The engagement letter is the first workpaper in the file and often the last one anyone reads carefully. That is a mistake. It sets the scope of the work, the responsibilities management accepts, the reports the firm expects to issue and the commercial terms. When a client disputes a fee, a lender asks why the report is modified, or a peer reviewer asks whether preconditions were met, the engagement letter is where the answer starts.
This guide covers the requirements for audit engagement letters under AU-C 210, Terms of Engagement, the differences for review, compilation and preparation engagements under the SSARS (AR-C 90, AR-C 80 and AR-C 70), recurring engagements, and common mistakes. It paraphrases the standards, which are published in AICPA Professional Standards. The firm's counsel and insurer should review its standard letter.
What is an audit engagement letter?
An audit engagement letter is the written agreement between the auditor and the client that records the agreed terms of the audit. AU-C 210 requires the auditor to agree the terms of the engagement with management or those charged with governance, as appropriate, and to document those terms in an engagement letter or other suitable form of written agreement.
The letter does two jobs under AU-C 210:
- Confirms the preconditions for an audit are present. The auditor determines that management uses an acceptable financial reporting framework and that management acknowledges and understands its responsibilities.
- Records the agreed terms, so that there is no misunderstanding about the scope of the audit and who is responsible for what.
If the preconditions are not present, the auditor discusses the matter with management and, unless required by law or regulation, does not accept the engagement.
Required elements of an audit engagement letter under AU-C 210
AU-C 210 requires the agreed terms to cover the following, paraphrased. The illustrative letter in its appendix also states the inherent limitations of an audit.
| Element | What it covers |
|---|---|
| Objective and scope of the audit | An audit of the financial statements to obtain reasonable assurance and express an opinion, conducted in accordance with GAAS |
| Auditor's responsibilities | Conducting the audit under GAAS, and the nature of reasonable assurance |
| Management's responsibilities | See the list below |
| Inherent limitations (illustrative letter) | A statement that, because of the inherent limitations of an audit together with those of internal control, there is an unavoidable risk that some material misstatements may not be detected, even though the audit is properly planned and performed under GAAS |
| Applicable financial reporting framework | For example, GAAP as issued by FASB, or a special purpose framework such as the tax basis or cash basis |
| Expected form and content of reports | A reference to the reports the auditor expects to issue, and a statement that circumstances may arise in which a report may differ from its expected form and content |
Management's responsibilities
AU-C 210 requires management to acknowledge and understand its responsibility for:
- the preparation and fair presentation of the financial statements in accordance with the applicable financial reporting framework
- the design, implementation and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error
- providing the auditor with access to all information of which management is aware that is relevant to the preparation and fair presentation of the financial statements, such as records, documentation and other matters
- providing additional information the auditor may request for the purpose of the audit
- providing unrestricted access to persons within the entity from whom the auditor determines it necessary to obtain audit evidence
Most firm letters also state that management will provide written representations at the end of the audit, consistent with AU-C 580. Including it up front avoids surprise when the management representation letter arrives for signature.
Common additional terms
AU-C 210 lists other matters the letter may include. Firms typically add:
- fees and billing arrangements, including how out-of-scope work is billed
- the timetable and the expected report release date
- the PBC list or a reference to it, and the consequences of late information
- the use of specialists, other auditors or offshore and outsourced service providers, if the firm uses them
- arrangements for any nonattest services, such as preparing the financial statements, proposing journal entries or preparing the tax return, and management's responsibilities for them
- communication of internal control matters under AU-C 265
- limitation of liability, dispute resolution, and access to working papers by regulators, peer reviewers and successor auditors, subject to state law and the AICPA Code of Professional Conduct
- the expectation that management will make the audited financial statements and auditor's report available with any document containing them, and notify the auditor before including the report in another document
Free templates: audit engagement letter.
Nonattest services and independence
If the firm prepares the financial statements, proposes adjusting entries or performs other nonattest services, the letter is the natural place to document the requirements of the AICPA nonattest services interpretation. Management must assume all management responsibilities, oversee the service through an individual with suitable skill, knowledge or experience, evaluate the adequacy and results of the service and accept responsibility for the results. The interpretation also expects the firm to document its understanding with the client about the objectives of the nonattest service, the services to be performed, management's acceptance of its responsibilities, the firm's responsibilities and any limitations of the engagement. Name the individual who will oversee the services.
Review, compilation and preparation engagement letters
Engagements under the SSARS have their own requirements. Like AU-C 210, the AR-C sections require the agreed terms to be documented in an engagement letter or other suitable form of written agreement. The difference is the signature: the AR-C sections require the agreement to be signed by the accountant or the firm and by management or those charged with governance, as appropriate, while AU-C 210 does not state an explicit signature requirement.
| Engagement | AR-C section | Assurance | Key letter points |
|---|---|---|---|
| Review | AR-C 90 | Limited assurance | Objective of obtaining limited assurance that no material modifications are needed; review consists primarily of inquiry and analytical procedures; not an audit; management's responsibilities including written representations; the review report expected |
| Compilation | AR-C 80 | None | Objective of applying accounting and financial reporting expertise to assist management; no assurance; the compilation report expected, including any reference to independence impairment |
| Preparation | AR-C 70 | None | Objective of preparing financial statements; no assurance and no report; each page of the statements includes a statement that no assurance is provided, or the accountant issues a disclaimer |
Templates: review engagement letter, compilation engagement letter, preparation engagement letter.
For a side-by-side comparison of the three service levels, see compilation vs review vs audit.
Changing the level of service
A client may ask to step down from an audit to a review, or from a review to a compilation, partway through the engagement. AU-C 210 requires the auditor to consider whether there is reasonable justification for the change, and the SSARS take a similar approach for requests to move to a lower level of service. A change in the client's circumstances, such as a lender no longer requiring an audit, can be reasonable. A request made because the auditor could not obtain evidence about a significant item, or because the client wants to avoid a modified opinion, may not be.
If the change is accepted, get a new engagement letter for the new service and do not refer in the new report to the original engagement or to any procedures performed under it (AU-C 210 makes an exception for a change to an agreed-upon procedures engagement).
Recurring audits
AU-C 210 requires the auditor, on recurring audits, to assess whether circumstances require the terms of the engagement to be revised, and whether there is a need to remind management of the existing terms. Many firms issue a new letter every year anyway, which is the simplest way to stay current.
Reasons to revise the terms include:
- a change in senior management, ownership or those charged with governance
- a change in the size or nature of the entity's business
- a new financial reporting framework or significant new accounting standard, such as adoption of a new revenue, lease or credit loss standard
- new legal or regulatory requirements, such as a new lender reporting requirement or a single audit
- any indication that management misunderstands the objective and scope of the audit
- any revised or special terms
Worked example: scoping the letter for a new client
A manufacturer with $45 million of revenue asks for a first-year audit of its December 31 financial statements to satisfy a new bank covenant. The bank also wants a covenant compliance letter.
Points the letter should cover:
| Item | Wording focus |
|---|---|
| Framework | GAAP as issued by FASB |
| Reports expected | Auditor's report on the financial statements; a separate report on covenant compliance, if the firm agrees to provide one, with its own scope and limitations |
| Opening balances | The prior year was reviewed, not audited, so the letter notes that procedures over opening balances under AU-C 510 are required and may affect timing and fees |
| Inventory | The auditor will observe the year-end physical count; if the observation date passes before acceptance, alternative procedures may be needed and the report may be affected |
| Nonattest services | The firm will draft the financial statements and notes; the CFO is named as the individual overseeing the service |
| Fees | Fixed fee for the defined scope with a separate rate for work caused by late or incomplete PBC items |
Each item is something that, if left out, turns into a fee dispute or a scope argument in March.
Common mistakes in engagement letters
- Signed after fieldwork started. The letter should be agreed before significant work begins. A letter signed in the final week does not show that preconditions were evaluated at acceptance.
- Wrong framework or wrong entity name. A letter for "ABC Holdings, Inc." when the statements are for "ABC Holdings, LLC and Subsidiary" leaves the scope unclear.
- Superseded standards references. Letters that still use wording from before the auditor's reporting standards changed. Update the firm template when standards change.
- Missing nonattest documentation. Statement preparation and journal entries done, but no named overseer and no acknowledgment of management responsibilities.
- No reference to other reports. A single audit, an agreed-upon procedures report or a covenant letter that the client expects but the letter does not mention.
- Unsigned by the client. Even when AU-C 210 does not require a client signature in so many words, an unsigned letter is weak evidence of agreement. Most firm methodologies require one.
- Not refreshed on recurring engagements. Three-year-old letters with old fees and old team arrangements.
What to document
- the evaluation of preconditions: acceptable framework and management's acknowledgment of its responsibilities
- the signed engagement letter, dated before significant fieldwork
- any change in terms and the reason for it
- independence evaluation for any nonattest services named in the letter
- for recurring engagements, the assessment of whether terms need revision
These items sit alongside planning documentation under AU-C 230. See audit working papers for how firms organize them.
Frequently asked questions
Is an engagement letter required for an audit?
Yes. AU-C 210 requires the agreed terms of an audit engagement to be documented in an engagement letter or other suitable form of written agreement.
Does an audit engagement letter have to be signed by the client?
AU-C 210 requires a written agreement, and most firm methodologies require signatures by both the firm and management. The AR-C sections for reviews, compilations and preparation engagements require signatures by both parties.
Do I need a new engagement letter every year?
Not always. For recurring audits, AU-C 210 requires the auditor to assess whether the terms need to be revised or management reminded of them, but many firms issue a new letter each year to keep terms current.
What happens if the client will not acknowledge its responsibilities?
If management will not acknowledge its responsibilities, a precondition for an audit is missing, and the auditor should not accept the engagement unless required by law or regulation.
Can a review engagement letter be converted to an audit letter later?
A change from a review to an audit is a change to a higher level of service, which is usually accepted, but it requires a new engagement letter that sets out the audit terms under AU-C 210.
Sources
- AICPA, AU-C Section 210, Terms of Engagement (paras .06-.17 and Appendix A)
- AICPA, AU-C Section 510, Opening Balances: Initial Audit Engagements, Including Reaudit Engagements
- AICPA, AU-C Section 501, Audit Evidence: Specific Considerations for Selected Items
- AICPA, AU-C Section 580, Written Representations
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, AR-C Section 70, Preparation of Financial Statements; AR-C Section 80, Compilation Engagements; AR-C Section 90, Review of Financial Statements
- AICPA Code of Professional Conduct, ET Section 1.295, Nonattest Services
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Engagement and acceptance: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error