AU-C section 210, Terms of Engagement, covers what the auditor must establish before starting an audit of a nonissuer, and how the agreed terms are recorded. It came out of SAS No. 122. It has since been amended, notably by SAS No. 147 (predecessor inquiries on initial engagements) and by SAS No. 146 (conforming changes).
This page paraphrases the standard; the authoritative text is AU-C 210 in AICPA Professional Standards. For a working template, see the audit engagement letter template and the engagement letter guide.
What is the objective of AU-C 210?
The auditor's objective is to accept or continue an audit engagement only when the basis on which it is to be performed has been agreed, by establishing whether the preconditions for an audit are present and by confirming that the auditor and management (and, where appropriate, those charged with governance) have a common understanding of the terms.
What are the preconditions for an audit?
Before accepting, the auditor determines whether the financial reporting framework to be applied is acceptable. The auditor also obtains management's agreement that it acknowledges and understands its responsibility for:
- preparing and fairly presenting the financial statements in accordance with the framework, including relevant disclosures
- the internal control management determines is necessary to enable statements that are free from material misstatement, whether due to fraud or error
- giving the auditor access to all information relevant to the statements (such as records and documentation), additional information the auditor may request, and unrestricted access to people within the entity from whom the auditor determines it necessary to obtain evidence
If a precondition is not present, the auditor discusses it with management. Unless law or regulation requires it, the auditor should not accept the engagement as an audit. If the law does require acceptance, the engagement is not an audit in accordance with GAAS, and the report must not say that it was.
When the framework is not acceptable
For general purpose statements, the auditor looks at whether the framework is acceptable, such as US GAAP, and the factors in the standard (the nature of the entity, the purpose of the statements, their nature, and whether law or regulation prescribes the framework). For special purpose frameworks such as cash or tax basis, the auditor considers whether the framework has the attributes of an acceptable framework, including relevance, completeness, reliability, neutrality and understandability.
If management or those charged with governance impose a limitation on the scope of the audit in the terms of a proposed engagement that the auditor believes will result in a disclaimer of opinion, the auditor should not accept the engagement as an audit unless required by law or regulation.
Initial engagements and predecessor inquiries
When the firm is the successor auditor on an initial audit, the auditor asks management for permission to communicate with the predecessor, and evaluates the implications if management refuses or limits the predecessor's response.
SAS No. 147 added a specific requirement: once management permits it, the successor auditor must ask the predecessor about identified or suspected fraud and about identified or suspected noncompliance with laws and regulations. The answer, or a statement that the predecessor's response is limited, feeds the decision on whether to accept the engagement. SAS No. 147 applies to audits of financial statements for periods beginning on or after June 30, 2023.
In practice, record the inquiry, the response and what the team did with it. A short "no concerns" reply is an acceptable response. A file with no record of the inquiry is not.
Agreeing the terms: the engagement letter
The auditor agrees the terms with management or those charged with governance, as appropriate, and records them in an audit engagement letter or other suitable written form. The standard requires the agreed terms to include:
| Element | What it covers |
|---|---|
| Objective and scope | The objective and scope of the audit of the financial statements |
| Auditor's responsibilities | What the auditor is responsible for under GAAS, and that, because of the inherent limitations of an audit and of internal control, an unavoidable risk exists that some material misstatements may not be detected |
| Management's responsibilities | The management responsibilities listed under the preconditions above |
| Framework | Identification of the applicable financial reporting framework |
| Expected reports | Reference to the form and content of the reports the auditor expects to issue, and a statement that circumstances may arise in which a report differs from what was expected |
Beyond the required elements, many firms add practice items: fee and billing terms, the client's deadline for PBC items, the timing of the draft, how nonattest services are handled and how safeguards over independence are applied, use of electronic confirmation platforms, how documents will be retained, and how disputes are resolved. These are common practice. They are not requirements of AU-C 210.
If law or regulation prescribes the terms, or an engagement letter is not used, the standard allows other written forms. In those cases the auditor still records the required elements.
Recurring audits
On a recurring audit, the auditor assesses whether circumstances require the terms to be revised and whether the entity needs a reminder of the existing terms. The auditor is not required to issue a new letter each year. A firm may decide to, and many do.
Common triggers for a new or revised letter, as a matter of practice:
- a change in the framework, such as a move from tax basis to US GAAP
- new nonattest services or a change in who prepares the statements
- a change in management or governance
- a new group structure or reporting requirement such as a lender covenant or regulator filing
- a new standard that changes the auditor's responsibilities or reporting
Changes in terms during the engagement
If a client asks the auditor to change the engagement to one that offers a lower level of assurance (for example, from an audit to a review or compilation), the auditor must have reasonable justification for agreeing. A change is generally acceptable when there is a change in circumstances that affects the client's need for the service, or a misunderstanding about the nature of the audit. It is not generally acceptable when the request comes because the auditor cannot get evidence or because management restricted the scope.
Points to weigh:
- the legal and contractual implications of the change
- whether the audit work already done is relevant to the new engagement, and the extra work needed
- that if the auditor agrees, the report issued must not refer to the original audit or to any procedures performed in the original audit, except as the standard allows
If the auditor does not agree to the change and management does not allow the audit to continue, the auditor withdraws where law permits, and considers whether there is a professional or legal obligation to report the circumstances to those charged with governance, owners or regulators. The matters would also be communicated under AU-C 260.
SAS 146 conforming change
SAS No. 146 amended the application material in AU-C 210 (paragraph .A1) to point to SQMS No. 1 for the firm's responsibilities on acceptance and continuance, and to AU-C 220 for the auditor's responsibilities on ethics and independence during acceptance. AU-C 210 deals with the matters within the control of the entity that the auditor and management must agree. The amendment applies to audits of periods beginning on or after December 15, 2025. See AU-C 220.
File checks on terms of engagement
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Engagement letters that cite a framework different from the one used in the statements
- Letters that are unsigned or signed after fieldwork has started
- Letters that do not describe management's responsibility for internal control or for access to information
- Nonattest services performed but not described anywhere in the letter or independence documentation
- Initial audits with no documented predecessor communication
- Changes in scope or timing agreed by email with no updated letter
Related
- Audit engagement letter template
- Audit engagement letter guide
- AU-C 300 planning
- AU-C 200 overall objectives
Sources
- AICPA, AU-C Section 210, Terms of Engagement (AICPA Professional Standards)
- AICPA, SAS No. 147, Inquiries of the Predecessor Auditor Regarding Fraud and Noncompliance With Laws and Regulations (amends AU-C 210; periods beginning on or after June 30, 2023)
- AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With GAAS (conforming amendment to AU-C 210 application material; periods beginning on or after December 15, 2025)
- AICPA, SQMS No. 1, A Firm's System of Quality Management
- Journal of Accountancy, "PEEC, ASB issue new requirements for CPAs regarding NOCLAR" (June 2022)
Part of CORAA University · Engagement and acceptance: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error