs ignore audit size.
A borrowed manual. A 150-page manual that mentions committees you do not have fails the first question the reviewer asks. Twelve true pages are better.
Blank answers in Form 1. Write "No", "Nil" or "NA" where a point does not apply.
No buffer after the report. The certificate comes after the Board considers the report, not on the day of the visit.
Forgetting audits already accepted. If you will sign after the mandatory date, you need the certificate when you sign.

If you also plan to apply for bank branch audits, a peer review certificate may be needed for a public sector bank branch audit, but MEF filing and final audit eligibility are separate and follow the current MEF and RBI criteria; see our guide on Bank Audit Empanelment (MEF): Prepare for 2027-28. And if peer review is pushing you to rethink the firm's size, the pros and cons are in Merger of CA Firms: ICAI Process and When It Makes Sense.

Peer review for CA firms rewards firms that start early and write only what they actually do. Begin with the applicability test in the free first lesson of Peer Review Ready, write the answer down, and give it a date.

Rules change: check the latest ICAI announcement before you act.

Questions people ask

Is peer review mandatory for all CA firms?

No. It is mandatory for the categories in ICAI's four phases, based on the audits a firm takes and, for some limbs, its number of partners. A firm that renders no attestation or assurance services does not need a certificate under the mandate, though it may choose a voluntary review.

Is peer review mandatory for a firm with 3 partners?

Under Phase IV, a firm rendering attestation services with 3 or more partners needs a valid peer review certificate before accepting any statutory audit, from 31 December 2026 as per ICAI's announcement of 31 December 2025. Check the current Peer Review Board announcement before you rely on the date.

Do I need a peer review certificate for bank branch audits?

For statutory branch audits of public sector banks, yes: Phase IV makes a certificate a pre-requisite from 31 December 2026. ICAI's FAQ says statutory branch audits of co-operative banks are not covered by Phase IV.

How long is a peer review certificate valid?

The Peer Review Guidelines 2022 say three years, or another period the Board decides. For a New Unit, current PRB guidance provides an 18-month certificate, with further 18-month certificates until a full three-year review period is covered. Plan your next review well before the expiry date.

How long does the peer review process take?

For a Practice Unit other than a New Unit, the Guidelines expect the review to be completed within 20 working days from receipt of the application (7 working days for a New Unit), if the firm and reviewer co-operate. The Board then considers the report before issuing the certificate, so keep a buffer of several weeks.

How do I apply for peer review now?

From 2 July 2026, ICAI accepts new peer review applications (Form 1) only through the PRB Web Portal at prb.icai.org. Applications by email or on paper are not accepted.

Sources

Course: Peer Review ReadyStart with the applicability test

Try the free first lesson of Peer Review Ready, then use the course's working-back calendar to plan your firm's dates. The Office plan gives your seniors the same course, so the file work is shared.