What are group audit instructions?
The group engagement team issues group audit instructions after establishing the group audit strategy and identifying the risks of material misstatement across the group. ISA 600 (Revised) requires these instructions to include the work the component auditor should perform, the component materiality, identified risks relevant to the component, and the form of the component auditor's communication back to the group engagement team. The instructions must be specific enough that the component auditor can plan and perform the work without having to infer what the group engagement team expects.
Under the revised standard, the communication obligation runs in both directions. ISA 600 (Revised) requires the group engagement team to request that the component auditor communicate matters relevant to the group engagement team's conclusion. The component auditor reports back on misstatements identified, indicators of management bias, control deficiencies relevant to the group audit, and any other matters the instructions specified. This is not a courtesy update. The group engagement team needs this information to evaluate whether the evidence from the component is sufficient for the group audit opinion.
Key Points
- Group audit instructions tell the component auditor what to do and at what materiality.
- The group engagement team issues them; the component auditor cannot set their own scope independently.
- The revised standard requires ongoing two-way communication, not just initial instructions.
- Incomplete or late instructions are among the most common causes of group audit file deficiencies.
Worked example: Duval Ingénierie S.A.
Client: French engineering group, FY2024, consolidated revenue €320M, IFRS reporter, with subsidiaries in Germany and Italy and a joint venture in Morocco. The group auditor's firm in Paris appoints component auditors in Munich and Casablanca. The Italian subsidiary is audited directly by the group engagement team.
Munich component auditor
The German subsidiary (Duval Technik GmbH, revenue €88M, 28% of consolidated) has been identified as having specific risks in revenue recognition (long-term construction contracts under IFRS 15) and in the valuation of a €14M intangible asset from a 2022 acquisition. Component materiality is set at €1.28M (40% of group materiality of €3.2M).
Instructions cover: targeted procedures on IFRS 15 revenue (percentage-of-completion on contracts exceeding €5M), valuation testing of intangible asset (€14M carrying amount, amortisation period review), component materiality of €1.28M, reporting deadline, and communication format.
Casablanca component auditor
The Moroccan subsidiary (Duval Maroc S.A.R.L., revenue €19M, 6% of consolidated) has lower individual significance but specific risks in foreign currency translation and in a local tax dispute (estimated exposure €1.2M). Component materiality is set at €960K (30% of group materiality). The lower percentage reflects the cross-border nature of the component and limited direct oversight.
Report back and evaluation
The Munich component auditor reports one unadjusted misstatement of €210K in revenue recognition (percentage-of-completion adjustment) and no issues with the intangible asset valuation. The Casablanca component auditor reports that the tax dispute provision appears reasonable based on legal counsel's assessment but flags a €95K foreign currency translation difference. The group engagement team aggregates both misstatements with findings from the Italian subsidiary and group-level consolidation procedures.
Conclusion: the group audit instructions specified the work and the materiality for each component auditor, along with the expected reporting format. The two-way communication produced evidence the group engagement team could evaluate. Had the instructions been vague (for example, "perform appropriate procedures on the component"), the group engagement team could not have assessed whether the work addressed the identified risks.
What reviewers and practitioners get wrong
Instructions issued too late for the component auditor to plan the work properly are a persistent problem. When the group engagement team finalises its risk assessment in February but the component auditor's reporting deadline is March, the component auditor has to compress planning into weeks. ISA 600 (Revised) does not specify a timeline, but the requirement that the component auditor can plan and perform the work implies instructions must be timely. Regulators view compressed timelines as an indicator of insufficient group audit planning.
Some group engagement teams issue generic instructions that apply identically to every component auditor. The standard requires the instructions to be tailored to each component's risk profile and component materiality. A single template with blanks filled in for the entity name and materiality number does not meet the requirement if the risk areas and the procedures requested are identical across components with different risk profiles.
Key standard references
- ISA 600 (Revised): Requirements for the content of group audit instructions issued to component auditors.
- ISA 600 (Revised): Two-way communication requirements between the group engagement team and component auditors.
- ISA 210: Distinction between the engagement letter (terms of the audit) and group audit instructions (direction of component work).
Related terms
Related reading
Frequently asked questions
What must group audit instructions contain?
At minimum: the work the component auditor should perform, the component materiality set by the group engagement team, identified risks relevant to the component, the form of the component auditor's communication back to the group engagement team, and requirements to communicate fraud indicators and instances of non-compliance. The instructions must be specific enough that the component auditor can plan and perform the work without inferring what the group engagement team expects.
Can the same template be used for every component auditor?
Templates are a starting point, but ISA 600 (Revised) requires the instructions to be tailored to each component's risk profile and component materiality. A single template with blanks filled in for the entity name and materiality number does not meet the requirement if the risk areas and the procedures requested are identical across components with different risk profiles. FRC inspection findings consistently flag this as a deficiency.