Group Audit Standards Are Changing. Are You Ready?
Generally speaking, group audits should be far more common than they actually are!
On top of that, the new group audit requirements kick in next year, with some major changes: They have created a whole new class of “referred-to” auditors that must be considered when performing a group audit. And it’s time and past time to start preparing for that now.
The American Institute of Certified Public Accountants’ (AICPA) Auditing Standards Board (ASB) issued SAS 149 that revises the definition of a “component auditor” and takes an updated risk-based approach to planning and performing a group audit. Issued in March 2023, SAS 149 goes into effect for audits of group financial statements for periods ending on or after December 15, 2026.
Before we get into that, it’s vital to know that numerous times, auditors miss the fact that a group audit is necessary in the first place. That’s because determining what is and isn’t a “component” can be simple, but it’s not always obvious.
Depending on how management runs its operations, a company can be a single entity with two or more different business activities means a group audit is necessary.
When dealing with a single entity, many times, auditors see a single business or business line and miss what is really a separate “component” requiring a group audit, unless they have a consolidation of two or more subsidiaries staring them in the face.
The question you should be asking yourself is, does the company have multiple product lines, service lines, branches, or anything else where the CFO and the CEO of the company manage their operations by tracking the performance of those multiple product or service lines? Are there multiple locations or divisions?
It doesn't necessarily mean the company has to have a subsidiary or another legal entity that they control. Auditors are required to use professional judgment to determine whether a business activity represents a component, regardless of whether it is a separate legal entity.
The current standard
Group financial statements can include aggregated financial information from entities or business units like branches or divisions. If business units with separate management, locations, or information systems are aggregating financial information, you need a group audit. Here are some examples:
- Combined financial statements, when for example two companies are owned by the same person
- Consolidated financial statements, in which a company owns another company
- A joint venture
- A company organized by geography, for example American, Canadian and European units, each with their own general ledger
- A company with different business activities where performance is tracked separately
- A company that reports an equity method investment on its balance sheet
Look at business activities first and determine if they are significant in terms of dollar amounts, or materiality, or if there’s a high risk in that part of the operations. Follow the flow of the numbers!
SAS 149 kicks in
Alongside the work of component auditors cited — for whose work the group auditor is responsible — there’s a new category: Referred-to auditors
These are secondary auditors, brought in to issue their own opinion on a particular part of the operations that the group auditor will reference in their work. The new group audit standards make clear that the work of the referred-to auditor is relied upon in the final group audit, but was not carried out by the group auditor.
These referred-to auditors are not component auditors under the terms of SAS 149, Special Considerations — Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors).
SAS 149 is effectively telling group auditors to say very clearly, “Hey, we didn’t look at this part of the operation but we are referring to and relying upon this opinion.”
The new standards also make clear that component auditors are part of the engagement team, whereas referred-to auditors are not.
Risks grow
For all that, the addition of referred-to auditors is not SAS 149’s most significant change: It provides an updated risk-based approach to planning and performing group audits.
Under the existing standard a group engagement team is required to identify significant components at which to perform audit work.
However, SAS No. 149 directs the group auditor to use professional judgment in determining the components at which to perform procedures, based on assessed risks.
Just like the auditor is required to use professional judgment in determining what should or shouldn’t be a group audit.
Collemi Consulting leverages over three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.



