SAS No. 149, Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors), was issued by the AICPA Auditing Standards Board in March 2023. It supersedes the extant AU-C section 600 and applies to audits of group financial statements for periods ending on or after December 15, 2026. For a calendar-year group, the December 31, 2026 audit is the first one covered.
This page is the implementation view. The requirements themselves are laid out in the AU-C 600 standards page and the group audits guide. Read AU-C 600 in AICPA Professional Standards for the full text.
Who has to act?
Any firm that audits financial statements that include more than one entity or business unit through a consolidation process. That includes a parent with subsidiaries, a holding company with equity-method investees (investees are components, as they were under the old section), and a nonprofit with affiliated entities consolidated into one set of statements. The standard applies regardless of the group's size or complexity. A small group with one subsidiary audited by the same firm is still a group audit and still needs the risk-based scoping documented.
What are the changes to plan for?
The Journal of Accountancy's summary of the standard, written by AICPA staff and practitioners, and the AICPA's implementation series point to the same set of changes.
| Change | What it means in the file |
|---|---|
| Risk-based scoping replaces "significant component" thresholds | The group team chooses components for procedures based on the risks of material misstatement it has assessed, including centralized service components such as a shared service center. A percentage-of-revenue screen can inform the choice but no longer decides it |
| Component auditors are part of the engagement team | The definition of engagement team was revised, so direction, supervision and review under SAS 146 cover the component auditor's work |
| Aggregation risk | Aggregation risk is the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality. Component performance materiality is set lower than group performance materiality to respond to it |
| Referred-to auditors | A referred-to auditor is an auditor who audits the financial statements of a component and is not part of the engagement team. Making reference to that auditor's report is still available. Under the old section the term component auditor covered both referred-to and involved auditors |
| Two-way communication | Communication with component auditors is more extensive and continues through the audit, including events or conditions that may raise substantial doubt about the group's ability to continue as a going concern |
| Consolidation process | The group team understands the consolidation process and group-level systems and controls, including how commonly the controls are applied across components |
The option the old section called assuming responsibility for the work of a component auditor is now framed as involvement in the work of component auditors.
A transition checklist
Practice observations built from the changes above, not a list the standard prescribes:
- Inventory the group audits. List every engagement with a consolidation or equity-method investee that will have a period ending on or after December 15, 2026, and who audits each component.
- Decide on making reference early. If a component has its own audit by another firm and you plan to refer to that report, the referred-to path has its own requirements. Decide it at planning, not at the end.
- Rewrite the scoping template. Replace significance screens with a documented link from assessed risks of material misstatement at group and component level to the components selected and the work planned. The audit planning memo template and risk assessment worksheet are places to anchor it.
- Reset materiality. Set group performance materiality and a lower component performance materiality, and record the aggregation risk reasoning. See materiality in auditing.
- Update component instructions. Add the risks of material misstatement the component team needs for its own risk assessment, the communications you require, and any going concern conditions the group team has identified.
- Plan involvement and review. State how the group engagement partner will direct, supervise and review each component auditor, scaled to the aggregation risk, and what happens if the component work is inadequate (additional procedures by the component team or the group team).
- Walk the consolidation. Document the consolidation process, intercompany eliminations and top-side entries, and test them as part of the risk response. The intercompany elimination worksheet helps with the mechanics.
- Update the engagement letter and representation letter for the group structure.
A worked illustration
Illustrative numbers only. A group has group performance materiality of $200,000 and five components. Four components each hold 18% of group revenue and one holds 28%. A revenue-share screen of 15% would select all five. Risk-based scoping asks a different question: which components carry assessed risks that need work? Suppose the group team judges that a shared service center posts the payroll for all five and carries a significant risk of management override in manual journal entries. The service center becomes a scoped component for those risks even though it holds no revenue, and two of the smaller operating components may need only analytical procedures at group level. The file shows the risk, the component, the work, and the lower component performance materiality set for it, for example $120,000, to respond to aggregation risk.
Frequently asked questions
When must a firm start using SAS 149?
SAS 149 applies to audits of group financial statements for periods ending on or after December 15, 2026. A December 31, 2026 group audit is the first calendar-year audit covered.
Does SAS 149 apply to a group with only two entities?
Yes. The standard applies to all audits of group financial statements, regardless of size. What scales is the work, not the applicability.
Is a component auditor still treated as a separate auditor?
For auditors who participate in the engagement, no. Component auditors are part of the engagement team. An auditor who audits a component and whose report is referred to is a referred-to auditor, who is not part of the engagement team.
Does SAS 149 change the audit report?
The standard keeps the option of making reference to a referred-to auditor's report. The wording of any reference follows the reporting standards. See AU-C 700.
Sources
- AICPA Auditing Standards Board, SAS No. 149 (March 2023)
- Journal of Accountancy, "SAS 149 is coming: What audit teams need to know" (August 2026); Journal of Accountancy, "New standard provides risk-based approach for group audits" (March 2023)
- AICPA, "Implementing the new group audit standard" series, including the effective date and the risk-based approach: aicpa-cima.com
Related
Part of CORAA University · SEC reporting and PCAOB audits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error