An audit engagement letter is the written agreement a company and its external auditor sign before fieldwork begins, setting the objective of the audit, the standards that govern it, each side’s responsibilities, the fee arrangement, and the terms for ending the relationship. Professional standards require one for every audit. AU-C Section 210 covers private companies, and PCAOB AS 1301 covers SEC-registered issuers, with the public company version carrying additional obligations tied to the audit committee.
Core Elements Every Engagement Letter Must Contain
AU-C Section 210 governs audits of nonissuers, and ISA 210 applies under international standards. The wording differs; the required content largely doesn’t. Every audit engagement letter needs to cover the following ground.
- Audit objective. A statement that the purpose of the engagement is to express an opinion on whether the financial statements are fairly presented under the applicable reporting framework, whether that is GAAP, IFRS, or another accepted basis.
- Applicable auditing standards. Identification of the standards that govern the work, such as Generally Accepted Auditing Standards for a private company or PCAOB standards for a public one.
- Management’s responsibilities. A written acknowledgment from management that it is responsible for preparing the financial statements, for designing and maintaining internal controls, and for giving the auditor complete access to records, personnel, and any additional information the auditor requests.
- Inherent limitations of an audit. Language explaining that because audits rely on sampling and testing rather than a review of every transaction, some material misstatements may go undetected even when the audit is properly planned and executed.
- Reporting framework. The specific accounting framework the company uses, which determines the standards the auditor applies in evaluating the statements.
- Financial period covered. The exact fiscal period the audit will cover, for example the year ending December 31, 2025.
ISA 210 also suggests including the expected form of any reports the auditor will issue, the arrangements for planning the audit, a request for written management representations, and the basis for computing fees. These items aren’t always mandatory internationally, but most letters include them regardless of which framework applies.
Management Responsibilities in Detail
This section carries more legal weight than any other part of the letter, because it prevents a client from later claiming the auditor was responsible for maintaining the books. AU-C Section 210 requires management to agree in writing to three specific obligations before the audit can proceed.
First, management is responsible for preparing and fairly presenting the financial statements. Second, management must design, implement, and maintain internal controls that prevent and detect fraud and errors. Third, management must give the auditor unrestricted access to anyone within the organization the auditor needs to interview, along with all relevant records and documents.
If management refuses to acknowledge any of these responsibilities, the auditor cannot accept the engagement. That is not a negotiating posture; it is a professional requirement. The preconditions exist because an audit is impossible if management controls information flow or disclaims responsibility for the accuracy of its own financial statements.
The engagement letter is separate from the management representation letter the auditor will request near the end of the audit, but it typically references it. That later document requires management to confirm specific assertions, including that all financial records were made available, that all related-party transactions were disclosed, and that any uncorrected misstatements identified during the audit are immaterial. For public companies, PCAOB AS 2805 requires these written representations for every period covered by the auditor’s report.
Extra Requirements for Public Company Audits
If the company is an SEC issuer, the engagement letter must satisfy PCAOB requirements on top of general auditing principles. PCAOB AS 1301 requires the auditor to direct the engagement letter to the audit committee, not just management, and to provide it annually. The audit committee must acknowledge and agree to the terms. If someone other than the audit committee chair signs, the auditor must still confirm that the audit committee itself has agreed.
For an integrated audit, where the auditor opines on both the financial statements and the effectiveness of internal control over financial reporting, the letter has to state both objectives explicitly. The auditor’s responsibilities section must explain that the firm will plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement and whether effective internal control was maintained in all material respects.
Public company auditors also face an independence communication requirement under PCAOB Rule 3526. Before accepting an initial engagement, the firm must describe in writing to the audit committee every relationship between the firm and the company that could reasonably bear on independence, discuss the potential effects of those relationships, and document the conversation. That written independence communication must then be updated at least annually for the duration of the relationship.
Fees and Billing Terms
The letter should state clearly how fees will be calculated. Firms generally use one of two approaches: a fixed fee for the whole engagement, or hourly rates that vary by the seniority of the staff performing the work. Specify which method applies, when invoices will go out, and when payment is due. Out-of-pocket expenses such as travel are usually addressed separately.
Hourly rates vary widely with firm size, client complexity, and geography. What matters in the letter is that the rate structure is documented clearly enough that neither side can dispute the basis for a bill after the fact. Some letters include a fee estimate along with language noting that the final amount may differ if the scope expands or if the auditor encounters unexpected complications, such as incomplete records that require additional testing.
Liability Caps, Indemnification, and Dispute Resolution
Some engagement letters include clauses that cap the auditor’s liability for damages or require the client to indemnify the auditor under certain circumstances. These clauses are legally and ethically sensitive, and the rules differ sharply depending on the client.
For audits of financial institutions, federal banking regulators issued an interagency advisory stating that limitation-of-liability provisions in external audit engagement letters are generally considered unsafe and unsound banking practices. Regulators may take supervisory action against institutions that agree to such provisions. The advisory specifically targets clauses that cap damages, waive punitive damages, or shorten the period for filing claims.
For other clients, enforceability varies by jurisdiction. From an auditing standards perspective, the concern is whether the clause impairs independence. If indemnification effectively means the auditor faces no consequences for negligent work, the auditor has less incentive to challenge management’s assertions, which undermines the point of the audit. The AICPA’s ethics standards address this issue, and firms should consult legal counsel before including any limitation-of-liability language.
Dispute resolution clauses raise a related question. Under AICPA Ethics Ruling No. 95, agreeing to arbitration or mediation does not by itself impair auditor independence, because alternative dispute resolution changes the forum where a dispute is heard rather than limiting the auditor’s liability. If an ADR clause also incorporates damage caps, prohibitions on punitive damages, or shortened filing deadlines, it becomes a limitation-of-liability provision and raises the same independence concerns.
Do You Need a New Letter Every Year
For a recurring audit engagement, AU-C Section 210 says it depends. The auditor must assess whether circumstances have changed enough to warrant revising the terms. Triggers for a new letter include a shift in the reporting framework, a significant change in the company’s ownership or operations, new regulatory requirements, or a revised scope of services.
If nothing material has changed, the auditor doesn’t have to issue a fresh letter, but must remind management of the existing terms and document that reminder. Many firms issue a new letter annually anyway, which eliminates any question about whether the prior terms still apply. For public companies the question is settled outright: PCAOB AS 1301 requires the engagement letter to go to the audit committee every year.
Termination and Withdrawal Provisions
The letter should address what happens if either side wants to end the relationship before the audit is complete. At a minimum, it should specify notice requirements, how fees for work already performed will be handled, and the auditor’s obligation to provide access to workpapers.
For public companies, PCAOB AS 1310 imposes specific notification requirements when the auditor-issuer relationship ends. If the auditor resigns, is dismissed, or declines to stand for reappointment and the company does not file a timely Form 8-K disclosing the change, the auditor must notify both the company and the SEC in writing by the end of the fifth business day after determining the relationship has ended.
When an auditor withdraws from a nonissuer engagement, AU-C Section 210 requires the auditor to communicate the reasons to management and, where applicable, to those charged with governance. Anticipating these scenarios in the letter keeps neither side guessing later.
Drafting and Signing the Letter
The most efficient starting point is a template from the relevant standard-setter. The AICPA publishes sample engagement letters for a range of engagement types, including templates for not-for-profit audits and personal financial planning engagements. These provide standardized language aligned with current professional requirements, but every template needs customization for the specific client.
Start with the basics: the entity’s exact legal name as it appears on incorporation documents, the fiscal period, the applicable reporting framework, and the names and titles of the individuals who will sign. Identify the primary internal contact for audit requests. For a public company, confirm the letter is addressed to the audit committee and that the committee chair or another authorized party will sign.
Then review every clause to make sure it reflects the actual scale and complexity of the engagement. A template built for a small nonprofit will not cover the internal control language relevant to a mid-market manufacturer. Check that every placeholder has been replaced with real data; a stray bracket or blank field can create ambiguity about whether a term was intentionally omitted or simply overlooked.
Deliver the finalized letter through a secure method, whether that is an electronic signature platform or certified mail. The board, audit committee, or designated management official reviews the terms and signs. After receiving the executed copy, the auditor files it in the engagement documentation and can begin formal planning and risk assessment. A delayed signature is a red flag, not an administrative nuisance; starting fieldwork before the letter is signed defeats the purpose of having one.