# Audit engagement letter: the AU-C 210 terms, clause by clause [Home](/) / [Engagement letter templates](/templates/engagement-letters) / Financial statement audit By [Arthur Teboul](/authors/arthur-teboul), Founder, DokuTrak. Published 2026-10-27, updated 2026-10-27. > **In brief:** An audit engagement letter is the signed agreement in which the auditor and management set the objective and scope of the audit, each side’s duties, the reporting framework and the expected report. AU-C 210 requires those terms in a written letter, and its guidance favors agreeing them before the audit begins. ## The template: Audit engagement letter **Not advice.** This page is general information, not tax, legal or HR advice. Rules change: check the cited source and ask your own professional before you rely on it. Last reviewed October 25, 2026. Fill in each [placeholder] and keep the clauses tagged with an AU-C 210 term. Attach your PBC schedule as Schedule A, keep the single audit rider only for entities that spend federal awards, and have counsel review the file once. ```text [Firm name] [Firm address] [Date] To the [Board of Directors / Audit Committee] and management of [Entity legal name] [Entity address] Re: Audit of the financial statements for the year ending [year-end date] Dear [Board chair name] and [CEO name], Objective and scope (AU-C 210: objective, scope, framework) You have asked us to audit the financial statements of [Entity legal name], which comprise the balance sheet as of [year-end date] and the related statements of operations, changes in [equity / net assets] and cash flows for the year then ended, and the related notes. Our objective is to obtain reasonable assurance about whether those statements as a whole are free from material misstatement, whether due to fraud or error, and to issue a report that includes our opinion on whether they are presented fairly, in all material respects, in accordance with [accounting principles generally accepted in the United States of America / name of framework]. Our responsibilities (AU-C 210: auditor’s responsibilities) We will conduct the audit in accordance with auditing standards generally accepted in the United States of America [and Government Auditing Standards]. Those standards require us to exercise professional judgment and skepticism, identify and assess the risks of material misstatement, and design procedures that respond to those risks. We will consider internal control relevant to the audit in order to design our procedures, but not to express an opinion on its effectiveness. We will tell you in writing of any significant deficiencies or material weaknesses we identify, and we will evaluate whether there is substantial doubt about the entity’s ability to continue as a going concern. Limits of an audit (AU-C 210: inherent limitations) Because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk exists that some material misstatements may not be detected, even though the audit is properly planned and performed in accordance with generally accepted auditing standards. Our audit is not designed to detect misstatements that are immaterial to the financial statements. Predecessor auditor (optional) You authorize [Predecessor firm name] to respond fully to our inquiries about your prior audits and to let us review its audit documentation. If you limit that authorization, we will ask why and consider it before we accept this engagement. Management’s responsibilities (AU-C 210: preconditions) Management acknowledges and understands that it is responsible for: (a) preparing and fairly presenting the financial statements in accordance with [framework], including all informative disclosures; (b) designing, implementing and maintaining internal control relevant to statements free from material misstatement, whether due to fraud or error; (c) preventing and detecting fraud, and telling us of any fraud or suspected fraud, and of any allegations, that it knows of; (d) identifying and complying with laws, regulations, contracts and grant agreements; and (e) giving us access to all records and information relevant to the statements, any additional information we request, and unrestricted access to the people from whom we need evidence. Schedule A: records you will prepare You will deliver the items in Schedule A, complete and reconciled to the general ledger, by the dates shown there, and no later than [number] business days before fieldwork begins on [fieldwork start date]. They include the year-end trial balance, bank statements and reconciliations, receivable and payable agings, inventory counts, the fixed asset rollforward, debt agreements and covenant calculations, leases, significant contracts and board minutes. Our target report date of [report date] assumes every item arrives on time. Late or incomplete items will move that date and may change our fee. Written representations At the end of fieldwork, management will sign a letter confirming the representations made to us during the audit. That letter will be dated as of the date of our report. Nonattest services (optional) We will also [draft the financial statements and notes / propose adjusting entries / prepare the federal and state tax returns]. These services do not form part of the audit. Management designates [name, title], who has suitable skill, knowledge and experience, to oversee them, and management will evaluate their adequacy and accept responsibility for their results. Supplementary and other information (optional) We will report on [the supplementary schedules] in relation to the financial statements as a whole. We will read [the annual report text] and consider whether it is materially inconsistent with the statements, but we will not audit it or express an opinion on it. Our report (AU-C 210: expected form and content) We expect to issue a written report containing an unmodified opinion. Circumstances may arise in which our report differs from that form and content, for example a modified opinion or an emphasis-of-matter paragraph. If we cannot complete the audit or form an opinion, we may decline to issue a report or withdraw from this engagement. Single audit rider (optional) Because [Entity legal name] expects to spend federal awards above the single audit threshold of 2 CFR 200.501, we will also perform a compliance audit of its major federal programs under 2 CFR Part 200, Subpart F. Management will prepare the schedule of expenditures of federal awards, the corrective action plan and the summary schedule of prior audit findings. Management will submit the data collection form and the reporting package to the Federal Audit Clearinghouse within 30 calendar days after receiving our reports, or nine months after the end of the audit period, whichever is earlier. Audit documentation and use of our report Our working papers are the property of [Firm name] and will be kept for [retention period]. Peer reviewers and regulators may access them under professional standards. You will not include our report, or refer to our firm, in an offering document, website or other publication without our prior written consent. Fees and billing Our fee estimate is [amount], based on records being ready on the Schedule A dates, no significant audit adjustments, and staff being available during fieldwork. Work caused by late items, restatements or added scope is billed at [hourly rates]. We will invoice [schedule]; invoices are payable within [number] days. We may stop work or withdraw if fees for earlier periods remain unpaid. Indemnity and disputes (optional) You agree to release and hold harmless [Firm name] and its personnel from any liability and costs resulting from knowing misrepresentations by management. Any dispute about our services will first go to non-binding mediation in [city, state] before either party starts other proceedings. This letter is governed by the laws of [state]. Later years These terms will apply to the audits of later years until either of us changes them in writing. Each year we will tell you whether we propose revised terms or remind you that these terms still apply. Acceptance Please sign and return a copy of this letter to confirm that it sets out the terms of our audit engagement, including our respective responsibilities. We will begin planning once we receive it. Very truly yours, [Firm name] [Engagement partner name], Partner Signature: ____________________ Date: __________ Acknowledged and agreed on behalf of [Entity legal name]: [CEO name], Chief Executive Officer Signature: ______________ Date: ________ [CFO name], Chief Financial Officer Signature: ______________ Date: ________ [Audit committee chair name], Audit Committee Chair Signature: ______________ Date: ________ ``` Download: [Word](https://dokutrak.com/downloads/pseo-v2/f2-engagement-letters/audit.docx) · [PDF](https://dokutrak.com/downloads/pseo-v2/f2-engagement-letters/audit.pdf) ## The six terms AU-C 210 puts in every audit letter This template is for audits of nonissuers under GAAS, the AICPA auditing standards. For an SEC issuer, PCAOB AS 1301 applies instead: the auditor agrees the terms with the audit committee and gives it the engagement letter each year ([PCAOB AS 1301, Communications with Audit Committees](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1301)). GAAS do not ask for a long letter. They ask for specific terms. AU-C 210 says the agreed terms go in an engagement letter or another suitable written agreement, and it lists what that writing must hold ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). The table maps each required term to the clause of the template below that carries it. Everything else in a typical letter is the firm’s choice. Fees, the document schedule, dispute terms and the use of the report are good practice, not GAAS terms. That split matters when a client asks you to delete a paragraph: the six items in the table cannot go. | Term AU-C 210 requires | Clause in the template | What to fill in | | --- | --- | --- | | Objective and scope of the audit | Objective and scope | The entity, the statements and the period audited | | Responsibilities of the auditor | Our responsibilities | Reasonable assurance, fraud or error, internal control communications | | Responsibilities of management | Management’s responsibilities | Fair presentation, internal control, access to records and people | | Inherent limitations statement | Limits of an audit | Keep the wording: some material misstatements may go undetected | | Applicable financial reporting framework | Objective and scope | U.S. GAAP, or the special purpose framework by name | | Expected form and content of the report | Our report | The opinion you expect, and that it may differ | ## Management’s side: the preconditions for an audit Before you accept, AU-C 210 asks you to confirm two things ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). The framework must be acceptable, and management must agree to its responsibilities in writing. Those **preconditions for an audit** are management’s acknowledgment that it prepares the statements, maintains internal control, and gives you full access to records, extra information and staff. If management will not sign that acknowledgment, the standard says you should not accept the audit unless law requires you to ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). The same applies to a scope limit that you expect to end in a disclaimer of opinion, when no law requires the audit. Put the duties in the letter, not in a side email. A **nonattest service** is any work beyond the audit itself, such as drafting the statements, proposing journal entries or preparing the tax return. If your firm does that work, the AICPA independence rules ask management to name a person with suitable skill to oversee it and to accept the results ([AICPA Code of Professional Conduct, ET 1.228 and 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). The understanding must be in writing before the work starts, so the letter is the natural place. - Address the letter to those charged with governance, such as the board or audit committee, and to management. - Have the CEO and CFO sign for management, and the audit committee chair sign when governance is separate. - Name the person who oversees any nonattest work, by name and title. - For an initial audit with a **predecessor auditor**, the firm that audited the prior year, ask management to authorize that firm to answer your inquiries before you accept ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). ## The PBC schedule: what the client hands over, and when An audit cannot start until the client’s records are in hand. A **PBC list** is the schedule of items the client prepares for the auditor, with an owner and a due date for each line. Attach it to the letter, so the dates bind both sides. You can draft one with the [PBC list generator](/tools/pbc-list-generator). Tie the report date to the PBC dates. Say that fieldwork starts only when the listed items are complete, and that late or partial items move the report date and may add fees. The guide on [what a PBC list is](/blog/what-is-a-pbc-list) covers how to word each request. - Trial balance and general ledger detail at year-end. - Bank statements and bank reconciliations for every account as of the balance sheet date. - Receivable and payable agings that tie to the ledger. - Inventory count sheets and the pricing support. - Fixed asset rollforward with additions and disposals. - Debt agreements, covenant calculations, leases and significant contracts. - Board minutes for the year and up to the report date. ## Single audit rider for entities that spend federal awards A **single audit** is an audit of the financial statements plus a compliance audit of the major federal programs, under the Uniform Guidance. A non-federal entity that spends $1,000,000 or more in federal awards in its fiscal year must have one ([2 CFR 200.501, Audit requirements](https://www.ecfr.gov/current/title-2/section-200.501)). Add a rider rather than rewriting the base letter. The rider should name the schedule of expenditures of federal awards as management’s document. It should also set the filing duty. The audit, the data collection form and the reporting package are due within 30 calendar days after the auditee receives the report, or nine months after year-end, whichever is earlier ([2 CFR 200.512, Report submission](https://www.ecfr.gov/current/title-2/section-200.512)). Write both dates in the rider, so nobody counts from the wrong one. ## Indemnity, disputes and recurring audits The independence rules limit what you can write here. The client may agree to hold the firm harmless for losses caused by knowing misrepresentations by management ([AICPA Code of Professional Conduct, ET 1.228 and 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). The firm may not agree to indemnify an attest client for losses linked to the client’s own acts, because that impairs independence ([AICPA Code of Professional Conduct, ET 1.228 and 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). Mediation for disputes about past services is fine. Binding arbitration is closer to litigation, and the code warns it may create an adverse-interest threat once it starts ([AICPA Code of Professional Conduct, ET 1.228 and 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). For a public company, check SEC and PCAOB rules before you add any cap on liability. For a recurring audit of a nonissuer, you do not need a new letter each year. AU-C 210 asks you to assess whether the terms need revising, and if not, to remind management of them and document the reminder ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). A short annual update letter with the new period and fee does both. ## Questions people ask ### Who signs an audit engagement letter? The engagement partner signs for the firm. Management signs to acknowledge its responsibilities, usually the CEO and CFO. When the board or audit committee is separate from management, its chair often signs too, because AU-C 210 lets you agree the terms with management or those charged with governance ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). ### Is an audit engagement letter a contract? In practice yes: both sides sign it, and it records the services, duties and fees they agreed. Its contents are also a professional requirement, since AU-C 210 lists the terms it must hold ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). Have your lawyer review the template once for your state. ### Does a recurring audit need a new engagement letter every year? Not for a nonissuer. Each year you assess whether the terms need revising; if they do not, you remind management of the existing terms and document that reminder ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). For an SEC issuer, PCAOB AS 1301 asks the auditor to give the engagement letter to the audit committee annually ([PCAOB AS 1301, Communications with Audit Committees](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1301)). ### What happens if management refuses to sign the engagement letter? Without management’s written agreement to its responsibilities, the preconditions for an audit are not met. AU-C 210 says the auditor should not accept the engagement in that case, unless law or regulation requires it ([AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective)). ## Sources - [AICPA Statements on Auditing Standards, AU-C 210 Terms of Engagement](https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effective): AU-C 210 sets the preconditions for an audit, lists the terms an audit engagement letter must include, and covers recurring audits and refused terms. - [AICPA Code of Professional Conduct, ET 1.228 and 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf): Indemnification by and of an attest client, alternative dispute resolution, and the written understanding and designated overseer for nonattest services. - [PCAOB AS 1301, Communications with Audit Committees](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1301): For audits under PCAOB standards, the auditor establishes the terms of the audit with the audit committee, records them in an engagement letter and provides that letter to the audit committee annually. - [2 CFR 200.501, Audit requirements](https://www.ecfr.gov/current/title-2/section-200.501): A non-federal entity that spends $1,000,000 or more in federal awards in a fiscal year must have a single or program-specific audit. - [2 CFR 200.512, Report submission](https://www.ecfr.gov/current/title-2/section-200.512): The audit, data collection form and reporting package are due within 30 calendar days after the auditor’s report or nine months after the audit period, whichever is earlier. ## More on this topic - [Engagement letter template (general)](/blog/engagement-letter-template) - [PBC list generator](/tools/pbc-list-generator) - [What is a PBC list](/blog/what-is-a-pbc-list) - [Engagement letter templates by service](/templates/engagement-letters) ## About the author Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. [Arthur Teboul](/authors/arthur-teboul). How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? [Contact us](/contact). ## Ask once. DokuTrak does the chasing. - Your client uploads from one link, with no account and no password. - Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives. - You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file. 14-day free trial, no card. Add one only to keep going. [Request these documents with DokuTrak](https://app.dokutrak.com/sign-up?docs=bank-statement%2Ccontract%2Clease%2Cinvoice)