Group audits and working with component auditors

A group audit is the audit of group financial statements. The parent’s auditor signs the opinion, but some subsidiaries, often abroad, are audited by other firms. The group auditor carries the whole responsibility and cannot hide behind them. This topic covers how the group auditor decides what to audit, how much to do personally, and how to direct and check the other firms.

It is tested in both recent diets. November 2025 asked for scope, risk assessment, materiality and the group auditor’s involvement in a scenario with subsidiaries in three countries. May 2026 asked for the reports a component auditor sends and the instructions the group auditor gives. Learn the structure here and you can answer either style.

Key terms in ISA 600

The syllabus lists the standards you need alongside ISA 600: International Financial Reporting Standard (IFRS) 3 on business combinations, IFRS 10 on consolidated statements, IFRS 11 on joint arrangements, IFRS 12 on disclosure of interests, International Accounting Standard (IAS) 27 on separate statements, IAS 28 on associates and joint ventures, and IAS 24 on related parties, because companies in a group are related to each other.

Why a group audit is harder

• A group may include many companies, some foreign, reporting in other currencies and perhaps using local accounting practices instead of IFRS.
• Year ends may differ.
• Consolidation adjustments must be made or audited.
• Some companies may be audited by a firm that is not the parent’s auditor.

The audit of each company follows normal audit principles. This topic is about the extra considerations that come from putting the group statements together.

Accepting the appointment as group auditor

The auditor of the parent normally acts as group auditor, but this is technically a separate appointment. The firm must meet the acceptance requirements of ISA 220. Must have a reasonable expectation of obtaining sufficient appropriate evidence about the consolidation process and the financial information of components to reduce audit risk to an acceptable level.

To form that expectation, the firm obtains an understanding of the group and its components and decides:

• which components are significant;
• which significant components are audited by other firms; and
• whether the group engagement team will be able to be involved enough in the audit of significant components to obtain evidence.

If the group auditor cannot be involved in the audit of a significant component, it is unlikely to obtain enough evidence. It should not accept the engagement or should resign. If the law prevents resignation, the auditor issues a disclaimer of opinion on the group statements.

Understanding the group and the component auditors

The group auditor identifies and assesses risks of material misstatement under ISA 315. That means building on the understanding gained at acceptance, and understanding the consolidation process, including the instructions management sends to components. This lets the group auditor confirm or revise its first view of which components are significant.

Before asking a component auditor to do any work, the group auditor assesses:

1. whether the component auditor understands and will comply with the ethical requirements that apply to the group audit, in particular independence;
2. the component auditor’s professional competence;
3. whether the group engagement team can be involved in the component auditor’s work as much as is needed; and
4. whether the component auditor works in a regulatory environment that actively oversees auditors.

The group auditor cannot rely on a component auditor’s work without assessing its quality. If the component auditor is not independent, or there are serious doubts on the other points, the group auditor must obtain the evidence on that component without asking the component auditor to do any work.

Scope determination and group risk assessment

Scope determination

Scope determination means deciding which components, account balances or classes of transaction will be audited, and how much work each will receive. Its purpose is to make sure the group auditor gets sufficient appropriate evidence to bring the risk of material misstatement in the group statements to an acceptably low level, and to spend audit effort where the risk is.

Group risk assessment

Group risk assessment is the process of identifying and assessing the risks of material misstatement in the consolidated statements, by understanding the group, its environment and its controls over financial reporting. Its purpose is to set the group strategy and decide the nature, timing and extent of the work. Typical group-level risks are:

• Consolidation. Complex adjustments, goodwill, and the elimination of inter-company transactions and balances, including transfer pricing.
• Different regulation and accounting policies. Subsidiaries in different countries may apply policies that differ from group IFRS policies.
• Foreign currency. Translation of foreign results and balances.
• Special assets. Key assets, such as intellectual property or artificial intelligence (AI)-based assets, held in a small subsidiary that influence group value.
• Related parties. Most components are related to each other, so IAS 24 disclosure and the completeness of related party lists matter.
• Different year ends and local audit thresholds that complicate the timing and the materiality.

Group and component materiality

The group auditor sets:

• Group materiality for the group financial statements as a whole, usually a percentage of a benchmark such as profit before tax, total assets or revenue, chosen to reflect what the users care about most; and
• Component materiality for those components where a component auditor will audit or review for the group.

Component materiality is normally lower than group materiality, so that the total of uncorrected and undetected misstatements across components does not exceed group materiality. If a component has been audited in its own right under local law and the group auditor wants to use that audit, it must check the materiality used. If the threshold was too high, more work may be needed.

Qualitative factors also matter, such as regulatory sensitivity and the expectations of stakeholders, which may justify a lower amount.

Background: ISA 600 does not fix a percentage. Because misstatements at different components are unlikely to all go in the same direction, the group auditor may accept that the total of the component materiality amounts is greater than group materiality. But each amount must stay below group materiality. The group auditor also sets a threshold above which misstatements are not clearly trivial, and tells the component auditors.

Communication with component auditors

Without clear two-way communication, the group auditor might not get the evidence it needs. The group auditor writes a letter of instruction, and the component auditor replies with a report of work performed. Communication need not all be written. A meeting to discuss significant risks, or a review of the component auditor’s files, can also take place, but must be documented under ISA 230.

The component auditor gives access to relevant documentation unless the law prevents it.

Group auditor’s letter of instruction

The letter sets out:

1. the work required;
2. the use that will be made of the work; and
3. the form and content of the component auditor’s communication.

It also includes a request for cooperation, the ethical requirements (especially independence), component materiality and the clearly trivial threshold, the significant risks identified, and a list of related parties that the group knows about, with a request to report any others. It states the timetable agreed with those charged with governance of the group.

Component auditor’s confirmation

ISA 600 gives an example in which the component auditor confirms that it will comply with the instructions or says which it cannot, understands them, will cooperate and give access to documentation, understands the ethical and auditing standards and the reporting framework, is independent of the parent and other components, and has the special skills needed.

Component auditor’s report of work performed

The report includes:

1. a statement of compliance with ethical and group auditor requirements;
2. identification of the financial information on which the component auditor is reporting;
3. any non-compliance with laws and regulations that could lead to a material misstatement of the group statements;
4. a list of uncorrected misstatements of the component’s financial information;
5. indicators of possible management bias;
6. any material weaknesses in internal control that were identified;
7. any other significant matters that the component auditor expects to communicate to those charged with governance of the component;
8. any other matters that may be relevant to the group audit; and
9. the component auditor’s overall findings, conclusions or opinion.

The group auditor’s involvement in component work

The group auditor decides what work is done on a component and how involved to be. For significant components the group auditor must, as a minimum:

• discuss with component management or the component auditor the business activities of the component that matter to the group;
• discuss with the component auditor the risk of material misstatement of the component’s financial information; and
• review the component auditor’s documentation of the significant risks of material misstatement of the group statements.

Where significant risks have been identified at a component, the group auditor evaluates the further procedures that will respond to them and considers whether to be involved in those procedures.

Involvement might include meeting component management or auditors to understand the component, reviewing the component auditor’s overall strategy and plan, performing risk assessment procedures at the component, designing or performing further procedures, attending closing or other key meetings, and reviewing other relevant parts of the component auditor’s documentation.

For other components, the degree of involvement depends on what the group auditor knows about the component auditor. If it has concerns about competence or about weak local regulation, it may get involved in the component auditor’s risk assessment.

In every case the group auditor evaluates the component auditor’s report of work performed. If the work is insufficient, the group auditor decides what extra procedures are needed and whether the component auditor or the group team will carry them out.

The rules in more depth

Sole responsibility and the group audit report

The group auditor is solely responsible for the opinion on the group statements. The report does not refer to component auditors unless the law requires it. If it does, the report must say that the reference does not reduce the group auditor’s responsibility.

The revised ISA 600

Background: ISA 600 (Revised) applies to audits of group financial statements for periods beginning on or after 15 December 2023. It takes a risk-based approach to scoping instead of starting from significant components, and it applies the ordinary ISA risk and evidence framework to the group audit. It still requires the group engagement team to be sufficiently and appropriately involved and to evaluate the component auditors.

The syllabus and the exam use the older terms, so learn the structure in this topic and mention the revised standard only as extra context.

Why the group auditor still does some work itself

The group auditor always does the work on the consolidation process and on the group-level analytical procedures, and keeps control of the strategy, because the opinion is its own.

Worked example: a group with four components

Scenario. Harbour Group Plc has group revenue of ₦100 billion and profit before tax of ₦8 billion. Group materiality is set at 0.5% of revenue, which is ₦500 million. Four components are in the group:

Materiality. The group engagement team sets component materiality at about 50% of group materiality for A and B, which is ₦500 million × 50% = ₦250 million. This is illustrative, because ISA 600 sets no percentages. The team writes the amounts in the letters of instruction, together with the clearly trivial threshold.

Involvement. The auditors of A and B are in Ghana and Sierra Leone and were chosen by the local boards.

The group team assesses their independence, competence and the regulation in their countries, then discusses significant risks with each, reviews their documentation of those risks and attends the closing meeting for B. For C the group team performs the valuation work itself because the risk is high and the asset is critical.

After the reports of work performed arrive, the team evaluates them and asks for extra work where the lists of uncorrected misstatements show gaps.

How to score full marks

• Use the scenario’s components by name. Say which is significant by size, which by risk and which is not significant, and give the work for each.
• Separate concept from purpose. A question on scope or group risk wants both, in that order.
• List the four assessments of a component auditor. Independence and ethics, competence, extent of involvement possible, and regulation.
• Name the documents. Letter of instruction and report of work performed, with their contents.
• State sole responsibility. The group auditor gives the opinion and does not share it.

Common mistakes in the exam

• Saying that the group auditor can rely on a component auditor without checking.
• Confusing a group audit with a joint audit. In a group audit one firm is responsible for the opinion. In a joint audit the firms share it.
• Setting component materiality equal to or above group materiality for each component.
• Writing a generic list of audit procedures instead of ones for components.
• Referring to the component auditor in the group audit report as if responsibility were shared.
• Forgetting that the letter of instruction contains the related party list and the significant risks.

Quick revision

• Group auditor is solely responsible for the group opinion.
• Accept only if the firm can be involved enough in significant components.
• Assess component auditors: ethics and independence, competence, possible involvement, regulation.
• Components: significant by size (audit), significant by risk (audit, balances or procedures), others (analytical review plus extra work).
• Component materiality below group materiality.
• Letter of instruction out, report of work performed back. Evaluate the report.
• Minimum for significant components: discuss activities, discuss risks, review documentation of significant risks.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.