Peer review in India: what audit firms and the companies they audit need to know

What a peer review covers

The aim of peer review is to make sure that practice units follow the technical, professional and ethical standards that apply to audit and other assurance work. The reviewer looks at:

• Compliance with the Standards on Auditing and other engagement standards issued by ICAI
• The firm's system of quality control under SQC 1, including leadership, ethics, client acceptance, human resources, engagement performance and monitoring
• Independence and ethical requirements under the ICAI Code of Ethics
• Documentation of audit work, as required by SA 230
• Compliance with laws and regulations that apply to the engagements reviewed

The review is about how the firm works, not about re-auditing the client's accounts. But because the reviewer reads real audit files, weak documentation in a statutory audit, tax audit or other assurance engagement shows up quickly.

Which engagements the reviewer looks at

The reviewer selects a sample from the practice unit's assurance engagements during the review period. The sample can include:

• Statutory audits of companies, including CARO 2020 and internal financial controls reporting
• Tax audits under the Income-tax Act
• Internal audits where they are assurance engagements
• Bank branch audits, concurrent audits and stock audits for lenders
• Audits of trusts, societies and LLPs
• Certificates and other reports issued by the firm

Firms with a mix of these engagements should make sure each type meets its own standard. For example, a risk control matrix and testing documentation support IFC reporting in statutory audits, while bank audits are checked against the lender's instructions and RBI requirements.

Who must hold a peer review certificate

ICAI has made peer review mandatory in phases. A practice unit covered by a phase must hold a valid peer review certificate before accepting the statutory audits that phase covers.

Separately, SEBI's listing regulations require that the statutory auditor of a listed entity holds a valid peer review certificate. Banks, regulators and government bodies that appoint auditors often ask for one too.

SQC 1, SQM 1 and SQM 2

Quality control in Indian audit firms is governed by the Standard on Quality Control (SQC) 1. ICAI has issued two newer standards based on the international quality management standards: SQM 1, on quality management at firm level, and SQM 2, on engagement quality reviews. Their mandatory effective date has been deferred, and SQC 1 remains in force until ICAI announces otherwise.

How the peer review process works

1. Application: the practice unit applies to the Peer Review Board and submits its questionnaire, declarations and list of assurance engagements.
2. Appointment of reviewer: a reviewer from ICAI's panel is appointed for the practice unit.
3. Sample selection: the reviewer selects a sample of engagements to examine, along with the firm's quality control documents.
4. Review: the reviewer examines the firm's policies, files and records, on site or remotely, and discusses observations with the partners.
5. Report: the reviewer reports to the Peer Review Board, which may issue a certificate, ask for improvements or require a follow-up review.
6. Certificate: a satisfactory review results in a peer review certificate, generally valid for three years.

How we help practice units prepare

We support practice units in getting ready for their peer review. We do not carry out the review itself, which is done by the reviewer appointed under ICAI's process. Our readiness work includes:

• Gap assessment: comparing your quality control policies with SQC 1 and the Peer Review Guidelines
• Quality control manual: drafting or updating policies on independence, acceptance, consultation, engagement quality control review and monitoring
• File reviews: reviewing a sample of audit files against the Standards on Auditing, as a reviewer would
• Templates: engagement letters, independence declarations, planning memos, materiality workings and completion checklists
• Training: sessions for partners and staff on documentation and common review findings
• Remediation: fixing issues before the application is submitted

A practical 90-day readiness plan

1. Days 1 to 15: list all assurance engagements in the review period, collect existing policies and identify the partners and staff involved.
2. Days 16 to 40: compare policies with SQC 1, update the quality control manual and collect independence declarations for the period.
3. Days 41 to 70: review a sample of engagement files across statutory audits, tax audits and bank audits, and record the gaps.
4. Days 71 to 85: fix the gaps that can still be fixed, such as missing documentation of reviews already performed, and train the team on the rest.
5. Days 86 to 90: complete the application documents and keep a clear index of policies and files ready for the reviewer.

Gaps found in past files cannot be hidden, and documents must never be back-dated. The aim is to understand the gaps, explain them honestly and show that the firm's systems have improved.

Common peer review findings

• Engagement letters missing or not updated for the year
• Independence declarations not obtained from all staff on the engagement
• No documented materiality or risk assessment
• Audit procedures performed but not documented, or documented after the report date
• Management representation letters not dated close to the report date
• No evidence of engagement quality control review where required
• Working papers not archived within the required period after the report date

Getting audit documentation right

Most peer review comments come down to documentation. Under SA 230, the audit file must show what was done, the evidence obtained and the conclusions reached, in enough detail for an experienced auditor with no previous involvement to understand it.

1. Plan in writing: engagement letter, independence confirmations, risk assessment and materiality before fieldwork starts.
2. Link work to risks: each significant risk should lead to specific procedures and a documented conclusion.
3. Record review: show who prepared and who reviewed each working paper, and when.
4. Close properly: management representations, subsequent events and a completion checklist dated before the report.
5. Assemble on time: under SQC 1, the final engagement file should ordinarily be assembled within 60 days of the report date, and nothing should be deleted afterwards.

Firms that also carry out forensic engagements under FAIS should apply the same discipline to evidence and working papers.

What peer review means for companies and US parents

Peer review sits alongside two other layers of oversight in India: the Quality Review Board, which reviews the quality of audit services for certain companies, and the National Financial Reporting Authority (NFRA), which oversees audits of listed and other large companies.