How to Vet an Overseas Auditor Before You Engage Them: A Due Diligence Checklist

Finding an auditor for your foreign subsidiary usually feels like the easy part of the APR process — a quick search, a few names, a fee quote, and a signature. The actual work, everyone assumes, starts once the engagement begins. That assumption is exactly why so many companies end up with a rejected AD Bank submission months later. The vetting you skip at the start is the same vetting an AD Bank does anyway, just later, with far less time to fix whatever it finds.

Why Vetting Matters More Than It Seems at the Start

An audit of a foreign subsidiary of an Indian company isn't interchangeable work. RBI's reporting requirements are specific about who's allowed to sign off on that audit, and an AD Bank checks this credential against RBI's expectations before it checks anything about the numbers themselves. A company that engages an auditor without confirming these details upfront is essentially betting that everything will turn out fine — and that bet fails often enough that it's worth a proper checklist before any engagement letter gets signed.

Step One: Confirm the License Actually Exists, Don't Just Take Their Word for It

The single most avoidable mistake in this entire process is trusting a claimed credential without independently checking it. A US CPA's license can be verified through CPAverify.org, the national database maintained by state boards of accountancy, or directly through the relevant state board if the auditor practices somewhere not yet fully listed there. A UK ICAEW member can be confirmed through the institute's own public "find a chartered accountant" register. A Singapore ISCA member's public accountant status — the specific designation that matters for statutory audit purposes — can be checked against ACRA's register of approved public accountants.

This step takes minutes. Skipping it is how companies discover, sometimes after the audit is complete and the report submitted, that the person who signed wasn't actually licensed to do so.

Step Two: Confirm the License Covers the Right Jurisdiction, Not Just the Right Title

A verified CPA license doesn't automatically mean the right CPA for your engagement. Licenses are jurisdiction-specific down to the state or country level, and an auditor licensed in one place has no authority to certify financials for an entity incorporated somewhere else. This becomes especially relevant for companies with subsidiaries in more than one country, where it's tempting to assume one experienced professional can cover the whole group. A US CPA cannot sign a UK audit report. A UK ICAEW member cannot certify a Singapore entity's financials. Each engagement needs its own jurisdiction-matched professional, verified separately.

Step Three: Ask About RBI-Facing Experience Specifically

A technically qualified, competent auditor in their home jurisdiction can still be the wrong fit for an APR audit if they've never handled an engagement that feeds into RBI reporting requirements. FEMA compliance has its own expectations — reconciliation against original ODI investment records, shareholding percentage verification, specific disclosure formats — that a general-practice auditor abroad simply won't know to anticipate unless they've done this kind of engagement before.

Ask directly: has this professional certified financials for an Indian-owned subsidiary previously, and do they understand what an APR audit needs to reconcile against, beyond just producing accurate local-standard financials? An auditor who's never heard the term "AD Bank" is not automatically disqualified, but it's a signal that more oversight will be needed on your side to catch gaps they won't know to flag themselves.

Step Four: Understand What Service Level You Actually Need

Not every foreign subsidiary needs a full statutory audit. A smaller US LLC, for instance, is often better served by a CPA Review Report under SSARS than a full audit engagement nobody asked for. Before engaging anyone, clarify what level of assurance your entity actually requires — full audit, review engagement, or compilation — based on the entity's size, structure, and host-country requirements. An auditor who pushes a full audit regardless of what the entity actually needs, without explaining why, is worth questioning on cost grounds as much as on fit.

Step Five: Set Response-Time Expectations Before You Sign

The single biggest reason a 60-day audit engagement stretches into 90-plus days rarely has anything to do with the auditor's workload — it's a document request or clarification query that sits unanswered for a week on the client's side. But the reverse matters too: an auditor who's slow to respond to your queries, slow to schedule review calls, or vague about turnaround times during the vetting conversation is telling you something about how the engagement itself will run. Ask directly how quickly they typically respond to client queries and what their current engagement load looks like heading into your filing season — particularly important given that foreign audit firms run their own busy seasons that don't bend for a December 31 RBI deadline.

Step Six: Ask for a Reference From a Similar Engagement

A credentialed, experienced auditor should be able to point to at least one comparable engagement — ideally another Indian-owned subsidiary, or at minimum a cross-border reporting situation of similar complexity. A brief reference conversation, even a short email exchange, tells you more about how an engagement actually runs day-to-day than any credential check can.

Step Seven: Clarify How the Audit Will Reconcile Against Your ODI Records

Before the engagement starts, walk the auditor through what reconciliation will be needed against your original ODI investment records — shareholding percentage, loans or guarantees extended, prior year's reported figures. An auditor who's never had this conversation before the engagement begins is more likely to hand you technically accurate financials that still don't line up with what RBI already has on file, leaving that gap for you to discover during your own internal review, or worse, during an AD Bank query.

Red Flags That Should Make You Walk Away

A few patterns are worth treating as immediate disqualifiers rather than minor concerns: an auditor who resists a direct license verification request, one who can't clearly state which specific regulatory body they're registered with, one who quotes a timeline dramatically shorter than the standard 60 to 90 day range without explaining why, or one who's willing to issue an opinion based on management-prepared draft figures rather than their own independent review.

A Practical Checklist Before You Engage

Before signing anything: verify the license independently, confirm it matches the subsidiary's specific jurisdiction, ask about prior RBI-facing engagement experience, confirm the right service level for your entity's size, set explicit response-time expectations, request one comparable reference, and walk through the ODI reconciliation requirement together before the audit begins. None of these steps take long individually. Together, they're the difference between an audit that clears on the first pass and one that becomes the reason your APR filing runs out of runway in December.