SAS 149 Group Audits: Risk-Based Scoping, Referred-To Auditors and Documentation

SAS 149 group audits follow a rewritten AU-C section 600, which applies to audits of group financial statements for periods ending on or after December 15, 2026. For a calendar-year client, the December 31, 2026 audit is the first one under the new rules. The standard replaces the old "significant component" test with a risk-based choice of components. It also gives auditors whose reports are referenced in the group report a new label: the referred-to auditor.

This guide covers what SAS 149 group audits require in practice, based on the standard text the AICPA publishes in its Professional Standards, from the new vocabulary to scoping, involvement, reference to other auditors and documentation.

What SAS 149 Is and When It Takes Effect

SAS No. 149 is titled Special Considerations: Audits of Group Financial Statements (Including the Work of Component Auditors and Audits of Referred-to Auditors). It is codified as AU-C section 600 and supersedes the version that came from SAS No. 122. The AICPA's AU-C sections currently effective carry the new section with the note "Effective for audits of group financial statements for periods ending on or after December 15, 2026." The prior text stays in the codification as AU-C 600A for earlier periods.

The AICPA's May to August 2026 update to the AU-C sections also records June 2026 conforming changes to AU-C 260 and AU-C 600 tied to SAS 149, so firms should work from the current text when they update templates.

SAS 149 builds on standards already in force. SAS No. 145, effective for periods ending on or after December 15, 2023, introduced the separate assessment of inherent risk and control risk, and AU-C 600 now points back to AU-C 315 for group risk assessment. SQMS No. 1 systems had to be designed and implemented by December 15, 2025, and SAS No. 146 is effective for engagements for periods beginning on or after that date, according to the Journal of Accountancy's implementation guide. Our overview of SQMS and the AICPA quality management standards covers the firm-level side.

The New Vocabulary in SAS 149 Group Audits

The term "component auditor" survives. What changes is who it covers. Under the old AU-C 600A, a component auditor was any auditor who performed work on a component's financial information used as audit evidence for the group audit, and the group engagement partner could either assume responsibility for that work or make reference to it in the report.

SAS 149 splits that population in two:

AU-C 600 states that a referred-to auditor "is not a component auditor, and accordingly, is not a part of the engagement team for a group audit." So the group auditor does not direct, supervise or review a referred-to auditor's work, though that route carries its own conditions and documentation.

How SAS 149 Changes Component Scoping

Under the prior standard, the group engagement team first sorted components into significant and non-significant, and the work at significant components followed largely from that label. SAS 149 removes that step. Paragraph .06 says the group auditor "uses professional judgment in determining the components at which audit work will be performed," based on its understanding of the group and factors such as the ability to perform procedures centrally, shared service centers and common information systems and controls.

The application material lists matters that may drive the choice, such as newly formed or acquired entities, entities with significant changes and significant related party transactions. A shared service center can itself be a component.

The scoping sequence runs roughly as follows:

1. Understand the group, its environment, its reporting framework and its system of internal control, including how much controls are common across entities and how the consolidation process works (paragraph .32).
2. Identify and assess risks of material misstatement of the group financial statements, including risks in the consolidation process (paragraph .35).
3. Set component performance materiality below group performance materiality for components where procedures will be performed, along with a threshold for reporting misstatements to the group auditor that does not exceed the group's clearly trivial amount (paragraph .37).
4. Decide where further audit procedures will be performed and what work each component needs (paragraph .39).

The consolidation process gets its own requirements. The group auditor is responsible for procedures on whether all entities are included, on the accuracy of consolidation adjustments and reclassifications, and on signs of management bias in consolidation judgments. If your client relies on consolidation tools, our guide to financial consolidation software under ASC 810 explains what those systems automate. The same risk thinking that drives materiality and risk in audits now drives component selection directly.

Group Auditor Involvement in Component Auditors' Work

Because component auditors are now part of the engagement team, the AU-C 220 rules on direction, supervision and review apply to them. The group engagement partner has to be "sufficiently and appropriately involved throughout the group audit engagement, including in the work of component auditors" (paragraph .18).

The main involvement requirements are:

• Before the work starts: confirm that each component auditor will cooperate and perform the requested work, make them aware of relevant ethical and independence requirements, and determine that they have the competence, capabilities and time to do the assigned procedures (paragraphs .26 to .28).
• Direction and supervision: the group engagement partner takes responsibility for the nature, timing and extent of direction, supervision and review, with more attention on areas of higher assessed risk, significant risks and significant judgment (paragraph .30).
• Two-way communication: the group auditor sends component auditors the significant risks, related parties and going concern matters relevant to their work, along with the component performance materiality and reporting threshold. Component auditors are asked to report back on risk matters, newly found related parties and going concern indicators (paragraphs .33, .34 and .38).
• Reporting at the end: the component auditor's communication should cover misstatements above the threshold, control deficiencies, fraud, noncompliance, indicators of management bias and overall conclusions, among other matters (paragraph .47).
• Reviewing their files: the group auditor decides whether to review additional component auditor documentation, considering the work performed, the component auditor's competence and the supervision already applied (paragraph .49).

If a component auditor does not meet independence requirements, or the group engagement partner has serious concerns about matters such as their cooperation, ethics compliance or competence, the group auditor has to obtain the evidence for that component without involving that auditor (paragraph .29). When component auditors are involved, the auditor's report on the group financial statements makes no reference to them (paragraph .71).

For firms that use offshore staff on component work, the same engagement team rules apply. Our guide to offshore audit support and US GAAP workpapers and our article on outsourced audit support under AICPA standards cover how firms set that up.

When the Group Auditor Can Refer to a Referred-To Auditor

Making reference remains available, with conditions. Under paragraph .56, reference cannot be made unless the referred-to auditor audited the component's financial statements under GAAS or PCAOB standards and issued a report that is not restricted as to use. If the component uses a different financial reporting framework, extra conditions apply under paragraph .57, including that the group auditor can evaluate the conversion adjustments without being involved in the component audit.

Before deciding, the group engagement partner takes responsibility for making the referred-to auditor aware of ethical requirements and confirming compliance, and determines that the referred-to auditor has appropriate competence and capabilities (paragraphs .51 and .52). The group auditor then reads the component's financial statements and the referred-to auditor's report to identify significant matters (paragraph .58).

When reference is made, the group audit report has to state that the component was audited by the referred-to auditor and the magnitude of the portion it audited (paragraph .59). Naming the referred-to auditor requires their express permission and presentation of their report alongside the group report (paragraph .60).

Worked example: stating the magnitude of a referred-to auditor's portion

Application material paragraph .A182 says magnitude can be stated as dollar amounts or percentages of total assets, total revenues or other appropriate criteria, whichever most clearly describes the portion audited. Take a hypothetical group whose subsidiary C is audited by another firm, with figures in millions:

The report could describe the referred-to auditor's portion as total assets of $4.2 million (23.3% of consolidated total assets) and total revenues of $3.1 million (13.8% of consolidated total revenues). Component performance materiality is not required for this component (paragraph .A129).

Documentation Required Under SAS 149

Paragraph .77 lists what the group auditor must include in the audit documentation. Required items include:

• significant matters about restrictions on access to people or information, and how they were addressed;
• the basis for determining components for planning and performing the group audit;
• the basis for component performance materiality and for the misstatement reporting threshold;
• the basis for concluding that component auditors have the competence, capabilities and time to perform their assigned procedures;
• key elements of the understanding of the group's system of internal control;
• the nature, timing and extent of direction, supervision and review of component auditors, including any review of additional component auditor documentation;
• communications with component auditors, including fraud, related party and going concern matters, and how significant matters were addressed;
• for each component where reference is made, the component's financial statements and the referred-to auditor's report, the basis for the competence determination, and the related communications;
• components where audited financial statements of an equity method investee are used as evidence;
• the group auditor's evaluation of, and response to, findings of component auditors or referred-to auditors that could have a material effect on the group financial statements.

Why SAS 149 Group Audits Reach Smaller Firms

AU-C 600 applies "to all group audits, regardless of size or complexity" (paragraph .12). Group financial statements include consolidations, combined statements of entities under common control, and aggregation of branches or divisions. Application paragraph .A4 adds that a single legal entity with business units that have separate locations, separate management or separate information systems, such as a bank with multiple branches, can meet the definition.

That pulls in ordinary engagements, such as a manufacturer with two plants on separate ledgers or a holding company with a few operating LLCs. When the group auditor performs all the work itself, the requirements that depend on component auditors or referred-to auditors do not apply.

Client-side readiness matters too. A client that has documented its controls gives the group auditor a clearer picture of common controls across entities, and our guide to internal controls for startups explains how SAS 145 shapes the auditor's view of those controls. For a refresher on how group audits fit within GAAS generally, see GAAS standards explained, and for engagement-level choices, our comparison of financial statement audit vs review vs compilation.

Preparing December 31, 2026 Year-Ends

With the first calendar-year audits under SAS 149 already in planning as of October 2026, these steps help:

1. Flag every engagement that meets the group financial statements definition, including single entities with separately managed locations.
2. For each, decide early whether other auditors will be component auditors or referred-to auditors, because the requirements, the report wording and the documentation differ.
3. Update planning templates to replace significant component scoping with a documented risk-based basis for selecting components.
4. Build a component auditor instruction pack covering ethics confirmations, component performance materiality, the reporting threshold, and the paragraph .47 reporting items.
5. Update the group audit report templates for reference to referred-to auditors, including how magnitude will be stated.
6. Update engagement letters for the group management access acknowledgments in paragraph .21.

Firms short on capacity often bring in audit support outsourcing for workpaper preparation and checklist updates, while keeping judgments with the engagement partner.

Frequently Asked Questions

When is SAS 149 effective? AU-C 600 as revised by SAS 149 is effective for audits of group financial statements for periods ending on or after December 15, 2026. For a calendar-year entity, the first audit covered is the December 31, 2026 year-end.

Does "referred-to auditor" replace "component auditor"? Only in part. Both terms exist under SAS 149. A component auditor performs audit work on a component for the group audit and is part of the engagement team. A referred-to auditor audits a component's financial statements and is referenced in the group report, and is outside the engagement team. Under the prior standard, both were called component auditors.

Does SAS 149 still use significant components? No. AU-C 600 no longer defines significant components. The group auditor uses professional judgment, based on its understanding of the group and the assessed risks, to determine the components at which audit work will be performed.

Do SAS 149 group audits apply to a single company with several locations? They can. If business units have separate locations, management or information systems and their financial information is aggregated, the financial statements can meet the definition of group financial statements under AU-C 600.

What documentation does SAS 149 add? Paragraph .77 requires documentation of items such as the basis for determining components, component performance materiality, component auditor competence, the supervision and review of component auditors, and records for each component audited by a referred-to auditor.

Next Step

Madras Accountancy supports US CPA firms with audit workpaper preparation, checklist and template updates, and engagement documentation, working under the direction of the firm's engagement team. To talk through support for your 2026 group audit season, contact our team.