Audit & Assurance for Indian CAs

Where the audit power comes from

The statutory audit of a company is governed by Chapter X of the Companies Act 2013 and the Companies (Audit and Auditors) Rules 2014. The audit is not optional: every company must have its accounts audited by a chartered accountant in practice, and the auditor reports to the members, not to management.

Appointment (s.139)

• First auditor: appointed by the Board within 30 days of incorporation; failing which, by the members in an EGM.
• Subsequent auditors (s.139(1)): appointed at the AGM to hold office from the conclusion of that AGM until the conclusion of the sixth AGM, subject to ratification rules as amended.
• Form ADT-1: the company must file Form ADT-1 with the Registrar within 15 days of the appointment, intimating the auditor's appointment.

Rotation (s.139(2))

For prescribed classes — listed companies and certain public and large private companies — mandatory rotation applies: an individual auditor may serve one term of five consecutive years, and an audit firm two terms of five years, after which a cooling-off period applies before reappointment.

Disqualifications (s.141)

Section 141 lists who cannot be appointed — for example a person holding securities in the company, indebted beyond the prescribed limit, or holding a business relationship, and a person or firm holding appointment in more than the permitted number of companies. Independence is structural, not just attitudinal.

Common mistakes

• Missing the 15-day ADT-1 window after appointment.
• Overlooking rotation limits for a company that has crossed the threshold.
• Accepting an engagement where a s.141 relationship quietly exists.

Takeaway: Confirm a clean s.141 position and the correct s.139 appointment and rotation status, and file ADT-1 on time, before any audit work begins.

Decide whether to accept

Before accepting, assess independence, competence, resources and integrity of management. Where there is a predecessor auditor, professional etiquette and the ICAI Code of Ethics require communicating with them. Acceptance is a professional judgement, not a formality.

Agreeing terms under SA 210

SA 210, Agreeing the Terms of Audit Engagements, requires you to establish that the preconditions for an audit are present — an acceptable financial reporting framework and management's agreement to its responsibilities — and to record the agreed terms in writing. Capture them in an auditor engagement letter.

What the engagement letter covers

• The objective and scope of the audit and the applicable financial reporting framework (Companies Act + applicable Ind AS / Accounting Standards).
• Management's responsibilities for the financial statements, internal control, and providing access and information.
• The auditor's responsibilities and the inherent limitations of an audit.
• The form and content of reports and the basis of fees.

Recurring engagements

For a continuing engagement you need not send a fresh letter every year, but you must assess whether circumstances require revised terms — a change in management, ownership, framework or legal requirements is a trigger to reissue.

Common mistakes

• Starting fieldwork before terms are agreed in writing.
• An engagement letter silent on management's responsibility for internal controls.
• Not refreshing terms after a significant change at the client.

Takeaway: Accept only after independence and predecessor checks, then lock the scope and responsibilities in an SA 210 engagement letter before fieldwork.

Plan the engagement (SA 300)

SA 300, Planning an Audit of Financial Statements, requires an overall audit strategy and a more detailed audit plan setting the scope, timing and direction of the audit and the nature/extent of resources. Record both in an audit planning memo so the file shows your thinking, not just your conclusions.

Materiality (SA 320)

Under SA 320, set materiality for the financial statements as a whole using an appropriate benchmark (profit before tax, revenue or net assets, depending on the entity), then set performance materiality lower to reduce the risk that uncorrected and undetected misstatements exceed overall materiality. Revise materiality if you learn information that would have led to a different figure.

Risk assessment (SA 315)

SA 315, Identifying and Assessing the Risks of Material Misstatement, requires you to understand the entity, its environment and its internal control, and to identify risks at the financial-statement level and the assertion level. From this you flag significant risks — including a rebuttable presumption of fraud risk in revenue recognition under SA 240 — that demand a specific audit response.

Common mistakes

• A boilerplate strategy that is not tailored to the entity's actual risks.
• Setting overall materiality but skipping performance materiality.
• Documenting risks but not linking each significant risk to a planned response.

Takeaway: A planning file that ties SA 315 risks to SA 320 materiality and an SA 300 plan is what makes later evidence work focused and defensible.

Sufficient appropriate evidence (SA 500)

SA 500, Audit Evidence, requires you to obtain sufficient appropriate audit evidence to support the opinion — "sufficient" being the quantity and "appropriate" the relevance and reliability. Evidence from independent external sources, or generated under effective controls, is generally more reliable than internally produced evidence or oral assertion.

Audit sampling (SA 530)

Where you test less than 100% of a population, SA 530, Audit Sampling, governs how you design the sample, select items so every unit has a chance of selection, and project misstatements to the population. Sampling risk must be addressed — a small or biased sample undermines the conclusion. Document the population, the method (statistical or non-statistical) and the basis for the sample size.

External confirmations (SA 505)

• SA 505, External Confirmations, applies when you seek direct written responses from third parties — bank balances, debtors, creditors, loan terms.
• You must maintain control over the confirmation requests, send them yourself, and receive replies directly, not through the client.
• Investigate non-responses and exceptions, and consider whether negative confirmation is appropriate (it provides weaker evidence).

Documentation

Per SA 230, the working papers must let an experienced auditor with no prior connection understand the nature, timing and extent of procedures, the results, and the conclusions.

Common mistakes

• Letting the client send or collect confirmations, breaking auditor control under SA 505.
• A sample size with no documented rationale.
• Relying on management representation where corroborating evidence was obtainable.

Takeaway: Build the opinion on sufficient appropriate evidence — favour independent and externally confirmed sources, keep control of confirmations, and document why your sample supports the conclusion.

What CARO 2020 is

The Companies (Auditor's Report) Order 2020 (CARO 2020), issued under Section 143(11) of the Companies Act 2013, requires the auditor of specified companies to report on a list of detailed matters in addition to the main audit report. It significantly expanded the disclosures over the earlier CARO 2016.

Applicability

CARO 2020 applies to most companies but exempts certain categories — including a banking company, an insurance company, a company licensed under Section 8, a One Person Company, a small company, and a private company meeting prescribed limits on paid-up capital, reserves, borrowings and turnover. Confirm the entity's status before assuming the Order applies.

What you report on

• Property, plant and equipment and intangibles — records, physical verification, and title deeds of immovable property.
• Inventory verification and, where applicable, working-capital limits sanctioned against current assets.
• Loans, investments, guarantees and securities under ss.185/186.
• Statutory dues — including GST, provident fund, ESI, income tax — and disputed amounts.
• Default in repayment of loans, end-use of funds, and whether funds raised short-term were used long-term.
• Fraud reported or noticed, related-party transactions, internal audit, and resignation of the statutory auditors.

Work through each clause systematically using a CARO 2020 checklist so nothing is missed and each answer is evidenced.

Common mistakes

• Applying CARO to an exempt small or private company, or skipping it on one that qualifies.
• Generic "yes/no" answers with no underlying verification (e.g. title deeds, physical inventory counts).
• Missing the disputed-statutory-dues detail the Order specifically requires.

Takeaway: First settle applicability, then answer every CARO 2020 clause with evidence behind it — the Order is a structured checklist, not a narrative.

Forming the opinion (SA 700)

SA 700, Forming an Opinion and Reporting on Financial Statements, sets the structure of the report: a clear Opinion section first, a Basis for Opinion, and sections on going concern, key audit matters where applicable, and the respective responsibilities of management and the auditor. An unmodified ("clean") opinion states that the financial statements give a true and fair view in accordance with the applicable framework.

Key Audit Matters

For listed entities (and others where required), SA 701 requires reporting Key Audit Matters (KAM) — the matters of most significance in the current-period audit — drawn from those communicated to those charged with governance.

Modified opinions (SA 705)

• Qualified opinion: misstatements are material but not pervasive, or you cannot obtain evidence on a material but not pervasive matter — "except for".
• Adverse opinion: misstatements are both material and pervasive — the statements do not give a true and fair view.
• Disclaimer of opinion: you cannot obtain sufficient appropriate evidence and the possible effects are material and pervasive — you do not express an opinion.

Emphasis and other matter (SA 706)

SA 706 lets you add an Emphasis of Matter paragraph to draw attention to something properly presented in the statements that is fundamental to users, and an Other Matter paragraph for something relevant to understanding the audit or report — neither of which modifies the opinion.

Use a structured statutory audit report so the required sections and any modification are placed correctly.

Common mistakes

• Burying a problem in an Emphasis of Matter when it actually warrants a qualification under SA 705.
• Omitting the Basis for Opinion detail that explains a modification.
• Forgetting KAM where SA 701 applies.

Takeaway: Match the opinion to the evidence — clean, qualified, adverse or disclaimer per SA 705 — and reserve SA 706 paragraphs for emphasis, never as a substitute for a proper modification.

Written representations (SA 580)

SA 580, Written Representations, requires you to obtain a management representation letter confirming that management has fulfilled its responsibility for the financial statements and has provided all relevant information and access. Representations are necessary audit evidence but are not a substitute for other evidence you could reasonably obtain — they support, they do not replace.

What the letter covers

• Responsibility for preparation of the financial statements and for internal control.
• Completeness of information, transactions and related-party disclosures.
• Specific representations tied to areas of judgement — estimates, litigation, subsequent events, fraud.

Capture these in a dated management representation letter signed by those with appropriate responsibility, dated as near as practicable to (but not after) the date of the auditor's report.

Going concern (SA 570)

SA 570, Going Concern, requires you to evaluate management's assessment of the entity's ability to continue as a going concern. Look for indicators — net liabilities, recurring losses, defaults, loss of a key customer — and where a material uncertainty exists, evaluate whether it is adequately disclosed. The reporting consequence depends on disclosure: adequate disclosure leads to a Material Uncertainty Related to Going Concern section; inadequate disclosure leads to a qualified or adverse opinion; an inappropriate going-concern basis leads to an adverse opinion.

Common mistakes

• Treating the representation letter as proof of matters you should have independently tested.
• Dating the letter after the audit report date.
• Identifying a going-concern indicator but not following SA 570's reporting consequences.

Takeaway: Obtain SA 580 representations as supporting evidence only, and let your SA 570 going-concern conclusion — and the adequacy of disclosure — drive how the report is worded.

The auditor's fraud-reporting duty (s.143(12))

Section 143(12) of the Companies Act 2013 imposes a statutory duty on the auditor: if, in the course of the audit, you have reason to believe that an offence of fraud involving an amount above the prescribed threshold is being or has been committed against the company by its officers or employees, you must report it to the Central Government in the manner prescribed (Rule 13 of the Audit Rules, via Form ADT-4 after following the intimation procedure). Frauds below the threshold are reported to the audit committee or Board and disclosed in the Board's report.

This sits alongside SA 240

The audit standard SA 240, The Auditor's Responsibilities Relating to Fraud, governs how you identify and respond to fraud risk during the audit; Section 143(12) governs the statutory reporting of fraud you come to suspect. They work together — professional scepticism throughout, statutory reporting when the trigger is met.

Reporting on internal financial controls

Under Section 143(3)(i), the auditor of specified companies must report on whether the company has an adequate internal financial controls (IFC) system with reference to financial statements (ICFR) and its operating effectiveness. This is reported in an Annexure to the main audit report, following the ICAI Guidance Note on Audit of Internal Financial Controls. Smaller private companies meeting prescribed conditions are exempt from the operating-effectiveness reporting.

Practical guidance and common mistakes

• Document the basis for any fraud conclusion contemporaneously — the s.143(12) procedure has strict steps and timelines.
• Do not conflate the IFC opinion with the main opinion; it is a separate conclusion in the annexure.
• Avoid a generic IFC annexure that does not reflect actual testing of controls relevant to financial reporting.

Takeaway: Carry SA 240 scepticism through the engagement, follow the s.143(12) procedure precisely if the fraud threshold is met, and report the ICFR opinion separately and on the basis of real control testing.