Audit Contract Template

In plain language: Identifies the audit firm and the client as legal entities, names the engagement, and references the fiscal period to be audited.

Common mistake: Using a trade name instead of the registered legal entity for either party. If the contracting entity differs from the billing or reporting entity, enforcing fee obligations or limiting liability becomes legally complex.

In plain language: Defines precisely what the auditor will and will not do — which financial statements are covered, which reporting framework applies (GAAP, IFRS), and any explicit exclusions such as tax returns or internal control advisory.

Common mistake: Omitting an explicit list of what is excluded from scope. Without exclusions, clients routinely expect tax advice, fraud detection, or internal-control recommendations that a standard audit does not provide.

In plain language: States the specific standards framework — GAAS, PCAOB, ISA, or a national equivalent — that governs how the audit is conducted and the basis for the auditor's opinion.

Common mistake: Referencing standards generically as 'applicable auditing standards' without specifying the framework. Regulatory bodies and lenders often require a named standard; a vague reference can invalidate the audit opinion for compliance purposes.

In plain language: Confirms the auditor's independence from the client under the applicable professional code, discloses any known threats to independence, and sets out the client's obligation to notify the auditor of changes that could impair independence.

Common mistake: Omitting the client's ongoing disclosure obligation. Independence threats frequently arise mid-engagement — without a contractual duty to disclose, the auditor may not learn of a threat until after fieldwork is complete.

In plain language: Sets out what management must do to enable the audit — preparing financial statements, maintaining internal controls, providing access to records and personnel, and signing a management representation letter.

Common mistake: Vague language like 'cooperate fully with the audit.' Courts and professional standards bodies have held that unclear management-responsibility clauses shift blame to the auditor when records are incomplete or access is denied.

In plain language: States the fixed fee or hourly rates, the billing schedule (e.g., 30% on signing, 40% at fieldwork, 30% on report delivery), reimbursable expenses, and the late-payment interest rate.

Common mistake: Agreeing to a fixed fee without a scope-change clause. If the client's records are disorganized or additional entities must be consolidated, the auditor absorbs the overrun with no contractual basis to request additional compensation.

In plain language: Specifies what the auditor will deliver — the audit report, management letter, and any required communications to those charged with governance — and the format and addressees of each.

Common mistake: Omitting the governance communication deliverable. Professional standards require auditors to communicate significant deficiencies and material weaknesses in writing — failing to specify this in the contract leaves the client uncertain about what they will receive.

In plain language: Sets the start date for planning, the fieldwork window, and the target date for report issuance — and allocates responsibility for delays caused by late client deliverables.

Common mistake: No consequence for late client deliverables. Without a timeline-extension clause, auditors face fee disputes and client complaints when late records push the report past a regulatory or lender deadline.

In plain language: Caps the auditor's total liability to the client at a defined amount — typically the fee paid — and excludes consequential, indirect, and punitive damages.

Common mistake: No limitation of liability clause at all, or a cap set at total audit fees paid to date rather than fees for the specific engagement. Audit firms have faced seven-figure claims on engagements billed at five figures — an uncapped liability is commercially unacceptable.

In plain language: Specifies the jurisdiction whose law governs the contract, the mechanism for resolving disputes (arbitration or litigation), and the conditions under which either party may terminate the engagement.

Common mistake: Choosing a governing law with no connection to where the audit is performed or either party is located. Some jurisdictions impose mandatory provisions on audit engagements — a mismatched governing-law clause can create unenforceable terms.

An audit contract — also called an audit engagement letter — is a legally binding agreement between an external auditor and a client company that defines the terms of a financial-statement audit engagement. It covers the scope of services, applicable auditing standards, auditor independence, management responsibilities, fee structure, deliverables, timeline, and liability limits. Professional auditing standards in most jurisdictions require a written engagement agreement before audit work begins.

Yes, in most jurisdictions. AICPA auditing standards (AU-C 210) require auditors to agree on audit engagement terms in writing before commencing a new engagement or continuing a recurring one. ISA 210 imposes the same requirement internationally. Many statutory audit frameworks — including UK Companies Act audits and EU statutory audits — also mandate a written engagement agreement as part of auditor appointment.

Functionally, they are the same document. 'Engagement letter' is the term used in professional auditing standards (GAAS, ISA); 'audit contract' is the commercial term used when the document is negotiated and executed as a formal bilateral agreement. Both create the same enforceable obligations. Larger engagements and public-company audits often use a more detailed contract format, while smaller private audits may use a shorter engagement letter format.

Reference the standard that matches your jurisdiction and the nature of the engagement. US non-public company audits typically reference GAAS as established by the AICPA (AU-C standards). SEC-registered public company audits require PCAOB standards. International engagements reference ISA as issued by the IAASB. Confirm the required standard with any regulator, lender, or exchange that will rely on the report before finalizing the contract.

At minimum, the contract should state that management is responsible for preparing financial statements in accordance with the applicable framework, maintaining adequate internal controls, providing the auditor unrestricted access to records and personnel, and executing a management representation letter before the audit report is issued. These responsibilities mirror the requirements of GAAS AU-C 210 and ISA 210 and are non-negotiable for a compliant engagement.

Most audit engagements use a fixed fee with a three-tranche billing schedule: a percentage on signing, a percentage at the start of fieldwork, and the balance on report delivery. The contract should also address reimbursable out-of-pocket expenses, the interest rate on overdue balances, and the billing rate for any work outside the agreed scope. Agreeing on a scope-change mechanism upfront avoids fee disputes when additional work is required.

Auditor independence is the requirement that the external auditor has no financial, personal, or business relationship with the client that could impair — or appear to impair — objective judgment. The audit contract confirms independence as of the signing date and requires the client to disclose any future transactions or relationships that could create an independence threat. Without this clause, independence threats arising mid-engagement may go undetected until they invalidate the audit opinion.

In most jurisdictions, yes — limitation of liability clauses are enforceable in audit contracts for private companies, typically capping total liability at the fees paid for the engagement. However, some jurisdictions restrict or prohibit liability caps for statutory auditors. In the UK, liability limitation agreements require shareholder approval under the Companies Act 2006. In the EU, member states vary in their treatment of auditor liability caps. Consider consulting legal counsel before finalizing any liability limitation clause.

Without a timeline-extension clause, the auditor may still be held to the original report delivery date even if the delay was entirely the client's fault — exposing both parties to missed regulatory filing deadlines. A well-drafted audit contract should automatically extend the report delivery date by the number of business days the client's required materials arrive late, and should require the client to acknowledge this mechanism at signing.

For straightforward private-company audits, a high-quality template adapted by the audit firm's engagement partner typically suffices. Legal counsel is advisable when the engagement involves a public company, a regulated entity, cross-border audit requirements, liability limitation agreements that require shareholder approval, or a fee arrangement above $100,000 where the commercial risk warrants professional review.