If your firm audits anything with more than one piece, a parent and subsidiaries, a company with multiple locations, a fund with several entities, the rules for how you do it just changed. SAS 149 rewrites the group audit standard, and it takes effect for periods ending on or after December 15, 2026. For a calendar-year audit, that is the December 31, 2026 year-end, which is close.
This is not a small tweak to a checklist. It changes how an engagement team thinks about risk across a group and how it works with other auditors on components. Here is what SAS 149 does, the new vocabulary it introduces, and what your firm should do before the effective date arrives.
SAS 149 is the Auditing Standards Board's overhaul of the group audit rules, replacing the older approach. The core shift is toward a risk-based method. Instead of mechanically deciding which components are "significant" and auditing them by rote, the standard pushes the group engagement team to focus effort where the risks of material misstatement actually sit across the group.
As the Journal of Accountancy explains, the new standard provides a risk-based approach to planning and performing a group audit. In practice that means more thinking up front about where misstatement could occur, and a more deliberate link between identified risks and the work performed, rather than a location-by-location box-ticking exercise.
SAS 149 introduces language that changes how firms talk about other auditors on a group engagement. The standard formalizes the concept of a "referred-to auditor," an auditor whose work the group engagement partner decides to reference in the auditor's report rather than assume responsibility for.
This matters because it draws a clearer line. Either the group engagement team takes responsibility for a component auditor's work and is involved in it, or it refers to that other auditor's report and says so. The standard sets out how and when referencing is appropriate and what has to be true for it to work. For firms that routinely rely on other auditors for subsidiaries or foreign components, getting this distinction right is central to a clean report.
A theme running through SAS 149 is more structured interaction with component auditors. The group engagement team is expected to be involved in the work of component auditors in a way that matches the assessed risks, and to communicate clearly with them about expectations, findings, and issues.
This raises the bar on coordination. A group team cannot simply collect a subsidiary's audit and staple it in. It has to understand the risks at that component, direct the right level of involvement, and document the two-way communication. For engagements spread across locations or firms, that is a real planning and scheduling change, not just a documentation one. Where offshore teams support component work, tight coordination becomes even more important, which is part of why audit support outsourcing for CPA firms has to be built around clear communication protocols.
It is easy to assume group audit standards only touch the largest engagements. They do not. Any audit of financial statements that include more than one component falls in scope, and that captures a lot of ordinary work: a company with multiple locations or divisions, a parent with a couple of subsidiaries, a nonprofit with affiliated entities.
So a firm that would never call itself a "group audit shop" may still have several engagements that meet the definition. The practical risk is discovering mid-engagement that a routine audit is actually a group audit under SAS 149, with expectations the team did not plan for. Identifying those engagements before fieldwork is the single best way to avoid a scramble.
SAS 149 does not arrive alone. It lands in the same window as a wave of quality management and standards changes, so a firm's December 31, 2026 year-end sits under several new expectations at once. Understanding where group audits fit against the firm's broader responsibilities, and against the basic distinctions in an audit versus a review or compilation, helps a team scope engagements correctly.
The takeaway is that 2026 is a heavy year for audit standards, and SAS 149 is one of the pieces that reshapes actual fieldwork rather than just firm-level policy.
The effective date is close, so preparation beats reaction. A few steps help.
Identify which engagements are group audits under the standard before planning, so nothing surprises you in the field. Decide early, per engagement, whether you will assume responsibility for component auditors or refer to their reports, since that shapes the whole approach. Build the risk assessment across the group up front rather than component by component. Set up clear communication protocols with component auditors, including timing and what you need from them. And update your audit methodology and templates so the team documents the risk-based approach consistently.
Because the standard takes effect for periods ending on or after December 15, 2026, the December 31, 2026 audits are the first ones affected, and planning for them is happening now. This is exactly the kind of methodology and coordination work where experienced support pays off. Madras Accountancy helps US CPA firms with audit support built around US GAAP and PCAOB and AICPA expectations, so group engagements run smoothly under the new standard.
Start by flagging your group engagements. Everything else in SAS 149 follows from knowing which audits are in scope.
What is SAS 149? SAS 149 is the Auditing Standards Board's revised standard for group audits. It replaces the prior approach with a risk-based method for planning and performing audits of financial statements that include more than one component.
When does SAS 149 take effect? It is effective for audits of group financial statements for periods ending on or after December 15, 2026. For calendar-year engagements, that means the December 31, 2026 year-end is the first one covered.
What is a referred-to auditor? A referred-to auditor is an auditor whose work the group engagement partner references in the auditor's report rather than assuming responsibility for it. SAS 149 formalizes when and how such referencing is appropriate.
What is the risk-based approach in SAS 149? It directs the group engagement team to focus audit effort where the risks of material misstatement actually exist across the group, rather than mechanically auditing components deemed significant. Work is tied to assessed risk.
Does SAS 149 apply to small firms? Yes. Any audit of financial statements with more than one component can be a group audit, including a company with multiple locations or a parent with subsidiaries. Many firms have such engagements without labeling them group audits.
How does SAS 149 change work with other auditors? It raises expectations for involvement and communication. The group team must be involved in component auditors' work in proportion to risk and document clear two-way communication, rather than simply collecting a component's report.
What should firms do to prepare for SAS 149? Identify group engagements before planning, decide whether to assume responsibility for or refer to component auditors, build a group-wide risk assessment, set communication protocols with component auditors, and update audit templates for the risk-based approach.
Is SAS 149 the only new audit standard for 2026? No. It arrives alongside other quality management and standards changes effective around the same December 15, 2026 window, so firms face several new expectations at their 2026 year-ends at once.
Section 4960's 21% excise tax now reaches far more nonprofit employees. See who is a covered employee in 2026 and what changed.
The Section 45S paid family leave credit is permanent for 2026 with new options. See who qualifies, the amounts, and how to claim it.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
