A group audit is an audit of financial statements that include the financial information of more than one entity or business unit. In the US, the requirements for nonissuers sit in AU-C 600, Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors). The AICPA revised that section with SAS No. 149, which moves the section toward a risk-based approach to the group audit.
This guide explains what changed, how to scope a group audit, how to work with component auditors, and what the group team should document. It is written for staff through partners at small and mid-sized firms that audit consolidated clients with subsidiaries, branches, joint ventures or divisions.
When a group audit exists and why SAS 149 matters
A group audit exists when the financial statements being audited consolidate or combine the financial information of more than one component. A component is an entity, business unit, function or business activity (or a combination) that the group auditor decides to treat as a unit for planning and performing audit procedures. A parent with two operating subsidiaries is a group. So is a single legal entity with several divisions that keep separate books, if the financial statements combine their information.
SAS 149 applies to audits of group financial statements for periods ending on or after December 15, 2026. For calendar-year clients, the December 31, 2026 audit is the first one under the revised section. Planning for those audits starts in 2026, so firms with consolidated clients should not wait for the year-end.
The most visible change is conceptual. The older section centered on identifying "significant components" and then performing procedures on them. The revised section treats the group audit like any other audit: the engagement team assesses the risks of material misstatement of the group financial statements under AU-C 315, as revised by SAS 145, and then decides what work is needed, and where, to respond to those risks. Components are one way of organizing that work, not the starting point. For the risk assessment itself, see the SAS 145 guide.
Key terms
- Group auditor: the group engagement partner and the members of the engagement team other than component auditors. The group auditor sets the overall group audit strategy and plan, directs and supervises component auditors, reviews their work, and evaluates the evidence behind the opinion on the group financial statements. This guide also says "group team" for the same idea. The group engagement partner is responsible for the engagement and its quality.
- Component auditor: an auditor who performs audit work related to a component for the group audit. A component auditor is part of the engagement team. That can be a team from another firm, a different office of your own firm, or a network firm.
- Component: an entity, business unit, function or business activity, or a combination of these, that the group auditor determines for purposes of planning and performing audit procedures.
- Referred-to auditor: an auditor who audited a component's financial statements and to whom the group engagement partner decides to refer in the group auditor's report. A referred-to auditor is not a component auditor and is not part of the engagement team.
- Consolidation process: consolidation entries, eliminations, and the adjustments made to bring component information to the group's accounting policies.
A different office of your own firm can also be a component auditor when it performs audit work related to a component for the group audit. Treat that office the same way for planning and communication: give it instructions and evaluate its work.
Scoping: deciding where audit work is needed
Start with the group-level risks
The group engagement team obtains an understanding of the group, its components, its environment and the group-wide controls and consolidation process. From that understanding it identifies and assesses risks at the group level and decides which risks need response procedures. The scoping question is then: what work, on which components or on which group-level balances, will give sufficient appropriate evidence for those risks?
Choose the nature of work
For each component or item of interest, the team decides among several approaches. The revised section allows the team to:
- have an audit of the component's financial information performed (a full-scope audit)
- have specific procedures performed on one or more account balances, classes of transactions or disclosures
- perform procedures at the group level, for example on centralized processes or on consolidation entries
- perform other procedures, such as analytical procedures, where they are responsive to the assessed risk
This is a judgment based on the assessed risks, not a mechanical rule that a component above some percentage of assets or revenue gets a full audit. Many firms keep a coverage target as a sanity check. If the work chosen does not address a risk, the team needs further procedures.
Materiality
The group engagement team sets materiality for the group financial statements as a whole and performance materiality under AU-C 320. Where component auditors are involved, the team also determines the materiality to be used for component work. Under the revised section, component performance materiality is set at a level lower than group performance materiality to address aggregation risk, the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the group financial statements as a whole. The materiality calculator can help with the group figures.
Also set a threshold for communicating misstatements identified at a component to the group auditor, set by reference to what is clearly trivial to the group financial statements, and state it in the instructions.
Working with component auditors
Understanding the component auditor
Before relying on a component auditor, the group team considers whether that auditor understands and will comply with the ethical requirements relevant to the group audit, including independence, and whether the auditor has the professional competence to do the work. Factors include experience with the entity's industry and the applicable reporting framework, quality management at the component auditor's firm, and whether the component auditor operates under a regulatory or professional oversight system.
For a component auditor from outside your firm, the group team also considers the extent of access to the component auditor's documentation and how the working relationship will be managed. If the team concludes it cannot adequately direct, supervise and review the work, it needs to take that into account in deciding on its approach or whether it can serve as group auditor.
Instructions to component auditors
The group team communicates its requirements clearly and in time. A useful instruction letter covers:
- the work to be performed, its purpose and the financial information it covers
- the applicable financial reporting framework and group accounting policies
- relevant ethical requirements, including independence
- component performance materiality and the threshold for communicating misstatements
- identified risks of material misstatement, including fraud risks, relevant to the component work
- a list of related parties identified by group management, and a request to report others noted
- what must be communicated back, when, and the format
- the timetable and the point at which the group team will review the component documentation
Do not send a standard form letter. If the instructions do not mention a risk that matters at the component, the component auditor may never test it.
Direction, supervision and review
The group engagement partner is responsible for the group audit even when other firms do most of the fieldwork. The group team therefore directs the component auditor's work, supervises it and reviews it. The extent depends on the risks and on what the team knows about the component auditor. Typical steps include:
- discussing the risk assessment and planned procedures with the component auditor
- reviewing the component auditor's documentation of significant risks and key judgments
- attending closing meetings and visiting where risks warrant it
- evaluating whether the work performed is sufficient and, if not, deciding what additional procedures are needed and who will perform them
Quality management at the group level, including SQMS No. 1 and engagement-level responsibilities, applies to the group engagement just as it does to a single-entity audit.
Communications
Communication runs in both directions and continues through the audit.
From the group team to the component auditor
Instructions at the start, updates when risks change, and timely feedback on the results of the group team's review. If new related parties, a subsequent event or a change in group policy arises, tell the component auditor promptly.
From the component auditor to the group team
The group team's instructions typically require the component auditor to report:
- confirmation that the component auditor has complied with the group team's requirements and relevant ethical requirements
- identification of the component financial information the work covers
- information on instances of noncompliance with laws or regulations that could give rise to a material misstatement of the group financial statements
- corrected and uncorrected misstatements above the communication threshold, and indicators of possible management bias
- deficiencies in the system of internal control identified in connection with the work performed
- other significant matters the component auditor communicated, or expects to communicate, to component management or those charged with governance of the component
- the component auditor's overall findings or conclusions
- any other matter that may be relevant to the group audit, including fraud or suspected fraud involving component management, employees with significant roles in group-level control, or others where fraud resulted in a material misstatement
Read what comes back. Evaluate whether the communication is adequate and whether the work done is sufficient for your purposes. Unresolved gaps are a matter for the group partner, not the senior.
With group management and those charged with governance
The group team communicates with group management and those charged with governance about the scope and timing of the audit, including the planned involvement of component auditors where relevant, and about significant findings and any limitations on access that affected the audit. Use the same channels and the communication with those charged with governance template as for any audit.
Reporting: component auditors versus referred-to auditors
When the group auditor assumes responsibility for the work of component auditors, the group auditor's report does not refer to them. The group auditor retains responsibility for the group opinion.
SAS 149 keeps a separate path for dividing responsibility. If a component's financial statements were audited by another auditor (a referred-to auditor), the group engagement partner may decide to refer to that audit in the group report. A referred-to auditor is not part of the engagement team, but the group engagement partner still confirms that auditor's ethics and independence compliance and evaluates its competence. AU-C 600 sets the conditions for this path and the wording the report must use, so read those paragraphs before choosing it. If a scope limitation prevents sufficient appropriate evidence, a modified opinion or disclaimer may be required under AU-C 705. See types of audit opinions.
Documentation
AU-C 230 applies. A group file typically includes:
- the understanding of the group, its components and the consolidation process
- the rationale for scoping decisions: which risks, which components, which type of work
- materiality at group and component levels and the communication threshold
- instruction letters and the component auditors' responses
- evaluation of each component auditor, including independence and competence
- the group team's review of component documentation and conclusions
- procedures on the consolidation, eliminations and group adjustments
- how uncorrected misstatements across components were aggregated on the summary of uncorrected misstatements
An audit planning memo that explicitly addresses the group structure makes the file easier to review.
Common mistakes in group audits
- Scoping by size alone. Choosing components by asset or revenue percentage without linking the choice to assessed risks.
- Generic instructions. Instruction letters that omit group-specific risks, related parties or the communication threshold.
- No evaluation of the component auditor. Independence confirmations and competence assessments missing or dated before the engagement.
- Consolidation left untested. Auditing each component and then not testing eliminations, intercompany balances, foreign currency translation or group-level adjustments.
- Late discovery of limitations. Access to component documentation or management restricted, with the issue first raised at completion.
- Treating an internal office as outside the standard. Another office of the same firm that does component work is part of the engagement team and needs instructions and review.
FAQ
When does SAS 149 take effect?
SAS 149 is effective for audits of group financial statements for periods ending on or after December 15, 2026. A calendar-year group's December 31, 2026 audit is the first one that must follow the revised AU-C 600.
Is another office of my own firm a component auditor?
It can be. A component auditor is an auditor who performs audit work related to a component for the group audit, and component auditors are part of the engagement team. That can include another office of the same firm. Give that office instructions and review its work as you would any other component auditor.
Do I still need to identify significant components?
The revised section moves away from the "significant component" model. Scoping starts from the assessed risks of material misstatement of the group financial statements, and components are then selected for work based on those risks. Many firms still use size as a reasonableness check, but it should not be the basis for scoping.
Can I refer to the component auditor in my report?
Not if the other auditor is a component auditor. When component auditors are involved, the group report makes no reference to them. SAS 149 does allow reference to a referred-to auditor, meaning an auditor who audited a component's own financial statements and whom you decide to refer to. That path has its own requirements in AU-C 600.
What if I cannot get access to a component auditor's documentation?
Consider whether you can still direct, supervise and review the work well enough to obtain sufficient appropriate evidence. If not, you may need to perform the work yourself, use another component auditor, or consider a scope limitation and its effect on the opinion. Raise it with the group partner early.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- AICPA, SAS No. 149, Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors), codified in AU-C Section 600. aicpa-cima.com (download requires a free account)
- AICPA, AU-C Section 315 (as revised by SAS No. 145), AU-C Section 320, AU-C Section 230, AU-C Section 705
- Journal of Accountancy, "SAS 149 is coming: What audit teams need to know" (August 2026). journalofaccountancy.com
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error