The United States has two sets of auditing standards, and which one applies depends on the client, not on the auditor's preference. Audits of companies that report to the SEC follow PCAOB standards. Audits of most other entities follow AICPA standards. An Indian CA firm that touches US work needs to know which set sits behind the engagement before anything else.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on PCAOB and AICPA standards and read the summaries returned. We did not open the full text of any PCAOB or AICPA standard, so paragraph references are left out and every point below is stated at a general level. Confirm against pcaobus.org and the AICPA's own publications before relying on a detail.
Two sets of standards, two audiences
PCAOB standards are written by the Public Company Accounting Oversight Board, which the US Congress created through the Sarbanes-Oxley Act. They apply to audits of "issuers" (companies with securities registered with the SEC) and, under later rules, to audits of broker-dealers. The Board's standards are numbered with an "AS" prefix, for example AS 2201 on audits of internal control.
AICPA standards are written by the Auditing Standards Board of the American Institute of CPAs. They are issued as Statements on Auditing Standards (SAS) and codified in the "AU-C" sections. They apply to audits of private companies, not-for-profits and many other entities that are not SEC issuers.
A simple test: if the client files annual reports with the SEC, expect PCAOB. If it does not, expect AICPA.
How the two compare with India's Standards on Auditing
India's SAs, issued by ICAI, are built on the International Standards on Auditing. The AICPA's AU-C sections are also largely aligned with the ISAs, so an Indian auditor will find most headings familiar: risk assessment, materiality, audit evidence, sampling, the audit report. The wording and some requirements differ.
PCAOB standards started from a different base and are generally more prescriptive. That shows up most clearly in two areas:
- Internal control. PCAOB audits of larger issuers include an opinion on internal control over financial reporting, integrated with the financial statement audit. Our post on the integrated audit under AS 2201 covers this.
- The audit report. PCAOB reports carry a section on critical audit matters. Under AICPA standards, a comparable section on key audit matters is available but is not the default. Check the current standards for the exact conditions.
Our existing guide to Standards on Auditing and how they relate to global frameworks in Asia gives the wider picture on convergence.
Who can sign what
This is the point that catches firms out.
- To sign an audit report on an SEC issuer, a firm must be registered with the PCAOB. Non-US firms can register. Registration brings inspection by the Board, which is a real commitment of time and quality-control effort.
- Signing an AICPA-standards audit report for a US entity is a licensing matter. In the US, audit signing authority comes from state boards of accountancy, and rules differ by state. An India-based firm should assume it cannot sign such a report unless a licensed US firm is involved. Treat this as something to confirm with the relevant state board, not something to infer.
Our summary of what an Indian firm can realistically do for US clients is in how Indian CA firms can work with US clients.
Where an Indian firm usually meets these standards
- Component auditor of a US group. The US group auditor sends instructions and expects work to meet PCAOB or AICPA standards, depending on the group. The reporting package, independence confirmations and documentation format all follow the US firm's methodology.
- Indian subsidiary of a US-listed parent. The parent's auditor may review controls at the subsidiary, and management has to support the parent's internal control certification. See SOX compliance for Indian subsidiaries.
- Offshore support for a US CPA firm. Reviewing workpapers, tie-outs and documentation under the US firm's supervision. The US firm stays responsible for the opinion.
Practical differences that affect working papers
- Independence. US rules, including SEC independence rules for issuers, differ from ICAI's Code of Ethics in places. Do not assume that an engagement clean under one is clean under the other.
- Documentation. US firms expect documentation to stand on its own so that an experienced reviewer with no prior connection can follow it. This is similar in spirit to SA 230 but inspection culture makes it stricter in practice.
- Terminology. "Significant deficiency" and "material weakness" are defined terms under US rules. They have specific meanings. Our post on classifying control deficiencies explains them.
A short checklist before accepting any US-linked work
- Is the client an SEC issuer or a broker-dealer? That decides the standards.
- Who signs the report, and is that firm registered or licensed as required?
- Which standards will the US firm's instructions refer to?
- Who is responsible for supervision and review of the work you perform?
- Has independence been checked under the US rules that apply?
If these cannot be answered in writing at the start, the engagement is not ready.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error