NFRA, the Standards on Auditing and the small firm
Who NFRA actually governs, what its orders actually say, and which Standards bind the tax audit you sign this season — with the common claims that are wrong.
Much of what is written about NFRA is aimed at a practice that signs listed-company audits. Most chartered accountants in India do not. They sign tax audits, audits of private companies and firms, bank and certification work. For them the useful questions are narrower: does NFRA reach my work at all, and if not, what does?
Who NFRA governs
Rule 3 of the National Financial Reporting Authority Rules, 2018 sets out the entities whose auditors NFRA oversees: listed companies and listed bodies corporate; unlisted public companies with paid-up capital of ₹500 crore or more, annual turnover of ₹1,000 crore or more, or outstanding loans, debentures and deposits of ₹500 crore or more as on 31 March of the preceding year; insurance, banking and electricity companies; and certain other bodies corporate. An entity that crosses a limit stays covered for three years after it falls below.
Everyone else — the private company, the partnership firm, the contractor's tax audit — sits outside NFRA. Their auditors remain answerable to ICAI, through peer review, the Quality Review Board and the disciplinary process under the Chartered Accountants Act, 1949. The Standards are the same; the forum is different.
What an NFRA order actually looks like
NFRA's orders are public, and they are worth reading for what they cite rather than for the headline. In its order on the audit of Vikas Proppant and Granite Limited for FY 2020-21, as reported, NFRA imposed penalties of ₹2 lakh on the engagement partner and ₹3 lakh on the firm, and barred the engagement partner for two years. The lapses it listed are ordinary ones:
- no evidence that opening balances were verified (SA 510);
- no documentation of the auditor's understanding of the entity and its environment (SA 315, SA 300);
- no engagement quality control reviewer appointed where one was required (SA 220), and gaps in the firm's own quality control (SQC 1);
- among the remainder, audit file assembly within 60 days, materiality, going concern, related parties and external confirmations.
Nothing in that list needs a large firm to get right. Each is a working paper that either exists or does not.
“Work not documented is work not done”
SA 230 asks for documentation sufficient for an experienced auditor with no connection to the audit to understand what was done, what was found and what was concluded. Its application material puts the assembly of the final file ordinarily within 60 days of the date of the auditor's report. After assembly, nothing is deleted or discarded; anything added later is recorded with when, by whom and why. The 60 days are for assembling the file — not for doing the work.
Do the Standards apply to a tax audit?
Yes, to the extent relevant. ICAI's Guidance Note on Tax Audit under section 44AB treats the tax audit as an audit, and the Standards on Auditing apply to it as far as they are relevant to the engagement. Form 3CB itself records that the audit was conducted in accordance with the auditing standards generally accepted in India. In practice these are the ones that do most of the work:
| Standard | Where it bites in a tax audit |
|---|---|
| SA 210 | The engagement letter: management's responsibility for the books and the particulars, yours for the report. |
| SA 230 | A working paper behind every clause figure, assembled within 60 days of signing. |
| SA 500 | Evidence for each figure: TDS defaults checked against 26AS and the filed statements, not the client's summary. |
| SA 530 | Where you sample — cash payments, MSME creditors — a sample you can explain and repeat. |
| SA 580 | Written representations for what only management knows, such as a creditor's MSME status — never in place of evidence you could have obtained. |
| SA 705, SA 706 | Qualifications and comments: on the Form 3CD particulars in paragraph 3 of Form 3CA or paragraph 5 of Form 3CB. |
Claims worth correcting
Several widely shared summaries get these wrong. Each matters because it ends up in someone's working paper.
“External confirmations are mandatory under SA 505.”
SA 505 governs how confirmations are designed and evaluated when the auditor uses them. Whether to use them is a judgement made under the auditor's response to assessed risks; it is not an automatic requirement for every balance.
“SA 530 requires statistical sampling.”
SA 530 permits statistical and non-statistical sampling. What it requires is that the sample be designed so that every unit has a chance of selection and that the result is evaluated against the purpose of the test.
“SQM 1 has replaced SQC 1.”
Not yet. SQM 1 and SQM 2 were due to apply from 1 April 2026, but on 31 March 2026 ICAI deferred their effective date until further announcement and confirmed that SQC 1 continues to apply.
“Report MSME dues in clause 26.”
After the 2025 amendment to Form 3CD, amounts under section 43B(h) are reported in clause 22(ii) and 22(iii), and clause 26(B) excludes them. In Form 26 they move to clause 33(b).
“Put-to-use dates are an SA 540 matter.”
The date an asset was put to use is a fact to be evidenced under SA 500 — the invoice, the installation record. SA 540 deals with accounting estimates, such as provisions and fair values.
A short checklist for this season
- Check, client by client, whether any audit you sign falls under NFRA Rule 3. If none does, your reviewer is ICAI — prepare for peer review, not NFRA inspection.
- For each Form 3CD clause, be able to point to the working paper and the evidence behind the figure.
- Keep representations for what only management can know, and make them specific.
- Assemble the file within 60 days of signing, and record anything added afterwards.
Sources: NFRA Rules, 2018, rule 3 (analysis); NFRA order on Vikas Proppant and Granite Limited, as reported by Taxscan; ICAI, deferment of SQM 1 and SQM 2 (31 March 2026); SA 230, SA 505, SA 530, SA 540 and the Guidance Note on Tax Audit, as issued by ICAI. Read the original order and Standards before relying on this note.