Group Audits and Other Assurance Engagements

Introduction and context

Modern organisations rarely operate as a single legal entity. Groups may contain subsidiaries, branches, joint arrangements, associates, special-purpose entities and overseas operations, while important information may be processed by shared-service centres, cloud platforms and external service organisations. The auditor of consolidated financial statements therefore faces a problem that is broader than auditing the parent company: sufficient appropriate evidence must be obtained about the financial information of the group and its components.

At the same time, users request services other than a reasonable-assurance audit. They may need limited assurance over interim information, factual findings under agreed-upon procedures, assistance in compiling financial statements, an examination of a forecast, an investigation into suspected fraud, or assurance that an entity has complied with a contract or law. These engagements differ in objective, evidence, practitioner responsibility and reporting language. Confusing them can create a serious expectation gap.

This chapter applies an engagement-risk perspective. The practitioner must first identify the information need, determine the appropriate engagement framework, assess risks, design procedures, evaluate evidence and communicate a conclusion that accurately describes the work performed.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Plan and manage an audit of consolidated financial statements, including the direction and evaluation of component auditors.
2. Identify consolidation-specific risks and design appropriate responses.
3. Distinguish reasonable assurance, limited assurance, agreed-upon procedures and compilation engagements.
4. Explain the assurance approach for prospective information, compliance, forensic and public-sector engagements.
5. Select an appropriate report and communicate scope, limitations and findings ethically.
6. Evaluate the effects of technology, regulation, independence and professional judgement on engagement quality.

1. The group-audit model

A group audit is an audit of consolidated financial statements that include the financial information of more than one component. A component may be a legal entity, business unit, branch, function, location or other division whose financial information is included in the group financial statements. The group engagement team (GET) is responsible for the group audit opinion, even when work is performed by component auditors.

A component auditor is an auditor who performs work on the financial information of a component for the group audit. The component auditor may be part of the same network as the group auditor or an entirely separate firm. The relationship does not transfer responsibility for the group opinion to the component auditor.

The group engagement partner must determine whether sufficient appropriate audit evidence can reasonably be expected to be obtained. If access restrictions, legal barriers, unreliable records or severe time constraints prevent this, the issue is a scope limitation that may require a modified opinion or withdrawal where permitted.

1.1 Risk assessment at group level

The GET begins with an understanding of:

• the group structure, ownership and reporting timetable;
• the industries, jurisdictions and regulatory environments involved;
• the consolidation process and reporting instructions;
• common accounting policies and policy changes;
• shared-service centres, information systems and outsourced processes;
• related parties, intra-group transactions and unusual structures; and
• the competence, independence and availability of component auditors.

Risk assessment must operate at two levels. At the financial-statement level, the auditor considers pervasive risks such as weak governance, management override, liquidity pressure or unreliable group-wide systems. At the assertion level, the auditor considers risks relating to classes of transactions, account balances and disclosures.

A component is not important only because of its size. A small component can be significant because it contains a high-risk estimate, a material related-party transaction, a major litigation exposure, a suspected fraud or a difficult foreign-currency conversion. Component significance is therefore both quantitative and qualitative.

A useful planning distinction is:

These categories are not substitutes for professional judgement. The GET must reassess them as evidence develops.

1.2 Group materiality and component performance materiality

Materiality for the consolidated financial statements is set by the group auditor. A lower component performance materiality is normally assigned so that the aggregation of undetected misstatements does not exceed group materiality. The amount is not calculated mechanically. It depends on aggregation risk, the number of components, the quality of component controls and the likelihood that misstatements in different components may have a common cause.

The GET should communicate, at an appropriate level of detail:

• the group materiality and relevant component thresholds;
• identified significant risks and presumed fraud risks;
• related parties and unusual transactions;
• accounting policies and consolidation instructions;
• required audit procedures and documentation standards;
• reporting deadlines and communication protocols; and
• the form and content of component auditor reporting.

Instructions should not be so detailed that they prevent professional judgement, nor so vague that component work cannot be evaluated.

2. Directing, supervising and evaluating component auditors

The GET remains responsible for the nature, timing and extent of work required for the group opinion. Effective management of component auditors is a cycle rather than a single instruction.

Planning

The GET evaluates whether component auditors understand the ethical requirements, are independent, possess appropriate competence and have sufficient resources. This includes considering language, local law, industry expertise, staff turnover, use of specialists and the firm’s quality-management arrangements.

Communication

The GET communicates the purpose of the work and requires component auditors to report matters such as:

• actual or suspected fraud;
• non-compliance with laws and regulations;
• identified or likely misstatements;
• control deficiencies;
• going-concern uncertainties;
• significant estimates and management bias;
• related-party relationships;
• subsequent events; and
• restrictions on access or departures from instructions.

Communication must be two-way. Component auditors should be able to ask questions and challenge group assumptions.

Supervision and review

The GET reviews the component auditor’s risk assessment, planned procedures, significant judgements, identified misstatements and conclusions. Review effort should be risk-based. It may include discussions, review of selected working papers, attendance at meetings, visits to component locations, involvement in significant procedures or reperformance.

A written component report is not sufficient by itself. The GET must understand what work was done, what evidence was obtained and whether the work addresses the group risks. If the work is inadequate, the GET must request additional procedures or perform them directly.

Use of internal auditors and experts

Internal auditors may support the audit only after their objectivity, competence and systematic approach have been evaluated. Their work does not eliminate the GET’s responsibility. Specialists may be needed for valuation, actuarial assumptions, taxation, environmental obligations, cybersecurity or complex financial instruments. The GET must evaluate the specialist’s competence, objectivity, methods, assumptions and consistency with other evidence.

3. Consolidation-specific risks

Consolidation is more than adding trial balances. It involves decisions about control, accounting policies, measurement, eliminations, presentation and disclosure.

Boundary and control risks

Management may omit a controlled entity, include an entity that is not controlled, or apply an incorrect treatment to a joint arrangement or associate. Complex ownership chains and structured entities increase this risk. The auditor examines legal agreements, board minutes, voting rights, substantive rights, exposure to variable returns and the ability to affect those returns.

Completeness and accuracy of consolidation entries

Typical consolidation entries include:

• elimination of the parent’s investment against the subsidiary’s equity;
• recognition and measurement of goodwill and identifiable net assets;
• elimination of intra-group receivables and payables;
• elimination of intra-group sales, purchases and unrealised profits;
• elimination of intra-group interest, dividends and management charges;
• recognition of non-controlling interests; and
• foreign-exchange translation adjustments.

These entries may be posted outside the normal ledger and may therefore be vulnerable to management override. The auditor reconciles component submissions to the consolidation system, tests the consolidation journal population, and investigates unusual manual entries.

Foreign operations

Foreign operations create risks involving exchange rates, local accounting rules, taxation, inflation, political restrictions and translation adjustments. The auditor verifies the exchange rates used, the translation method, the treatment of hyperinflation where relevant, and the presentation of currency differences in accordance with the applicable reporting framework.

Goodwill and impairment

Acquisitions create risks in purchase-price allocation, valuation of identifiable intangible assets, contingent consideration and goodwill impairment. Forecast cash flows may be optimistic, discount rates may be inappropriate and cash-generating units may be defined too broadly. The GET should challenge assumptions against budgets, historical performance, market evidence and post-year-end results.

Intra-group transactions and fraud

Intra-group transactions may be used to accelerate revenue, move losses, manipulate covenant measures or conceal liabilities. The auditor tests both sides of significant transactions, checks cut-off, confirms balances and evaluates whether terms are commercially plausible. Data analytics can identify reciprocal entries, round-dollar transactions, unusual end-period activity and transactions lacking a clear business purpose.

4. A group-audit workflow

A practical workflow is:

1. Accept or continue the engagement after assessing access, competence and independence.
2. Understand the group, its components, systems and reporting framework.
3. Set group materiality and identify significant components and risks.
4. Design the group audit strategy and component instructions.
5. Obtain evidence about consolidation controls and entries.
6. Direct, supervise and review component work.
7. Aggregate and evaluate misstatements, including uncorrected items.
8. Evaluate going concern, subsequent events and disclosures.
9. Conclude on evidence sufficiency and determine the report.
10. Communicate significant matters to those charged with governance and document judgement.

The process is iterative. A late discovery of a major component error may require revised materiality, further work elsewhere or reconsideration of fraud risk.

5. Assurance engagements: a common conceptual framework

An assurance engagement involves a practitioner obtaining sufficient appropriate evidence to express a conclusion designed to enhance the confidence of intended users in information prepared by a responsible party. The subject matter may be historical financial information, a control, a sustainability metric, compliance with requirements or prospective information.

The principal dimensions are:

Suitable criteria should be relevant, complete, reliable, neutral and understandable. If criteria are unsuitable or unavailable, the practitioner should not imply a meaningful assurance conclusion.

Reasonable assurance

Reasonable assurance is a high, but not absolute, level of assurance. The practitioner reduces engagement risk to an acceptably low level and expresses a positive conclusion, such as: “In our opinion, the financial statements present fairly…” An audit includes risk assessment, tests of controls where appropriate, substantive procedures and evaluation of presentation and disclosure.

Limited assurance

Limited assurance provides less assurance than reasonable assurance. Procedures are narrower and commonly include inquiries and analytical procedures, although other procedures may be necessary. The conclusion is expressed negatively, for example: “Nothing has come to our attention that causes us to believe…” Limited assurance is not “no assurance”; it is a structured engagement with a lower evidence threshold and a different conclusion.

The difference is not merely the number of procedures. It concerns the assessed risk, nature and timing of evidence, depth of investigation and wording of the conclusion.

6. Reviews, agreed-upon procedures and compilations

Review engagements

A review of financial statements normally provides limited assurance. The practitioner obtains an understanding of the entity and its environment, performs inquiries and analytical procedures, considers whether information appears inconsistent or misstated, and follows up significant matters. A review does not ordinarily include the extensive confirmation, inspection, observation and reperformance expected in an audit.

If a material misstatement comes to attention, the practitioner requests correction or modification of the report. If the scope is restricted, the practitioner evaluates whether the restriction is sufficiently serious to preclude a conclusion.

Agreed-upon procedures

In an agreed-upon procedures (AUP) engagement, the practitioner and specified users agree the procedures in advance. The practitioner performs those procedures and reports factual findings without expressing an assurance conclusion. Users draw their own conclusions.

For example, procedures may include inspecting 40 invoices, comparing invoice dates with delivery records and listing exceptions. The report should state what was examined, the population or sample basis, the findings and any limitations. It should not use audit or review language suggesting assurance.

AUP engagements are particularly useful where users need targeted evidence, such as covenant testing, grant expenditure verification or acquisition due diligence. However, users must understand that procedures not performed may have revealed additional matters.

Compilation engagements

In a compilation, the practitioner uses accounting expertise to assist management in presenting financial information, primarily by collecting, classifying and summarising information. The practitioner does not obtain assurance and does not verify the information as an auditor would. The report must clearly state that no assurance is provided and that management remains responsible for the information.

7. Prospective financial information

Prospective financial information includes forecasts, based on management’s best-estimate assumptions, and projections, based on hypothetical assumptions about future events or actions. The practitioner evaluates whether assumptions are reasonable, internally consistent and properly presented, and whether the information is prepared using an appropriate framework.

A forecast is not a guarantee of future results. A projection may be useful for a financing scenario even though the hypothetical assumptions are unlikely to occur. The practitioner should avoid implying that the outcome will be achieved. The report normally draws attention to the uncertainty of actual results and may restrict use where appropriate.

Key procedures include:

• testing the mathematical accuracy of models;
• agreeing opening data to audited or reliable historical information;
• comparing assumptions with approved plans and external evidence;
• evaluating sensitivity to key variables;
• checking consistency between narrative and numerical information; and
• assessing whether material assumptions are adequately disclosed.

8. Compliance, forensic and public-sector engagements

Compliance engagements

Compliance work evaluates whether an entity has followed specified laws, regulations, contracts, grant conditions, policies or debt covenants. The criteria must be clearly identified. The practitioner considers both individual breaches and patterns indicating systemic non-compliance. Reporting may be to a regulator, funder, board or legislature, and confidentiality obligations can differ from those in a private commercial engagement.

Forensic engagements

Forensic work is investigation-oriented and often intended for use in litigation, disciplinary proceedings or regulatory action. It may address alleged fraud, asset tracing, bribery, corruption, conflicts of interest or damages. The practitioner must preserve evidence integrity, document chain of custody, distinguish facts from assumptions and remain independent.

Forensic procedures may include targeted data extraction, email review, interviews, transaction reconstruction and digital-forensic analysis. A forensic practitioner should not claim that fraud is absent merely because no evidence has been found. The conclusion must reflect the scope, evidential limitations and applicable legal standard.

Public-sector engagements

Public-sector audit extends beyond financial-statement accuracy. It may include regularity, propriety, economy, efficiency, effectiveness, performance and accountability. Public-sector auditors often report to legislatures or the public, making transparency and stewardship central. They may have statutory powers of access and mandatory reporting duties that differ from private-sector engagements.

The concept of value for money should not be reduced to cost minimisation. A low-cost programme that fails to achieve its social objective may be inefficient or ineffective. Public-sector criteria should therefore include service outcomes, equity, legality and responsible use of public resources.

9. Selecting the report

Report selection follows the engagement performed and the evidence obtained. The practitioner should ask:

1. What type of engagement was accepted?
2. Were the criteria suitable and available to intended users?
3. Was sufficient appropriate evidence obtained?
4. Are identified misstatements or departures material and pervasive?
5. Is the matter a qualification, an adverse conclusion, a disclaimer, an emphasis matter or an other-matter communication?
6. Does the report clearly state responsibility, scope, level of assurance and intended users?

A reasonable-assurance audit may result in an unmodified opinion, a qualified opinion, an adverse opinion or a disclaimer, depending on the nature and pervasiveness of misstatement or scope limitation. A review uses a limited-assurance conclusion, while AUP reports factual findings and compilations state that no assurance is provided. These report types are not interchangeable.

A report must not overstate certainty. Clear wording is an ethical safeguard because users may make financing, investment, public-policy or legal decisions based on it.

10. Illustrative case: Northstar Mobility Group

Background

Northstar Mobility Group, a fictional listed manufacturer, consolidates a parent in the United Kingdom, a battery subsidiary in Germany, a distribution subsidiary in Brazil and a recently acquired software entity in Singapore. The group uses a shared-service centre for procurement and finance. The Singapore entity is audited by a local firm outside the parent auditor’s network.

Problem

At planning, the GET identifies four concerns. First, the Singapore entity is small relative to group revenue but holds valuable development assets and reports rapidly growing margins. Second, the Brazil subsidiary has large year-end sales to dealers with generous return rights. Third, the group’s consolidation system contains manual elimination journals. Fourth, the parent has not fully documented whether it controls a jointly funded battery-recycling arrangement.

Analysis and approach

The GET classifies Singapore as a significant-risk component because of valuation and revenue-recognition risk, despite its size. It evaluates the local auditor’s independence and competence, issues detailed instructions and requires direct discussion of development-asset assumptions. The GET reviews selected working papers and reperforms the impairment sensitivity analysis.

For Brazil, the team tests subsequent returns, inspects dealer agreements and performs cut-off procedures around year-end. It identifies sales that should have been deferred because return rights were substantive. For consolidation, the GET obtains the complete journal population, identifies entries posted by senior management near closing and tests eliminations to both component ledgers. For the recycling arrangement, it examines governance rights, contractual obligations, exposure to variable returns and the entity’s ability to affect those returns.

Outcome

Northstar corrects the Brazilian revenue error and revises the Singapore impairment assumptions. The arrangement is concluded to be a joint arrangement rather than a controlled subsidiary. The GET performs additional work on the consolidation model and reports a significant control deficiency to those charged with governance. After correction, sufficient appropriate evidence supports an unmodified group opinion, with separate communication of the control deficiency and significant audit matters where applicable.

Learning points

The case demonstrates that component significance is not solely a size calculation; that the GET must evaluate, not merely receive, component work; that consolidation journals deserve direct attention; and that control conclusions depend on substantive rights and returns rather than legal form alone.

11. Technology, ethics and quality management

Data analytics can improve group audits by matching intercompany transactions, identifying duplicate invoices, analysing unusual journal entries and comparing component trends. Artificial intelligence may assist classification, anomaly detection and document review. Nevertheless, an anomaly is a prompt for investigation, not evidence of misstatement. The auditor must understand data completeness, algorithmic limitations, false positives, bias, access controls and reproducibility.

Cross-border engagements raise confidentiality, privacy, professional-secrecy and data-transfer issues. Client information should be transferred through secure, authorised systems, with retention and access policies consistent with law and professional requirements.

Threats to independence include self-review, advocacy, familiarity, intimidation and financial interests. They may arise when a firm helps design consolidation systems, values an acquisition and then audits the resulting balances, or performs investigative work for a client whose financial statements it audits. Safeguards may include separate teams, independent review, restrictions on non-audit services or declining the engagement.

Engagement quality depends on professional scepticism, consultation, timely review, adequate resources and a culture that rewards challenge. The group partner should document significant judgements, especially component classification, materiality, control conclusions, use of specialists and the basis for relying on component auditors.

12. Contemporary developments and limitations

Global groups increasingly use centralised digital ledgers, cloud accounting, automated controls and complex sustainability metrics. These developments can improve auditability but also create concentration risk: a single shared-service failure may affect every component. Cyber incidents, geopolitical restrictions, sanctions and climate-related estimates may affect both component evidence and consolidation disclosures.

No assurance engagement eliminates risk. Sampling, management estimates, persuasive rather than conclusive evidence, uncertain future events and potential collusion impose inherent limitations. The appropriate response is not to promise certainty but to design proportionate procedures, communicate limitations and maintain a questioning mindset.

Chapter Summary

Group audits require the group engagement team to obtain sufficient appropriate evidence over consolidated financial statements while directing, supervising and evaluating component auditors. Component significance depends on size, risk and qualitative factors. Consolidation risks include incomplete group boundaries, inappropriate control conclusions, inaccurate eliminations, foreign-currency translation, goodwill impairment, intra-group transactions and management override.

Other assurance engagements differ in objective and evidence. Audits provide reasonable assurance; reviews provide limited assurance; agreed-upon procedures report factual findings without a conclusion; and compilations provide no assurance. Prospective information requires careful evaluation of assumptions and disclosure of uncertainty. Compliance engagements use specified legal or contractual criteria, forensic engagements focus on investigation and evidential integrity, and public-sector engagements emphasise accountability, regularity and performance.

Reports must match the engagement performed and the evidence obtained. Ethical independence, secure technology use, professional scepticism, clear criteria and robust quality management are essential to credible assurance.

Key Terms

Agreed-upon procedures: An engagement reporting factual findings from procedures agreed with specified users, without an assurance conclusion.

Assurance engagement: An engagement intended to enhance users’ confidence in information by evaluating it against suitable criteria.

Component: An entity, business unit, branch, function or location included in group financial information.

Component auditor: An auditor performing work on a component for a group audit.

Compilation: Assistance in preparing financial information without providing assurance.

Consolidation adjustment: An entry made to combine component information and eliminate intra-group effects.

Criteria: Benchmarks used to evaluate the subject matter.

Forensic engagement: Investigation-oriented work often designed for litigation, regulatory or disciplinary use.

Group engagement partner: The partner responsible for the group audit opinion.

Group engagement team: The team responsible for planning, directing, supervising and concluding on the group audit.

Group materiality: Materiality applied to the consolidated financial statements.

Limited assurance: A lower level of assurance, commonly expressed through a negative-form conclusion.

Non-controlling interest: Equity in a subsidiary not attributable, directly or indirectly, to the parent.

Prospective financial information: Information about expected future financial results or position.

Reasonable assurance: A high, but not absolute, level of assurance.

Review engagement: A limited-assurance engagement mainly involving inquiry and analytical procedures.

Scope limitation: A restriction preventing the practitioner from obtaining required evidence.

Significant component: A component important because of its financial size or significant risk.

Suitable criteria: Criteria that are relevant, complete, reliable, neutral and understandable.

Unmodified opinion: A conclusion that the financial statements are prepared in accordance with the applicable framework, without a required modification.

Review Questions

Short Answer Questions

1. Why does the group engagement team retain responsibility for the group audit opinion when component auditors perform work?
2. State two reasons why a small component may nevertheless be significant.
3. What is the principal difference between reasonable and limited assurance?
4. Why do agreed-upon procedures reports not contain an assurance conclusion?
5. Identify two consolidation-specific risks.

Long Answer Questions

1. Explain how a group engagement team should plan, direct, supervise and evaluate the work of component auditors.
2. Discuss the risks associated with intra-group transactions and consolidation journals, and propose audit responses.
3. Compare audits, reviews, agreed-upon procedures and compilations in terms of objective, evidence and reporting.
4. Explain the special evidential and ethical challenges in forensic engagements.
5. Evaluate the role of professional judgement and technology in achieving group-audit quality.

Analytical / Application Questions

1. A subsidiary represents 3% of group assets but holds a highly uncertain environmental provision and is audited in a country where access to records is restricted. Classify the component and explain the GET’s response.
2. A client asks for a report stating that all grant expenditure was eligible, but proposes only three agreed procedures over a sample of invoices. What engagement type and report wording would be appropriate, and what expectation risk exists?
3. During consolidation, the GET discovers that management posted large manual eliminations which cannot be reconciled to component records. Analyse the risks, additional procedures and possible reporting consequences.

Multiple Choice Questions with Answers

Question 1

Who is responsible for the opinion on the consolidated financial statements?

A. The component auditor with the largest component

B. The group engagement partner and group engagement team

C. The entity’s internal audit director

D. The consolidation accountant

Correct Answer: B. The group engagement partner and group engagement team

Question 2

Which factor can make a small component significant?

A. It has no transactions with other group entities

B. It has a high-risk estimate or suspected fraud

C. It uses the same accounting software as the parent

D. It reports before the parent

Correct Answer: B. It has a high-risk estimate or suspected fraud

Question 3

What does an agreed-upon procedures engagement provide?

A. A reasonable-assurance opinion

B. A limited-assurance conclusion

C. Factual findings from specified procedures

D. A guarantee that fraud does not exist

Correct Answer: C. Factual findings from specified procedures

Question 4

Which engagement normally provides limited assurance over financial statements?

A. Compilation

B. Review

C. Agreed-upon procedures

D. Forensic investigation

Correct Answer: B. Review

Question 5

Which is a consolidation-specific audit risk?

A. Failure to eliminate intra-group balances

B. Failure to issue employee payslips

C. Excessive external advertising

D. Insufficient product warranties only

Correct Answer: A. Failure to eliminate intra-group balances

Question 6

What is the main reporting feature of a compilation engagement?

A. It expresses an adverse opinion

B. It reports factual findings only

C. It states that no assurance is provided

D. It provides reasonable assurance

Correct Answer: C. It states that no assurance is provided

Question 7

A forecast is best described as information based on:

A. Management’s best-estimate assumptions

B. Only hypothetical events that management does not expect

C. Historical figures with no assumptions

D. Procedures agreed with a regulator

Correct Answer: A. Management’s best-estimate assumptions

Question 8

Which activity is especially important in a forensic engagement?

A. Ignoring chain of custody

B. Preserving evidence integrity

C. Guaranteeing a conviction

D. Replacing criteria with management preference

Correct Answer: B. Preserving evidence integrity

Question 9

If a component auditor’s work is inadequate, the group engagement team should:

A. Automatically ignore the component

B. Issue an unmodified opinion without further work

C. Request additional procedures or perform them directly

D. Transfer responsibility for the group opinion

Correct Answer: C. Request additional procedures or perform them directly

Question 10

Which statement about limited assurance is correct?

A. It provides no assurance at all

B. It provides the same assurance as an audit

C. It uses a lower level of assurance and commonly negative-form wording

D. It reports only legal breaches

Correct Answer: C. It uses a lower level of assurance and commonly negative-form wording