Audit Engagement Letter (Pakistan)

An Audit Engagement Letter in Pakistan puts the writer's position in formal terms, setting out the facts relied on and the response or action it seeks.

ISA 210, as adopted by ICAP, requires that the auditor agrees with management or those charged with governance the terms of the audit engagement and records these terms in an audit engagement letter or other suitable form of written agreement. The engagement letter must be signed by both parties and sent to the client before the commencement of audit work. Failure to issue or obtain a signed engagement letter is a professional deficiency that may be cited in ICAP's Quality Control Review (QCR) inspections conducted under the Chartered Accountants (Quality Control Review) Regulations 2013.

Under the Companies Act 2017, the statutory audit of companies incorporated with the Securities and Exchange Commission of Pakistan (SECP) is conducted by a member of ICAP holding a Certificate of Practice (COP). Section 252 of the Companies Act 2017 requires companies to appoint an auditor at each Annual General Meeting (AGM) and Section 255 sets out the auditor's duties and rights. For listed companies, SECP's Listed Companies (Code of Corporate Governance) Regulations 2019 impose additional requirements on the audit relationship, including requirements for the audit committee to review and approve the engagement letter before the audit commences.

Banks and financial institutions regulated by the State Bank of Pakistan (SBP) are subject to additional audit requirements under the Banking Companies Ordinance 1962. SBP's Prudential Regulations require that the auditors of banks are drawn from a panel of auditors approved by SBP and that the engagement letter reflects the scope requirements stipulated by SBP including the review of internal controls, compliance with SBP directives, and the reporting of significant findings directly to SBP.

Insurance companies regulated by the Securities and Exchange Commission of Pakistan (SECP) under the Insurance Ordinance 2000 must have their accounts audited by an ICAP member approved by SECP, and the engagement letter must reflect the statutory reporting requirements under the Insurance Rules 2017 and the SECP Insurance Circulars.

The Public Sector Companies (Corporate Governance) Rules 2013, applicable to public sector companies listed on the Pakistan Stock Exchange (PSX) or those meeting the threshold criteria under the rules, impose governance obligations that affect the audit engagement — including the requirement for audit committee pre-approval of all audit and non-audit services and the rotation of the engagement partner at least every five years.

In addition to statutory audits, ICAP members conduct non-statutory audits including internal audits, tax audits for Federal Board of Revenue (FBR) compliance purposes, and special purpose engagements. Each type of engagement requires its own tailored engagement letter specifying the particular scope, deliverables, and professional standards applicable.

An Audit Engagement Letter in Pakistan is required at the commencement of every audit engagement conducted by a member of the Institute of Chartered Accountants of Pakistan (ICAP), whether the audit is statutory or voluntary.

An Audit Engagement Letter is needed at the start of a new statutory audit engagement — when an ICAP member is appointed as auditor of a company for the first time, or when there is a change in the terms of an existing engagement. ISA 210 adopted by ICAP requires an engagement letter for every new audit client and recommends a fresh letter at the start of each audit year where terms change or where it is appropriate to remind the client of existing terms.

An Audit Engagement Letter is required when a bank or financial institution regulated by the State Bank of Pakistan (SBP) appoints its statutory auditor. SBP's requirements for banking sector audits — including specific reporting obligations, the review of classified assets, and the assessment of capital adequacy under the Basel III framework — must be reflected in the engagement letter to define the auditor's duties clearly.

An Audit Engagement Letter is needed when a listed company on the Pakistan Stock Exchange (PSX) appoints or reappoints its auditor following the AGM. SECP's Listed Companies (Code of Corporate Governance) Regulations 2019 require the audit committee to review and recommend the engagement terms to the Board, and the engagement letter forms the basis of this review.

An Audit Engagement Letter is required when a non-governmental organisation (NGO) or non-profit company registered under Section 42 of the Companies Act 2017 engages an ICAP member for an audit required by a donor, regulatory body, or the SECP. International donors and development finance institutions — such as the World Bank, ADB, USAID, and DFID — typically require an ICAP-standard engagement letter as part of their grant or loan financial management requirements.

An Audit Engagement Letter is needed when a tax audit is being conducted by an ICAP member at the request of the Federal Board of Revenue (FBR) or on behalf of a taxpayer under Section 177 of the Income Tax Ordinance 2001. The letter defines the scope of the tax audit, the access rights to records, and the deliverables including the tax audit report.

An Audit Engagement Letter is required when the audit scope changes significantly during an existing engagement — for example, when the company acquires a new subsidiary, when a new financial reporting standard (such as IFRS 16 or IFRS 9) takes effect, or when SBP or SECP issues new regulatory requirements affecting the audit scope. A revised or supplemental engagement letter should be issued and signed to reflect the changed scope.

A valid Audit Engagement Letter in Pakistan under ISA 210, the Chartered Accountants Ordinance 1961, and the Companies Act 2017 must contain the following essential elements.

Identification of Parties and the Engagement: The full name of the audit firm (including its ICAP registration number and Certificate of Practice number), the name of the client company (including its SECP company registration number and NTN issued by the Federal Board of Revenue), the financial period to be audited, and the engagement type (statutory audit, internal audit, tax audit, or special purpose engagement).

Objective and Scope of the Audit: A clear statement that the objective of the statutory audit is to express an opinion on whether the financial statements give a true and fair view in accordance with the applicable financial reporting framework — typically International Financial Reporting Standards (IFRS) as adopted by the Institute of Chartered Accountants of Pakistan (ICAP) or Accounting and Financial Reporting Standards for Medium-Sized Entities (AFRS for MSEs) as promulgated by ICAP. The scope must specify the financial statements to be audited (balance sheet, profit and loss, cash flow, statement of changes in equity, and notes) and the period covered.

Applicable Financial Reporting Framework: A statement of the financial reporting framework applicable to the client — IFRS (for listed companies, banks, insurance companies, and large unlisted companies), AFRS for MSEs (for qualifying medium-sized entities), or Special Purpose Framework (for specific regulatory or donor requirements). The applicable framework determines the auditing standards and procedures.

Responsibilities of Management: A clear statement that management is responsible for the preparation and fair presentation of the financial statements in accordance with the applicable framework, for maintaining adequate internal controls, for providing the auditor with all information and access required, and for making representations to the auditor under ISA 580 — Written Representations.

Responsibilities of the Auditor: A statement that the auditor will conduct the audit in accordance with International Standards on Auditing (ISAs) as adopted by ICAP, with professional skepticism under ISA 200, and in compliance with the ICAP Code of Ethics. The auditor's independence from the client must be confirmed in accordance with ICAP Independence Rules.

Fees and Billing: The audit fee, the basis of calculation (fixed fee or time and materials), the billing schedule (interim and final invoices), and the treatment of out-of-pocket expenses. For listed companies, audit fees must be disclosed in the annual report under Schedule IV to the Companies Act 2017.

Reporting: The form and content of the auditor's report under ISA 700 (Forming an Opinion and Reporting on Financial Statements), the timing of delivery, the reporting of material weaknesses under ISA 265, and any additional reporting required by SBP, SECP, FBR, or other regulatory authorities.

Confidentiality: The auditor's obligation to maintain client confidentiality under the ICAP Code of Ethics — Section 140 (Confidentiality) — except where disclosure is required by law, regulatory authorities (SECP, SBP, FBR), or professional standards.

Engagement Period and Renewal: The term of the engagement (one financial year with annual renewal), the conditions for early termination, and the notice period required. For statutory audits, the resignation and removal of auditors is governed by Sections 258 and 259 of the Companies Act 2017.

Forms-legal.com provides this Audit Engagement Letter (Pakistan) template as a practical drafting guide consistent with ISA 210 and ICAP requirements. Audit firms should customise the letter for each client engagement and seek guidance from ICAP's Technical Advisory Committee or Practice Review Committee where complex regulatory issues arise.

Under the State Bank of Pakistan (SBP) Act 1956, the SBP regulates banking. The Securities and Exchange Commission of Pakistan (SECP) regulates capital markets under the Securities Act 2015. Section 4 of the Negotiable Instruments Act 1881 governs promissory notes. The Federal Board of Revenue (FBR) administers tax obligations under the Income Tax Ordinance 2001. The Sales Tax Act 1990 governs indirect taxation.