Standards on Auditing (SAs)

In short

Standards on Auditing (SAs) are the ICAI's authoritative pronouncements that tell an auditor what must be done in an audit of financial statements and how it must be documented and reported. They are not advisory: section 143(9) of the Companies Act, 2013 makes compliance a statutory duty, section 143(10) gives them legal force, and departure without disclosure is professional misconduct under the Second Schedule of the Chartered Accountants Act, 1949. The SAs are India's convergence with the IAASB's International Standards on Auditing, with a few deliberate carve-outs (joint audit, division of responsibility, documentation retention). This topic is examined directly in CA Intermediate and Final Auditing papers — commonly as "state the requirements of SA xxx" or a case asking which SA applies — and is the first thing tested in audit-firm interviews at the Big Four, the next-tier firms (Grant Thornton Bharat, BDO India, Nangia) and in NFRA/peer-review inspections.

Explained

The framework: who issues what, and with what authority

• Auditing and Assurance Standards Board (AASB) of ICAI drafts the standards; the Council of ICAI issues them. The National Financial Reporting Authority (NFRA), constituted under section 132 of the Companies Act, 2013, recommends auditing standards to the Central Government for notification.
• Section 143(9): "Every auditor shall comply with the auditing standards." Section 143(10): the Central Government may prescribe the standards of auditing (including Standards on Quality Control) as recommended by ICAI in consultation with and after examination of NFRA's recommendations; until so notified, the standards specified by ICAI are deemed to be the auditing standards. No SA has been separately notified by the Government so far, so the ICAI-issued SAs are the statutory standards.
• The pronouncements sit in a hierarchy of falling authority:
  1. Standards on Quality Control (SQC) / Standards on Quality Management (SQM) — firm-level, apply to all services under the Engagement Standards.
  2. Engagement Standards — SAs (audits), SREs (reviews), SAEs (other assurance), SRSs (related services).
  3. Statements (mandatory, largely superseded), then General Clarifications, then Guidance Notes, Technical Guides and Industry Audit Guides — recommendatory, not mandatory, though a court or disciplinary bench will ask why a Guidance Note was ignored.
• Standards on Internal Audit (SIAs) are a separate ICAI series and are recommendatory; they are not SAs.
• Scope of the SAs: audit of *historical financial information*. They apply to every audit — company, firm, LLP, trust, society, co-operative — not only to company audits, and apply irrespective of the entity's size, with the "scalability" discussion inside each standard.

The four families of Engagement Standards (know the numbering logic)

• Key non-SA members: SRE 2400 (Revised) Review of Historical Financial Statements; SRE 2410 Review of Interim Financial Information Performed by the Independent Auditor of the Entity (used for every listed company's quarterly limited review under SEBI LODR Regulation 33); SAE 3400 Examination of Prospective Financial Information; SAE 3402 Assurance Reports on Controls at a Service Organisation; SAE 3420 pro forma financial information in a prospectus; SRS 4400 Agreed-Upon Procedures; SRS 4410 (Revised) Compilation Engagements.
• SQC 1 — Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements. Its six elements: leadership responsibilities, ethical requirements, acceptance and continuance of client relationships, human resources, engagement performance (including consultation, EQCR, differences of opinion), and monitoring.
• ICAI has issued SQM 1 (quality management for the firm) and SQM 2 (engagement quality reviews) along with a revised SA 220, moving the firm from a *compliance* model to a risk-based quality-management model with a mandatory annual evaluation of the system by the firm's leadership. ICAI deferred the original applicability date once; the effective date is accounting periods beginning on or after 1 April 2026, so the new system is in force for the year 2026-27.

Anatomy of an SA, and the objective-based approach

Every SA after the clarity-project redrafting has the same five parts:

1. Introduction — scope, subject matter, effective date.
2. Objective — what the auditor must achieve. SA 200 requires the auditor to use the stated objectives to judge whether further procedures are needed and whether sufficient appropriate evidence has been obtained.
3. Definitions — terms used in that standard.
4. Requirements — expressed with "shall". These are mandatory.
5. Application and Other Explanatory Material (paragraphs prefixed "A"), plus Appendices — these explain and illustrate the requirements; they are not optional background, because a requirement must be read together with them.
6. Conditional requirements apply only when the condition exists (for example SA 701 applies only where KAM communication is required or voluntarily undertaken).
7. Departure: in an exceptional circumstance the auditor may judge it necessary to depart from a *relevant* requirement, and must then perform alternative procedures and document how they met the objective. An SA is not relevant if the circumstance it addresses does not exist (no inventory → SA 501's inventory requirements are irrelevant; that is not a departure).
8. Compliance claim: the auditor may state compliance with SAs only if all SAs relevant to the audit have been complied with (SA 200).

Map of the SA series — what each number is for

• 200-299, Overall responsibilities. SA 200 overall objectives and conduct of an audit (reasonable assurance, inherent limitations, professional scepticism, professional judgement, audit risk, ethics, engagement-level quality control); SA 210 agreeing the terms of engagement (preconditions for an audit, engagement letter, recurring audits, change in terms); SA 220 quality control/quality management for the engagement; SA 230 audit documentation; SA 240 auditor's responsibilities relating to fraud; SA 250 consideration of laws and regulations; SA 260 (Revised) communication with those charged with governance; SA 265 communicating deficiencies in internal control; SA 299 (Revised) Joint Audit of Financial Statements — an India-specific standard with no ISA equivalent: joint auditors divide work by documented division, each is responsible for their own area, and all are jointly and severally responsible for work not divided, for decisions taken jointly, and for compliance with the SAs and with reporting requirements.
• 300-499, Risk assessment and response. SA 300 planning; SA 315 (Revised, effective for periods beginning on or after 1 April 2023) identifying and assessing the risks of material misstatement; SA 320 materiality; SA 330 the auditor's responses to assessed risks; SA 402 audit considerations relating to an entity using a service organisation; SA 450 evaluation of misstatements identified during the audit. (Planning, materiality, risk and sampling mechanics are developed in their own note.)
• 500-599, Audit evidence. SA 500 audit evidence (sufficiency = quantity, appropriateness = relevance + reliability; the reliability hierarchy favours external, independent, original, documentary evidence); SA 501 specific considerations for selected items (inventory attendance, litigation and claims, segment information); SA 505 external confirmations (positive and negative confirmations, management refusal, non-response, unreliable replies); SA 510 initial audit engagements — opening balances; SA 520 analytical procedures; SA 530 audit sampling; SA 540 (Revised) auditing accounting estimates and related disclosures; SA 550 related parties; SA 560 subsequent events; SA 570 (Revised) going concern; SA 580 written representations.
• 600-699, Using the work of others. SA 600 Using the Work of Another Auditor — the principal auditor's procedures over component/branch auditors, and the Indian position that the principal auditor is not responsible for the work of the other auditor whose report they rely on, with division of responsibility disclosed. A revision aligning India with ISA 600 (Revised) — which abolishes that division and makes the group auditor responsible for the whole group audit — has been contested between ICAI and NFRA; treat the existing SA 600 as current and check the latest ICAI/NFRA position before asserting otherwise. SA 610 (Revised) using the work of internal auditors (evaluating the function's objectivity, competence and systematic approach; ICAI has not adopted the ISA 610 provisions on direct assistance, so internal auditors may not be used to provide direct assistance in India); SA 620 using the work of an auditor's expert.
• 700-799, Conclusions and reporting. SA 700 (Revised) forming an opinion and reporting on financial statements; SA 701 communicating key audit matters (mandatory for audits of listed entities' complete sets of general purpose financial statements, otherwise voluntary or when law requires); SA 705 (Revised) modifications to the opinion; SA 706 (Revised) emphasis of matter and other matter paragraphs; SA 710 comparative information; SA 720 the auditor's responsibilities relating to other information (such as the Board's Report that accompanies the financial statements). The 700-series revisions are effective for audits of financial statements for periods beginning on or after 1 April 2018. (The report format and CARO 2020 are covered in their own note.)
• 800-899, Specialised areas. SA 800 audits of financial statements prepared in accordance with special purpose frameworks; SA 805 audits of single financial statements and of specific elements, accounts or items; SA 810 engagements to report on summary financial statements.

Enforcement: what happens when an SA is not followed

• Companies Act, 2013 s.147(2): an auditor who contravenes section 139, 143, 144 or 145 is punishable with a fine of not less than ₹25,000 and up to ₹5,00,000, or four times the auditor's remuneration, whichever is less; if done knowingly or wilfully with intent to deceive, imprisonment up to one year and a fine of ₹50,000 to ₹25,00,000, or eight times the remuneration, whichever is less, plus refund of remuneration and damages under s.147(3).
• Chartered Accountants Act, 1949, Second Schedule, Part I: clause 5 (failure to disclose a material fact known to them in a financial statement), clause 6 (failure to report a material misstatement known to them), clause 7 (gross negligence / failure to exercise due diligence), clause 8 (failure to obtain sufficient information to express an opinion) and clause 9 (failure to invite attention to a material departure from the generally accepted procedure of audit) are the standard charges for SA non-compliance.
• NFRA (s.132(4), with NFRA Rules, 2018) monitors and enforces compliance for listed companies and the prescribed class of large unlisted companies, conducts audit quality reviews and financial reporting quality reviews, and may impose a penalty of not less than ₹1 lakh up to 5 times the fees received on an individual, and not less than ₹10 lakh up to 10 times the fees on a firm, and debar from 6 months to 10 years.
• ICAI's Peer Review Board reviews audit documentation against the SAs; a peer review certificate is a pre-condition for auditing listed entities under SEBI/ICAI mandates.
• The practical rule the inspectors apply: "not documented" is treated as "not done" (SA 230).

Convergence with ISAs, and the limitations of the SAs

• The SAs are converged with the ISAs; the carve-outs and additions are the examinable difference: SQC 1 requires documentation retention of not less than 7 years (ISA/ISQC: 5 years); SA 299 on joint audit has no ISA equivalent; SA 600 retains division of responsibility; the SA 700 report carries a separate "Report on Other Legal and Regulatory Requirements" section for the Companies Act matters; some ISA references to law are adapted to Indian statute.
• Limitations of the framework: the SAs cannot eliminate the inherent limitations of an audit (sampling, collusive fraud, management override, judgemental estimates); they prescribe process, not a guarantee of detection; compliance is expensive for small practitioners (hence the global move towards a separate standard for less complex entities — ICAI has worked on an LCE standard; confirm its status before relying on it); and India's standard-setting is now shared between ICAI and NFRA, which has produced public disagreement on SA 600.

Key points

• SA - mandatory ICAI standard for audits of historical financial information; statutory force via Companies Act s.143(9) and (10).
• s.143(10) deeming clause - until the Central Government notifies standards, ICAI's standards *are* the auditing standards.
• NFRA s.132 - recommends standards, and enforces them on listed and prescribed large companies.
• Hierarchy - SQC/SQM > Engagement Standards > Statements > Guidance Notes (recommendatory).
• Four families - SA (reasonable assurance), SRE 2000s (limited), SAE 3000s (other assurance), SRS 4000s (no assurance).
• "Shall" = requirement; application material ("A" paragraphs) is part of the standard, not commentary.
• Objective-based approach - SA 200: achieve each standard's objective; document alternative procedures if a relevant requirement is departed from.
• Relevance vs departure - a standard that addresses a circumstance that does not exist is simply not relevant.
• SA 200 - reasonable, not absolute, assurance; professional scepticism and professional judgement run through every SA.
• SA 230 - assemble the final audit file within 60 days of the auditor's report date; retain for at least 7 years (SQC 1).
• SA 240 - primary responsibility for fraud prevention and detection is with management and TCWG; the auditor is responsible for reasonable assurance that the financial statements are free of material misstatement, whether from fraud or error.
• SA 299 (Revised) - joint auditors: separate responsibility for divided work, joint and several responsibility for undivided work, joint decisions and SA compliance.
• SA 600 - Indian position permits division of responsibility; the principal auditor relies on the other auditor's report and discloses it.
• SA 701 - key audit matters are mandatory only for listed entities; a going-concern material uncertainty goes in its own SA 570 section, not as a KAM.
• SA 705 - material but not pervasive → qualified; material and pervasive → adverse (misstatement) or disclaimer (inability to obtain evidence).
• SQM 1 / SQM 2 / SA 220 (Revised) - risk-based quality management at firm level, effective for periods beginning on or after 1 April 2026 after one deferment, i.e. in force from FY 2026-27.
• Enforcement - s.147 fines/imprisonment, Second Schedule Part I clauses 5-9, NFRA penalties and debarment, ICAI peer review.
• Carve-outs from ISAs - 7-year retention, SA 299, SA 600 division of responsibility, Other Legal and Regulatory Requirements section.

Examples

Example 1 — Documentation timeline under SA 230 and SQC 1. A statutory audit report for FY 2025-26 is signed on 25 July 2026.

• Final file assembly: 60 days from the report date → 6 days left in July + 31 in August + 23 in September = 60 → the file must be assembled by 23 September 2026.
• Retention: not less than 7 years from the report date → until 25 July 2033. (The company's own books must be kept 8 years under Companies Act s.128(5) — a different clock.)
• If an engagement partner adds a working paper on 10 October 2026, SA 230 requires documentation of who changed it, when, why, and who reviewed it; the original file is not overwritten.

Example 2 — Choosing the opinion under SA 705. A company has total assets ₹60.00 crore and profit before tax ₹3.10 crore. The auditor cannot obtain evidence over inventory of ₹4.20 crore lying with a third party that refuses confirmation and access.

• Effect: 4.20/60.00 = 7.0% of total assets; 4.20/3.10 = 1.35 times PBT.
• The limitation is material, but it is confined to one line item and does not affect the majority of the financial statements → not pervasive → qualified opinion, worded "except for the possible effects of the matter described in the Basis for Qualified Opinion paragraph".
• Had the unverifiable amount been, say, ₹38 crore (63% of assets) covering inventory, receivables and revenue, the possible effects would be pervasive → disclaimer of opinion, and SA 705 then prohibits a Key Audit Matters section other than as required.

Example 3 — Division of responsibility under SA 600. A listed company's standalone financial statements show total revenue ₹500 crore, of which three branches audited by other firms contribute revenue ₹180 crore and total assets ₹210 crore of ₹700 crore.

• Shares: 180/500 = 36% of revenue, 210/700 = 30% of assets.
• The principal auditor performs the SA 600 procedures (discusses the audit approach, reviews the other auditors' reports and, where needed, their working papers, evaluates the materiality of the components) and includes an Other Matter paragraph under SA 706 quantifying the branches' revenue and assets and stating that the opinion on those branches is based solely on the other auditors' reports.
• The principal auditor is not responsible for the other auditors' work under the present SA 600 — but is responsible for the sufficiency of their own reliance procedures, and must still respond if the component report discloses a matter affecting the whole.

Example 4 — Evaluating uncorrected misstatements (SA 450 → SA 705). Overall materiality ₹50.00 lakh. Uncorrected misstatements: understated gratuity provision ₹22.00 lakh, unrecorded supplier invoices ₹7.50 lakh, revenue recognised one week early ₹2.80 lakh; reversal of the prior-year uncorrected item ₹12.00 lakh.

• Aggregate = 22.00 + 7.50 + 2.80 + 12.00 = ₹44.30 lakh, i.e. 88.6% of materiality — below materiality in amount.
• SA 450 nonetheless requires evaluation of qualitative factors: here the ₹2.80 lakh cut-off error turns a loss into a profit and the gratuity item is a related-party-linked management estimate → the auditor requests correction, communicates all uncorrected misstatements (and the prior-period effect) to TCWG with a written representation under SA 580, and if the entity refuses and the effect is material in context, modifies the opinion.

Example 5 — Which standard applies?

Where it is used

• Statutory audit practice — every firm's audit programme, checklists and audit file templates are built standard-by-standard; a Big Four India audit file is structured around SA 315, SA 330, SA 500 and SA 230.
• Audit quality regulation — NFRA's published Audit Quality Review reports on auditors of IL&FS, Coffee Day, Reliance Capital and others are written as findings of SA 200, 240, 315, 500 and 600 non-compliance; ICAI's Peer Review and Financial Reporting Review Board use the same yardstick.
• Job roles — audit associate to engagement partner in assurance; internal audit and risk-advisory staff who must know where SIAs end and SAs begin; EQCR partners under SQC 1/SQM 2; banks' concurrent and statutory branch auditors (RBI's long form audit report work is performed within the SAs).
• Listed-company compliance — SEBI LODR limited reviews (SRE 2410), KAM disclosure under SA 701 in annual reports, and prospectus/pro forma reporting under SAE 3420.
• Group audits and multi-location entities — PSU and conglomerate audits where SA 600 reliance and SA 299 joint audit are routine (CAG-appointed joint auditors of public sector banks and insurers).
• Exams and selection — CA Inter Paper 5 and CA Final Paper 3, CS/CMA audit papers, bank and PSU internal-audit recruitment tests, and the technical round in every audit-firm interview.

Interview questions

• Q: What gives Standards on Auditing legal force in India? A: Section 143(9) of the Companies Act, 2013 obliges every auditor to comply with them, and section 143(10) deems the ICAI-specified standards to be the auditing standards until the Central Government notifies standards on NFRA's recommendation.
• Q: Are the "Application and Other Explanatory Material" paragraphs mandatory? A: They are not separate requirements, but a requirement must be read and applied in the light of them, so ignoring them is treated as not complying with the standard.
• Q: When may an auditor depart from a requirement of an SA? A: Only in an exceptional circumstance where the requirement cannot be met; the auditor must perform alternative procedures that achieve the standard's objective and document the reason and the procedures.
• Q: Difference between an SA, an SRE and an SRS? A: An SA gives reasonable assurance with a positive opinion on historical financial information; an SRE gives limited assurance expressed negatively; an SRS engagement gives no assurance at all — only factual findings or a compilation.
• Q: How long must audit documentation be retained, and when must the file be assembled? A: The final file is assembled within 60 days of the auditor's report date (SA 230) and retained for not less than 7 years from that date under SQC 1 — longer than the ISA's 5 years.
• Q: What is the Indian position on division of responsibility in a group or branch audit? A: Under SA 600 the principal auditor relies on the other auditor's report, is not responsible for that auditor's work, and discloses the division through an Other Matter paragraph — unlike ISA 600 (Revised), which makes the group auditor responsible throughout.
• Q: Under SA 299, if the joint auditors divide the work, is each free of the others' errors? A: For properly divided and documented work each is separately responsible, but all remain jointly and severally responsible for undivided work, jointly taken decisions and overall compliance with the SAs and reporting requirements.
• Q: To whom does SA 701 apply? A: It is mandatory for audits of complete sets of general purpose financial statements of listed entities, and otherwise applies only if the auditor decides to, or law or regulation requires, communicating key audit matters.
• Q: A material uncertainty exists about going concern. Is that a KAM? A: It is reported in a separate "Material Uncertainty Related to Going Concern" section under SA 570 (Revised); it is referred to in, but not presented as, a key audit matter.
• Q: What replaces SQC 1, and from when? A: SQM 1 and SQM 2 with a revised SA 220 introduce a risk-based quality-management system with a mandatory annual evaluation by firm leadership; ICAI's applicability date, after one deferment, is periods beginning on or after 1 April 2026, so it governs engagements from FY 2026-27.
• Q: Which disciplinary clause is used when an auditor ignores a Standard on Auditing? A: Typically clause 9 of Part I of the Second Schedule to the Chartered Accountants Act, 1949 (failure to invite attention to a material departure from the generally accepted procedure of audit), often with clauses 7 and 8 for gross negligence and insufficient information.
• Q: Does an auditor have to comply with Guidance Notes? A: Guidance Notes are recommendatory, not mandatory — but an auditor who departs from one must be able to justify it, and the departure will be examined in a peer review or disciplinary proceeding.

Common mistakes

• Treating all ICAI pronouncements as equally binding — Guidance Notes, Technical Guides and Standards on Internal Audit are recommendatory; SAs and SQC/SQM are not.
• Writing that the Central Government has notified the SAs; it has not — their force comes from the deeming provision in s.143(10).
• Confusing "not relevant" with "departure": no inventory means SA 501's inventory requirements do not apply, which is not a departure needing documentation.
• Quoting the ISA position in an Indian answer — stating 5-year retention, or saying the group auditor owns the component auditor's work under SA 600.
• Mixing up the SA 705 matrix: using "adverse" for an inability to obtain evidence (that is a disclaimer) or "disclaimer" for a known pervasive misstatement (that is adverse).
• Putting a going-concern material uncertainty, or an EOM matter, into the KAM section, or giving KAMs in a private company audit as though SA 701 were mandatory there.
• Reciting standard numbers without their content in a case-study question — the marks are for identifying the applicable SA *and* the specific requirement breached.

Related topics

Auditing basics · Audit planning, materiality, risk assessment and sampling · Company audit: CARO 2020 and the auditor's report · Internal control and internal audit · Professional ethics: the Code of Ethics and the Chartered Accountants Act 1949 · Bank audit, tax audit and special audits