Internal and Forensic Audit · Internal Audit Engagements and Planning

Internal Audit Engagement Letter and Acceptance

Updated 11 October 2026 · Fact-checked

An internal audit engagement letter is a written agreement between the internal auditor and the entity. It records scope, objectives, responsibilities, access, reporting and fees. You accept an engagement only after checking independence, competence, resources and authority, then you document the terms of reference in the letter.

Understand Internal Audit Engagement Letter and Acceptance

An internal audit engagement starts when management, the board or the audit committee asks for an internal audit. It may be a fresh appointment, an annual plan item or a special assignment. Before you start work, you must decide whether to accept it. Then you must record what you and the client agree.

Acceptance is a decision, not a formality. You check four things. First, independence and objectivity: do you have any conflict, family tie, financial interest or link to the area you will audit? Second, competence: do you and your team have the skills for this sector and area? Third, resources: do you have time, staff and budget? Fourth, authority: will you get access to people, records and premises, and will you report to a level that protects your independence?

The engagement letter puts the agreement in writing. It avoids misunderstanding about scope, responsibilities and deliverables. The terms of reference are the core of it. They state the objectives, the areas and period covered, the limits of the work, the reporting line and the timelines.

For a statutory audit, the external auditor's standards also stress this early stage. SA 300 requires the auditor, at the start of an engagement, to perform procedures on continuance of the client relationship, evaluate compliance with ethical requirements including independence, and establish an understanding of the engagement terms. Internal audit follows the same logic. Do the ethics and acceptance checks first, then fix the terms in writing.

Independence matters most when one firm does several jobs. The ICAI Code of Ethics, as quoted in SA 610 (Revised), says a statutory auditor of an entity cannot be its internal auditor, as it will not be possible to give an independent and objective opinion. So check whether you already hold any role that clashes with the new engagement.

Key rules to remember

Acceptance checks: Independence + Competence + Resources + Authority/Access; Accept only when all four are satisfied, or when threats are reduced to an acceptable level.
Core contents of an engagement letter: Objectives + Scope + Period + Responsibilities + Access + Reporting + Fees + Timelines; Add confidentiality, use of experts, and termination terms where relevant.
Objectivity factors (SA 610 A32): Organisational status + Family/personal ties + Association with the area + Significant financial interest; These are factors that may be relevant when judging threats to objectivity.
Statutory auditor as internal auditor: Statutory auditor of an entity ≠ its internal auditor; Per the ICAI Code of Ethics as quoted in SA 610 (Revised), para A14.
SA 300 start-of-engagement activities: Client continuance procedures + Ethics and independence evaluation + Understanding of engagement terms; SA 300 para 5. Use as the model for internal audit acceptance.

How to solve Internal Audit Engagement Letter and Acceptance questions

Use this order for any question on acceptance or the engagement letter. It keeps your answer in provision, analysis and conclusion form.

1Read the facts and note who is asking, what the engagement is, and any relationships or other services.
2State the rule: acceptance requires checks on independence, competence, resources and authority, then written terms.
3Apply each check to the facts. Name the threat, for example a link to the audited area or a prior role as statutory auditor.
4Decide: accept, accept with safeguards, or decline. Give the reason in one line.
5List the engagement letter contents that fit the case: objectives, scope, period, responsibilities, access, reporting line, fees, timelines, confidentiality.
6Add drafting and compliance points, such as the signatory, board or audit committee approval, and how changes in scope will be handled.
7Close with a clear conclusion that answers the exact question asked.

Quickest way: I-C-R-A then letter

When to use it: Use it when a short question asks whether to accept an engagement or what the letter should contain.

Write I-C-R-A: Independence, Competence, Resources, Authority.
Tick or flag each against the facts in one line each.
State your decision.
List 6 to 8 letter contents as bullets, matched to the case.
End with one line on who signs and who receives the letter.

Common mistakes in Internal Audit Engagement Letter and Acceptance

Treating the engagement letter as a mere formality and listing only fees and dates.
Students copy a template from memory.
Fix: Lead with objectives, scope and responsibilities. These prevent disputes. Fees come last.
Skipping independence checks and accepting at once.
The question looks like a routine appointment.
Fix: Always scan the facts for conflicts: prior roles, family ties, financial interest, association with the area.
Saying a statutory auditor can also be the internal auditor with safeguards.
Students recall that safeguards reduce threats in other cases.
Fix: State the Code of Ethics rule quoted in SA 610 (Revised): a statutory auditor of an entity cannot be its internal auditor.
Confusing terms of reference with the whole engagement letter.
The two terms are used loosely.
Fix: Say the terms of reference are the core part of the letter covering objectives, scope, period, limits and reporting.
Leaving out access and reporting line.
Students focus on the audit work, not on enabling conditions.
Fix: Always include unrestricted access to records and people, and reporting to the board or audit committee.
Giving a long theory answer with no conclusion on the facts.
Case-based answers are unfamiliar.
Fix: Use provision, analysis, conclusion. End with a clear accept, accept with conditions, or decline.

Worked examples

Example 1

Sunrise Textiles Ltd asks CA Mehta, its statutory auditor, to also act as its internal auditor for the year. Advise whether the engagement can be accepted.

Show the solution

Rule: acceptance needs independence, competence, resources and authority.
Independence is the issue. SA 610 (Revised), para A14, quotes the ICAI Code of Ethics: a statutory auditor of an entity cannot be its internal auditor, as it will not be possible to give an independent and objective opinion.
The same para notes a self-review threat: the engagement team may use internal audit results without proper evaluation or the same professional scepticism.
Competence and resources do not cure this, because the bar is about independence.
Conclusion: decline the internal audit engagement, or resign from one role.

Answer: CA Mehta should not accept the internal audit engagement while he is the statutory auditor of Sunrise Textiles Ltd. The Code of Ethics bars the combination, and no safeguard makes it acceptable.

Example 2

Bharat Foods Pvt Ltd appoints an independent firm for a review of its purchase function. Draft the key contents of the engagement letter.

Show the solution

Check acceptance first: confirm no conflict, relevant experience, staff availability and access to purchase records.
Objectives: assess whether purchase controls work and policies are followed.
Scope and period: purchase function, including vendor selection, orders, receipt and payment, for the stated financial year.
Responsibilities: management provides records and access and is responsible for controls. The auditor plans, performs and reports with objectivity.
Access and cooperation: unrestricted access to people, records and premises.
Reporting: reports to the audit committee or board, with the format, draft and final timelines and management response process.
Other terms: fees, confidentiality, use of experts, change in scope and termination.
Signature: signed by the firm and by an authorised person of the company, with board or audit committee approval.

Answer: The letter should state objectives, scope and period, responsibilities of both sides, access, reporting line and timelines, fees, confidentiality, scope change and termination terms, and carry signatures of both parties after acceptance checks are done.

Exam tips

Open with the acceptance checks, then the letter. Many answers lose marks by jumping to contents.
In case questions, scan for hidden conflicts such as a prior statutory role, family ties or financial interest in the audited area.
Use bullets for letter contents and tie each to the facts. Generic lists score less.
Quote the Code of Ethics point from SA 610 (Revised) para A14 only for the statutory-auditor case. Do not stretch it to other cases.
Close every answer with a one-line conclusion: accept, accept with safeguards, or decline.

Practice questions from Internal Audit Engagements and Planning

Internal Audit Engagement Letter and Acceptance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Engagement Letter and Acceptance: frequently asked questions

What should an internal audit engagement letter contain?

It should contain objectives, scope, period covered, responsibilities of the auditor and management, access to records, reporting line, timelines, fees and confidentiality. Add terms on scope change and termination where relevant.

What is the difference between terms of reference and an engagement letter?

The terms of reference set out objectives, scope, limits, reporting and timelines of the work. The engagement letter is the document that records these terms and other commercial points such as fees and signatures.

Can a statutory auditor accept the internal audit of the same company?

No. SA 610 (Revised), para A14, quotes the ICAI Code of Ethics: a statutory auditor of an entity cannot be its internal auditor, as an independent and objective opinion would not be possible.

What should I check before accepting an internal audit engagement?

Check independence, competence, resources and authority to access records and report independently. Also confirm there are no conflicts from family ties, financial interests or past association with the area.