Group audits I: scope, components and materiality

Most listed companies, and many private ones, report consolidated financial statements that combine a parent with subsidiaries, joint arrangements, branches and investees, often in several countries. The auditor of those group financial statements cannot usually examine every transaction at every location, and frequently relies on other auditors who know the local language, law and accounting. Group audits are among the most heavily inspected areas of practice, because failures at a distant component, from inventory that did not exist to revenue that was invented, have caused some of the largest restatements. This lesson covers how the group auditor understands the group, decides what components are and where work will be done, and sets materiality for the group and its components. Lesson 3 continues with component auditors, consolidation and reporting.

The standards and when they apply

Two sets of standards apply in the United States. Tamarack is an issuer, so its audit follows PCAOB standards: AS 2101, Audit Planning, and AS 1201, Supervision of the Audit Engagement, as amended for audits involving other auditors, together with AS 1206, Dividing Responsibility for the Audit with Another Accounting Firm. Those amendments apply to audits of fiscal years ending on or after December 15, 2024. Audits of private groups follow the AICPA's SAS 149, Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors), which amends AU-C 600 and applies to audits of periods ending on or after December 15, 2026. SAS 149 is closely based on the IAASB's revised ISA 600, so its risk-based concepts match those in this lesson; the PCAOB standards use different terms, other auditors rather than component auditors, but impose similar responsibilities for planning and supervision.

Group audit standards also apply when a single company has branches or divisions whose information is audited separately, or when the auditor uses another firm to perform procedures at a location. The essential feature is that the auditor of the group financial statements must plan, direct, supervise and review work that others perform on parts of the group, and must take responsibility for the opinion on the whole.

Key terms

One change in the revised standards is easy to miss. A component is no longer simply a legal entity. The group engagement team decides how to divide the group for audit purposes. A shared service center that processes payables for every subsidiary can be a component; so can a single business activity such as a group-wide revenue stream, or a combination of entities that share systems and management. The question is how to plan work so that it responds to the risks, not how the group happens to be organized legally.

Understanding the group

Before scoping, the group engagement team must understand the group, its environment and its consolidation process well enough to identify and assess the risks of material misstatement in the group financial statements. For Tamarack Foods Group Inc., the team documents the following points from meetings with group management, the prior-year file and a walkthrough of the consolidation.

The understanding drives scoping. Because the shared service center processes payables, payroll and treasury for three of the four operating components, the team can test those processes once, centrally, rather than at each entity. Because Mexico runs separate systems and books under a different framework, work there needs local knowledge and a careful look at the conversion adjustments. Because the cold-storage investee is accounted for by the equity method, the team needs evidence about Tamarack's share of its results and the carrying amount of the investment, but not about its individual transactions.

Deciding where work is performed

Under the older standard, auditors identified significant components, usually those exceeding a percentage of a benchmark such as 15 percent of group revenue or profit, and audited them fully. Everything else received analytical procedures at group level. The revised standards drop the mechanical test. The group engagement team determines the components at which audit work will be performed, and the nature and extent of that work, in response to the assessed risks of material misstatement of the group financial statements. Work can be: an audit of the component's financial information; audit procedures on specific accounts, classes of transactions or disclosures; specified procedures; or analytical procedures at group level.

Size still matters, because a large component usually contributes a large share of the risks; but it is no longer the only factor. A small component that holds the group's derivatives, or that has a history of errors, may need focused procedures even though it falls below any size threshold. Conversely, a large component with simple, stable operations whose transactions run through centralized, well-controlled processes may be covered largely by testing those processes at the center. For Tamarack, the team plans full audits of parent operations, distribution and Mexico, specified procedures on inventory and revenue at the snacks subsidiary, and analytical procedures on the equity-method investee, supported by the investee's audited financial statements. Lesson 12 shows that this plan covers 94 percent of group revenue and pre-tax income with full audits.

Coverage percentages are a useful cross-check, not the objective. The standard asks whether the work, taken together, provides sufficient appropriate evidence on the group financial statements. A plan that covers 95 percent of revenue but leaves an untested significant risk, such as the goodwill attached to the snacks business, does not meet that test.

Group materiality and component performance materiality

Group materiality is set exactly as in ACCT-331: a benchmark, usually pre-tax income for a profit-oriented entity, multiplied by a percentage based on judgment. For Tamarack, the team uses 5 percent of pre-tax income of 28.0 million, giving materiality of 1.4 million, performance materiality at 75 percent, or 1.05 million, and a clearly trivial threshold of 70,000 dollars.

Where components are audited separately, each component's work is planned with a lower amount, component performance materiality. The reason is aggregation risk. If each component auditor tested to group performance materiality, misstatements that are individually below that amount could, in total across the components, exceed group materiality without anyone noticing. Component performance materiality must therefore be lower than group performance materiality, and the group engagement team sets it, using judgment about the component's size and risk and the number of components. The sum of component amounts may exceed group performance materiality, because it is unlikely that every component will have undetected misstatements at the maximum level, and all in the same direction.

The program below compares three ways of setting component amounts. The proportional method divides group performance materiality in proportion to each component's share of pre-tax income. A square-root weighting is a common practical approach that gives smaller components relatively more. The judgment band applies percentages the Tamarack team chose for each component, between 40 and 80 percent of group performance materiality. The program then simulates aggregation risk under an illustrative assumption about how much misstatement is left undetected in each component.

# Group materiality and component performance materiality for the group audit (invented figures,
# thousands of dollars). Three common ways of setting component amounts are compared.
import math, random

group_pretax = 28_000
group_mat = 0.05 * group_pretax          # 5% of pre-tax income
group_pm = 0.75 * group_mat              # performance materiality
trivial = 0.05 * group_mat
print(f"Group materiality {group_mat:,.0f}  performance materiality {group_pm:,.0f}  clearly trivial {trivial:,.0f}\n")

components = {          # pre-tax income contribution
    "Parent operations": 14_600,
    "Distribution": 7_600,
    "Mexico": 4_100,
    "Snacks": 1_100,
}
total = sum(components.values())
sqrt_total = sum(math.sqrt(v) for v in components.values())
band = {"Parent operations": 0.80, "Distribution": 0.65, "Mexico": 0.55, "Snacks": 0.40}  # team judgment

rows = {}
print(f"{'Component':<18}{'Share':>7}{'Proportional':>14}{'Square root':>13}{'Judgment band':>15}")
for name, v in components.items():
    prop = group_pm * v / total
    sq = min(group_pm * 0.9, group_pm * math.sqrt(v) / sqrt_total * 2)   # capped below group PM
    jb = group_pm * band[name]
    rows[name] = (prop, sq, jb)
    print(f"{name:<18}{v/total:>7.1%}{prop:>14,.0f}{sq:>13,.0f}{jb:>15,.0f}")
for i, label in enumerate(["Proportional", "Square root", "Judgment band"]):
    print(f"Sum of component amounts, {label.lower()}: {sum(r[i] for r in rows.values()):,.0f}")

# Aggregation risk, simulated: assume undetected misstatement left in each component averages a
# quarter of its performance materiality (an illustrative assumption, exponential distribution).
random.seed(431)
def aggregation_risk(i, trials=20_000):
    over = 0
    for _ in range(trials):
        total_left = sum(random.expovariate(1 / (0.25 * r[i])) for r in rows.values())
        over += total_left > group_mat
    return over / trials
print("\nSimulated probability that undetected misstatement exceeds group materiality:")
for i, label in enumerate(["Proportional", "Square root", "Judgment band"]):
    print(f"  {label:<14}{aggregation_risk(i):6.1%}")

Group materiality 1,400  performance materiality 1,050  clearly trivial 70

Component           Share  Proportional  Square root  Judgment band
Parent operations   53.3%           559          831            840
Distribution        27.7%           291          600            682
Mexico              15.0%           157          441            578
Snacks               4.0%            42          228            420
Sum of component amounts, proportional: 1,050
Sum of component amounts, square root: 2,100
Sum of component amounts, judgment band: 2,520

Simulated probability that undetected misstatement exceeds group materiality:
  Proportional    0.0%
  Square root     0.9%
  Judgment band   2.6%

The proportional method produces very low amounts for small components, such as 42,000 dollars for snacks, barely above the clearly trivial threshold. Such low amounts would force excessive work and, as the simulation shows, reduce aggregation risk far below what is needed. The square-root and judgment-band methods give each component a workable amount while keeping the simulated probability that undetected misstatements exceed group materiality low, about 1 to 3 percent under these assumptions. The simulation is a teaching device: real assumptions about undetected misstatement are uncertain, and the standards require judgment rather than a formula. What the exercise shows is why the sum of component amounts may exceed group performance materiality without creating unacceptable aggregation risk, provided no single component's amount approaches group performance materiality.

The group engagement team also communicates to component auditors the threshold above which misstatements must be reported back, usually the group's clearly trivial amount, 70,000 dollars for Tamarack. If a component is subject to a statutory audit with its own, possibly higher, local materiality, the group team must still require the component auditor to work to the component performance materiality set for the group audit.

Acceptance and access

Before accepting or continuing a group audit, the engagement partner must determine whether the group engagement team can reasonably expect to obtain sufficient appropriate evidence, including access to component information, management and component auditors. Restrictions can come from group management, from laws in another country, or from war or sanctions. If access to a material component is restricted and cannot be overcome, the result is a scope limitation and possibly a disclaimer of opinion. For Tamarack's Mexican subsidiary, local law does not restrict sharing of audit documentation with the group auditor, but the team confirms in writing with the Mexican firm that working papers can be made available for review.

Access is also a regulatory question. The PCAOB requires lead auditors to disclose on Form AP the names and locations of other firms that performed 5 percent or more of total audit hours, and the PCAOB inspects foreign firms that play a substantial role in issuer audits. Hollis Ward includes the right to provide the Mexican firm's working papers to regulators in its engagement letter.

Group-wide controls and centralized processes

Group-wide controls, such as the CFO's monthly review of results by component, a group accounting manual and quarterly certifications, can reduce the risk of material misstatement at components, but only if they are designed with enough precision and operate effectively. A monthly results review that looks only at variances above 2 million dollars will not detect a 600,000-dollar error at the snacks subsidiary. The group engagement team evaluates these controls in the same way as any other controls, and tests them where it plans to rely on them.

Centralized processes deserve special attention. The shared service center at head office handles payables, payroll and cash for three components. Testing those processes once, at the center, can provide evidence for all three, avoiding duplicated work. The team must still confirm that the processes operate the same way for each component, for example that the snacks subsidiary's payroll really runs through the same system and controls rather than a local spreadsheet.