Peer Review for CA Firms: Who Needs It and What Gets Examined

Peer review started life as a voluntary quality initiative and has become something closer to a licence. A practice unit without a valid peer review certificate is now shut out of categories of work it may have done for years, and the categories keep widening. The shift catches smaller firms in particular, because the requirement arrives not as a notification they were watching for but as a question from a client: can you send us your peer review certificate, our listing obligations require it.

What Peer Review Is, and What It Isn't

A peer review is an examination of a practice unit's attestation work by another chartered accountant, appointed by ICAI's Peer Review Board, against the technical, professional, and ethical standards the profession sets for itself. The reviewer looks at how the firm runs engagements: whether it evaluates client and engagement acceptance, whether independence is assessed and documented, whether staff are supervised and work is reviewed, whether the applicable Standards on Auditing were followed, and whether the working papers actually support the opinion signed. It is a systems and compliance review, not a second audit of the client, and the reviewer does not re-perform the audit or opine on whether the financial statements were right.

That distinction matters more than it sounds, because it tells you where reviews are actually lost. Very few practice units fail a peer review because their professional judgement was wrong. They fail, or collect a long list of observations, because the judgement is not evidenced anywhere. An audit that was performed properly but documented thinly looks identical, on paper, to one that was not performed at all, and the reviewer can only see the paper.

Who Needs a Certificate

ICAI has expanded mandatory peer review in phases, working outward from the practice units whose work carries the widest public consequence. The earliest phases captured firms auditing listed entities, and coverage has extended progressively to firms auditing other categories of entity, including unlisted public companies above specified thresholds, banks, insurance companies, and entities in the financial sector. Separately, SEBI's own requirements mean an auditor of a listed entity needs a valid certificate regardless of where ICAI's phasing has reached. Because the phasing has moved repeatedly and each phase carries its own effective date, the current applicability position for your firm is something to confirm with the Peer Review Board rather than infer from what applied last year.

A practice unit outside the mandatory net can still apply voluntarily, and a growing number do. The certificate has become a procurement signal: tender documents, bank empanelment processes, and larger clients' vendor onboarding increasingly ask for it, and having one is easier than explaining why you do not.

What the Reviewer Examines

• Engagement acceptance and continuance: whether the firm assesses its competence, independence, and the integrity of the client before taking on or continuing work.
• Independence: whether relationships, fees, and non-audit services are evaluated against the Code of Ethics, and whether that evaluation is recorded rather than assumed.
• Compliance with Standards on Auditing across a selected sample of engagements, traced through the working papers.
• Audit documentation: whether the file shows what was done, by whom, when, what was found, and how the conclusion follows from it.
• Supervision and review: evidence that work performed by juniors and articles was reviewed by someone competent before the report was signed.
• Human resources and training: whether staff have the competence for the work assigned, and whether the firm maintains CPE compliance.
• Records of the engagement: signed engagement letters, management representation letters, and communication with those charged with governance.

How the Process Runs

The practice unit applies to the Peer Review Board, which appoints a reviewer from its panel. Reviewers are experienced members who have qualified for the panel and who are independent of the unit under review. The unit completes a questionnaire describing its structure, staffing, and engagements, and the reviewer selects a sample of attestation engagements to examine. The review itself is conducted at the practice unit's premises, with the reviewer examining files, discussing observations, and giving the unit an opportunity to respond before anything is finalised.

Where the reviewer identifies deficiencies, they are communicated to the practice unit for its reply, and non-trivial matters go into a report to the Board. A unit that satisfies the reviewer receives a peer review certificate valid for a fixed period, after which the exercise repeats. Where significant deficiencies remain unresolved, the Board can require corrective action and a follow-up review before issuing a certificate. This is deliberately a remedial process rather than a punitive one: the objective is to get the practice unit's systems to an acceptable standard, not to catch it out.

Preparing Without Panicking

The most effective preparation is unglamorous and starts long before the reviewer is appointed. Pick three or four recent audit files at random and read them as a stranger would. Can you tell, from the file alone, why the materiality figure was set where it was? Is there evidence that someone reviewed the article's work before the report was signed? Is the engagement letter in the file, signed, for the right year? Is there a documented independence assessment, or is independence simply assumed because nobody thought about it? Firms that do this exercise honestly usually find the same gaps the reviewer will, with the difference that they still have time to fix the templates and the habits that produced them.