An ICAI peer review examines whether a firm's systems and procedures for audit and attest work comply with technical, professional and ethical standards — covering independence, engagement acceptance, documentation, and compliance with applicable Standards on Auditing — and it does this by selecting a sample of the firm's actual attest engagements and checking whether the firm's stated processes were, in fact, followed on those files, not by re-performing the underlying audit itself.
What the reviewer actually looks at
| Area | What's checked |
|---|---|
| Firm-level quality control (SQC 1) | Whether policies exist across the six elements — leadership, ethics, acceptance, HR, engagement performance, monitoring — and whether they're actually operating, not just documented |
| Engagement acceptance and continuance | Whether the firm has a documented basis for taking on and continuing each client relationship |
| Independence | Declarations obtained from partners and staff, and whether any threats identified were addressed with documented safeguards |
| Engagement files — sample basis | Audit planning, risk assessment, evidence gathered, review sign-offs, and whether the opinion given is supported by the file as it stands |
| Compliance with Standards on Auditing | Specific SAs tested against the sample files, particularly SA 230 documentation, SA 315/330 risk and response, and SA 700 series reporting |
How firms are selected and classified
- Firms are categorised (I to IV, broadly by the nature and scale of the practice, including whether the firm audits listed entities, banks, or other specified entities) and the review cycle and depth vary by category
- The reviewer is appointed by the Peer Review Board from a panel, and is independent of the firm being reviewed
- At the end of the review, the firm receives a report with observations, and in some cases a rating that can affect eligibility for larger assignments
What to have ready before the reviewer arrives
- 01A current, written SQC 1 manualNot a template downloaded once and never updated — reviewers check whether policy dates and practice actually match.
- 02Independence declarations for the review periodSigned and dated, for every partner and relevant staff member, for every client in scope.
- 03A complete set of working papers for the sample engagementsIncluding evidence of partner review and sign-off dates relative to the report date — a gap between fieldwork completion and report date with no documented review in between is a common finding.
- 04Engagement letters and acceptance documentation for each sampled clientMatching SA 210's requirements, on file and dated appropriately.
Common practice, not a requirement
Firms that treat peer review preparation as an annual housekeeping exercise — tidying files, backdating nothing, closing documentation gaps as they arise during the year — tend to get through reviews with fewer findings than firms that try to reconstruct a year's documentation in the weeks before the reviewer is due.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationSQC 1: what the firm-level quality control standard actually requires a CA firm to buildSA 220 tells a partner what to do on one file. SQC 1 is what the firm has to have in place before that partner can do it consistently across every file.
- Audit documentationReviewing and signing off audit working papersWhat a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
- Audit documentationAn audit documentation checklist for statutory auditsA checklist organised by when the work happens: planning, fieldwork, each paper, completion and assembly, with the deadlines that govern the last two.
- Internal audit & IFCInternal audit checklist for CA firms taking on the mandateHow to scope a new internal audit mandate: the risk-based plan, coverage across the year rather than one visit, typical areas covered, and the reporting rhythm an audit committee expects.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.