NFRA Issues Compliance Alert on SA 260: Audit Committees Must Receive Substantive, Purpose-Driven Communication

What Happened

The National Financial Reporting Authority (NFRA), India's apex audit regulator, has flagged widespread compliance deficiencies in the application of SA 260 (Communication with Those Charged with Governance) across audit practices. In its recent quality review findings, NFRA identified that auditors are treating SA 260 obligations as a mechanical compliance exercise rather than a substantive engagement mechanism.

The regulator's concern centres on auditors providing standardised, template-driven communications to audit committees without adequately tailoring content to the specific entity, its risk profile, industry dynamics, or the particular governance challenges the audit committee faces. NFRA has warned against this "tick-box" approach, emphasizing that SA 260 communication must be purposeful, relevant, and reflective of the actual audit findings and risks identified during the engagement.

The alert appears to stem from NFRA's inspection findings at various audit firms where audit committee communications were observed to be generic, lacking entity-specific insights, and failing to demonstrate how the audit addressed significant risks or areas of management judgement unique to that organisation.

Why It Matters

SA 260 is fundamental to the audit committee's ability to discharge its governance responsibilities effectively. The standard mandates that auditors communicate key matters including:

• →The auditor's responsibilities and scope of the audit
• →Significant audit risks, including fraud risk and management override
• →Significant accounting policies, changes, and areas of management judgement
• →Audit findings, unadjusted misstatements, and internal control deficiencies
• →The auditor's independence and any threats to it
• →Fee information and audit team composition

When auditors reduce these communications to boilerplate templates, audit committees lose their ability to engage critically with the audit process. This undermines corporate governance, as the audit committee's effectiveness depends on understanding the specific challenges and judgements the auditor faced in forming an opinion on the financial statements.

NFRA's intervention is significant because it signals the regulator's expectation that audit quality encompasses not just the technical execution of audit procedures, but also the quality of governance dialogue. Non-compliance with SA 260 expectations can now attract regulatory scrutiny, potential sanctions, and reputational damage to audit firms.

The warning is also timely given increased stakeholder focus on audit effectiveness, particularly following global corporate failures where audit committees were criticized for insufficient engagement during audits.

Practical Impact

For audit firms, this directive requires immediate operational changes. Audit engagement teams must move away from standardized SA 260 templates and invest time in understanding each client's specific risks, transactions, and accounting judgements. This means:

**For Audit Practices:** Audit engagement partners and senior managers must document how their SA 260 communication specifically addresses the entity's risk profile, significant accounting areas, and management judgement areas. Templates should serve as prompts, not outputs. Quality control processes must now include review of SA 260 communications for substance, not just completeness.

**For Audit Committees:** Committee members should expect communications that directly reference their company's specific audit challenges. Generic letters merit pushback. Committees should require auditors to articulate how identified risks were addressed, what judgements were challenged, and what internal control findings emerged—in language specific to their business.

**For CFOs and Finance Leaders:** Finance teams should brief audit committee members pre-audit on known areas of complexity or management judgement. When SA 260 communications arrive, CFOs should ensure the audit committee scrutinizes whether they reflect the actual audit challenge. Poor-quality communications may signal quality concerns about the audit itself.

**For Compliance Professionals:** In-house compliance and finance teams preparing for audits should document complex areas, significant transactions, and policy changes clearly. This enables auditors to tailor their SA 260 communications meaningfully and reduces the risk of generic, superficial engagement.

NFRA inspections will increasingly assess SA 260 quality, and firms scoring poorly risk reputational damage, inspection findings, and potential regulatory action. This places real pressure on audit firms to resource SA 260 appropriately rather than treating it as an administrative task.

Key Takeaways

• →NFRA has identified widespread 'tick-box' compliance with SA 260, indicating that audit firms are using generic templates instead of delivering substantive, entity-specific communication to audit committees
• →SA 260 communications must now clearly address each entity's specific audit risks, significant accounting judgements, and management override concerns—generic letters are no longer compliant with regulatory expectations
• →Audit firms must invest in engagement-level customization of SA 260 communications and strengthen quality control processes to assess substantive relevance, not merely procedural completeness
• →Audit committees should demand tailored communications that reference their company's particular business challenges; generic SA 260 letters may signal audit quality concerns and warrant escalation
• →NFRA inspections now specifically assess SA 260 quality, creating regulatory risk for audit firms that fail to move beyond mechanical compliance, with potential implications for firm reputation and inspection outcomes

Disclaimer: This update is for general information only and does not constitute legal, tax or professional advice. Regulatory positions may change. Please consult APRA & Associates LLP for advice specific to your business. Contact us.