SQC 1 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The second half of SQC 1 covers how a firm staffs engagements, supervises and reviews the work, has a second partner look at the important audits, keeps the file, and checks its own system. It also deals with complaints and with documenting the whole system.
SQC 1, as effective for engagements relating to accounting periods beginning on or after 1 April 2008 (recommendatory) and 1 April 2009 (mandatory), is the quality standard that applies today. ICAI may revise standards, so check icai.org for the current text. Part 1 covers leadership, ethics, independence and client acceptance.
The firm must have enough capable people, assign an engagement partner with time for the job, supervise and review the work, and consult on difficult matters. An engagement quality control review is mandatory for every audit of a listed entity and for other engagements that meet the firm's own criteria, and the report is not issued until it is complete. The file is assembled within a set time (ordinarily not more than 60 days for an audit), kept for seven years, and the system is monitored with at least one engagement per partner inspected in each cycle. ICAI deferred the mandatory date of SQM 1 and SQM 2 on 31 March 2026, so SQC 1 applies.
Human resources (paragraphs 36-45)
The firm needs policies that give reasonable assurance it has enough people with the capabilities, competence and commitment to ethics to do its work. Paragraph 37 lists the topics: recruitment, performance evaluation, capabilities, competence, career development, promotion, compensation and estimating personnel needs. Competence is built through professional education, continuing training, work experience and coaching (paragraph 38). Small firms may evaluate people less formally (paragraph 41).
Assigning teams
Each engagement gets an engagement partner. The firm must make sure the partner's identity and role are communicated to key management and those charged with governance, that the partner has the capabilities, competence, authority and time, and that the partner's responsibilities are defined (paragraph 42). Paragraph 43 asks the firm to watch partner workloads. Staff are assigned on the basis of similar experience, knowledge of standards and law, technical and IT knowledge, industry knowledge, judgment and understanding of the firm's policies (paragraph 45).
Engagement performance (paragraphs 46-50)
The firm aims at consistent quality through manuals, software tools, standard documentation and guidance material, and covers briefing the team, applying standards, supervision, review and keeping policies current (paragraph 47). Supervision means tracking progress, checking that team members have the competence, time and understanding, dealing with significant issues and flagging matters for consultation (paragraph 49). Review is done by more experienced people, including the engagement partner, asking whether the work meets standards, the evidence supports the conclusions and the objectives were achieved (paragraph 50).
Consultation and differences of opinion (paragraphs 51-59)
Consultation on difficult or contentious matters must take place, with enough resources, and its scope and conclusions must be documented and implemented. Those consulted must be given all relevant facts (paragraph 54). A firm without internal expertise may use other firms or professional and regulatory bodies, after checking that the provider is suitably qualified (paragraph 55).
Differences of opinion within the team, with those consulted, or between the engagement partner and the reviewer must be resolved under a defined procedure and recorded. Paragraph 58 states that the report is not issued until the matter is resolved.
Engagement quality control review (paragraphs 60-73)
| Point | What SQC 1 requires | Paragraph |
|---|---|---|
| Which engagements | All audits of listed entities; others if they meet the firm's criteria | 60 |
| Timing | Completed before the report is issued | 61, 66 |
| Criteria for other engagements | Public interest, unusual risks, whether law requires a review | 62 |
| What the review involves | Discussion with the partner, review of statements and report, and selected working papers on significant judgments | 64 |
| Listed entity review also considers | Independence, significant risks, materiality judgments, consultations, misstatements, communications and the report | 65 |
| Unresolved recommendations | Report is not issued until resolved under the differences of opinion procedure | 67 |
| Reviewer eligibility | Technical qualifications and authority; for listed entities, enough experience to act as engagement partner on such audits | 68-69 |
| Objectivity | Not chosen by the engagement partner, not otherwise on the engagement, makes no decisions for the team | 70 |
| Documentation | Procedures performed, completed before the report date, no unresolved matters | 73 |
The review does not reduce the engagement partner's responsibility (paragraph 64). The partner may consult the reviewer, but if the consultation becomes significant, objectivity must be protected, and if that cannot be done another person is appointed (paragraph 71). Sole practitioners and small firms may contract a suitably qualified external person (paragraph 72). Our SQM 2 article compares this with the newer standard.
Engagement documentation (paragraphs 74-85)
The firm must set a time limit for assembling the final file after the report. Where law sets none, paragraph 75 says the limit for an audit is ordinarily not more than 60 days after the date of the auditor's report. If more than one report is issued on the same subject matter, each is treated separately (paragraph 76).
The firm also needs controls so that documentation stays confidential, safe, accurate, accessible and retrievable, whether on paper or electronic. Paragraph 79 asks for the ability to tell when and by whom documents were created, changed or reviewed, protection against unauthorised changes, and access for those entitled. Paragraph 80 gives passwords, back-ups, controlled distribution and restricted hard-copy storage as examples. Scanned originals must reflect the entire content, including signatures and annotations, and be indexed and retrievable (paragraph 81).
Retention: seven years
For audits, paragraph 83 says the retention period is ordinarily no shorter than seven years from the date of the auditor's report. Footnote 8 explains that ICAI's Council amended the figure from ten to seven years in August 2009, and that the ten years printed in SA 230 paragraph A23 stands amended in the same way. Readers meeting "ten years" in SA 230 or older copies of SQC 1 should apply seven years; read law or regulation too, as they may require a longer period. Paragraph 84 asks for procedures that keep electronic files retrievable as technology changes, record changes after the file is complete, and let authorised external parties review specific documents.
Unless law says otherwise, the documentation belongs to the firm. The firm may give clients parts or extracts if that does not undermine the work or independence (paragraph 85). For the audit-level detail, see SA 230 on audit documentation.
Monitoring (paragraphs 86-100)
Monitoring means an ongoing look at whether the system is relevant, adequate, operating effectively and followed, plus a periodic inspection of completed engagements (paragraph 86). A partner or other competent person with authority runs it (paragraph 88). Paragraph 90 asks that at least one engagement for each engagement partner is inspected over a cycle that ordinarily spans no more than three years. Inspectors must not have worked on the engagement or its review (paragraph 91). Small firms may use an external person or share resources (paragraph 92).
Deficiencies are classed either as instances that do not show the system is insufficient or as systemic, repetitive or significant ones needing prompt action (paragraph 93). They are communicated, with recommendations such as remedial action, training, changes to policies or discipline (paragraphs 94-95). The firm reports the results at least annually to engagement partners and firm leadership, covering procedures performed, conclusions and significant deficiencies (paragraph 97). Where a report may be inappropriate, the firm decides what further action is needed and considers legal advice (paragraph 96).
Complaints and allegations (paragraphs 101-105)
The firm needs a process for complaints, whether from staff, clients or third parties, that its work does not meet standards or that its quality system was breached. Frivolous ones are excluded. Staff must have channels to raise concerns without fear of reprisal, and a partner who was not on the engagement supervises the investigation, involving legal counsel as needed. Small firms may hire an external person. Complaints and responses are documented.
Documenting the system (paragraphs 106-109)
The firm documents evidence of how each element operates. Large firms may use databases; small firms can use notes, checklists and forms (paragraph 107). The records are kept long enough for monitoring, or longer if law requires (paragraph 109).
Need help with documenting your quality system?
If you are building file-assembly checklists, review sign-offs or monitoring records for your practice, TaxClue's compliance documentation service can help draft them. Audited companies that want their records to be file-ready can also use our compliance documentation support.
Key takeaways
- Assign a partner with real time and authority, and monitor partner workloads.
- Listed entity audits need an engagement quality control review before the report goes out.
- Assemble the audit file within a fixed period, ordinarily not more than 60 days after the report date.
- Keep audit files for seven years from the report date, noting that SA 230 still prints ten.
- Inspect at least one engagement per partner in each cycle of up to three years and report results annually.
Read next
- SQC 1, part 1: leadership, ethics and client acceptance
- SQM 2: engagement quality reviews
- SA 230: audit documentation and retention
- Audit documentation and working papers
Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.