ISA 600: Scope, Component Materiality, and Consolidation Audits

The International Standard on Auditing 600 (Revised) sets the requirements for auditing group financial statements, and it applies to audits of periods beginning on or after December 15, 2023.¹ Under the revised standard, the group engagement team plans and scopes the audit by identifying and assessing risks of material misstatement at the assertion level of the group financial statements, then designs responses to those risks. The old approach of labeling components as “significant” and auditing them on that basis is gone.

When ISA 600 Applies

ISA 600 governs any audit where the opinion covers financial statements that aggregate results from more than one business unit or legal entity. The “group” is the entire collection of entities whose financial information ends up in the consolidated report, and components can be subsidiaries, branches, joint ventures, or geographical divisions.²

The standard exists because certain risks only surface in the relationships between entities. Intercompany loans that inflate both sides of a balance sheet, transfer pricing that shifts profits between jurisdictions, consolidation adjustments that smooth earnings — none of these show up in a standalone entity audit. A group auditor has to look at the whole picture.

The Risk-Based Approach That Replaced Significant Components

The revision’s headline change is the elimination of the “significant components” concept. Under the previous standard, auditors identified significant components based on financial size or risk profile and then performed full audits on those components. The revised standard drops that framework entirely.¹

In its place, the group engagement team identifies and assesses risks of material misstatement across the consolidated financial statements, then designs audit responses to those risks. Component-level work follows from the risk assessment, not from a size-based label. A financially large subsidiary with straightforward operations and strong controls may only need targeted procedures on a few high-risk accounts. A smaller entity with complex transactions or weak controls could require a full-scope audit.

The revision also strengthened several related areas:¹

Explicit expectations around professional skepticism when the group team receives information from component auditors and group management.
Two-way communication between the group engagement team and component auditors, rather than top-down instructions only.
Expanded documentation of the group auditor’s involvement with component auditors.
Alignment with ISQM 1, ISA 220 (Revised), and ISA 315 (Revised 2019).

Setting Component Materiality

Component materiality must be set lower than group materiality. If every component allowed misstatements right up to the group threshold, combined undetected errors across components could easily exceed what is acceptable for the group financial statements as a whole.³

Different components can have different materiality levels, and the aggregate of all component materiality figures may exceed group materiality. That works because not every component will have undetected misstatements at the maximum level. The group engagement team also sets performance materiality at the component level, which is the working threshold used to design and execute procedures.

Determining the Scope of Work at Each Component

Based on the risk assessment, the group engagement team decides whether each component needs a full audit, a review, specific procedures on particular accounts, or analytical procedures only. The decision flows from assessed risks, not from size labels. A component in a jurisdiction with weak oversight could warrant a full-scope audit even if its financial contribution to the group is modest.

Roles and Responsibilities

Every group audit divides work between the group engagement team and, in most cases, component auditors. The group engagement partner carries ultimate responsibility for the audit opinion and cannot delegate that responsibility, no matter how many other firms perform work. The group engagement team sets the overall audit strategy, establishes materiality, and communicates directly with those charged with governance of the parent.¹

Component auditors perform audit work on a specific subsidiary or division. They may be part of the same international network as the group auditor or a wholly separate firm. The group engagement team decides what each component auditor performs, reviews the results, and evaluates whether the evidence gathered is sufficient.

Evaluating Component Auditor Competence and Independence

Before relying on a component auditor’s work, the group engagement team must satisfy itself that the component auditor is both competent and independent. That means evaluating professional qualifications, familiarity with the applicable financial reporting framework, and quality control track record, and checking for financial interests or relationships that could compromise objectivity.¹

Independence is assessed against the IESBA Code of Ethics and any applicable local professional standards. The group engagement team must also determine whether it can be sufficiently involved in the component auditor’s work. If it cannot, the team either performs the work itself or modifies the audit approach.

Two-Way Communication With Component Auditors

The revised standard puts heavy weight on communication in both directions.¹ Instructions from the group team need to describe the work to be performed, the materiality levels to apply, and the specific risk areas to address. What flows back matters equally: component auditors should be reporting the issues they encounter, including potential fraud indicators, control deficiencies, and matters relevant to the group team’s risk assessment.

Communication also crosses component boundaries. If the group team becomes aware of an issue that could affect a component’s standalone financial statements, the standard expects the team to ensure component management is informed, through group management if necessary. If group management refuses to pass information along, the group team takes the matter to those charged with governance at the group level.³

Restrictions on Access to Component Information

The revised standard directly addresses restrictions on accessing people or information at the component level. Legal restrictions in certain countries may prevent the group team from reviewing a component auditor’s working papers, or local regulations may limit direct contact with component management.⁴

When law blocks access to a component auditor’s documentation, the group team can request the component auditor to prepare a memorandum covering the relevant information. When group management itself imposes restrictions and the team concludes it cannot obtain sufficient evidence as a result, the group engagement partner has two options: decline or withdraw from the engagement, or issue a disclaimer of opinion on the group financial statements.³

Auditing the Consolidation Process

The consolidation itself requires dedicated audit attention. The group engagement team reviews the adjustments and eliminations applied during consolidation, confirming that intercompany transactions like internal sales, management fees, and inter-entity loans are properly removed. Leaving them in place would artificially inflate group revenues and assets.

The team also looks for signs of management bias in consolidation adjustments. A parent might time an intercompany transaction to shift revenue into a favorable reporting period, or use conversion adjustments between different reporting frameworks to smooth earnings. The auditor verifies that the applicable financial reporting framework, whether IFRS or a local GAAP, is applied consistently across all reporting entities. Inconsistent application is a common source of consolidation error, particularly in groups spanning multiple countries.

Documentation

Documentation requirements were expanded in the revision. The group engagement team must record enough information to demonstrate the basis for the audit opinion, including how risks were assessed across the group, why a particular audit approach was chosen for each component, and how the work of component auditors was evaluated.¹

Under the old standard, documentation centered on listing components, classifying them as significant or not, and recording the type of work assigned. The revised standard replaces that with documentation of how the group team identified components for audit purposes, the assessed risks driving each scope decision, and the communications exchanged with component auditors. This paper trail is exactly what inspectors review when evaluating audit quality.

How This Differs From PCAOB Standards

Auditors of U.S. public companies follow PCAOB standards rather than ISA 600, and one difference is fundamental. Under PCAOB AS 1206, a lead auditor can formally divide responsibility with another firm, naming that firm in the audit report and disclosing the portion of the financial statements it covered.⁵ ISA 600 does not permit that. The group auditor takes sole responsibility for the entire opinion regardless of how much work component auditors performed.

To divide responsibility under PCAOB rules, the lead auditor confirms that the referred-to auditor performed the work under PCAOB standards, is familiar with SEC financial reporting requirements, and is registered with the PCAOB if it played a substantial role. The lead auditor’s report then identifies the other firm by name and discloses the dollar amounts or percentages covered by that firm’s audit.⁵ Where a lead auditor has concerns about the referred-to auditor, the options are to perform the necessary procedures directly, qualify or disclaim the opinion, or withdraw. There is no middle path.

PCAOB AS 1201 governs supervision, and the engagement partner retains primary responsibility for the engagement even when team members from outside the firm are involved.⁶ If you are auditing a U.S. public company, these are the rules that bind you; ISA 600 will not.

1
IAASB. International Standard on Auditing 600 (Revised), Special Considerations—Audits of Group Financial Statements (Including the Work of Component Auditors)
2
International Federation of Accountants. International Standard on Auditing 600 (Revised) – Special Considerations—Audits of Group Financial Statements (Including the Work of Component Auditors)
3
Pacific Association of Supreme Audit Institutions. International Standard on Auditing 600 (Revised) – Full Text
4
IAASB. Group Audits – ISA 600
5
Public Company Accounting Oversight Board. AS 1206: Dividing Responsibility for the Audit with Another Accounting Firm
6
Public Company Accounting Oversight Board. AS 1201: Supervision of the Audit Engagement