Audit Communication Letter Template for the United States

Generate a bespoke document

What is a Audit Communication Letter?

The Audit Communication Letter is a mandatory document required under U.S. auditing standards that formalizes the relationship between auditors and their clients. This document is essential when initiating a new audit engagement or updating terms for continuing engagements. It includes detailed information about audit scope, methodologies, timelines, and responsibilities, ensuring compliance with AICPA standards, PCAOB requirements (for public companies), and relevant federal regulations. The letter serves as both a legal and professional framework for the audit process, protecting all parties involved while establishing clear expectations and communication channels.

Frequently Asked Questions

Is an Audit Communication Letter legally binding under US law?

Yes, an Audit Communication Letter is legally binding in the United States. Once signed by both the auditor and client, it creates enforceable contractual obligations under federal auditing standards, including Sarbanes-Oxley Act requirements. The letter establishes the legal scope of work, responsibilities, and terms that both parties must follow throughout the audit engagement.

Can my company face penalties if the Audit Communication Letter is missing or incomplete?

Yes, missing or incomplete Audit Communication Letters can result in serious penalties under US law. For public companies, this could lead to SEC enforcement actions, fines, and potential violations of Sarbanes-Oxley Act requirements. The AICPA also requires proper engagement letters, and their absence can result in professional sanctions against the auditing firm.

Does the Sarbanes-Oxley Act require specific language in Audit Communication Letters?

Yes, the Sarbanes-Oxley Act of 2002 mandates that Audit Communication Letters include specific provisions regarding auditor independence, prohibited non-audit services, and management responsibilities. The letter must clearly define the scope of audit work and ensure compliance with Section 201 restrictions on auditor services to maintain independence.

How is an Audit Communication Letter different from an engagement letter?

An Audit Communication Letter is actually a type of engagement letter specifically designed for audit services under US auditing standards. While general engagement letters can cover various professional services, Audit Communication Letters must comply with specific AICPA and Sarbanes-Oxley requirements, including detailed provisions about audit scope, independence, and regulatory compliance.

How long does it typically take to prepare an Audit Communication Letter?

Creating an Audit Communication Letter typically takes 1-3 business days for experienced auditing firms. The timeline depends on the complexity of the engagement, whether it's a new or continuing client, and the level of customization needed to address specific Sarbanes-Oxley compliance requirements and company circumstances.

Can using a generic template for Audit Communication Letters cause legal problems?

Yes, using generic templates without proper customization can create significant legal risks under US auditing standards. Each Audit Communication Letter must be tailored to specific client circumstances, applicable Sarbanes-Oxley requirements, and current AICPA standards. Generic language may fail to address critical compliance issues or create unintended liability exposure.

Must Audit Communication Letters be updated annually for continuing clients?

Yes, AICPA standards generally require annual updates to Audit Communication Letters, even for continuing clients. Changes in auditing standards, Sarbanes-Oxley regulations, company circumstances, or engagement scope necessitate letter revisions. Many firms issue new letters annually to ensure current compliance and address any changes in legal requirements or engagement terms.

Reviewed by

Swetha Meenal

Legal Engineer, GenieAI

Swetha Meenal profile photo

A lawyer, legal researcher and legal tech founder, Swetha has built AI products deployed inside Tier 1 firms and enterprises. She ensures GenieAI's alignment with the latest regulation and executes testing on the legal robustness of Genie output.

Reviewed by

Imad Mohammed Nazar

Legal Engineer, GenieAI

Imad Mohammed Nazar profile photo

A Skadden-trained M&A lawyer, Imad advised on cross-border transactions and contractual risk before moving into legal AI. He reviews GenieAI's output for compliance and enforceability across our 150+ supported jurisdictions, as well as facilitating external benchmarking.

Jurisdiction

United States

Publisher

GenieAI

Sector

Business

Cost

Free to use

Last updated

About the Audit Communication Letter

An Audit Communication Letter is a critical legal document that formalizes the professional relationship between auditors and their clients in the United States. This comprehensive agreement outlines the terms, scope, and expectations for audit engagements while ensuring compliance with federal regulations and professional auditing standards. You need this document to establish clear communication channels, define responsibilities, and protect all parties involved in the audit process.

When do you need this document?

You must prepare an Audit Communication Letter when beginning any new audit engagement or when updating the terms of an existing auditor-client relationship. Public companies require this letter to comply with Sarbanes-Oxley Act requirements and PCAOB standards. Private companies need it to meet AICPA auditing standards and establish professional accountability. You'll also need this document when there are significant changes to your business operations, audit scope, or when switching audit firms. Additionally, boards of directors and audit committees rely on this letter to understand their oversight responsibilities and the audit timeline.

Key legal considerations

Your Audit Communication Letter must clearly define the engagement scope to avoid disputes about what is and isn't included in the audit. The responsibilities section should explicitly outline management's obligation to provide accurate financial records and the auditor's duty to conduct the audit according to professional standards. Communication protocols are crucial for ensuring timely reporting of significant findings, including any potential fraud or material weaknesses in internal controls. Fee arrangements should be detailed and transparent to prevent billing disputes. You must also address auditor independence requirements and any limitations on the audit scope. The letter should include provisions for how disagreements will be resolved and specify the governing law for the engagement.

Legal requirements in United States

Under United States law, your Audit Communication Letter must comply with the Sarbanes-Oxley Act of 2002, which mandates specific independence requirements and establishes the framework for public company audits. The Securities Exchange Act of 1934 and Securities Act of 1933 create additional disclosure and reporting obligations that must be reflected in your engagement terms. For public companies, PCAOB standards require specific communications about audit strategy, significant risks, and material findings. AICPA Statements on Auditing Standards apply to all engagements and mandate certain disclosures in the engagement letter. The Private Securities Litigation Reform Act of 1995 affects auditor liability and requires specific language about fraud reporting responsibilities. Your letter must also comply with state-specific regulations where your company is incorporated or conducts business, as these may impose additional requirements beyond federal law.

GOVERNING LAW

Applicable law

This Audit Communication Letter is drafted to comply with United States law. Key legislation includes:

Sarbanes-Oxley Act 2002: Primary federal law that establishes requirements for all U.S. public company boards, management, and public accounting firms. Sets standards for external auditor independence and corporate responsibility.

Securities Exchange Act 1934: Federal law governing secondary trading of securities, establishing the SEC, and requiring periodic reporting for public companies. Impacts audit requirements and disclosures.

Securities Act 1933: Federal law requiring registration of securities offerings and detailed financial disclosure. Sets foundation for audit requirements in securities offerings.

Private Securities Litigation Reform Act 1995: Law affecting auditor liability and responsibility in securities litigation, including requirements for reporting fraud.

AICPA Statements on Auditing Standards: Professional standards issued by AICPA that provide framework for audit conduct and reporting, including communication requirements.

PCAOB Standards: Standards set by the Public Company Accounting Oversight Board for audits of public companies, including specific communication requirements.

Generally Accepted Auditing Standards: Systematic guidelines used by auditors when conducting audits, including standards for audit communications and reporting.

Statement on Standards for Attestation Engagements: Professional standards for CPAs performing attestation services, including specific communication requirements.

SAS 114: Specific standard governing auditor's communication with those charged with governance, outlining required communications and their timing.

SAS 115: Standard specifically addressing requirements for communicating internal control related matters identified in an audit.

AICPA Code of Professional Conduct: Ethical guidelines including independence requirements that must be reflected in audit communications.

SEC Independence Rules: Specific requirements for auditor independence when dealing with publicly traded companies, affecting communication content.

Professional Ethics Guidelines: General ethical principles governing audit practice, including confidentiality and communication requirements.

Genie's Security Promise

Genie is the safest place to draft. Here's how we prioritise your privacy and security.

Your data is private:

We do not train on your data; Genie's AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

We are ISO27001 certified, so your data is secure

Organizational security:

You retain IP ownership of your documents and their information

You have full control over your data and who gets to see it