What group and component auditors must tell each other
What ISA 600 (Revised) expects the group auditor and component auditors to communicate in each direction, and how to record and follow it up.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A South African group has a subsidiary in Kenya audited by a local firm. The group auditor sends instructions in March, receives a signed clearance in July, and discovers in August, from the group's own finance team, that the Kenyan auditor found a significant control deficiency and a suspected fraud in the subsidiary's procurement. Nobody had told the group auditor.
Group audits fail at the joins. ISA 600 (Revised) treats communication between the group auditor and component auditors as a requirement running in both directions, not a courtesy. This article sets out what each side should send the other, and how to make sure it actually arrives.
Two-way communication is a requirement
The IAASB states that the new and revised requirements in ISA 600 (Revised) strengthen the auditor's responsibilities related to professional scepticism, planning and performing a group audit, two-way communications between the group auditor and component auditors, and documentation. ACCA explains that the standard specifies required areas of two-way communication, and its article on group audits lists them, which makes it a practical checklist for drafting instructions.
"Two-way" is the point. Instructions going out are only half of it. The group auditor also has to get the information it needs back, in time to use it.
From the group auditor: instructions, requested work and ethics
Before the component auditor starts, ACCA explains that the group engagement partner should consider confirmation of the component auditors' co-operation, their awareness of the relevant ethical requirements of the group audit engagement, and their competence and capabilities. Those considerations shape what the instructions must cover:
- the financial information on which work is requested, and the nature of that work;
- materiality for the component and the threshold for reporting misstatements;
- the ethical requirements that apply to the group audit, including independence;
- the matters the group auditor wants reported, and the format and deadline;
- known risks at the component, such as related-party transactions or fraud indicators the group team has already seen;
- how and when the group auditor will review the component auditor's documentation.
Ask the component auditor to confirm in writing that it will co-operate and that it understands the ethical requirements.
From the component auditor: misstatements, bias, deficiencies, fraud and conclusions
ACCA lists the required areas of communication including non-compliance with laws or regulations, corrected and uncorrected misstatements in the component financial information, indicators of possible management bias, internal control deficiencies, and fraud or suspected fraud involving component management. It also lists the financial information on which work was requested, whether the requested work was performed, compliance with ethical requirements, other significant matters, and the component auditor's overall findings or conclusions.
Turn that list into the component auditor's reporting template, so each item has its own heading. A heading left blank is visible; an omission buried in a narrative report is not. In the opening example, a template with a heading for "internal control deficiencies" and another for "fraud or suspected fraud involving component management" would have forced the question.
Instructions and reports through the component portal link
In Achekam, staff set up a group audit by recording each component with its scope, materiality and component auditors, and issue instructions from there. Each component auditor works through a portal link to acknowledge the instructions, upload deliverables and report misstatements. The link itself is the component auditor's credential, so send it only to the named engagement partner or manager at the component firm, and replace it if it reaches the wrong person.
Because acknowledgements, deliverables and reported misstatements come back through the portal rather than by e-mail, the group team is not left reconstructing them from an inbox. It does not replace the review of the work. ACCA explains that ISA 600 (Revised) includes enhanced documentation requirements, particularly where access to component auditor documentation is restricted, and emphasises the group auditor's review of component auditor documentation. Decide early which components' files the group team will review, and how, especially where access across borders is limited. Group audit scoping covers that decision.
Carrying component misstatements into the group summary by hand
There is a limit to be clear about. Component auditors can report misstatements through the portal, but Achekam's completion Summary of Uncorrected Misstatements stays empty, because no screen or route writes to the misstatement register it reads. The group team therefore keeps the group's summary on a working paper of its own, carrying each component's reported misstatements across by hand, with a reference to the component report, the component, and whether the item was corrected at component or group level.
Do this as each report arrives rather than at the end. Misstatements that are small for each component can add up across the group, and only the group schedule shows the total.
Following up silence
Silence is the most dangerous communication in a group audit. A component that reports nothing may have nothing to report, or may not have finished, or may not have understood what was asked. Treat it as an open question:
- Track every item the instructions asked for, by component, with its due date.
- Chase overdue items promptly and record each chase.
- Ask for an explicit "nothing to report" against each required heading, rather than accepting an empty section.
- Escalate to the component's engagement partner if deadlines slip, and consider what the group team must do itself if the information does not come.
- Record the final position for each component before the group opinion is signed.
Confirmations are a common area where components and the group team need to coordinate; see confirmations and component auditors. The principle is the same everywhere in a group audit: what was not communicated was not audited, as far as the group file is concerned.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
