The second review before signing: 15 questions an independent partner will ask

The engagement partner who has lived with a file for three weeks reads the statements the way the team drafted them. A second reviewer reads them the way a bank, a regulator or a peer reviewer will: cold, starting from the report and working back to the evidence. Even when no standard requires it, a short independent review before signing is one of the cheapest controls a small firm has. This guide explains what SQC 1 and SA 220 say about an engagement quality control review, and gives 15 questions a second reviewer should ask — and expect a documented answer to.

What SQC 1 and SA 220 say

SQC 1 defines an engagement quality control review (EQCR) as a process designed to provide an objective evaluation, before the report is issued, of the significant judgements the engagement team made and the conclusions it reached in formulating the report. The firm's policies must:

• require an EQCR for all audits of financial statements of listed entities;
• set out criteria against which all other audits and assurance engagements are evaluated to decide whether an EQCR is needed — SQC 1 mentions public interest, unusual circumstances or risks, and whether law or regulation requires one; and
• require an EQCR for every engagement that meets those criteria, completed before the report is issued.

SA 220 then sets out what happens on the engagement. The engagement partner must make sure a reviewer has been appointed, discuss significant matters with the reviewer, and not date the auditor's report until the review is complete. The reviewer's objective evaluation involves four things:

SA 220's application material accepts that in some firms none of the audits may meet the firm's criteria for an EQCR. That is not a reason to skip a second look — it means the firm decides how much review each file needs, and should be able to show that it decided.

Making it work in a small firm

SQC 1 is built around objectivity. Its guidance says the reviewer is, for example, not selected by the engagement partner, does not otherwise take part in the engagement during the review period and does not make decisions for the team. A two-partner firm can often manage that with a firm policy under which each partner reviews the other's riskier files, so the reviewer is set by the policy rather than chosen by the engagement partner; where a reciprocal arrangement would itself threaten objectivity, an external reviewer is the alternative. SQC 1 also recognises that sole practitioners and small firms may contract suitably qualified external persons, or use another firm, where an engagement needs an EQCR.

Two practical points. First, timing: SQC 1 expects the review to happen at appropriate stages so that significant matters can be resolved before the report is issued — a review on the morning of signing can only find problems, not fix them. Second, documentation: SQC 1 requires the firm to document that the required procedures were performed, that the review was completed before the report was issued, and that the reviewer is not aware of unresolved matters that would make the team's significant judgements inappropriate. A one-page review note with the questions below, answered and initialled, does this.

The review is not a re-audit. It also does not reduce the engagement partner's responsibility — both SQC 1 and SA 220 say so. If the reviewer and the partner disagree, the report waits until the matter is resolved under the firm's procedures for differences of opinion.

Questions 1–4: does the right framework apply?

Applicability is decided once, early, and then rarely revisited. A second reviewer should revisit it.

1. Is the small company status right for this year? The limits are now ₹10 crore paid-up capital and ₹100 crore turnover (from 1 December 2025), and a holding or subsidiary company is never a small company. Ask to see the working, not the conclusion. (See the new small company limits.)
2. Does CARO 2020 apply — and if it is excluded, which paragraph 1(2) condition was tested? For a private company the exclusion depends on paid-up capital plus reserves, borrowings from banks or financial institutions at any time during the year, and revenue; and on not being a holding or subsidiary of a public company. (See CARO 2020 applicability.)
3. Is the internal financial controls reporting exemption actually available? The 2017 exemption for private companies (G.S.R. 583(E), as corrected in July 2017) covers one person and small companies, and companies with turnover below ₹50 crore in the latest audited statements and borrowings from banks, financial institutions and bodies corporate below ₹25 crore at all times in the year; it is lost if the company has defaulted in filing its financial statements or annual return. A paragraph left in or out from last year's template is a visible slip.
4. Is a cash flow statement required? Section 2(40) allows a one person company, a small company and a dormant company to omit it, and the 2017 exemption notification for private companies (G.S.R. 583(E)) extends this to a private company recognised as a start-up, if it has not defaulted in filing its financial statements or annual return. If the company has ceased to be small, last year's omission does not carry over.

Questions 5–7: do the figures hold together?

The mechanical checks — balancing, note totals, cross-references — belong in the team's own pre-signing routine (see 7 checks before signing a balance sheet). The reviewer asks the questions that sit one level above them:

5. Which trial balance were the statements drawn from, and is it the final one? Entries passed after the draft are the most common source of a statement that no longer agrees to the books.
6. Do the comparatives agree to last year's signed accounts, and is every regrouping disclosed?
7. Is every ratio that moved by more than 25% explained — and does the explanation make sense? Schedule III asks for the reasons. "Due to business reasons" is not an explanation a reviewer should accept. (See ratios and the 25% rule.)

Questions 8–11: are the judgements supported?

This is the core of an EQCR — the significant judgements and the evidence behind them.

8. Is materiality still right at the end of the audit? SA 320 requires materiality to be revised if information comes to light that would have led to a different amount initially — for example, when actual profit or revenue is well away from the planning figure. Then ask how the uncorrected misstatements compare with it (SA 450).
9. Has going concern been assessed, not assumed? Losses, negative net worth, overdue borrowings or the loss of a major customer call for an evaluation of management's assessment. SA 570 (Revised) requires the auditor to ask management to extend an assessment that covers less than twelve months from the date of the financial statements. The conclusion must be consistent with the notes, the report and CARO clause 3(xix).
10. Are provisions and contingent liabilities supported? Gratuity and leave, warranty, disputed tax demands, pending litigation. Ask what evidence supports the amount and the disclosure, and whether it matches the Rule 11(a) statement on pending litigations.
11. Is the related party list complete, and are the transactions disclosed and approved? Compare the list with the directors' disclosures and with ledgers of loans, rent and remuneration. Check the AS 18 note and, for a company, the section 188 approvals where they are needed. (See related party disclosures under AS 18.)

Questions 12–13: does the report follow from the file?

12. Are the Rule 11 statements and the CARO answers consistent with each other, with the statements and with the main report? A litigation in the notes but "no pending litigations" under Rule 11(a); a delay in statutory dues in CARO but no mention anywhere else; an audit trail paragraph under Rule 11(g) that does not match what the team found about the software. ICAI's Guidance Note on CARO 2020 asks the auditor to consider whether an unfavourable CARO comment has a bearing on the true and fair view and might warrant a modification of the main report — while noting that not every unfavourable comment will. The reviewer should see that consideration on file. (See the Rule 11 checklist.)
13. If the opinion is modified, does the basis paragraph do its job? Under SA 705 (Revised), the Basis for Qualified (Adverse, Disclaimer of) Opinion section describes the matter that gave rise to the modification. For a misstatement of specific amounts it also quantifies the financial effects, unless that is impracticable (and then says so); where the auditor could not obtain sufficient appropriate evidence, it gives the reasons. The reviewer asks whether the type of opinion — qualified, adverse or disclaimer — fits how material and how pervasive the matter is. And if the opinion is not modified, whether any matter on file should have led to a modification.

Questions 14–15: is the paperwork in order?

14. Are the dates in the right order? The Board approves the statements; the management representation letter is dated as near as practicable to, but not after, the date of the auditor's report (SA 580); and the report is dated no earlier than the date on which there is sufficient appropriate evidence, including that the statements are prepared and those with authority have taken responsibility for them (SA 700). A representation letter dated a month before the report leaves a gap for subsequent events.
15. Will the report carry a valid UDIN, and are review points and client queries closed? UDIN is ideally generated at signing, and in any case within ICAI's time limit (currently 60 days from the date of signing). Every review point should be cleared with a visible resolution, or carried with a documented condition the partner accepted.

Record the review

A review that leaves no trace looks, to a peer reviewer, like a review that did not happen. Keep it simple: the 15 questions, an answer or a working paper reference against each, the points raised and how they were resolved, the reviewer's name and the date — on or before the date of the report. For files that do meet your firm's EQCR criteria, the note should also record what SQC 1 asks for: that the firm's procedures were performed, that the review was completed before the report was issued, and that no unresolved matters remain. (See what a peer reviewer looks for in a company audit file.)

Frequently asked questions

Sources

• ICAI — SQC 1 Quality Control for Firms (engagement quality control review)
• ICAI — SA 220 Quality Control for an Audit of Financial Statements
• ICAI — SA 320 Materiality in Planning and Performing an Audit
• ICAI — SA 450 Evaluation of Misstatements Identified during the Audit
• ICAI — SA 570 (Revised) Going Concern
• ICAI — SA 580 Written Representations
• ICAI — SA 700 (Revised) Forming an Opinion and Reporting on Financial Statements
• ICAI — SA 705 (Revised) Modifications to the Opinion in the Independent Auditor's Report
• ICAI — Guidance Note on CARO 2020 (Revised 2022 Edition)
• Small company limits — G.S.R. 880(E), 1 December 2025 (Gazette)
• ICAI — UDIN: time limit aligned to 60 days
• Companies Act, 2013 — sections 2(40), 2(85), 143, 188; Companies (Audit and Auditors) Rules, 2014 — rule 11