Audit letters for CA firms: engagement, previous auditor, consent, confirmation and representation letters

Letters are the part of an audit file that the client signs, the previous auditor receives and the peer reviewer asks for first. Each one exists because a standard or a law requires it, and each has a few points that are easy to get wrong. This guide goes through them in the order they are needed on an engagement, with what each must contain.

The letters at a glance

Letter to the previous auditor

Clause (8) of Part I of the First Schedule to the Chartered Accountants Act, 1949 makes it professional misconduct to accept a position as auditor previously held by another chartered accountant without first communicating with him in writing. Points to keep in mind:

• Send it before you accept. A letter sent after accepting does not meet the requirement.
• Keep proof of delivery — positive evidence that the letter reached the previous auditor (a letter sent by Registered Post A.D., delivery by hand against a written acknowledgement, or an email acknowledged from the previous auditor's email address registered with ICAI or their last known official email address). Posting it is not enough on its own.
• The purpose is to learn whether there are professional or other reasons not to accept, such as a client that withheld information or disputes over the previous auditor's work or fees. You do not need the previous auditor's consent, but you should consider what they tell you. ICAI's ethics guidelines also bar you from accepting a statutory audit while the previous auditor's undisputed audit fees remain unpaid.
• Do not ask for their working papers. The previous auditor cannot share them without the client's consent (Clause (1), Part I, Second Schedule). For opening balances, SA 510 relies on the prior year's audited statements and your own procedures.

For a company, Clause (9) adds a second check: before accepting, ascertain from the company that the requirements of the Companies Act for the appointment have been complied with (the clause still refers to section 225 of the 1956 Act; ICAI reads it as sections 139 and 140 of the 2013 Act) — for a change of auditor, for example, the special notice and the retiring auditor's right to make a representation.

Consent and eligibility certificate (companies)

Section 139(1) requires the company to obtain, before the appointment, the auditor's written consent and a certificate that the appointment, if made, will be in accordance with the prescribed conditions and that the auditor satisfies the criteria in section 141. Rule 4 of the Companies (Audit and Auditors) Rules, 2014 sets out what the certificate states, including that:

• the auditor is eligible for appointment and is not disqualified under the Companies Act, the Chartered Accountants Act and the rules or regulations made under them;
• the proposed appointment is within the limits laid down by or under the Companies Act;
• the list of proceedings against the auditor or the partners pending with respect to professional matters of conduct, as disclosed in the certificate, is true and correct.

The company then files the appointment with the Registrar in form ADT-1, within 15 days of the meeting at which the auditor was appointed. Keep a copy of the consent, the certificate, the resolution and the ADT-1 filing in the permanent file.

The engagement letter (SA 210)

SA 210 first asks you to establish that the preconditions for an audit are present: that management uses an acceptable financial reporting framework and acknowledges its responsibility for preparing the financial statements, for the internal control needed to prepare them free from material misstatement, and for giving you access to all relevant information and people. The agreed terms are then recorded in an engagement letter or other suitable written agreement, which must include:

1. the objective and scope of the audit;
2. the responsibilities of the auditor;
3. the responsibilities of management;
4. the applicable financial reporting framework (for example, Schedule III Division I and the Accounting Standards notified under section 133, or the Accounting Standards issued by ICAI, for a non-corporate entity);
5. a reference to the expected form and content of the reports, and a statement that a report may in some circumstances differ from that form.

Practical points:

• Get it acknowledged. SA 210 requires the terms to be agreed; a copy signed back by management is the best evidence of that — file it.
• Recurring audits. SA 210 asks you to assess each year whether the terms need revising and whether to remind the entity of the existing terms. A fresh letter is sensible where there is a change in management, ownership, the nature or size of the business, the reporting framework or the law — or where the client seems to misunderstand the scope.
• Separate engagements, separate letters. A statutory audit, a tax audit under the Income-tax Act and accounting or GST services are separate engagements; record the terms of each, including fees and timelines. Where you also prepare the books, say so and say who is responsible for them.
• Change in terms. If the client asks to change the engagement to a lower level of assurance before completion, SA 210 asks whether there is reasonable justification. A request to avoid a likely qualification is not one.

Balance confirmation requests (SA 505)

Confirmations are sent on the client's letterhead but under the auditor's control. SA 505 requires you to determine what to confirm, select the parties, design the request (including that replies come directly to you) and send the requests yourself. In practice:

• Choose the parties from the trial balance — balances above a threshold linked to performance materiality, plus any unusual, related party, old or nil-balance accounts where completeness is the risk.
• Positive or negative. Positive requests (the party is asked to reply in every case) give better evidence. SA 505 allows negative requests as the sole substantive procedure only when all four of its conditions are met: low assessed risk supported by tested controls, a large population of small homogeneous balances, a very low expected exception rate, and no reason to expect recipients to ignore the request.
• Keep a control sheet: party, balance, date sent, date of reply, confirmed amount, difference, and how the difference was reconciled.
• If management refuses to let you send a request, ask why and look for evidence of the reason, consider the effect on your risk assessment, and perform alternative procedures. If the refusal is unreasonable or you cannot get evidence another way, communicate with those charged with governance and consider the effect on your report (SA 705).
• No reply calls for alternative procedures — subsequent receipts or payments, invoices, delivery documents — documented against the party. Where you decided a positive reply was essential, alternative procedures will not do; consider the effect on your opinion.

Communicating control deficiencies (SA 265)

Often called the "management letter", this is required, not optional, where you identify significant deficiencies in internal control. SA 265 requires you to communicate significant deficiencies in writing to those charged with governance on a timely basis, and to communicate to management, at the appropriate level, both the significant deficiencies and other deficiencies that merit their attention. The written communication describes each deficiency and its potential effects, with enough explanation for the reader to understand it, and states that the audit was not designed to express an opinion on the effectiveness of internal control. For smaller clients, a short letter listing each issue, its effect and a suggested fix is usually what the owners find most useful.

The management representation letter (SA 580)

Written representations are audit evidence, but they do not on their own give sufficient appropriate evidence about any matter. SA 580 requires them to be:

• From management with appropriate responsibilities for the financial statements and knowledge of the matters — usually the directors, the partners or the proprietor;
• In the form of a letter addressed to the auditor;
• Dated as near as practicable to, but not after, the date of the auditor's report, and covering all the financial statements and periods referred to in the report.

Two representations are required in every audit: that management has fulfilled its responsibility for preparing the financial statements in accordance with the framework, as set out in the terms of engagement; and that it has provided all relevant information and access as agreed, and that all transactions have been recorded and reflected in the financial statements. Other SAs require further specific representations where relevant:

Avoid a generic letter: add representations that support the judgements in this year's file — the recoverability of a large old debtor, the valuation of slow-moving stock, the nature of a related party loan. If management does not provide the two required representations, or you conclude that there is sufficient doubt about management's integrity that the representations are not reliable, SA 580 requires you to disclaim an opinion.

Filing and tracking the letters

• Permanent file: appointment documents, consent and certificate, ADT-1, the letter to the previous auditor with proof of delivery and their reply, and the current engagement letter.
• Current file: confirmation requests and control sheet, replies and reconciliations, the deficiencies letter, and the signed representation letter.
• Before signing, check that the engagement letter is acknowledged, the confirmations are closed or covered by alternative procedures, and the representation letter is signed and dated on or before the report date. An unsigned representation letter is a common reason a report is held up.

Frequently asked questions

Sources

• ICAI — SA 210 Agreeing the Terms of Audit Engagements
• ICAI — SA 505 External Confirmations
• ICAI — SA 580 Written Representations
• ICAI — SA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management
• ICAI — Announcement on communication with the previous auditor by email (1 May 2020)
• Chartered Accountants Act, 1949 — First Schedule, Part I, Clauses (8) and (9); Second Schedule, Part I, Clause (1)
• Companies Act, 2013 — sections 139, 140 and 141; Companies (Audit and Auditors) Rules, 2014, Rule 4