Engagement Letters for Audit, Review, and Compilation

Engagement letters for audit, review, and compilation engagements share a common purpose, establishing a written understanding before work begins, but the AICPA standards governing each one specify different required content. At BusAcTa Advisors, we support CPA firms with the bookkeeping and file preparation work behind audit, review, and compilation engagements, and an engagement letter missing a required element is one of the more avoidable gaps we see surface during peer review.

This is general information, not a substitute for the full text of the applicable AICPA standards or professional judgment applied to your specific engagement. Always consult AU-C 210, AR-C 80, AR-C 90, and your firm's quality control policies before finalizing an engagement letter.

Why the Required Elements Differ by Engagement Type

Answer first: an audit, a review, and a compilation each carry a different level of assurance, and the engagement letter for each one has to reflect that difference clearly. An audit provides reasonable assurance, a review provides limited assurance, and a compilation provides no assurance at all. A letter that blurs that distinction, even in well-meaning language meant to reassure the client, creates a real risk that the client misunderstands exactly what service they are receiving.

Every signed, written engagement letter under SSARS and GAAS is required for the engagement type it governs. A verbal understanding, however clear at the time, is not sufficient under any of these standards.

What an Audit Engagement Letter Must Include Under AU-C 210

AU-C 210, Terms of Engagement, sets out six required elements that must appear in every audit engagement letter or other suitable form of written agreement:

1. The objective and scope of the audit of the financial statements.

2. The responsibilities of the auditor.

3. The responsibilities of management.

4. A statement on the inherent limitations of an audit. Because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk exists that some material misstatements may not be detected, even when the audit is properly planned and performed in accordance with generally accepted auditing standards.

5. Identification of the applicable financial reporting framework for the preparation of the financial statements.

6. Reference to the expected form and content of any reports to be issued by the auditor, along with a statement that circumstances may arise in which the actual report differs from that expected form and content.

Before any of this gets documented, the auditor has to confirm that certain preconditions for an audit are actually present. That means determining whether the financial reporting framework management intends to use is acceptable, and obtaining management's agreement that it understands and accepts responsibility for preparing the financial statements, maintaining relevant internal control, and giving the auditor full access to records, information, and personnel needed to complete the audit.

If management will not acknowledge these preconditions, there is no audit engagement to document a letter for. The preconditions come first, the letter second.

Initial Audits, Recurring Audits, and Changed Terms

AU-C 210 also addresses several specific situations that affect what gets documented.

• Initial audits. Before accepting an initial or reaudit engagement, the auditor should ask management to authorize the predecessor auditor to respond fully to inquiries that will help the new auditor decide whether to accept the engagement. If management refuses or limits that response, the auditor needs to inquire about why and consider what that refusal means for acceptance.

• Recurring audits. The auditor should assess each year whether circumstances require revising the terms of engagement. If the terms do not need to change, the auditor should still remind management of the existing terms, and that reminder needs to be documented, even when a brand new letter is not issued.

• Changed terms. The auditor should not agree to a change in terms without reasonable justification. If the terms do change, the new terms must be documented in a new engagement letter or other suitable written agreement.

What a Compilation Engagement Letter Must Include Under AR-C 80

A compilation engagement letter establishes a written understanding with management about the nature of the engagement, which AR-C 80 treats as a foundational requirement, not an optional courtesy.

• The applicable financial reporting framework. Identified clearly, along with the accounting policies management has adopted.

• Management's responsibilities. For the financial statements and for providing the accountant with the information needed to compile them.

• The objectives of the engagement. Assisting management in presenting the financial statements and reporting on them, without providing assurance.

• Separate identification of preparation services, if performed. If the accountant is also preparing the financial statements as part of the same engagement, the letter must identify the preparation service and the compilation service as distinct services, even within a single letter.

Independence is not a precondition for a compilation the way it is for a review. A compilation can still be performed when the accountant's independence is impaired, as long as that lack of independence is disclosed in the compilation report.

What a Review Engagement Letter Must Include Under AR-C 90

A review engagement letter under AR-C 90 should be prepared and signed by the accountant or the accountant's firm, and by management or those charged with governance. Because reviews commonly involve both a nonattest service, preparing the financial statements, and an attest service, the review itself, most review engagement letters address both and clearly separate the client's responsibility for the nonattest service from the accountant's responsibility for the review.

Independence is a hard requirement for a review with no equivalent flexibility to a compilation's disclosure option. If the accountant's independence is impaired, a review cannot be performed at all, regardless of disclosure.

Where Engagement Letters Most Often Fall Short

Why do otherwise well-run engagements still pick up engagement letter findings in peer review? Usually because the letter was copied from a template used for a different engagement type and never fully adapted.

• Reusing a compilation letter template for a review, or vice versa. The two engagements require fundamentally different language around assurance level and independence.

• Omitting the inherent limitations statement from an audit letter. This specific statement is a named requirement under AU-C 210, not optional boilerplate.

• Not documenting the annual reminder on recurring audits. Firms sometimes assume that because the terms have not changed, nothing needs to be written down. The standard still requires the reminder itself to be documented.

• Letting preparation and compilation or review services blur together in one undifferentiated paragraph. When both are performed, each service needs its own clear identification in the letter.

Conclusion and Next Steps

Engagement letters for audit, review, and compilation engagements all serve the same basic purpose, but each one is governed by a different standard with its own required content. An audit letter under AU-C 210 needs six specific elements, including the inherent limitations statement that is unique to audits. A review letter under AR-C 90 has to reflect the hard independence requirement that has no compilation equivalent. A compilation letter under AR-C 80 needs the engagement objectives spelled out clearly, with preparation and compilation services identified separately whenever both are performed. Firms that keep distinct, current templates for each engagement type, rather than adapting one template on the fly, are the ones that avoid the most common and most avoidable peer review findings.

If your firm needs support with the bookkeeping and file preparation work behind audit, review, or compilation engagements, talk to BusAcTa Advisors about how a dedicated team can support your engagement workflow, we can show you how this typically fits alongside your firm's existing quality control process. You can also see our related guides on SSARS 21 documentation requirements and subsequent events documentation under AU-C 560, or learn more on our audit support services page.