SAS 149 makes communication with component auditors a continuing, two-way exchange. The group engagement team no longer sends one letter at the start and files the reply at the end. This post focuses on the practical piece: what goes into the instruction package, what the team asks to receive back, and how the team reviews it.
The framework, the scoping approach and the reporting options are in group audits under AU-C 600 and SAS 149. Nothing here repeats that structure.
What the standard changed
SAS 149 applies to audits of group financial statements for periods ending on or after December 15, 2026. According to the Journal of Accountancy, its relevant features are:
- A component auditor is part of the engagement team, so the group engagement partner is responsible for direction, supervision and review of the component auditor's work under AU-C 220.
- The group auditor must tell component auditors about relevant events or conditions, identified by group management or the group auditor, that may raise substantial doubt about the group's ability to continue as a going concern for a reasonable period.
- The standard emphasizes two-way communication, with required communications throughout the audit.
- Direction, supervision and review are commensurate with aggregation risk, defined as the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the group financial statements as a whole.
- Component performance materiality should be lower than group performance materiality.
- A referred-to auditor audits a component's financial statements and is referred to in the group auditor's report. That auditor is not part of the engagement team.
- If at any stage the group auditor concludes that a component auditor's work is inadequate, the group auditor decides what additional procedures to perform, and either party can perform them. The group auditor may also perform further procedures centrally.
- Equity-method investees are treated as components.
The IAASB's equivalent, ISA 600 (Revised), highlights the same two-way communication and applies to periods beginning on or after December 15, 2023.
The instruction package
The Journal of Accountancy notes that instructions may cover identified risks of material misstatement, other information relevant to the component auditor's risk assessment procedures, and matters the group auditor considers relevant to designing responses to assessed group-level risks. It suggests updating instructions to support the enhanced communication requirements.
The following is a working template. It is a practice layout, not a statement of what the standard prescribes line by line.
| Section | Content | Why it matters |
|---|---|---|
| 1. Scope | Entity, financial information to be audited or reviewed, period, and the work expected | The component auditor knows what is covered |
| 2. Framework and policies | Group accounting policies, framework, chart of accounts mapping, reporting package format | Prevents local GAAP surprises |
| 3. Ethics and independence | Relevant requirements and confirmation expected | Component auditors are on the engagement team |
| 4. Risks | Identified risks of material misstatement relevant to the component, fraud risks, specific estimates or transactions | The component auditor tests what the group team is worried about |
| 5. Materiality | Component performance materiality and the threshold for reporting misstatements | The standard calls for component performance materiality below group |
| 6. Going concern | Any events or conditions identified that may raise substantial doubt for the group | A required communication under SAS 149 |
| 7. Related parties | Related party list and a request to report others noted | Completeness of related party identification |
| 8. Deliverables and timetable | What comes back, in what format, by when | Review time is planned, not squeezed |
| 9. Access | Access to documentation and the date of the group team's review | Supports direction and review |
Do not send the same package to every component. A component with a significant risk gets section 4 written for it. A component selected only for analytical procedures gets a short letter.
Worked example of component performance materiality
All figures are illustrative. Group performance materiality is $600,000. The group has four components selected for audit. The team assesses aggregation risk, considering that four components plus unaudited remaining balances could each carry misstatements that together approach group materiality. It sets component performance materiality at $360,000 for the largest component, $300,000 for two mid-sized ones and $240,000 for a component with a prior-year error. Each is below $600,000 as the standard expects. The team documents the basis and tells each component auditor the threshold for reporting misstatements in the same letter.
Timing: communication is a calendar
| When | Group team sends | Group team expects |
|---|---|---|
| Planning | Instruction package; risk discussion | Acknowledgment of ethics and independence; component audit plan |
| Interim | Updates when group-level risks change; going concern conditions | Status and any significant matters |
| Fieldwork close | Request for deliverables; review dates | Component results and conclusions |
| Review | Questions and requests for additional work | Responses by agreed date |
| Report date | Confirmation of subsequent events procedures | Updated communications |
An update is triggered by anything that changes the picture: a new related party, a subsequent event, a change in the group's policies, or conditions that raise doubt about the group's ability to continue.
Reviewing what comes back
The group engagement partner's responsibility does not end when a component auditor delivers. The review should ask:
- Was the work performed what the instructions asked? Compare the deliverable to sections 1 to 8.
- Did the component auditor address the risks named in section 4? An absence of comment on a named risk is a gap, not clearance.
- Are the misstatements reported on the right basis? Tie corrected and uncorrected amounts to the component materiality and the reporting threshold.
- Do conclusions follow from the evidence? Read the component documentation for the significant risks, not only the summary.
- Is anything inconsistent with what the group team knows? Compare to group analytics and prior-year results.
If the answers show the work is inadequate, the standard leaves the choice of additional procedures to the group auditor. Decide who performs them and by when, and record the decision. Central procedures can sometimes replace a re-performance at the component.
Review depth follows aggregation risk. A high-risk component warrants reading the working papers or visiting. A low-risk component may need only the deliverable and a discussion.
Documentation
File the instruction package as sent, with the date. File each component's deliverable, the group team's review notes and the resolution of every open item. Include the group's understanding of the component auditor and how the group team decided its direction, supervision and review. Update the group audit strategy memo when instructions change.
FAQ
Is a component auditor from another firm part of the engagement team?
Yes. Under SAS 149 a component auditor is defined as part of the engagement team.
Does the group auditor have to tell component auditors about going concern conditions?
Yes. The group auditor must communicate relevant events or conditions that may raise substantial doubt about the group's ability to continue as a going concern for a reasonable period.
Is a referred-to auditor treated like a component auditor?
No. A referred-to auditor audited a component and is referred to in the group auditor's report. That auditor is not part of the engagement team, and the group engagement partner should decide early whether to make reference.
Sources
- Journal of Accountancy, SAS 149 is coming: What audit teams need to know (August 2026)
- Journal of Accountancy, New standard provides risk-based approach to group audits (March 2023)
- IAASB, ISA 600 (Revised), Special Considerations: Audits of Group Financial Statements
- AICPA, SAS No. 149, codified in AU-C Section 600
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error