Scoping components in a group audit
How a group auditor decides which components need work and sets component performance materiality under ISA 600 (Revised), and how to instruct them.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A family business has grown into a group: a holding company, an operating company in Johannesburg, a property company that owns the buildings, a distribution subsidiary in Nairobi audited by another firm, and a dormant company nobody has closed. The group auditor's first question is not "how do we audit five companies?" It is "what could make the consolidated statements materially wrong, and where in the group does that risk sit?"
ISA 600 (Revised), effective for audits of group financial statements for periods beginning on or after 15 December 2023, moved group audits firmly onto that footing. The old categories of significant and non-significant components are gone. In their place is a risk-based approach: understand the group, assess the risks to the group statements, and then decide where work is needed to respond to them.
Understanding the group and its consolidation
Scoping starts with understanding, and in a group that means three things beyond the usual:
- The group structure: which entities, business units and functions exist, how they are owned and controlled, and which are consolidated, equity-accounted or excluded.
- The consolidation process: who prepares the consolidation, how intra-group balances and transactions are eliminated, how foreign subsidiaries are translated, and what adjustments are made centrally.
- Group-wide controls: common IT systems, shared service centres, central treasury, and how head office oversees the components.
The revised standard lets the group auditor define components to suit the group: by legal entity, by location, by business unit, or by a shared function such as a central payroll. Defining them well makes everything after it easier.
In Achekam, staff can see clients grouped under their parent group, with each group's entities and engagement counts, and can create a group and add entities to it. Building the group there first gives the team one view of every entity before deciding where work is needed.
Achekam has no engine that consolidates the accounts of a group of businesses. The consolidation is prepared outside Achekam, usually by the client, and the group auditor audits that consolidation as part of the group work. How firms prepare consolidated statements without a consolidation engine is covered in consolidated statements without a consolidation engine.
Which components need what work
Once the risks of material misstatement of the group statements are assessed, the group auditor decides at which components work will be performed and what kind. The options include:
- Further audit procedures on the entire financial information of a component.
- Further audit procedures on one or more classes of transactions, account balances or disclosures.
- Specific further audit procedures.
The choice is driven by where the assessed risks sit, not by a size rule. A small component holding the group's derivative contracts may need targeted work on one balance; a large but simple component may be covered adequately by group-level analytics and procedures on the consolidation.
A worked example in words, continuing the group above: the operating company carries most of the revenue and the inventory risk, so it gets work on its entire financial information. The property company's main risk is the valuation of investment property, so work is targeted at that balance. The Nairobi subsidiary is a significant source of receivables, so the component auditor is asked for procedures on receivables and revenue cut-off. The dormant company is covered by analytical procedures at group level and a check that it truly had no transactions.
Component materiality and scope
ISA 600 (Revised) uses precise terms. Where work is performed at a component, the group auditor determines component performance materiality, set lower than group performance materiality to address aggregation risk, and a threshold above which misstatements found in a component must be communicated to the group auditor. Component performance materiality can differ between components.
Group materiality itself is set in the usual way. In Achekam, staff propose overall, performance and clearly trivial materiality from a benchmark with a written rationale, Achekam suggests no percentage, and the engagement partner approves, never the preparer. For each component, the Group Audit Control Tower records the component's scope, its materiality and its component auditor. Use the rationale to explain how each component figure relates to group performance materiality and to the aggregation risk across the group.
Instructions to component auditors
Instructions tell each component auditor what to do and what to report. Typical contents:
- the work required and the component performance materiality and reporting threshold;
- relevant ethical requirements, including independence;
- the significant risks identified for the group that affect the component;
- related parties known to the group auditor;
- what to communicate back, including misstatements above the threshold, non-compliance with laws, indicators of management bias, significant control deficiencies and the component auditor's overall findings;
- deadlines.
In Achekam, staff issue instructions from the Group Audit Control Tower, and each component auditor works through a portal link to acknowledge them, upload deliverables and report misstatements. The token in the link is the only credential, so send it only to the named person at the component firm and treat it like a password. The arrangement is described further in external confirmations and component auditors by link.
Evaluating what comes back
The group engagement partner remains responsible for the group opinion and must be sufficiently and appropriately involved in the component work. When deliverables arrive, evaluate whether they answer the instructions, read the reported misstatements against the threshold, decide whether to review parts of the component auditor's documentation, and consider whether further work is needed at group level.
Group audits generate difficult judgements: whether a component auditor's work is sufficient, how to treat a component whose year end differs from the group's, whether a matter reported by a component changes the group risk assessment. Staff can take a technical consultation from question to conclusion and closure, and record a difference of opinion with each party's position, escalation and resolution.
The IAASB's page on ISA 600 (Revised) describes the standard on group audits, including when component auditors are involved.
Before the group planning meeting
Draw the group structure on one page with each entity's main risks next to it, before anyone discusses scope. Scoping decisions made from the structure chart are rarely the ones made from last year's list of subsidiaries.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
