An engagement letter has to establish the scope of the audit, management's responsibilities, the auditor's responsibilities, and the applicable financial reporting framework, along with the expected form of the report. It needs to be renewed or reissued whenever the terms actually change — a new reporting framework, a change in group structure, a different scope — and, for recurring audits, revisited each year rather than assumed to still apply. The most common gaps found on file inspection are letters that were never dated or signed back, and letters whose scope was never updated when something material about the engagement changed.
What the letter has to establish
An engagement letter is not a formality signed once and forgotten. It is the record that both parties agreed to the same thing before the audit started, and it is frequently the first document a reviewer — internal, peer, or regulatory — looks for when something about the engagement's scope is later disputed.
| Element | What it covers |
|---|---|
| Objective and scope of the audit | What is being audited, for which period, and under which reporting framework — Companies Act, applicable Accounting Standards or Ind AS, and any sector-specific requirements. |
| Management's responsibilities | Preparation of financial statements, maintenance of internal controls, providing access to records and personnel, and providing written representations. |
| Auditor's responsibilities | Forming and expressing an opinion in accordance with the Standards on Auditing, and the inherent limitations of an audit — that it provides reasonable, not absolute, assurance. |
| Identification of the applicable financial reporting framework | Stated explicitly rather than left implicit, since this determines what "fairly presented" means for the engagement. |
| Expected form and content of the report | Including a reference to circumstances where the actual report may differ from the expected form. |
| Other terms the firm wants on record | Fees, timelines, use of other auditors or experts, communication arrangements, and any restriction on the distribution of the report. |
Regulatory requirement
SA 210, Agreeing the Terms of Audit Engagements, sets out the preconditions for an audit and the content required in the engagement letter. Read the current text of the standard before relying on this summary, and check whether any additional terms are required by the specific regulatory framework the client falls under.
Preconditions before the letter is even sent
SA 210 requires the auditor to establish certain preconditions before agreeing the terms: that the financial reporting framework to be applied is acceptable, and that management acknowledges and understands its responsibility for the financial statements, for internal control, and for providing the auditor with access to whatever is needed. If either of these can't be established, the engagement letter is the wrong thing to be working on — the acceptance decision itself needs to be revisited first.
When a letter needs renewing or reissuing
For a recurring audit, the standard permits the auditor to decide not to send a new engagement letter every year, but that is a decision to be made deliberately each year, not a default that happens by not thinking about it. Several circumstances specifically call for a new or revised letter rather than carrying the old one forward.
- A change in the applicable financial reporting framework — for example, a company moving into Ind AS applicability.
- A change in the legal or regulatory requirements affecting the entity, such as a change in the class of company under the Companies Act.
- A significant change in the nature or size of the entity's business.
- A change in group structure, where the audit now needs to deal with component auditors or a different consolidation scope.
- Indications that management misunderstands the objective and scope of the audit, which the standard specifically flags as a reason to revisit the terms.
- A change in senior management or those charged with governance since the terms were last agreed.
- A change in ownership, particularly where the new owners have different expectations of the engagement.
Common practice, not a requirement
Many firms treat the engagement letter as renewed by habit for recurring clients, re-using last year's letter with only the date changed. Reviewing the preconditions and the list of trigger events every year, even briefly, and recording that the review happened, is a stronger position than silence on the point.
Gaps found on file inspection
A small number of defects account for most of what shows up when engagement letters are actually checked, rather than assumed to be in order.
| Defect | Why it matters |
|---|---|
| Undated, or dated after fieldwork had already started | An engagement letter signed after the audit began is weak evidence that terms were agreed before the engagement started, which is the point of having one. |
| Signed by the firm but never countersigned and returned by the client | An unreturned letter shows an offer of terms, not agreement to them. Management's acknowledgement is part of what the letter is meant to establish. |
| Scope not updated for a changed reporting framework | A letter still referring to the old framework after a move to Ind AS, or after a change in the class of company, no longer describes the engagement actually performed. |
| Group structure changed but the letter still describes a standalone audit | Silent where component auditors, consolidation, or group instructions should now be addressed. |
| Carried forward unchanged for several years with no record that renewal was even considered | Not itself a breach where the standard's conditions for a recurring engagement are met, but the absence of any record that this was considered is a documentation gap in its own right. |
| Fee or scope terms in the letter contradicted by a separate engagement proposal or email | Two documents describing different terms for the same engagement is worse than either defect alone, because it isn't clear which one governs. |
An engagement letter that doesn't match what was actually audited — wrong framework, wrong entity, stale scope — is a defect that tends to surface at the worst possible time: during a regulatory inspection or a dispute over what the firm was and wasn't engaged to do. Checking the letter against the current year's facts belongs in planning, not in a file review six months after signing.
Where it sits in the file
The signed engagement letter belongs in the permanent file section dealing with client acceptance and continuance, cross-referenced from the current year's planning memorandum. Where the letter has been reissued or amended during the year, both versions should be retained with dates, so the file shows which terms applied when.
How we think about this
Lekhya treats the engagement letter as a dated record tied to a specific year and a specific set of facts about the client — reporting framework, group structure, scope — rather than a static document sitting in a folder. When one of those facts changes year over year, the system flags that the letter has not been reviewed against the change; it does not decide on its own whether the change requires a new letter. That judgement, like the acceptance decision itself, stays with the engagement partner.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationSA 230: what actually has to be in the fileThe experienced-auditor test explained in plain terms, what documentation has to demonstrate, when the file has to be assembled, and the gaps that most often draw comment on review.
- Audit documentationAudit working papers: what they should containThe anatomy of a paper that stands on its own: objective, population, sample basis, procedure, results, exceptions, conclusion and sign-off, and what each must establish.
- Audit documentationAn audit documentation checklist for statutory auditsA checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
- Audit documentationManaging audit queries and client responsesLogging outstanding requests with an owner and due date, escalating when documents don't arrive, and closing a query with evidence rather than just a tick.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.