Can the CPA Who Keeps Your Books Also Audit Them? Auditor Independence for APR

A common setup for an Indian-owned US company: a small CPA firm handles the monthly bookkeeping. When APR season arrives, someone asks, "Why not have them audit it too? They already know the numbers." It sounds efficient. It is also where many files run into trouble.

Whether one firm can do both depends on what "keeping the books" actually means and which country's rules apply. It also depends on who makes the accounting decisions, the firm or your management.

The short answer: it depends on who makes the decisions

Professional codes do not ban bookkeeping and audit by the same firm outright for private companies. What they ban is a firm marking its own homework.

The AICPA Code calls this the self-review threat. It is the risk that a CPA will not properly evaluate a service the firm performed and will rely on that service when forming a judgment in an audit. If the firm built the ledger, the audit of that ledger has a blind spot.

For a listed company or other public interest entity, the international code prohibits bookkeeping for an audit client. Most Indian-owned foreign subsidiary companies are private. For them, the rules allow limited, safeguarded bookkeeping, and the conditions matter.

Why independence matters more for an APR than for a routine local audit

The bank relies on the report. The audit report is the document your AD bank leans on under India's RBI reporting requirements. The bank cannot re-audit the subsidiary. It looks at who signed and whether that person is eligible.

There is no unaudited fallback. Where you control the entity, Regulation 10(4) of the Overseas Investment Regulations, 2022 requires audited statements. A wholly owned subsidiary is controlled by definition. If the audit is open to challenge, the filing has nothing to fall back on.

The consequences fall on the Indian parent. A report the bank will not accept counts as an APR not filed. That puts the Indian parent's FEMA compliance at risk, and it affects the wider ODI compliance record, including new remittances. Independence problems can therefore hold up APR filing for foreign subsidiaries.

How the main rulebooks treat bookkeeping plus audit

United States. Bookkeeping is a non attest service under the AICPA Code. A CPA can provide it to an audit client only if the client:

• assumes all management responsibilities;

• names someone with suitable skill, knowledge or experience to oversee the work;

• evaluates the results; and

• accepts responsibility for them.

Firms are expected to document this understanding, and peer reviewers check for it.

International model. The IESBA Code, effective December 2022, allows accounting and bookkeeping for a non-public-interest audit client only if it is routine or mechanical and the threats are reduced to an acceptable level. Its examples of safeguards are using people who are not on the audit team and having an independent reviewer check the work.

UK, Singapore and others. Professional codes in these countries are built on the same architecture. Have your auditor state which local code governs them and confirm the position in writing.

What crosses the line in practice

Some tasks are management decisions, and a firm that makes them cannot then audit the result. The IESBA guidance lists:

• setting accounting policies;

• originating or changing journal entries; and

• approving how transactions are classified.

The same applies if the firm holds your records in a way that makes it the only custodian. The AICPA has a separate rule on hosting services for this.

Ordinary help is different. Posting entries your management approved, or explaining a standard during the audit, does not usually create a problem if your management stays in charge.

The test to apply is simple: did your finance team decide, or did the auditor decide and your team approve without understanding?

The Indian side: when your own CA is the auditor

Section 144 of the Companies Act, 2013 bars the statutory auditor of an Indian company from providing accounting and bookkeeping services, directly or indirectly, to the company, its holding company or its subsidiary company.

Whether "subsidiary" reaches an overseas entity is debated. Careful firms treat it as reaching, and that is the safer reading. An Indian CA who keeps the foreign subsidiary's books and then audits it under SA 800 for the APR has the same self-review problem, and Section 144 may apply as well.

What a review or compilation can and cannot do

A compilation under US standards does not require independence. That is because a compilation gives no assurance, and so no one should treat it as an audit. It cannot stand in for an audit where the Indian parent has control.

Our note on why RBI won't accept a notice-to-reader report covers the Canadian version of this trap. For more on the audit-versus-preparer split, see our comparison of a statutory auditor and a US CPA.

If you want one firm's help on both sides

For a small subsidiary, the cleanest answer is usually two separate firms. If you keep one, insist on these steps:

• Separate teams. The people who did the bookkeeping should not be on the audit team, and someone independent should review.

• Management-approved entries. Your team approves every journal entry and is able to explain it.

• Written terms. The engagement letter should say what the firm will and will not do, and who owns each decision.

• A written independence assessment. Ask the auditor for it before fieldwork starts, not after the report is drafted.

• A short memo on the choice. Keep it on file for the AD bank, which may ask.
  

Questions CFOs and AD banks ask

1. Does RBI prohibit this?

The Overseas Investment Regulations do not set an independence test for the foreign auditor. Independence comes from the host country's professional rules, and for an Indian CA from ICAI standards and Section 144. Even so, your bank can ask about the auditor's eligibility, and a report from a firm that breached independence rules is a weak foundation for a filing.

2. Can our India-based team do the bookkeeping instead?

Yes. Management preparing its own books is the cleanest arrangement, and the auditor then audits them.

3. What if the same CPA did the books and the audit last year?

Raise it with the firm now and ask for its independence assessment in writing. That does not automatically make past filings invalid, but decide with your advisor whether anything needs revisiting before this year's engagement.