Audit explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
A chartered accountant can be engaged to do four very different jobs on the same set of numbers: audit them, review them, perform procedures that you specify, or simply help you put them together. The difference is the level of assurance the reader of the report gets, and choosing the wrong engagement is the most common reason a lender, investor or regulator rejects a report. If your records are not yet in shape for any of these engagements, books of accounts and compliance support is the place to start.
The audit is covered by the Standards on Auditing issued by ICAI as in force on 4 October 2026; the other three engagements sit under separate ICAI standards named below. ICAI may revise any of these standards, so check the current text on icai.org before relying on a detail.
An audit gives reasonable assurance (high, but not absolute) and ends in an opinion. A review under SRE 2400 (Revised) gives limited assurance and ends in a conclusion. Agreed-upon procedures (SRS 4400) and compilation (SRS 4410 Revised) give no assurance at all: the first reports factual findings on procedures you agreed, the second reports only that the accountant helped prepare the information. Pick the engagement the user of the report actually needs, because the report cannot be stretched to say more than the engagement allows.
The four engagements at a glance
The standards place each engagement on a ladder. Moving down the ladder, the practitioner does less verification, the report says less, and the cost and time fall.
| Engagement | Governing standard | Assurance | Form of the practitioner's output | Who typically relies on it |
|---|---|---|---|---|
| Audit | Standards on Auditing (SA 200 onwards) | Reasonable assurance | Opinion on whether the financial statements give a true and fair view or are fairly presented | Members, lenders, regulators, tax authorities |
| Review | SRE 2400 (Revised); SRE 2410 for interim information reviewed by the entity's own auditor | Limited assurance | Conclusion in the negative form: nothing has come to attention that suggests the statements are misstated | Management, owners, lenders who do not need a full audit |
| Agreed-upon procedures | SRS 4400 | None | Report of factual findings on the procedures performed | Only the parties who agreed the procedures |
| Compilation | SRS 4410 (Revised) | None | Report stating that information was compiled from what management provided | Management and whoever management shares it with |
Audit: reasonable assurance
SA 200, paragraphs 3 to 5, explains that an audit enhances the confidence of users in the financial statements through an opinion on whether they are prepared, in all material respects, under the applicable framework. The auditor must obtain reasonable assurance that the statements as a whole are without material misstatement, whether from fraud or error. Paragraph 5 says reasonable assurance is a high level of assurance but is not absolute, because most audit evidence is persuasive rather than conclusive.
Paragraph 6 brings in materiality: the auditor is responsible for misstatements that could reasonably influence users' decisions, not for every small error. Paragraph 7 summarises how the auditor gets there: assess risks from understanding the entity, respond to them with evidence, and form an opinion. Our post on SA 200 and reasonable assurance goes through the whole standard; the full list of auditing standards is in our guide to SA 200 to SA 810 and their effective dates.
Review: limited assurance
SRE 2400 (Revised), paragraph 5, calls a review of historical financial statements a limited assurance engagement. Paragraph 7 says the practitioner performs primarily inquiry and analytical procedures, so the work is lighter than the detailed testing of an audit. The standard applies where the practitioner is not the auditor of the entity's statements (paragraphs 1 and 2). Paragraph 8 adds a safety valve: if the practitioner becomes aware of something that suggests the statements may be materially misstated, further procedures must be designed and performed until a conclusion can be reached.
The report therefore gives comfort, but a lower grade of it. Our articles on SRE 2400 (Revised), part 1 explain acceptance and procedures in detail.
Agreed-upon procedures: findings, not assurance
Under SRS 4400, paragraph 4, the auditor carries out procedures of an audit nature that the auditor, the entity and any appropriate third parties have agreed, and reports the factual findings. Paragraph 5 is explicit that no assurance is expressed; users draw their own conclusions. Paragraph 6 restricts the report to the parties who agreed the procedures. SRS 4400 is the 2004 text still listed by ICAI. Our article on SRS 4400 agreed-upon procedures covers it.
Compilation: help, not assurance
SRS 4410 (Revised), paragraphs 5 and 6, describe an engagement in which the practitioner uses accounting expertise to help management prepare and present financial information. The standard states that, because it is not an assurance engagement, the practitioner need not verify the accuracy or completeness of what management provides. The report does not express an opinion or a conclusion in any form (paragraph 39). Management keeps responsibility for the information (paragraph 7). See our article on SRS 4410 (Revised) compilation engagements.
Which one does a business need?
The right question is who will rely on the report and what they will accept.
| Situation (illustrative) | Likely engagement | Why |
|---|---|---|
| A private company must present audited accounts to its members | Audit | The law requires an auditor's opinion; nothing lower is a substitute |
| A bank asks a proprietorship for financial statements it can lean on, but the law does not require an audit | Review or audit, as the lender agrees | A review gives some comfort at lower cost |
| A group wants a distributor's stock and receivable balances checked against a list of agreed tests | Agreed-upon procedures | The tests are fixed by the requesting party; no opinion is wanted |
| A start-up needs monthly management accounts and year-end statements drafted for the founders | Compilation | The founders need preparation help, not assurance |
| A grant-making body wants confirmation that funds were spent on the specified heads | Agreed-upon procedures | Findings on named items, restricted to the funder and the grantee |
Worked example (illustrative)
Aarav Fabrics LLP, an invented textile trader, is asked by its bank for year-end financial statements. The partners are tempted to ask their accountant for "an audit certificate". The bank only wants to see that the numbers have been looked at by an outsider. The accountant explains the options: an audit gives an opinion on the whole statements; a review gives a limited-assurance conclusion; a compilation gives no assurance. The bank agrees that a review is enough. The accountant then accepts the engagement under SRE 2400 (Revised), and the report says in terms that it is a limited-assurance review. Had the partners asked for compilation and then circulated the statements as if audited, the report would not have supported that use.
Audits the Companies Act requires
The Act separately requires certain audits, and this article does not replace the dedicated posts on them.
- Statutory audit and the appointment of the auditor: section 139.
- Internal audit for the companies the Act and rules cover: section 138.
- Cost audit: section 148.
- Secretarial audit: section 204.
Common mistakes
- Using the word "audit" for a review, compilation or agreed-upon procedures engagement, or letting the recipient assume it.
- Handing an agreed-upon procedures report to parties who never agreed the procedures.
- Expecting a compilation report to detect errors or fraud: the standard does not require verification.
- Treating reasonable assurance as a certificate of accuracy; it is a high level of assurance, not an absolute one.
- Skipping the engagement letter, which fixes the nature, scope and use of the report.
Need help with choosing and preparing the engagement?
If you are unsure which engagement a lender, investor or regulator will accept, agree it before the work begins, because it is hard to upgrade a report later. Our team can help you set up your records and statements so that whichever engagement you choose runs smoothly; see our books of accounts and compliance support.
Key takeaways
- Audit gives reasonable assurance and an opinion; review gives limited assurance and a conclusion.
- Agreed-upon procedures and compilation give no assurance.
- A review relies mainly on inquiry and analytical procedures (SRE 2400 (Revised), paragraph 7).
- An agreed-upon procedures report is restricted to those who agreed the procedures (SRS 4400, paragraph 6).
- A compilation report cannot carry an opinion or conclusion (SRS 4410 (Revised), paragraph 39).
- Choose by the reader's need, and put the nature of the engagement in writing.
Read next
- SRS 4400 agreed-upon procedures engagements
- SRS 4410 (Revised) compilation engagements
- SRE 2400 (Revised) review engagements, part 1
- SA 200 and reasonable assurance
Disclaimer: Based on the Standards on Auditing, the review, assurance and related services standards, the Compendium of Standards on Internal Audit (as on 1 October 2022) and the Compendium of Forensic Accounting and Investigation Standards (as on September 2025) issued by the Institute of Chartered Accountants of India, in the versions named in the article, as consulted on 4 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org and the Companies Act provisions referred to. This article is general information, not legal advice; check the official text before acting.