Which quality control standard applies?
ICAI’s Standard on Quality Control (SQC) 1 applies to firms performing the audits, reviews, other assurance and related services covered by the standard. The system should provide reasonable assurance that the firm and personnel comply with professional standards and applicable legal and regulatory requirements, and that the reports issued are appropriate. Tailor the system to the firm and engagements. ICAI’s 31 March 2026 announcement deferred mandatory application of SQM 1 and SQM 2 and stated that SQC 1 would continue to apply until a further announcement. Use the standards and ethics provisions in force for each engagement; the current ethics edition and historical case dates are distinct.
The six elements and what to document
| Element | Required policy | Practical evidence |
|---|---|---|
| Leadership | Promote a culture of quality and assign ultimate responsibility to the firm’s chief executive or managing board of partners, or equivalent. | Record delegations, competence and authority of those operating the system. Resource quality work and keep commercial pressures from overriding it. |
| Ethics and independence | Identify and address independence threats, and obtain written confirmation at least annually from personnel required to be independent. | Maintain restricted entity lists, engagement-specific checks and a process for conflicts and breaches. Collect only the information needed. |
| Acceptance and continuance | Assess client integrity, competence, resources, time and ability to comply with ethical requirements. | Document significant issues, decisions, prior auditor communications where applicable and the steps for withdrawal. |
| Human resources | Assign personnel with the capabilities, competence and commitment to ethical principles needed for the work. | Maintain assignment, supervision, development and applicable CPE records. Any firm training target is separate from ICAI’s rules. |
| Engagement performance | Set policies for direction, supervision, review, consultation, differences of opinion and engagement quality control review where required. | Link review notes, evidence and conclusions to the final report and document how consultations were implemented. |
| Monitoring | Evaluate whether the quality control system works, including periodic inspection of selected completed engagements. | Use a cycle covering each engagement partner and document deficiencies, corrective action and follow-up. SQC 1 describes an inspection cycle ordinarily spanning no more than three years. |
Engagement quality control review (EQCR)
SQC 1 requires EQCR for all audits of financial statements of listed entities. The firm sets criteria for other audits, reviews and assurance or related services engagements and reviews those meeting the criteria. Consider the public interest and unusual risks; do not assume a universal debt threshold. Select a reviewer with sufficient technical competence, experience, authority and objectivity. A suitably qualified external person may be used when internal resources are inadequate. Follow SQC 1’s selection and objectivity safeguards; for example, the reviewer is ordinarily not selected by the engagement partner, where practicable. Keep the reviewer out of performing the engagement or making decisions for the team. Apply any separately applicable rotation, cooling-off and ethics provisions; SQC 1 itself does not impose a universal two-year EQCR cooling-off period.
The reviewer objectively evaluates significant judgements and conclusions, discusses material matters with the engagement partner, reviews selected documentation, and considers the financial statements and proposed report. Depending on the audit, focus on materiality, fraud risks, estimates, going concern, corrected and uncorrected misstatements, consultations, and key audit matters or CARO reporting where applicable. Record completion and the basis for it. Under SA 220 the auditor does not date the report before the required review is complete. Resolve differences of opinion using the firm’s documented policies and record and implement the conclusions before the report is issued. Escalation to an independent specialist may help; it does not replace the engagement partner’s responsibilities.
Assemble, retain and protect the file
SA 230 requires timely final assembly; the ordinary time limit in its application guidance is no more than 60 days after the auditor’s report date. Assembly is administrative: index the documentation, remove superseded drafts before final assembly where appropriate, and record evidence obtained, discussed and agreed before the report date. It cannot be used to create missing audit evidence after dating the report. If exceptional circumstances require new or additional procedures or conclusions after the report date, apply SA 230 paragraph 13 and document the circumstances, work, evidence, conclusions, effects and review. After assembly, do not delete documentation before retention expires. For necessary later modifications or additions, document the reasons and who made and reviewed them and when under paragraph 16.
For audits, the SQC 1 and SA 230 retention period is ordinarily at least seven years from the auditor’s report date or, if later, the group auditor’s report date. ICAI amended the earlier ten-year reference. The Companies Act’s separate requirement for a company’s books and vouchers does not set a blanket audit firm workpaper period. Apply any longer requirement or legal hold relevant to the engagement; a firm can also choose a longer internal policy. For statutory auditors of public interest entities within the circular’s scope, NFRA’s 16 December 2025 circular reinforces timely assembly and archival, ready access to the complete original file for submission, and preservation beyond the ordinary period where relevant legal or regulatory proceedings or requisitions continue. Consequences of misconduct depend on the facts, jurisdiction and applicable procedure under section 132 or other relevant law.
Use access controls, encrypted storage and backups, tested retrieval, and an audit trail showing each change. A baseline SHA-256 hash can detect byte changes if the baseline is separately protected. It does not establish when work was performed or that the file was complete. A practical archive protects the assembled baseline and permits properly documented later additions without silently overwriting it. WORM storage, a particular algorithm and a four-hour retrieval target can be useful controls, but are not blanket SQC 1 requirements.
Six worked cases
These are hypothetical examples. The controls are illustrative except where a requirement is cited.
1. Financial interest discovered on an audit team
A firm with six partners, 38 audit staff and 45 corporate audit clients, including one listed entity, discovers an audit senior owns 5,000 shares of the audit client worth ₹6.25 lakh, or ₹125 per share at the stated value. The annual declaration population would be 44 if all those partners and staff are required to be independent. Test the direct interest against the applicable ICAI Code of Ethics and separately check the statutory auditor disqualification provisions under section 141, which have their own scope. Escalate the breach, take the person off the engagement where appropriate, assess the impact and document corrective action and any required communications. The extent of re-performance depends on the evidence and cannot be set by a blanket rule.
2. A listed manufacturer’s revenue and goodwill review
For FY 2023–24, the company reports revenue of ₹385 crore, including ₹28.50 crore unbilled, and goodwill of ₹42 crore. The reviewer challenges ₹14 crore of custom-order revenue. Assume neither Ind AS 115 paragraph 35(a) nor (b) applies and there is no enforceable right to payment for performance to date under paragraph 35(c). Test when control passes under paragraph 38. Assuming it has not passed by year-end, reversing ₹14 crore leaves ₹371 crore of revenue and ₹14.50 crore of unbilled revenue. Before any related cost effects, pre-tax profit falls from ₹34 crore to ₹20 crore.
For the goodwill test, assume the cash-generating unit’s carrying amount is ₹100 crore including goodwill, fair value less costs of disposal is ₹88 crore, and the simplified value-in-use model assumes supported next-period pre-tax cash flows of ₹8.4075 crore growing at 4% at a 13.5% consistent pre-tax discount rate. The value-in-use calculation is ₹8.4075 crore ÷ (13.5% − 4%) = ₹88.50 crore; recoverable amount is the higher of the two measures. The resulting ₹11.50 crore impairment is allocated first to goodwill, leaving ₹30.50 crore goodwill and ₹8.50 crore pre-tax profit if there are no other adjustments. In a real engagement, test the forecast and long-term assumptions under Ind AS 36 rather than inferring impairment from an industry rate. Completion of EQCR on 28 July 2024 before the report date of 29 July satisfies the stated sequence.
3. Continuance after a regulatory inquiry
After four years with a construction client, a firm reviews an investigation involving ₹45 crore of alleged subcontracting transactions and 14 accounts. The ₹18 lakh annual audit fee is 4.5% of an assumed ₹4 crore annual firm billing base. An investigation and shared contact details are risk indicators, not proof of fraud. Reassess management integrity, access to evidence, specialist resources, independence and applicable reporting or non-compliance obligations, including section 143(12) where its test is met. If the auditor resigns, section 140(2) requires filing the prescribed statement with the company and Registrar within 30 days, and with the CAG where applicable. Confirm the current ADT-3 form and procedure.
4. File changes outside the ordinary assembly window
In a sample of 12 FY 2022–23 audit files, five have unexplained uploads or changes between days 110 and 140, or 50 to 80 days after the ordinary 60-day point. Preserve the original files and dates and determine whether the work was actually performed and reviewed before reporting. Investigate each entry under SA 230. A firm may set a day-45 reminder, 15 days before day 60, and lock the baseline once assembled. Later additions should be traceable under the documentation rules.
5. Deferred tax asset after recent losses
A company incurs an ₹18.50 crore loss in FY 2023–24 and has ₹42 crore unused business losses. At an assumed applicable rate of 25.17%, the theoretical full deferred tax asset is ₹10.5714 crore. Under Ind AS 12 paragraph 35, recent losses require sufficient taxable temporary differences or convincing other evidence of sufficient future taxable profit. A ₹30 crore contract at an 8% margin gives ₹2.40 crore of indicative total profit over three years. Assume that only that amount is convincingly supported, converts to eligible taxable profit within the loss utilisation period, and no other qualifying source exists. Supported DTA is ₹0.60408 crore, rounded to ₹0.60 crore; the reduction is ₹9.96732 crore, rounded to ₹9.97 crore. If contract termination rights undermine that evidence, a lower or nil amount may be appropriate. Document the consultation, revised accounting and implications for the opinion.
6. Design an optional ten-year archive
A firm with 250 annual corporate audit files spends ₹4.80 lakh per year on its current physical archive. It chooses ten years under its internal policy, subject to longer holds: two years in readily accessible storage and eight years, years 3–10 inclusive, in a protected archive. It tests retrieval of ten sampled files annually, including seven-year-old files, and checks completeness, integrity and readability. Use actual quotes and storage data to compare cost and choose backup locations. An optional longer policy is not a legal retention requirement for every engagement.
Practical workpaper structure
Maintain firm leadership and quality records, independence checks, acceptance and continuance decisions, personnel and training files, engagement review and consultation records, assembly and retention registers, and monitoring and remediation records. For electronic evidence, document retention, rights, access, retrieval and any legal hold.
Frequently asked questions
Does SQC 1 apply to a sole practitioner auditing private companies?
Yes for engagements in scope. A smaller firm can scale its policies and procedures while meeting the requirements.
Can a small firm use an external reviewer?
Yes. Use a suitably qualified and objective person and document competence, independence, confidentiality and authority.
What is the ordinary assembly date for a 15 July report?
Sixty calendar days after 15 July is 13 September. Follow the engagement’s applicable requirements; a particular system lock time is a firm control.
Is ten years the standard retention requirement?
No. The ICAI audit documentation period is ordinarily at least seven years, with the later group auditor date used where applicable. Check other requirements and holds.
Can the report be issued before EQCR is complete or a difference resolved?
No. Complete any required review before dating the report and resolve and document differences before release.
What evidence shows the electronic file stayed intact?
Combine a protected baseline, access and version records, evidence of retrieval, and documented subsequent additions. A checksum helps verify byte integrity but does not replace substantive audit evidence.
Sources
- ICAI: SQC 1, including the retention amendment
- ICAI: 31 March 2026 deferment of SQM 1 and SQM 2
- ICAI: SA 220, Quality Control for an Audit of Financial Statements
- ICAI: SA 230, Audit Documentation
- ICAI: amendment of the audit documentation retention period to seven years
- ICAI: Code of Ethics, 13th edition and effective dates
- NFRA: Circular on Maintenance, Archival and Submission of Audit File, 16 December 2025
- India Code: Companies Act, 2013, sections 128, 132, 140, 141 and 143
- MCA: Ind AS 115, paragraphs 35–38 and supporting application guidance
- MCA: Ind AS 36, recoverable amount and impairment of goodwill
- MCA: Ind AS 12, unused losses and deferred tax measurement