How to Manage a Statutory Audit Engagement End to End (with Checklist)

Short answer: Run a statutory audit as six stages, each with an owner and evidence: accept and get appointed (Companies Act s.139 and s.141, terms agreed under SA 210), plan (SA 300), do the fieldwork and document it as you go (SA 230), complete (written representations under SA 580 and an engagement quality review under SQC 1), report (SA 700, s.143 and CARO 2020), then close out by generating the UDIN on the ICAI portal and assembling the file within 60 days of the report.^[1][5]

Last updated 13 October 2026. Checked against ICAI and MCA sources listed at the end. This is a practical workflow for firms, not a substitute for the standards themselves: read the full SA and the Companies Act text for each engagement.

Most audit firms know the standards. Where engagements slip is the handover between stages: the engagement letter that wasn't signed before fieldwork, the PBC list chased on WhatsApp, the representation letter dated after the report, the UDIN generated on day 59. This guide puts every stage in one checklist with an owner and a piece of evidence, so a partner can see at a glance what is done and what is blocking the report.

What are the stages of a statutory audit engagement?

The statutory audit checklist

Use this as the task list for each engagement. "Owner" is a suggestion for a typical firm with a partner, a manager and staff or articled assistants.

How is a statutory auditor appointed under the Companies Act?

The company appoints the auditor at its first annual general meeting to hold office until the conclusion of the sixth AGM, and files a notice in Form ADT-1 with the Registrar within 15 days of that meeting. Before the appointment, the auditor must give written consent and a certificate that the appointment meets the conditions of the Act, including eligibility under s.141.^[1]

Two variations matter for planning:

• First auditor. For a company other than a government company, the Board appoints the first auditor within 30 days of registration, to hold office until the first AGM (s.139(6)).^[1]
• Rotation. For listed companies and the prescribed classes, an individual cannot serve more than one term of five consecutive years, and a firm no more than two such terms, followed by a five-year cooling-off period (s.139(2)).^[1]

Put the rotation end date on the engagement record when you accept. It is easy to miss in year five.

What goes in the engagement letter under SA 210?

SA 210 deals with the preconditions for an audit and the terms you agree with management. The revised standard's appendix carries an illustrative engagement letter.^[2] At a minimum the agreed terms should state the objective and scope of the audit, your responsibilities and management's, the financial reporting framework, and the expected form of the report. For a recurring audit, consider each year whether the terms need revisiting, and don't start fieldwork on an unsigned letter.

How should you plan the audit under SA 300?

SA 300's objective is to plan the audit so that it is performed effectively.^[2] In practice that means an overall strategy (scope, timing, direction) and a detailed plan (the procedures, who does them and when). Turn the plan into dated tasks with owners. Two scheduling habits help:

• Work back from the AGM. The report must be signed in time for the accounts to go to members, so set the signing date first and plan backwards.
• Make dependencies explicit. The representation letter waits on the final accounts; the report waits on the representation letter and the quality review; the UDIN waits on signing.

What does SA 230 require for audit documentation?

SA 230 covers timely preparation of documentation, recording the procedures performed and the evidence obtained, and assembly of the final audit file.^[2] ICAI's own announcement on UDIN restates the assembly rule: the final file should ordinarily be assembled within 60 days of the auditor's report.^[5] After assembly, don't delete or discard documentation before the end of the retention period. Under SQC 1, as amended in 2009, the retention period for audit engagements is ordinarily no shorter than seven years from the date of the auditor's report, or the group auditor's report if later.^[7]

How do you complete the audit: SA 580 and quality review

Written representations. The date of the representation letter must be as near as practicable to, but not after, the date of the auditor's report, and it must cover every period the report refers to.^[3] If management won't give a requested representation, treat it as a signal that something significant may be wrong, not as paperwork to chase.

Engagement quality control review. SA 220 covers the engagement partner's responsibilities for quality, including the role of the engagement quality control reviewer.^[2] Your firm's SQC 1 policies decide which engagements need a review. Schedule the reviewer's time before the signing date, not after.

Is SQC 1 still in force, or SQM 1?

SQC 1 still applies. ICAI issued SQM 1 and SQM 2 in October 2024 to replace SQC 1 from 1 April 2026, but on 31 March 2026 the Council deferred their mandatory date until further announcement. ICAI says SQC 1 "shall continue to remain applicable" until then.^[6] Use the deferral to prepare: SQM 1 asks for a risk-based quality management system, so the firm-wide records you build now (independence, acceptance, monitoring) will carry over.

What must the audit report cover?

Under s.143(2), the auditor reports to the members on the accounts and states whether they give a true and fair view of the company's affairs, profit or loss and cash flows. The report must take into account the Act, the accounting and auditing standards, and any order made under s.143(11).^[1] SA 700 sets the form and content of the report.^[2]

The s.143(3) matters include whether the company has adequate internal financial controls with reference to financial statements and whether they operate effectively (clause (i)).^[1]

CARO 2020 is the order made under s.143(11). It requires reporting on the matters in paragraphs 3 and 4 and does not apply to banking companies, insurance companies, section 8 companies, one person companies and small companies.^[4] It also exempts a private company that is not a holding or subsidiary of a public company, with paid-up capital and reserves of no more than ₹1 crore, bank borrowings never above ₹1 crore in the year, and revenue of no more than ₹10 crore. On consolidated financial statements, only clause (xxi) of paragraph 3 applies.^[8] Build a working for each clause early in fieldwork, not at the end.

Fraud. Where the auditor has reason to believe a fraud of ₹1 crore or more is being or has been committed against the company by its officers or employees, s.143(12) and rule 13 require a report to the Board or audit committee within two days of knowledge, and then to the Central Government in Form ADT-4. Smaller frauds go to the audit committee or Board.^[1]

When do you generate the UDIN?

ICAI requires a UDIN (Unique Document Identification Number) on certificates, reports and documents signed by practising members. Generate it on the ICAI UDIN portal when you sign. If that isn't possible, ICAI allows up to 60 days from the signing date, unless a regulator or stakeholder needs it sooner, and you must communicate it to management or those charged with governance.^[5]

Make UDIN generation a task due on the signing date, and keep your own UDIN register (the ICAI portal lists what you've generated). Practice management software is not the place for this in every case: MyPract, for example, does not track UDINs, so firms using it record the UDIN in their own register.

Where does practice management software help, and where doesn't it?

An audit has two kinds of work: the audit itself (risk assessment, testing, workpapers, review notes) and the engagement around it (dates, owners, client requests, time, billing). Audit software or a well-indexed audit file handles the first. Practice management software handles the second.

If you use MyPract, each audit is an engagement with a client, manager, dates, budget hours and fee. You add the checklist above as tasks with assignees, due dates and dependencies, so "Sign report" can't be ticked before "Representation letter received". The client portal gives the client contacts mapped to that engagement one link to upload PBC documents and message the team, and documents keep their version history. Staff record time against the engagement, managers approve it and lock past periods, and the invoice is created from approved, billable time. The activity log shows who changed what.

What MyPract does not do for audits: it doesn't hold audit workpapers, track UDINs, create engagement letters or provide e-signature (built, but not switched on), and it can't apply a checklist template to an engagement in one step. The AI assistant can suggest a kickoff checklist, but you create the tasks. See /facts for the full list, pricing for costs, and our roundup of practice management software for CA firms for other options. If UDIN tracking matters most, our MyPract vs Jamku comparison covers a tool that offers it.

How we checked

We read the ICAI Board of Studies material on the Companies Act audit provisions and the Standards on Auditing, the MCA's CARO 2020 order, ICAI's UDIN announcement of 17 September 2021, ICAI's SQC 1 retention amendment and ICAI's 31 March 2026 announcement deferring SQM 1 and SQM 2. All were checked on 13 October 2026. MyPract features come from our facts page. No prices or exchange rates are used in this guide.

Frequently asked questions

When must the audit file be assembled after signing the report?

The Standards on Auditing and SQC 1 say the final audit file should ordinarily be assembled within 60 days of the date of the auditor's report. ICAI aligned the UDIN time limit to the same 60 days in September 2021.

How long must a CA firm keep statutory audit working papers?

Under SQC 1 as amended by ICAI in 2009, ordinarily for no less than seven years from the date of the auditor's report, or the group auditor's report if later.

Has SQM 1 replaced SQC 1?

Not yet. SQM 1 and SQM 2 were due to apply from 1 April 2026, but the ICAI Council deferred them on 31 March 2026 until a further announcement. SQC 1 continues to apply.

When should the UDIN be generated for an audit report?

At the time of signing. If that isn't possible, ICAI allows it within 60 days of the signing date, unless a regulator needs it sooner. Communicate the UDIN to management or those charged with governance.

Does MyPract track UDINs or hold audit workpapers?

No. MyPract runs the engagement around the audit (tasks with owners and dependencies, client document requests, time, approvals and invoicing), but it does not track UDINs, hold audit workpapers or provide e-signature. Generate UDINs on the ICAI portal and keep workpapers in your audit file or audit software.

Run your next audit season on MyPract

Set up each audit as an engagement with dependent tasks, collect client documents through the portal and bill from approved time. Three months free, no card.

Sources

[1] ICAI Board of Studies, "Chapter 10: Audit and Auditors" (Companies Act 2013, ss.139–143), checked 13 October 2026.

[2] ICAI Board of Studies, "Auditing Standards, Statements and Guidance Notes: An Overview", checked 13 October 2026.

[3] ICAI Board of Studies, "Completion and Review" (SA 580), checked 13 October 2026.

[4] Ministry of Corporate Affairs, "Companies (Auditor's Report) Order, 2020", S.O. 849(E), 25 February 2020, checked 13 October 2026.

[5] ICAI UDIN Directorate, "Aligning the time limit of generating UDIN from 15 days to 60 days", 17 September 2021, checked 13 October 2026.

[6] ICAI Auditing and Assurance Standards Board, "Announcement on Deferment of Effective Date of SQM 1 and SQM 2", 31 March 2026, checked 13 October 2026.

[7] ICAI, "Announcement on amendment to SQC 1: retention period for engagement documentation", 21 August 2009, checked 13 October 2026.

[8] ICAI, "Guidance Note on the Companies (Auditor's Report) Order, 2020", checked 13 October 2026.