When a firm sends audit preparation outside the firm, the standard that decides who answers for it is AU-C 220, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards, as revised by SAS 146. The answer is the engagement partner, in every case, with no carve-out for work done by someone else's staff.
This post walks through the paragraphs that matter, in the public text of SAS 146, and turns them into a review design for outsourced work.
Effective date
Paragraph 10 of SAS 146 reads: the SAS is effective for engagements conducted in accordance with GAAS for periods beginning on or after December 15, 2025. For a calendar-year client, that is the December 31, 2026 audit. The firm-level standard, SQMS 1, took effect on the same date, December 15, 2025. Thomson Reuters notes the same date for SAS 146, SSARS 26 and SSAE 23.
Outsourced preparers are engagement team members
The definition of engagement team in paragraph 12 covers all partners and staff performing the audit engagement and any other individuals who perform audit procedures on the engagement. Only an auditor's external specialist and internal auditors providing direct assistance are excluded.
The application material then names the cases directly:
- A15 states that regardless of how the team is organized, any individual who performs audit procedures on the engagement, other than those two excluded groups, is a member of the engagement team.
- A17 states that engagement teams include personnel and also other individuals who perform audit procedures from a network firm, or from a firm that is not a network firm or another service provider.
- A18 states that engagement teams include individuals from service delivery centers who perform audit procedures, for example a group of appropriately skilled personnel assigned repetitive or specialized tasks.
The consequence is straightforward. A preparer at an outside provider who performs audit procedures, such as tying a schedule to the general ledger or recomputing a balance, belongs to the engagement team. The team-level requirements apply to that person. The carve-out is for an auditor's external specialist, whose work is evaluated under AU-C 620. An individual with specialized expertise who performs audit procedures on the engagement is still a team member (A19). See using the work of a specialist.
The paragraphs that put the work on the partner
Paragraph 15. When the engagement partner assigns tasks related to a requirement of the SAS to other members of the engagement team, the partner continues to take overall responsibility for managing and achieving quality on the engagement through direction and supervision of those members and review of their work.
Paragraph 26. The engagement partner determines that the engagement team, and any external specialists and direct-assistance internal auditors, collectively have the appropriate competence and capabilities, including sufficient time, to perform the engagement. Paragraph 27 requires action, including communicating about additional or alternative resources, when the resources are insufficient or inappropriate.
Paragraph 29. The engagement partner takes responsibility for the direction and supervision of the members of the engagement team and the review of their work.
Paragraph 30. The partner determines that the nature, timing and extent of direction, supervision and review are (a) planned and performed in accordance with the firm's policies or procedures, professional standards, and applicable legal and regulatory requirements, and (b) responsive to the nature and circumstances of the engagement and the resources assigned or made available to the team.
Paragraph 31. The partner reviews audit documentation at appropriate points during the engagement, including documentation on significant matters and significant judgments, including difficult or contentious matters, and the conclusions reached.
Paragraph 32. On or before the date of the auditor's report, the partner determines, through review of documentation and discussion with the team, that sufficient appropriate audit evidence has been obtained to support the conclusions and the report.
Paragraph 33. Before dating the report, the partner reviews the financial statements and the auditor's report and the related documentation.
Paragraph 30(b) is the one that governs outsourcing. The depth of direction and review is set by the resources assigned. When the resource is an outside team, the partner calibrates direction and review to that team.
What the application material says about distant teams
The application paragraphs speak to the location of team members. The factors that drive the approach to direction, supervision and review include the structure of the engagement team and where its members are located. The text states that direction and supervision of individuals located at service delivery centers, and the review of their work, are more formalized and structured than when team members sit in one place, and use IT to facilitate communication. It also states that the manner in which reviews are expected to take place matters, and that remote reviews are in some circumstances not effective in providing the necessary direction and are supplemented by in-person interaction.
Paragraph A83 adds that direction, supervision and review are firm-level responses implemented at the engagement level, and that the approach varies from one engagement to the next.
What review consists of
A89 lists what review of the team's work considers:
- whether the work was performed in accordance with firm policies or procedures, professional standards and legal and regulatory requirements;
- whether significant matters were raised for further consideration;
- whether appropriate consultations took place;
- whether the nature, timing and extent of the work need revising;
- whether the work performed supports the conclusions and is appropriately documented;
- whether the evidence obtained is sufficient and appropriate for the opinion; and
- whether the objectives of the procedures were achieved.
Apply that list to outsourced schedules without modification. A schedule prepared outside the firm is reviewed against source, against the program step it supports, and against the conclusion drawn from it.
A review design for outsourced preparation
- Direct at the start. Issue written instructions per engagement: client background, risk areas, materiality, program steps, tick mark legend, deadlines, and a named firm contact for questions. A119 lists sign-off of the audit plan and project management activities as evidence of direction.
- Set reviewer levels in the plan. Name who reviews each schedule: senior, manager, partner. Tie the level to risk. High-risk areas and significant judgments go to the partner under paragraph 31.
- Review at intervals, not at the end. Paragraph 31 says appropriate points in time. Schedule interim review of the first delivered schedules so that errors in approach surface before the full set arrives.
- Test the output against source. Select items from each delivered schedule and agree them to the general ledger, bank statements or client records. Record what was tested.
- Clear review notes in the file. Notes, responses and cleared status stay with the schedule.
- Partner conclusion. Paragraph 32 requires the determination on or before the report date. Record it.
Documentation
Paragraph 41 requires audit documentation of significant issues on ethical requirements and independence, acceptance and continuance, consultations, and completion of any engagement quality review before report release. A119 states that sign-offs by the engagement partner and other team members evidence that working papers were reviewed, and that agendas, minutes and records of partner time evidence involvement. Document the review of outsourced work through the same mechanisms. Detail is in documenting outsourced workpaper review under AU-C 230.
The firm-level layer
SAS 146 sits on top of SQMS 1. Paragraph A82 notes that SQMS 1 requires the firm to establish a quality objective on direction, supervision and review. The firm's policy sets the baseline and the partner tailors it per engagement. The ethics prerequisites for using outside providers are in ET 1.150 and the third-party service provider rules. The firm-level system is covered in SQMS 1, and the independent check before release in engagement quality review.
Sources
- AICPA, Statement on Auditing Standards No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards (public PDF; paragraphs 10, 12, 15, 26, 27, 29 to 33, 41; A15, A17, A18, A83, A89, A119): https://a-us.storyblok.com/f/1015104/x/32853782b6/aicpa-sas-146.pdf
- Thomson Reuters Tax and Accounting, "SQMS 1 explained" (effective dates of SQMS 1 and SAS 146): https://tax.thomsonreuters.com/blog/sqms-1-explained-a-practical-guide-to-firm-level-quality-management/
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error