NFRA Inspection Reports and IFRS: What Indian Auditors Are Getting Wrong
Author
Sai Manikanta Pedamallu
Published
Reading Time
12 min read
Table of Contents
NFRA Inspection Reports and IFRS: What Indian Auditors Are Getting Wrong
By Sai Manikanta Pedamallu (ACCA, CMA US, CSCA US, CGMA, ACMA, Dip IFRS, M.Com, MBA, MA)
Lead Instructor, Global Fin X | www.globalfinx.in/manikanta
NFRA inspects two different things, and conflating them produces a misleading picture of what Indian audit is getting wrong.
Firm-level inspections examine whether the audit firm has systems capable of producing good audits: independence policies, client acceptance procedures, quality control review appointment, consultation processes, monitoring, and root cause analysis.
Engagement-level reviews examine whether a specific audit was performed properly.
The findings differ substantially between the two, and the firm-level findings are the ones least discussed and arguably more consequential, because a systemic weakness affects every engagement rather than one.
Post 82 covered NFRA's related party findings and Post 94 covered recurring technical error patterns. This post covers the inspection programme itself and what it has been finding, including the firm-level dimension neither of those posts addressed.
The Structure of the Programme
NFRA's oversight operates through several distinct instruments.
Audit Quality Review Reports examine the auditor's work on specific engagements.
Financial Reporting Quality Review Reports examine the financial statements themselves, from the preparer's side rather than the auditor's.
Firm-level inspections examine the audit firm's quality control system as a whole, assessed against SQC 1 and the auditing standards.
Enforcement orders follow investigations into specific alleged professional misconduct and carry penalties and debarment.
Guidance material, including the Auditor-Audit Committee Interactions series referenced in Posts 41 and 82, sets out what audit committees should be asking.
The inspection reports are published, they identify firms by name, and they describe findings in enough detail to be recognisable.
The Firm-Level Findings: March 2026
In March 2026, NFRA released inspection reports covering the Indian affiliates of BDO, EY, KPMG, and PwC. The findings pointed to gaps in auditor independence, internal controls, and the examination of related party transactions.
The specifics differ by firm, and the differences are worth setting out because they show what the regulator is actually looking at.
Independence at partner level. For PwC-affiliated entities, NFRA raised concerns regarding the independence of six partners.
Network-wide non-audit service controls. In its review of MSKA & Associates, a BDO affiliate, NFRA indicated the firm must tighten network-wide controls over non-audit services.
Reports modified after issuance. The same review required that the engagement partner re-sign any audit report that is modified after issuance. This is a narrow finding with a wide implication: a report altered after signing, without the partner re-signing, means the version in circulation is not the version the partner assumed responsibility for.
Monitoring effectiveness. For EY affiliate S R B C & Co, NFRA indicated the need for stronger monitoring to ensure that firm-wide independence policies are effective and followed in practice. The distinction between having a policy and the policy operating is the point.
Improvement acknowledged. For KPMG's B S R affiliates network, NFRA noted that the firm was largely in line with independence requirements and had addressed practice-wide quality control issues identified in prior inspections. It also indicated that the firm needs to tighten policies on accepting non-audit work for recently audited clients and enhance its root cause analysis framework.
That last set of findings is worth flagging specifically. A regulator that only ever reports failure is not calibrating. NFRA recording that prior issues had been addressed, while identifying two remaining areas, is a more credible form of oversight than uniform criticism.
The Firm-Level Findings: Smaller Firms
Firm-level inspection is not confined to the large networks. A March 2026 inspection report on a mid-sized firm illustrates the full range of firm-level deficiencies NFRA identifies.
The inspection found gaps in independence verification, client acceptance procedures, documentation of consultations, time reporting, and internal monitoring mechanisms, indicating non-compliance with SQC 1 and the auditing standards.
Two findings from that report are instructive because they describe how quality control fails in practice rather than in principle.
Consultations were informal and not documented. The firm acknowledged that where complex or significant matters arose, consultations were undertaken by the engagement partner or senior team members with identified experts, based on professional judgment and the circumstances of the engagement, but that such consultations were informal and not consistently documented during the period under review.
The consultation happened. The record did not. From an inspection perspective, a consultation that leaves no trace is indistinguishable from one that never occurred, and the conclusion it supported is therefore unsupported.
EQCR appointment authority was not specified. The firm acknowledged that its engagement quality control review policy did not explicitly specify the authority responsible for appointing the EQCR for individual engagements, and that in practice appointments were determined at partner level considering the nature of the engagement, independence requirements, and availability of suitably qualified partners.
Again, the substance may have been reasonable. The governance around it was not documented, which means it cannot be demonstrated to have operated consistently.
What Firm-Level Failures Actually Cause
The link between a quality control weakness and an audit failure is not always obvious, and it is worth making explicit.
Independence failures compromise the foundation of the opinion. An audit performed by a firm or partner without the required independence is deficient regardless of how well the procedures were executed.
Client acceptance weaknesses mean engagements are taken on without the firm assessing whether it has the competence, capacity, and independence to perform them.
Undocumented consultation means the firm cannot demonstrate that difficult judgments received appropriate technical input, and cannot show consistency across engagements facing similar issues.
EQCR appointment without defined authority means the second-line review, which exists specifically to catch engagement team error on significant judgments, may not have been performed by someone with the necessary standing or objectivity.
Time reporting deficiencies obscure whether engagements were adequately resourced, which is directly relevant to whether the work described in the file could actually have been performed in the hours recorded.
Weak root cause analysis means the firm identifies individual deficiencies but never diagnoses why they arose, so the same finding recurs in the next inspection cycle.
That final point explains the pattern noted across NFRA's cycles: similar themes recurring across firms and over time. Deficiencies are corrected engagement by engagement without the underlying cause being addressed.
The Engagement-Level Findings
At engagement level, the recurring areas are consistent enough to be listed with confidence.
The March 2026 mid-sized firm inspection identified lapses in audit documentation, revenue verification, related party transactions, impairment assessment, going concern evaluation, and reliance on management representations without sufficient evidence, together with failure to document materiality judgments, external confirmations, and audit conclusions.
That list maps closely onto findings across NFRA's inspection cycles.
Related party transactions. Covered in detail in Post 82. The failures are completeness of identification, absence of documented business rationale, missing approvals, and disclosure that describes components without describing the arrangement.
Impairment. Covered in Post 41. Indicator assessment treated as a formality, CGU boundaries drawn too broadly, cash flow forecasts never backcast against actual outcomes, and discount rates derived incorrectly.
Revenue. Insufficient testing of the recognition point, particularly for over-time recognition and for arrangements with variable consideration, and inadequate consideration of the fraud risk presumption in revenue recognition.
Going concern. Evaluation performed without sufficient challenge of management's cash flow forecasts and without adequate consideration of the disclosure required where a material uncertainty exists.
Management representations. Reliance on written representations as audit evidence rather than as a supplement to it. A representation confirms management's position; it does not substitute for the evidence that position should rest on.
Documentation Is the Common Thread
Across firm-level and engagement-level findings, the single most frequent deficiency is documentation.
The recurring characterisation is that documentation is incomplete, insufficiently linked to identified risks, or finalised too close to or after the audit sign-off stage.
Three specific manifestations.
Risk identified, procedures not responsive. The file records an area as a significant risk and then contains standard programme steps that do not address that risk specifically. The risk assessment and the audit response are disconnected.
Conclusion recorded without supporting evidence. A working paper states that a position is reasonable or that a balance is fairly stated, without documenting what was examined to reach that conclusion.
Assembly after the fact. Documentation completed after the opinion was formed does not demonstrate that the work informed the opinion, whatever its content.
The uncomfortable implication is that a technically correct audit can produce a deficient file, and from a regulator's perspective the two are not separable. If the work cannot be demonstrated, it cannot be relied upon.
The Regulatory Environment
NFRA's scope and procedures have been the subject of litigation, and the position should be stated accurately rather than characterised.
In February 2025 the Delhi High Court upheld NFRA's authority to investigate and penalise misconduct among chartered accountants. In April 2025 the same court annulled eleven show cause notices the regulator had issued. NFRA's appeal against that decision has been before the Supreme Court.
Firms have publicly raised concerns about aspects of the regulator's operational methods and their consistency with the Companies Act 2013. The regulator's chairperson has separately acknowledged improvements in auditing standards.
Two observations, offered neutrally.
The dispute concerns process and jurisdiction, not the technical merits of the findings. Whether a particular show cause notice was validly issued is a different question from whether the accounting or auditing observation in an inspection report is correct. The technical content stands on its own.
The inspection programme continues. Reports were published in March 2026, naming firms and describing findings, while the jurisdictional questions remained live.
For preparers and auditors, the practical position is unchanged: inspection findings are public, specific, and recurring.
What This Means for Preparers, Not Just Auditors
It is easy to read inspection findings as an auditor problem. They are not, for two reasons.
Every engagement-level finding has a preparer counterpart. Where an auditor is criticised for insufficient challenge of an impairment forecast, the entity prepared that forecast. Where the finding concerns undisclosed related party arrangements, the entity structured and disclosed them. Where documentation of a judgment is absent from the audit file, it is frequently absent from the entity's own records too.
Financial Reporting Quality Review Reports examine the preparer directly. NFRA's remit extends to the financial statements themselves, not only to the audit of them.
The practical consequences for a finance function.
Prepare the analysis, not just the answer. A judgment reached without a contemporaneous written analysis will be challenged, and reconstructing the reasoning at audit time is both harder and less credible.
Expect the backcast. Where a forecast supports a carrying amount, expect to be asked how last year's forecast compared to what happened.
Assume the arrangement will be looked at whole. Disclosure of components without disclosure of the arrangement they constitute is a documented failure pattern.
Treat the audit committee questions as your own. NFRA's guidance sets out what audit committees should ask auditors. A finance team that can answer those questions before they are asked has done the work the questions are designed to surface.
What This Means for Candidates
Three practical points for anyone studying IFRS with a view to audit or reporting work in India.
The technical areas that recur in findings are the areas worth depth. Related parties, impairment, revenue, going concern, provisions, and deferred tax appear repeatedly. Depth in these is worth more than breadth across everything.
Documentation is a skill, not an administrative task. The ability to write a memo that records what was considered, what evidence was examined, and why the conclusion follows is directly what inspection findings say is missing.
Understand the difference between a policy and its operation. NFRA's finding against one firm was that its independence policies needed stronger monitoring to ensure they were effective and followed in practice. Knowing what a standard requires is the entry point; understanding how compliance is demonstrated is the professional skill.
FAQ
What is the difference between an Audit Quality Review and a firm-level inspection?
An Audit Quality Review examines the auditor's work on a specific engagement. A firm-level inspection examines the audit firm's quality control system as a whole, including independence, client acceptance, engagement quality control review, consultation, monitoring, and root cause analysis, assessed against SQC 1.
Do NFRA findings mean the financial statements were wrong?
Not necessarily. Many findings concern audit documentation and quality control rather than misstatement. A finding that a conclusion was inadequately documented does not establish that the conclusion was incorrect, though it does mean the audit cannot demonstrate that it was supported.
Are the findings only against small firms?
No. The March 2026 reports covered the Indian affiliates of BDO, EY, KPMG, and PwC, alongside inspections of smaller firms. The findings differ in nature, with the larger networks facing observations principally on independence, non-audit services, monitoring, and root cause analysis.
Has anything improved?
NFRA has recorded improvement in specific cases, including noting that one large network's affiliate was largely in line with independence requirements and had addressed practice-wide quality control issues identified in prior inspections. The regulator's chairperson has separately acknowledged improvements in auditing standards.
Does the litigation over NFRA's powers affect the findings?
The proceedings concern the validity of specific show cause notices and the extent of the regulator's disciplinary jurisdiction. They concern process rather than the technical merits of inspection observations, and the inspection programme has continued.
Why does undocumented consultation matter if the consultation actually happened?
Because an audit file must demonstrate that the work supporting the opinion was performed. A consultation that leaves no record cannot be shown to have occurred, to have covered the right issues, or to have informed the conclusion. From an inspection perspective it is indistinguishable from no consultation at all.
Enroll with Global Fin X
NFRA's findings identify the areas where Indian technical practice is weakest, which makes them a reasonable guide to where study effort produces the most professional value. Our programme covers the standards that recur most often in those findings, with detailed lectures, worked examples grounded in Indian practice, exam-style MCQs, and a dedicated LMS for working professionals.
Enroll Now: Dip IFRS Programme
Faculty profile: www.globalfinx.in/manikanta
This is Post 95 of the Global Fin X IFRS Series. Previous: Most Common IFRS Errors Found in Big 4 Audit Files. Next: Post 96: IFRS vs Ind AS: Master Comparison of All Key Differences.