Audit Engagement Letter Template (ISA 210)

Audit Engagement Letter: [Audited entity] [Financial year]

Terms of engagement for a statutory or contractual audit of financial statements, issued by the audit firm and countersigned by the audited entity: scope, respective responsibilities, reporting framework, expected reports, group audit arrangements, information and timetable, fees, independence, data protection, liability and governing law. Structure aligned with the requirement to agree the terms of an audit engagement in ISA 210 "Agreeing the Terms of Audit Engagements" (and ISA (UK) 210, AICPA AU-C 210) and, for US issuer audits, PCAOB AS 1301 "Communications with Audit Committees". The wording is original and does not reproduce the illustrative letter in any standard. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, audit or accounting advice; have the final letter reviewed by the firm's risk function and by counsel in the governing-law jurisdiction.

Document control

Approvals

Revision history

Contents

1. Acceptance and preconditions
2. Engagement letter
3. Schedule A: entities and reports
4. Schedule B: timetable and information requests
5. Schedule C: fees and billing
6. Jurisdiction and regime variations
7. Recurring audits and changes in terms
8. Glossary and references

1. Acceptance and preconditions

An audit should not begin until the firm has concluded that it may accept or continue the engagement and that the conditions for an audit exist. Auditing standards require the auditor to establish that the financial reporting framework is acceptable and to obtain management's agreement that it understands and accepts its responsibilities; if those conditions are not present, the engagement should not be accepted unless law requires it. Quality management standards (ISQM 1 for firms applying the ISAs, and PCAOB QC 1000 for PCAOB-registered firms from 2026-12-15) also require acceptance and continuance procedures. Record the outcome of those checks here so the letter rests on a documented decision.

For an SEC registrant, including a foreign private issuer filing Form 20-F, the audit for the SEC filing is performed under PCAOB standards by a PCAOB-registered firm. Where the company is an accelerated or large accelerated filer, that audit is an integrated audit that also covers internal control over financial reporting (ICFR). A UK listed company with SEC filings therefore usually needs one firm to deliver two audits on the same numbers: the statutory audit under ISAs (UK) and the PCAOB audit. Agree both in one letter, or in two letters that refer to each other, and make sure the fee and timetable cover both.

For a first-year audit, include communications with the predecessor auditor and the procedures needed on opening balances. For a group audit, confirm that the firm can be sufficiently involved in the work on components, including those audited by other firms, under ISA 600 (Revised) "Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors)". For listed and other public interest entities, confirm the rules on non-audit services, fee dependency and partner and firm rotation that apply.

2. Engagement letter

[Audit firm letterhead]

[Addressee: the audit committee, copied to the board of directors] Example: The Audit Committee, Corvid Commerce Group plc [Entity name and address]

Date: YYYY-MM-DD Example: 2026-10-30

Terms of our audit engagement for the year ending YYYY-MM-DD

2.1 Purpose of this letter

This letter sets out the terms on which [audit firm] (we, us) will audit the financial statements of [entity] (the company) and, where stated in Schedule A, its subsidiaries. It records what each of us is responsible for, what we will report and how the engagement will run. It replaces any previous terms for the period it covers and continues for later periods until either party proposes a change or the appointment ends.

2.2 What we will audit

We will audit the [consolidated and parent company] financial statements of the company for the year ending [YYYY-MM-DD], which comprise the statements and notes identified in the company's annual report. Schedule A lists the entities and any separate statutory or contractual audits included in this engagement. Work not listed in Schedule A, such as reviews of interim information, assurance on sustainability information or agreed-upon procedures, is outside this engagement and will be covered by separate terms.

2.3 How we will carry out the audit

We will conduct the audit in accordance with [auditing standards] and the ethical requirements that apply to us, including [the FRC Ethical Standard / the IESBA Code / national independence rules]. Example: the UK statutory audit under ISAs (UK) and the FRC Ethical Standard; the audit for the Form 20-F under the standards of the PCAOB and the independence rules of the SEC and the PCAOB. Our aim is to reach an opinion on whether the financial statements, taken as a whole, are materially right, and to gather enough evidence to support that opinion with reasonable assurance. A misstatement can arise from a mistake or from a deliberate act, and we plan for both.

Reasonable assurance is a high level of assurance but it is not a guarantee. We will test evidence on a selective basis, using our judgement about risk, and much of the evidence we obtain will be persuasive rather than conclusive. No set of controls is perfect either. So an audit can miss a material misstatement even when it is done well, and fraud is harder to find than error, because people who commit fraud hide it: they may act together, falsify documents, leave things out on purpose or get round the controls.

We will study the controls that matter to the accounts so that our tests fit the way the business actually works. We give an opinion on whether internal control over financial reporting is effective only where Schedule A says so. Example: for the Form 20-F we will report on the effectiveness of Corvid's ICFR as at 2026-12-31 under PCAOB AS 2201, alongside management's own assessment; for the UK statutory audit we give no separate controls opinion. We will tell the audit committee in writing about any material weakness and significant deficiency we find, and management about other deficiencies.

We will evaluate management's assessment of the company's ability to continue as a going concern. For the UK statutory audit we apply ISA (UK) 570 and ISA (UK) 240 in the versions the FRC has made effective for the period being audited; check the FRC's current effective dates, which may differ from the IAASB's. For audits under the international ISAs, ISA 570 (Revised 2024) and ISA 240 (Revised) apply to periods beginning on or after 2026-12-15. For the Form 20-F audit the PCAOB standards on going concern (AS 2415) and on fraud (AS 2401) apply. Where a revision first applies, we will explain its effect on our report and on the information we request before the first period it covers.

Nothing in this letter limits the work we judge necessary when we see a risk that the accounts are misstated through fraud.

2.4 Responsibilities of the directors and management

An audit only works if the directors and management accept that the accounts are theirs, not ours. By signing this letter you confirm that they accept the responsibilities below.

The directors are responsible for preparing financial statements that give a true and fair view in accordance with [framework] and applicable law, and for the accounting records on which they are based.

Management decides which controls the business needs so that the accounts are reliable, and keeps those controls working. It is also management's job, under the board's oversight, to prevent and detect fraud and breaches of law. Example: for the Form 20-F, management also assesses and reports on the effectiveness of ICFR (SOX section 404(a)) and the chief executive and chief financial officer give the certifications required by SOX section 302.

Management will let us see the books, records and papers we ask for, answer our questions, and let us speak to any employee or director of the group whose information we need. If management knows of something that bears on the accounts, it will raise it with us without waiting to be asked. [Companies Act 2006 section 499 gives the auditor of a UK company a statutory right to information and explanations; section 501 makes it an offence to provide misleading information to the auditor.]

At the end of the audit, management will sign a letter that puts in writing the explanations it has given us and any other matters we ask it to confirm. See Management Representation Letter (finance/management-representation-letter) for the format we expect.

Management will tell us promptly about any fraud or suspected fraud, any non-compliance with laws and regulations, any significant change in the business, and any matter arising after the date of our report and before the financial statements are issued that might cause the financial statements to be amended.

2.5 Our reports

We will issue an auditor's report on the financial statements addressed to the [members of the company]. The expected form and content of our report are described in Schedule A. The form and content may need to change in the light of our findings; for example, we may need to modify our opinion, add a section on a material uncertainty related to going concern, or include an emphasis of matter or other matter paragraph. If this happens, we will discuss it with you before the report is issued.

[For listed entities and other public interest entities] Our report will describe the key audit matters, the materiality we applied and an overview of the scope of the audit. [For the Form 20-F audit] Our PCAOB report, addressed to the shareholders and the board of directors, will include critical audit matters (PCAOB AS 3101) and state the year we began serving as auditor; where we audit ICFR, we will give our opinion on ICFR in the same report or a separate one.

We will read the other information in the annual report and consider whether it is materially inconsistent with the financial statements or with our knowledge, and we will report as required by [auditing standards and law]. Our opinion on the financial statements does not cover the other information unless law requires otherwise.

We will communicate with the [audit committee] about the planned scope and timing of the audit, our independence, significant findings, uncorrected misstatements and significant deficiencies in internal control. [For public interest entities in the EU and the UK: we will also provide the additional report to the audit committee required by Article 11 of Regulation (EU) No 537/2014 or its UK equivalent.]

Our UK statutory report is prepared for the [members] as a body, under the applicable law. To the extent permitted by law, we do not accept responsibility to anyone else for our audit work, our report or the opinions we form.

2.6 Group audit arrangements

Where the company is a parent, we are responsible for the opinion on the group financial statements. We will decide which components need work, and of what kind, and we will direct, supervise and review that work, whether it is performed by our own team, by other offices of our network or by other firms. Management will ensure that component management and component auditors cooperate with us and give us access to their documentation as we require. Where local law requires a separate statutory audit of a subsidiary, the local auditor will issue separate terms; Schedule A identifies these.

2.7 Timetable and information

We will agree a timetable with management and record it in Schedule B. Our ability to meet the reporting deadline depends on receiving complete and accurate information on the dates agreed, in the format requested. The list of information we request (prepared-by-client list) is part of Schedule B. If information is late or incomplete, we will tell you promptly, and the timetable and our fees may need to change.

2.8 Fees and billing

Our fees are set out in Schedule C. They are based on the time we expect to spend at the agreed rates and on the assumptions listed there, including the quality and timeliness of information and the absence of significant unexpected issues. If those assumptions prove wrong, we will discuss any additional fee with management and the [audit committee] before we incur it, except where the delay would compromise the audit. Fees are not contingent on the outcome of the audit or on the content of our report.

2.9 Independence and other services

We will maintain our independence throughout the engagement. Before we, or any member of our network, provide any other service to the company or its subsidiaries, the request will be approved under the company's policy for non-audit services and, where required, by the [audit committee]. Some services are prohibited for audit clients by law and cannot be provided at all. You agree to tell us before you discuss employment with any member of the engagement team.

2.10 Electronic communication, technology and data protection

We will communicate and exchange documents electronically, including through our client portal. Electronic communication carries risks of interception, corruption and delay, and each party will use reasonable measures, including encryption where available, to manage them.

We may use data analytics and automated tools, including tools that use artificial intelligence, to analyse your data as part of the audit. We remain responsible for the audit judgements we make. We will use your data only for the purposes of this engagement, our quality management and legal or regulatory obligations, and we will not use it to train general-purpose models outside our firm's control.

Each party will comply with applicable data protection law. [In the UK and EU: for personal data received for the audit, we act as an independent controller, because the law and our professional obligations determine how we must process it. Where we process personal data on your behalf in any separate service, a data processing agreement will apply.] We will retain audit documentation for the period required by law and professional standards, after which we will dispose of it securely.

2.11 Confidentiality and ownership of working papers

We will keep information about the company confidential, except where disclosure is required by law, regulation or professional standards, or is needed for our quality reviews and regulatory inspections, or where you consent. Our audit documentation belongs to us. We may provide access to it to regulators, to successor auditors with your consent and to group or component auditors as permitted by law.

2.12 Liability

[Insert only terms that are lawful in the governing-law jurisdiction and approved by the firm's risk function.] Example (UK): Any agreement to limit our liability for the statutory audit would be made only as a liability limitation agreement under sections 534 to 538 of the Companies Act 2006, approved by the members as section 536 requires, and would be set out in a separate document. In the absence of such an agreement, this letter does not limit our liability for the statutory audit. Example (US issuer, including a foreign private issuer): No term of this engagement provides for indemnification of the audit firm by the company, which would impair independence under SEC rules. Example (Corvid): because the same firm performs the audit for the Form 20-F, no liability limitation agreement is proposed for the UK statutory audit; SEC staff have treated limits on auditor liability as a risk to independence (check the current SEC position with counsel before proposing one).

2.13 Term, termination and complaints

This engagement continues until our appointment ends under the law, by resignation, removal or non-reappointment, or until either party terminates it in writing where the law allows. On resignation or removal we will make any statement the law requires. If you are dissatisfied with any aspect of our service, please raise it with [the engagement partner] or, if you prefer, with [the firm's head of quality]. We will investigate and respond promptly.

2.14 Governing law

This letter and any dispute arising from it are governed by the law of [jurisdiction], and the courts of [jurisdiction] have exclusive jurisdiction.

2.15 Acceptance

Please sign and return a copy of this letter to confirm that it reflects your understanding of the terms of our engagement, including the responsibilities of the directors and management. If the terms are not accepted in writing before the audit begins, we will discuss with you whether the engagement can proceed.

3. Schedule A: entities and reports

List the entities and the reports. For each, name the auditor (this firm, a network firm or another firm), the framework and the standards. Where the group relies on another firm for a component, record the access arrangements here.

Expected reports and communications:

4. Schedule B: timetable and information requests

Agree milestones with management and record owners. Link the information list to the PBC request list so both sides track the same items.

Information requested: see PBC Request List (finance/pbc-request-list) for the full list. Key items include the trial balance and consolidation, account reconciliations, the fixed asset and lease registers, revenue contracts and cut-off evidence, the going concern assessment, legal confirmations, related-party listing, board and committee minutes, and the draft annual report.

5. Schedule C: fees and billing

Fees are stated excluding VAT or sales tax. Express them in the billing currency and give the basis (fixed fee, estimate or time-based with a cap).

Check: 800 + 70 + 160 + 120 + 100 = 1,250; 5% of 1,250 = 62.5; 1,250 + 62.5 = 1,312.5. The total of 1,250 is the FY2026 statutory audit fee for the group and subsidiaries reported in the Audit Committee Report (finance/audit-committee-report), which uses it in the 70% non-audit fee cap. The half-year review (EUR 90k) and other non-audit services in that report are under separate terms and are not part of this schedule.

Most of FEE-01 is driven by the SEC filing: an integrated audit means testing the design and operating effectiveness of key controls across the group, and the PCAOB file must meet its own documentation and engagement quality review rules. When comparing the fee with peers that have no US listing, adjust for this before concluding that the fee is high.

Fee assumptions (Example): information delivered on the dates in Schedule B and in the agreed format; management's ICFR documentation and testing complete by 2027-01-29; no change in group structure; no significant new accounting matters beyond those identified at planning; no more than two rounds of review comments on the draft financial statements; component auditors receive timely cooperation from local management.

Billing (Example): 30% on signing, 40% at interim fieldwork, 30% on issuing the auditor's report; payment within 30 days of invoice. Any additional fee proposed under paragraph 2.8 is agreed in writing with the CFO and reported to the audit committee.

6. Jurisdiction and regime variations

The table below is a starting point as of 2026-10. Check the current law and professional rules in each jurisdiction before signing.

7. Recurring audits and changes in terms

For recurring audits, the auditor assesses each year whether circumstances require the terms to be revised and whether the entity needs to be reminded of the existing terms. Treat the following as triggers for a new or amended letter: a change of reporting framework, or a significant change within the framework (for example the first application of IFRS 18 for periods beginning on or after 2027-01-01), a change in SEC filer status (for example becoming or ceasing to be an accelerated filer, which changes the ICFR audit), new auditing standards that change the report (ISA 570 (Revised 2024) for periods beginning on or after 2026-12-15), a change in ownership or listing status, a new component or acquisition, a change in senior management or the board, or a change in the scope of reports requested.

If the entity asks during the engagement to change it to a lower level of assurance, such as a review instead of an audit, the auditor considers whether there is a reasonable justification before agreeing. A request driven by the wish to avoid a modified opinion is not a reasonable justification, and the auditor records the matter and considers its other obligations.

8. Glossary and references

References:

• ISA 210 "Agreeing the Terms of Audit Engagements"; ISA 260 (Revised); ISA 600 (Revised); ISA 570 (Revised 2024) and ISA 240 (Revised), effective for periods beginning on or after 2026-12-15; ISA 580 "Written Representations"; ISQM 1 (IAASB; numbers and titles only).
• ISAs (UK) 210, 240 and 570 and the FRC Ethical Standard (names only; check the FRC's effective dates).
• PCAOB AS 1301 "Communications with Audit Committees"; AS 1305 (communications about control deficiencies); AS 2201 (audit of internal control over financial reporting integrated with an audit of financial statements); AS 2401 (fraud); AS 2415 (going concern); AS 3101 (auditor's report, critical audit matters); PCAOB QC 1000, effective 2026-12-15 (numbers and titles only).
• Sarbanes-Oxley Act of 2002, sections 302 and 404; SEC Form 20-F (General Instructions and Items 15 and 16C).
• AICPA AU-C 210 "Terms of Engagement" (number and title only).
• Companies Act 2006 (UK), sections 485, 489, 492, 495, 499, 501 and 532 to 538.
• Regulation (EU) No 537/2014 on statutory audit of public interest entities; Directive 2006/43/EC as amended.
• US Securities Exchange Act Rule 10A-3; SEC Regulation S-X Rule 2-01.
• Germany: Handelsgesetzbuch sections 316 to 324.
• Vietnam: Law on Independent Audit No. 67/2011/QH12; Circular 99/2025/TT-BTC (accounting regime for enterprises).

Standard and licence note

Structure aligned with ISA 210 "Agreeing the Terms of Audit Engagements" (IAASB), ISA (UK) 210, AICPA AU-C 210 and PCAOB AS 1301, cited by number and title only, and based on public law (UK Companies Act 2006, Regulation (EU) No 537/2014, US Exchange Act Rule 10A-3 and SEC Regulation S-X). The letter text, schedules, checks and worked example are original and do not reproduce or mirror the illustrative engagement letters in any auditing standard or firm publication. IAASB, FRC, PCAOB and AICPA materials are copyrighted by their publishers; obtain the current official texts and check local law, professional rules and effective dates before use. Corvid Commerce Group and Ashgrove & Partners LLP are fictional. Template licence: MIT.