Most disputes between auditors and clients begin with a misunderstanding about what the audit covers. The engagement letter is the cure. It sets out in writing what the auditor will do, what management must do and what the report will look like. It protects both sides, and it is one of the practical ways to narrow the expectations gap.
This topic covers the objective of International Standard on Auditing (ISA) 210, the preconditions for an audit, when the auditor must refuse, what the engagement letter contains, the annual review of its terms, and what to do when a client asks to change the terms. Examiners ask you to list the contents, to explain why the letter matters and to deal with a request to change an audit into a review.
In 30 seconds
Under ISA 210 the auditor accepts or continues an audit only when its basis has been agreed, by checking that the preconditions exist and that auditor and management understand each other.
The preconditions are an acceptable financial reporting framework and management’s agreement that it is responsible for the financial statements, for internal control that allows statements free from material misstatement, and for giving the auditor all relevant information and unrestricted access to people. The auditor must refuse if management imposes a scope limitation that prevents an opinion, the framework is unacceptable, or management will not accept its responsibilities.
The letter must cover objective and scope, the auditor’s responsibilities, management’s responsibilities, the framework, the form and content of reports, and governing law and dispute resolution, plus confidentiality. For recurring audits, the auditor decides each year whether terms need revising or management needs reminding. A request to change terms needs a reasonable justification, or the auditor withdraws.
The objective of ISA 210
The objective of the auditor under ISA 210 is to accept or continue an audit engagement only when the basis on which it is to be performed has been agreed. The auditor does this by:
- establishing whether the preconditions for an audit are present; and
- confirming that auditor and management have a common understanding of the terms.
The preconditions
To establish them, the auditor must:
- decide whether the financial reporting framework to be used in preparing the financial statements is acceptable; and
- obtain management’s agreement that it acknowledges and understands its responsibility for: preparing the financial statements; internal control to make sure they are not materially misstated; and giving the auditor all relevant and requested information and unrestricted access to all personnel.
As the syllabus records elsewhere, the revised ISA 210 introduced these specific procedures. The framework will usually be International Financial Reporting Standards (IFRS), together with Nigerian law. Management’s responsibility for a true and fair view is part of the first of the three.
When the auditor must refuse
The auditor must refuse the engagement if:
- management imposes a limitation on scope such that the auditor would be unable to express an opinion on the financial statements;
- the financial reporting framework is unacceptable; or
- management does not agree to the responsibilities above.
The contents of the engagement letter
The letter states what the auditor will do and what the auditor’s exact responsibilities are. This makes it an important way of reducing the expectations gap, which is the difference between users’ view of the auditor’s role and the auditor’s actual statutory role. The letter must refer to:
- the objective and scope of the audit;
- the responsibilities of the auditor;
- the responsibilities of management;
- identification of the financial reporting framework;
- the expected form and content of any reports to be issued; and
- the governing laws and jurisdiction for resolving disputes.
The syllabus adds the issue of confidentiality, for both auditor and client, with guidelines on providing sensitive information and restrictions on its use.
Optional additions
The auditor may think it right to include:
- the regulations, ISAs and ethical pronouncements that will guide the audit;
- a statement that, because of the inherent limits of an audit and of internal control, there is an unavoidable risk that some material misstatement may not be detected even though the audit was properly planned and performed under the ISAs;
- arrangements for planning and performing the audit, including the audit team’s composition;
- the expectation that management will give written representations;
- the basis on which fees and expenses are computed and billing and payment terms;
- signature lines for auditor and client;
- a request that management acknowledge receipt and agree to the terms;
- arrangements for the involvement of other auditors, experts or internal auditors; and
- any limit on the auditor’s liability for errors or omissions where that is possible, including professional indemnity cover.
Best practice also suggests an explanation of the auditor’s responsibility for anti-money laundering checks and procedures.
Annual review of the letter
The first letter may say that its terms apply to all future audits until revised. For recurring audits, however, ISA 210 requires the auditor to assess whether circumstances mean that the terms need to be revised, and whether management needs to be reminded of the existing terms. Factors that may show that this is needed are:
- any sign that the entity misunderstands the objective and scope of the audit;
- any revised or special terms of the engagement;
- a recent change of senior management;
- a significant change of ownership;
- a significant change in the nature or size of the business;
- a change in legal or regulatory requirements;
- a change in the financial reporting framework; and
- a change in other reporting requirements.
A request to change the terms
The entity may ask the auditor to change the terms. This may be from a real change in circumstances or from a misunderstanding of what an audit is. It may also arise where the auditor cannot obtain sufficient appropriate evidence on a material item and the entity asks to change to a review engagement to avoid a qualified opinion or a disclaimer.
ISA 210 requires the auditor to consider the justification for the request and whether it is reasonable. If it is, revised terms are agreed and recorded. If the auditor cannot agree to a change, he must withdraw from the engagement and consider whether there is any obligation to report the circumstances to those charged with governance, the owners or regulators.
The rules in more depth
Why the preconditions come first
An audit is only possible if the basis is right. Without a recognised framework, the auditor has nothing to measure against. Without management’s acceptance of its responsibilities, the auditor could end up preparing the accounts or carrying the blame for weak controls. Without access to information and people, the auditor cannot gather evidence. So the standard checks these before the work starts, and refuses if they are missing.
Why a change to a review is a warning sign
An audit gives reasonable assurance and a review gives limited assurance. If a client wants to drop to a review exactly when the auditor cannot get evidence, the real motive may be to avoid a modified opinion. Changing the engagement so that the user gets less comfort, without telling users why, would mislead them.
That is why the auditor tests whether the reason is reasonable, and why a change to avoid a qualification is not.
How the letter helps in a dispute
If a client later claims that the auditor should have found a fraud, the letter shows that management was responsible for preventing and detecting fraud, and that the audit carries inherent limits. It is evidence for the auditor’s defence in a negligence claim, alongside the working papers.
Worked example: a client wants less than an audit
Scenario. Ife and Co is the auditor of Okin Plastics Ltd. During the audit, the team cannot get access to the records of a subsidiary, which hold ₦120 million of inventory. The managing director says the subsidiary’s records are “private”. He asks Ife and Co to change the engagement to a review of the financial statements, so that a qualified opinion is not needed.
The engagement letter was signed three years ago and says its terms apply to all future audits. Ownership of Okin changed last year. Advise.
- Preconditions. One precondition is that management gives unrestricted access to information and personnel. Refusing access to the subsidiary’s records breaches management’s agreed responsibility.
- Scope limitation. If management imposes a limitation that stops the auditor from expressing an opinion, the auditor must refuse the engagement. Here the limitation arose during the audit, so it must be dealt with under the terms.
- The request. The auditor must consider the justification and whether it is reasonable. The reason, avoiding a qualification, is not reasonable, since it would give users less assurance without explanation.
- Result. If Ife and Co cannot agree to the change, it must withdraw and consider whether to report the circumstances to those charged with governance, owners or regulators. If it stays, the opinion must be modified for the scope limitation.
- Annual review. A significant change in ownership last year was a reason to revise the terms or remind management. The firm should have done so, and should now issue an updated letter that sets out management’s responsibility for access.
- Conclusion. Refuse the change to a review, press for access, and if it is still refused, modify the opinion or withdraw, and update the engagement letter.
How to score full marks
- For “contents of the engagement letter”, give the six required items first, then confidentiality, then as many of the optional items as marks allow. Say why each matters in half a sentence.
- Explain why the letter matters. It narrows the expectations gap, protects both sides and evidences the agreed responsibilities.
- For preconditions, state the framework and the three management acknowledgements. Add the three grounds for refusal.
- For a change-of-terms request, follow the standard. Justification, reasonableness, revised terms recorded or withdrawal, and consider reporting.
- For recurring audits, list the factors. Eight triggers, with a mention of ownership and management changes.
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Saying the engagement letter makes the auditor responsible for preparing the financial statements. Management does.
- Leaving out the governing law and dispute resolution.
- Forgetting to mention that the letter reduces the expectations gap.
- Saying the first letter applies for ever with no review.
- Agreeing to a change to a review to avoid a qualification.
- Forgetting that the auditor must consider reporting if he withdraws.
- Mixing up the preconditions with the optional contents.
Quick revision
- Objective: accept or continue only when the basis is agreed: preconditions present and common understanding.
- Preconditions: acceptable framework; management accepts responsibility for statements, internal control and access to information and people.
- Refuse if scope limited so no opinion possible, framework unacceptable or management refuses responsibilities.
- Letter: objective and scope, auditor’s responsibilities, management’s responsibilities, framework, form and content of reports, law and jurisdiction; plus confidentiality and optional items.
- Annual review triggers: misunderstanding, special terms, new management, ownership change, size or nature change, legal change, framework change, reporting change.
- Change of terms: reasonable justification or withdraw and consider reporting.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. The objective of ISA 210 is to accept or continue an audit only when:
- The fee is high
- The basis on which it is to be performed has been agreed
- The client is listed
- The auditor is a partner
Show the answer
B. The basis must be agreed.
Question 2. Which is NOT a precondition for an audit?
- An acceptable financial reporting framework
- Management accepts responsibility for the financial statements
- Management accepts responsibility for providing access to information and people
- The auditor prepares the financial statements
Show the answer
D. Management prepares them.
Question 3. The auditor must refuse an engagement where:
- Management imposes a scope limitation preventing an opinion
- The client is small
- The fee is agreed
- The client uses IFRS
Show the answer
A. Also if the framework is unacceptable or management refuses its responsibilities.
Question 4. Which item must the engagement letter include?
- The governing laws and jurisdiction for resolving disputes
- The auditor’s holiday plans
- The client’s tax number only
- A list of staff salaries
Show the answer
A. One of the six required items.
Question 5. The engagement letter helps reduce the:
- Expectations gap
- Audit fee
- Tax charge
- Number of staff
Show the answer
A. It states the auditor’s real responsibilities.
Question 6. A factor that may show the terms need revising for a recurring audit is:
- A significant change in ownership
- A new office carpet
- A change of auditor’s logo
- A holiday
Show the answer
A. A change of ownership.
Question 7. A request to change an audit to a review to avoid a qualified opinion should be:
- Accepted at once
- Considered for justification and reasonableness
- Ignored
- Accepted if the fee is cut
Show the answer
B. Avoiding a qualification is not a reasonable justification.
Question 8. If the auditor cannot agree to a change of terms, he should:
- Continue under the old terms in silence
- Withdraw and consider whether to report the circumstances
- Issue an adverse opinion
- Dismiss management
Show the answer
B. To those charged with governance, owners or regulators, if required.
Question 9. The statement that an audit carries an unavoidable risk that some material misstatement may not be detected is:
- An optional addition to the letter
- Forbidden in a letter
- A required fee term
- A tax disclosure
Show the answer
A. It reflects the inherent limits of an audit and of internal control.
Question 10. Best practice suggests the letter should also explain:
- The auditor’s responsibility for anti-money laundering checks
- The partner’s salary
- The client’s sales targets
- The audit committee’s fees
Show the answer
A. Anti-money laundering checks and procedures.
Written questions
Question 11 (10 marks). Explain the objective of ISA 210, the preconditions for an audit and the circumstances in which the auditor must refuse an engagement.
Question 12 (20 marks). (a) Describe the contents of an audit engagement letter. (10 marks) (b) Explain why the letter is important. (4 marks) (c) Explain how the terms of recurring audits should be reviewed. (6 marks)
Question 13 (10 marks). Mark and Co audits Lekki Retail Ltd. After a change of ownership, the new owners tell the auditors they will not agree to take responsibility for internal control. Ask the firm to design the controls and also to change its engagement to a review after the audit team could not confirm inventory of ₦90 million. Advise Mark and Co. (10 marks)
Model answers
Show the model answer to Question 11
Objective. To accept or continue an audit only when the basis on which it is to be performed has been agreed, by establishing that the preconditions are present and confirming a common understanding between auditor and management. (2.5)
Preconditions. The financial reporting framework to be used is acceptable (1.5). Management agrees that it acknowledges and understands its responsibility for preparing the financial statements (1.5), for internal control that keeps the statements free from material misstatement (1.5), and for giving the auditor all relevant and requested information and unrestricted access to all personnel (1.5).
Refusal. The auditor must refuse if management imposes a scope limitation that would stop him expressing an opinion, the framework is unacceptable, or management does not agree to its responsibilities. (1.5)
Show the model answer to Question 12
(a) Contents (10 marks). Required:
- objective and scope
- auditor’s responsibilities
- management’s responsibilities
- the financial reporting framework
- the expected form and content of reports
- governing law and jurisdiction for disputes (6, 1 each)
Confidentiality for both sides (1).
Optional: the regulations, ISAs and ethics guiding the audit; the inherent limits of audit and internal control; arrangements for planning and the team; expectation of written representations; the basis of fees, billing and payment terms; signature lines and a request to acknowledge and agree; arrangements for other auditors, experts and internal auditors; and limits on liability including professional indemnity cover (3, any six at 0.5).
(b) Importance (4 marks). It states what the auditor will do and the exact responsibilities, which reduces the expectations gap (1.5). It records management’s responsibilities, such as for fraud prevention and internal control (1). It evidences the agreed basis in a dispute or negligence claim (1). It records fees and scope so that both sides know them (0.5).
(c) Annual review (6 marks). The first letter may say it applies to future audits until revised. But ISA 210 requires the auditor to decide each year whether terms need revising and whether management needs reminding (2).
Factors: misunderstanding of the audit’s objective and scope; special terms; a change of senior management; significant change of ownership; change in nature or size of the business; change in legal or regulatory requirements; change in the framework; and change in other reporting requirements (4, any eight at 0.5).
Show the model answer to Question 13
Management’s responsibilities (3 marks). Management’s agreement that it is responsible for internal control is a precondition for an audit. If the owners will not agree, the auditor must refuse the engagement. (2) The firm may advise but must not take on management’s responsibility for designing or controlling internal control, which would also create self-review and management-role threats. (1)
Request to change to a review (4 marks). The auditor must consider the justification and whether it is reasonable (1.5). Not being able to confirm ₦90 million of inventory is a problem of evidence, and changing to a review to avoid a qualified opinion or disclaimer is not reasonable, as users would get less assurance without being told why (2).
If the request cannot be agreed, the firm must withdraw and consider reporting to those charged with governance, owners or regulators (0.5).
Annual review and conclusion (3 marks). A significant change of ownership is a trigger to revise the terms or remind management, so the firm should update the letter (1.5). Conclusion: refuse unless management accepts its responsibilities, do not agree to the change to a review, and record the decisions (1.5).
Pathfinder on ISA 210 and engagement letters
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
No written question in these two diets tests this topic on its own. The scenario questions can still bring in the engagement letter, for example as a way to reduce the expectation gap or as a response to risk found at acceptance.
Revise first: The contents of the engagement letter
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
