ISA 210 in Practice - Acceptance and Continuance decisions

Why ISA 210 is the most underestimated standard in the audit file?

When an audit fails, the post-mortem usually starts in the fieldwork - the confirmation that wasn’t sent, the journal that wasn’t tested, the explanation that wasn’t challenged.

That is where the evidence of failure sits. It is rarely where the failure starts. Long before the first sample is drawn, a firm has decided to take on a client – or, more often, has decided for the fifth or tenth year running not to stop. Those decisions set the team, the risk appetite and the terms of everything that follows. Get them wrong and the fieldwork is not a safeguard; it is damage limitation.

Regulators have been making this point with increasing force. Four enforcement cases, from different regulators, show what happens when acceptance and continuance is treated as paperwork.

MARCUM LLP · US SEC AND PCAOB · 2023

During the SPAC boom, Marcum took on more than 600 new SPAC clients in a single year, a near six-fold increase, churning out audits at an unsustainable pace causing widespread quality control and audit standard violations. Throughout the SPAC boom of the last several years, Marcum prioritized increased revenue over audit quality: its aggressive pursuit of business growth far outpaced any commensurate development of an already weak system of quality controls. The SEC found that its quality controls failed across the engagement cycle, starting with client acceptance: new clients were accepted without proper regard to staffing capacity, and although firm policy called for background checks on client management team, the firm did not actually require those reports to be received and reviewed before acceptance. Marcum paid $10 million to the SEC and $3 million to the PCAOB.

Source: SEC press release 2023-114

Acceptance has two halves. One is about the client, is management trustworthy? The other is about the firm, do we have the people, time and expertise to do this properly? A policy that is not enforced before the decision is taken is not a control. The integrity checks and the capacity assessment must be complete, reviewed and on file before the engagement is accepted, not after the team is already in the field.

RELIANCE HOME FINANCE · NFRA, INDIA · 2024

The previous auditor, Price Waterhouse, reported suspected fraud involving approximately ₹7,900 crore in loans under Section 143(12) of the Companies Act, 2013, before resigning without issuing an audit report.

The incoming firm, Dhiraj & Dheeraj, accepted the engagement despite these significant warning signs. NFRA subsequently found that the firm had failed to comply with relevant engagement acceptance requirements and had not adequately assessed or responded to fraud risks.

In its April 2024 order, NFRA imposed penalties of ₹1 crore on the firm, ₹50 lakh on the engagement partner and ₹10 lakh on the engagement quality control reviewer. The two partners were also debarred for five and three years, respectively.

Source: NFRA order, April 2024

When an auditor resigns after reporting fraud, that is the single most important fact an incoming auditor can know about a client’s integrity. Communication with the predecessor is a legal requirement under the Chartered Accountants Act, but its real purpose is evidential: it is how the new auditor learns why the last one left. Accepting first and asking afterwards inverts the logic of the entire process, and concluding “no fraud risk” at acceptance, in those circumstances, is a judgement no file can support.

STIRLING WATER SEAFIELD FINANCE · FRC, UK · 2025

EY continued as auditor of Stirling Water Seafield Finance for the 2019 year even though mandatory audit firm rotation rules meant it was no longer eligible to do so. The FRC found that the firm and the engagement partner had failed to ensure that appropriate continuance procedures were followed, and that EY’s policies did not allow it to assess properly whether the conditions on the length of the engagement were met before continuing. EY was fined £325,000 and the partner £32,500.

Source: FRC sanctions announcement, April 2025

Independence is not settled once at acceptance and then assumed. Rotation limits, tenure, non-audit services and fee levels all change over time, which is exactly why they belong in every continuance decision. A firm that relies on last year’s answer can find itself performing an audit it is no longer permitted to perform. The FRC’s message was explicit: these checks must happen at both the engagement and the firm level, before the work continues.

BDO USA AND GENERAL EMPLOYMENT ENTERPRISES · US SEC · 2015

BDO had audited General Employment Enterprises since 2004. During the 2009 audit, $2.3 million, about half the company’s assets, went missing, supposedly invested in a certificate of deposit the bank had no record of. As part of its own client retention procedures, BDO ran background checks on the new CEO and an associate, which revealed a fraud lawsuit, links to a person the SEC had charged, and tax liens. Management gave BDO conflicting stories. BDO demanded an independent investigation, then, days later, withdrew the demand after the CEO resigned and his replacement asked BDO to conclude the audit, and issued a clean opinion. One partner described the purpose of that discussion as an effort to salvage the account. In 2010 a criminal complaint alleged the deposit had never existed; BDO’s client retention memo still recommended continuing, partly because the chairman had not yet been formally charged. The SEC found BDO had relied on representations from individuals it did not trust. BDO admitted wrongdoing and paid about $2.1 million; five partners were sanctioned.

Source: SEC administrative order 34-75862

BDO’s retention process generated exactly the right information, background checks, missing funds, contradictory explanations, and later a criminal complaint, and then concluded, twice, that the relationship should continue. Three lessons follow. First, integrity concerns are not resolved by a change of personnel, the question is what the evidence says about the entity, not whether a new face is more agreeable. Second, the threshold is not a criminal charge. ISQM 1 asks whether information indicates that the client lacks integrity, which is a far lower bar. Third, a desire to keep the client is a risk factor in its own right and is precisely what ISQM 1 means when it requires that financial priorities do not drive acceptance and continuance judgements. The SEC’s order required BDO to review its client acceptance and retention policies.

None of these firms lacked a policy, in every case the failure was the same: the process existed on paper but did not drive the decision.

That is the gap ISA 210, together with ISQM 1 and ISA 220, is designed to close.

ISA 210, Agreeing the Terms of Audit Engagements, is often treated as the standard that produces the engagement letter, necessary, procedural and quickly filed. That reading misses its purpose.

At its core, ISA 210 forces two questions before any audit work begins. Is an audit genuinely possible with this client? And do the auditor and those responsible for the financial statements share the same understanding of what the audit is, who is accountable for what, and what will be reported? If either answer is uncertain, the standard’s position is clear: the auditor should not proceed.

Crucially, the objective applies to accepting or continuing an engagement.

The standard works alongside the quality management framework. Matters within the auditor’s own control, the client’s integrity, the firm’s competence and capacity, independence, are addressed by ISQM 1 at firm level and ISA 220 (Revised) at engagement level. ISA 210 addresses the other side of the relationship: what the client must provide and agree to before an audit can stand.

The standard unfolds in six steps, each a condition for the next:

An audit is an opinion on whether financial statements are prepared in accordance with a set of rules. That makes two things non-negotiable.

An acceptable financial reporting framework: Frameworks issued by recognised standard setters – Ind AS, IFRS etc are presumed acceptable for general purpose statements. Anything else requires the auditor to judge whether the criteria are relevant, complete, reliable, neutral and understandable. Bespoke frameworks deserve scrutiny, a framework designed by management can easily be designed around management.

Management’s acceptance of its responsibilities: An audit does not shift responsibilities for preparing the financial statements and for the internal control needed to prevent material misstatement to the auditor; it is premised on management having accepted them. And the third responsibility, access deserves more attention than it typically receives. Access is a test, not a promise. A signed acknowledgement means little if, in practice, critical evidence such as bank confirmations reaches the auditor only through management.

Some clients want the assurance of an audit without its intrusion, no direct contact with banks, no access to a particular subsidiary, no attendance at the stock count. Where a limitation imposed at the outset is so significant that the auditor expects to disclaim an opinion, the engagement cannot be accepted as an audit, unless law or regulation requires it.

The same applies where the preconditions are absent. The right response is a frank discussion with management, and, if the position does not change, declining the engagement.

Once the foundations are in place, the terms are agreed with management or those charged with governance and recorded in writing, usually in an engagement letter. The engagement letter is the auditor’s first line of defence against the expectation gap, and frequently the first document examined when a dispute arises. It defines what was promised, what was not, and what management undertook to provide.

ISA 210 requires five elements:

The most effective letters go further. They set a timetable for draft financial statements and supporting schedules, confirm the expectation of written representations, and address the involvement of other auditors, experts or a predecessor. A letter that commits management to specific deliverables and dates gives the auditor something concrete to escalate against when those commitments are missed.

Where law or regulation prescribes the terms in sufficient detail, the written agreement need only record that the law applies and that management acknowledges its responsibilities.

This is where ISA 210 is most often honoured in form and neglected in substance. On every recurring audit, the auditor must assess whether circumstances require the terms to be revised, and whether the client needs to be reminded of the existing terms.

The circumstances that should prompt a revision are rarely subtle:

In practice, many firms answer this requirement with a continuance form rolled forward from the permanent file, “no change” ticked, and signed after fieldwork is under way. That is precisely the habit the requirement exists to break, and the habit every one of the four cases above illustrates. The most dangerous phrase in a continuance file is “as previous year”.

Occasionally, before an audit is complete, a client asks to change the engagement, most often to one offering lower assurance, such as a review. The auditor may agree only where there is reasonable justification.

Some reasons are legitimate: a change in circumstances that removes the need for an audit, such as a lender no longer requiring audited accounts, or a genuine misunderstanding about the service required. Others are not. A request that follows closely on the auditor’s inability to obtain evidence on inventory, say, or receivables should be treated as audit evidence in its own right. It frequently signals an attempt to avoid a modified opinion.

Where the auditor cannot agree to the change and management will not permit the original engagement to continue, the auditor should withdraw where the law allows and consider whether there is an obligation to report the circumstances to those charged with governance, owners or regulators. Where a change is justified, the report on the new engagement should make no reference to the original audit.

ISA 210 also addresses situations in which law or regulation supplements the accounting standards, prescribes a framework that would otherwise be unacceptable, or dictates the form of the auditor’s report. The guiding question in each case is whether users could be misled. Where they could, additional disclosure or explanation is required; where that is not achievable, the auditor should decline unless the law compels the engagement (paras 18–21).

The gap between what ISA 210 requires and how it is often applied comes down to one structural habit: treating acceptance and continuance as a document rather than a decision. Completed once, filed permanently and rolled forward, it gradually stops being an exercise of judgement at all.

Smart Audit is designed to close that gap. Acceptance and continuance are embedded in every year’s audit as the opening stage of the engagement, not stored in the permanent file. Each year, the team must consider afresh what has changed whether the preconditions still hold, and whether the terms need to be revised or reaffirmed, before planning can begin. The result is a continuance decision that is genuinely made, every year, by the people responsible for the audit.