Outsourced audit support under AICPA standards lets a CPA firm hand preparation work such as PBC tracking, tie-outs and first-draft workpapers to an outside team, while the firm keeps the judgments, the review and the report. The AICPA Code requires the firm to tell the client before confidential information goes to the provider, SQMS No. 1 treats the provider as a resource the firm must manage, and AU-C 220 keeps the engagement partner responsible for direction, supervision and review.
This guide is for audit partners and managers at US firms that perform nonissuer audits under GAAS. It explains the professional obligations behind outsourced audit support under AICPA standards: what the Code of Professional Conduct, SQMS No. 1 and AU-C 220 each require, how they shape the split of work, and the documentation that makes the arrangement hold up in peer review. For a broader list of delegable tasks across audit, review and compilation work, our guide to audit support outsourcing for CPA firms covers that ground.
Audit teams lose hours in two predictable places. The first is gathering: sending requests, chasing missing schedules and filing what the client sends. The second is formatting: setting up the engagement file, tying numbers between the trial balance and the statements, and making workpapers ready for review. Both are necessary, and both follow repeatable steps.
When seniors and managers spend busy season on that work, the judgment-heavy parts of the audit (risk assessment, test design, evaluation of exceptions) get squeezed into shorter windows. Firms facing this usually compare overtime, temporary hires and outside teams, a trade-off each firm has to price for itself. An outside audit support team is one of those options, and it carries specific professional obligations that the other two do not.
Outside support works best for tasks that follow the firm's documented procedures and produce something a reviewer can check. The examples below are the ones the AICPA requirements later in this guide are usually applied to:
Much of this work is the same whether the audit is voluntary or required. Owners who commission a voluntary financial statement audit for a lender or buyer still produce the same PBC lists and supporting schedules.
Three sets of AICPA requirements decide where the line falls. Each one points to the same conclusion: the outside team can prepare, and the firm remains answerable for the result.
The AICPA Code of Professional Conduct addresses outside providers in three interpretations. Under the "Use of a Third-Party Service Provider" interpretation of the Integrity and Objectivity Rule (ET 1.150.040), the current AICPA Code states that "before disclosing confidential client information to a third-party service provider, the member should inform the client, preferably in writing, that the member may use a third-party service provider." If the client objects, the firm either should not use the provider for that engagement or should decline the engagement. Many firms put this notice in the engagement letter.
Two related interpretations sit alongside it. ET 1.300.040 says the member must "adequately plan and supervise" the provider's work and should first confirm that the provider "has the required professional qualifications, technical skills, and other resources." ET 1.700.040 directs the member, before sharing confidential information, to either sign a confidentiality agreement with the provider or obtain specific client consent. An article on outsourcing and professional liability in the Journal of Accountancy states that "the CPA firm remains ultimately responsible for the services delivered to its clients."
Statement on Quality Management Standards No. 1 (QM section 10) requires each firm with an accounting and auditing practice to design, implement and operate a system of quality management. The AICPA's own auditing standards glossary defines a service provider, "in the context of QM section 10," as "an individual or organization external to the firm that provides a resource that is used in the system of quality management or in performing engagements." AU-C 620 adds that "QM section 10 requires the firm to address the use of resources from a service provider," and AU-C 220 lists the resources a firm assigns to engagements as human, technological and intellectual resources. Both quotes come from the AU-C sections published by the AICPA, current as of August 2026.
In plain terms, an outside audit support team is a resource that the firm's quality management system must cover. The Journal of Accountancy notes that the standards brought "new requirements for networks and service providers" and lists among the quality risks "having the appropriate tools, technologies, and resources (including third-party service providers)." Firms had to design and implement their SQMS No. 1 systems by December 15, 2025, so as of October 2026 peer reviewers can ask how an outside audit team fits into the firm's risk assessment and responses. Our overview of SQMS and the AICPA quality management standards explains the full system.
AU-C 220, issued as SAS No. 146, is effective for audits of periods beginning on or after December 15, 2025, so calendar-year 2026 audits fall under it. Its definition of the engagement team includes "any other individuals who perform audit procedures on the engagement," and the application material confirms that the team may include individuals from "a firm that is not a network firm or another service provider." Anyone at the outside provider who performs audit procedures is therefore part of your engagement team.
AU-C 220 then requires the engagement partner to "take responsibility for the direction and supervision of the members of the engagement team and the review of their work." The partner also reviews documentation on significant matters and significant judgments, and determines before the report date that sufficient appropriate audit evidence supports the conclusions. Because people from another firm do not go through your recruitment and training, the standard notes that your firm may need to take "different actions" to confirm their competence and their understanding of the ethical requirements, for example by providing manuals or guides. These obligations sit inside the wider framework set by generally accepted auditing standards.
The table below summarizes how responsibility divides once the three requirements above are applied.
| Audit task | Outside support team | Stays with the firm |
|---|---|---|
| PBC list tracking and follow-up | Logs requests, chases gaps through the portal, files documents | Agrees the request list with the client and decides what evidence is needed |
| File setup and lead schedules | Builds from the firm's template | Approves the structure and any deviation |
| Tie-outs (TB to leads to statements) | Performs and documents, flags differences | Investigates and resolves differences |
| Routine workpapers | Drafts to the firm's format with tickmarks | Reviews, signs off, revises conclusions |
| Analytics | Calculates ratios and variances above the set threshold | Sets thresholds, obtains explanations, decides on extra testing |
| Materiality, risk assessment, fraud inquiries | Not delegated | Engagement team led by the partner |
| Significant judgments and conclusions | Not delegated | Engagement partner |
| Client notice and confidentiality agreement | Signs the confidentiality agreement | Sends the notice and keeps the agreement on file |
| Auditor's report | Not delegated | Engagement partner |
Materiality and risk work stays on the firm side because it drives every later decision, a point explained for business owners in our article on materiality and risk in audits. The same split also applies to internal audit co-sourcing, though the rules differ. Our explainer on internal vs external audits sets out why external auditors face independence and reporting rules that internal teams do not.
The figures below are illustrative assumptions for a firm planning its next busy season, not results from any client. Suppose the firm performs 30 audits a year, each taking 160 hours in total. Of those hours, 35 per engagement go to document organization, file setup, tie-outs and first-draft workpapers. The firm expects the outside team to take on 70% of that preparation work, and it budgets 6 extra onshore hours per engagement to cover the direction, supervision and review that AU-C 220 assigns to the engagement partner.
| Line | Calculation | Hours |
|---|---|---|
| Preparation hours per year | 30 audits x 35 hours | 1,050 |
| Moved to outside team | 1,050 x 70% | 735 |
| Added onshore review time | 30 audits x 6 hours | 180 |
| Net onshore hours freed | 735 - 180 | 555 |
| Onshore hours per audit after the change | 160 - 24.5 + 6 | 141.5 |
| Extra audits the freed hours could absorb | 555 / 141.5 | about 3.9 |
The review line matters. A plan that counts only the moved hours (735) and divides by the full 160 would suggest about 4.6 extra audits. Once the supervision that the standards require is priced in, the planning figure falls to about 3.9. Firms should test their own numbers on a pilot before relying on them.
AU-C 230 requires the audit file to show "who performed the audit work and the date such work was completed" and "who reviewed the audit work performed and the date and extent of such review." Give each outside team member a named sign-off in the audit software, so a peer reviewer can see exactly which workpapers the provider prepared and who at the firm reviewed them. Use one template set and one indexing system across engagements, and return any workpaper with missing support before it enters review.
Write down what the outside team must raise immediately: unusual journal entries, possible control deficiencies, indications of fraud, related-party items and any client communication that goes beyond routine document requests. The common audit issues small businesses face, such as weak reconciliations, cut-off errors and missing documentation, are a good starting list for the issues preparers should flag rather than resolve.
Grant access one engagement at a time, limited to the files each team member needs. Use a secure portal with access logs instead of email, require multifactor authentication and remove access when an engagement closes. The confidentiality agreement required under ET 1.700.040 should describe these procedures, and the provider's controls should be checked against a data security checklist for offshore accounting before any client files move.
Begin with one engagement type that repeats, such as nonprofit or employee benefit plan audits, so the outside team learns one reporting framework first. Document your methodology and example workpapers before training starts. Run one or two engagements, measure hours saved, rework rates and review notes, and expand only when quality holds.
Can a CPA firm outsource audit work under AICPA standards? Yes. AU-C 220 explicitly contemplates engagement team members from another firm or service provider, and the AICPA Code addresses third-party service providers directly. The firm must notify the client before sharing confidential information, confirm the provider's competence, and direct, supervise and review the work.
Does ET 1.150.040 require written client consent? It requires the firm to inform the client, preferably in writing, before confidential information goes to the provider. Specific client consent is one of two options under ET 1.700.040; the other is a confidentiality agreement with the provider. Many firms do both through the engagement letter and the provider contract.
Are outside audit support staff part of the engagement team? If they perform audit procedures, yes. AU-C 220 defines the engagement team to include any individual who performs audit procedures, other than an auditor's external specialist and internal auditors providing direct assistance. Staff who handle only administrative tasks and perform no audit procedures fall outside that definition.
How does SQMS No. 1 affect outsourced audit support? It treats the provider as a resource that the firm's system of quality management must address. The firm should identify quality risks from using the provider, design responses such as competence checks and review requirements, and monitor whether those responses work.
Does the client notice apply to every outside provider? No. ET 1.150.040 states that a member is not required to inform the client when a third-party service provider gives the member administrative support services, such as record storage or software application hosting. An outside team that prepares workpapers on client data is performing professional services, so the notice applies.
Madras Accountancy supports US CPA firms with audit preparation work, including PBC tracking, file setup, tie-outs and first-draft workpapers prepared to the firm's own templates and reviewed by the firm's engagement team. To discuss how this could fit your next busy season, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
