Preparing for an ACRA inspection, before the letter arrives.

• Practice review (engagement inspection). Practice reviewers appointed by the Public Accountants Oversight Committee (PAOC) inspect a selection of a public accountant's audits against the Singapore Standards on Auditing and other requirements. For public accountants who do not audit listed companies, the reviewers are generally ISCA employees appointed by the PAOC.
• Quality control review (firm level). Entity reviewers appointed by the PAOC (Firm Level), the committee without its public accountant members, assess the firm's quality controls against SSQM 1 and SSQM 2. ACRA has had statutory powers for these reviews since 1 July 2023.

Selection is risk-based: ACRA's profiling looks at factors such as the public accountant's capacity and capabilities, the complexity of the engagements and the public interest involved. The result of a firm's quality control review feeds into how intensively its engagements are inspected.

Practice review: the reviewers inspect the selected audits; the Practice Monitoring Sub-Committee, made up of experienced public accountants and lay members, considers the findings and recommends an outcome; the PAOC decides.

Quality control review: the entity reviewers assess the firm's system; the Registrar of Public Accountants considers the findings and reports to the PAOC (Firm Level) with recommendations; the PAOC (Firm Level) decides. ACRA describes interviews on the firm's quality objectives, risks and responses, followed by walkthroughs, re-performance and independent testing of whether the policies work.

Both programmes use the same four outcomes.

• Satisfactory: the standards were met in all significant respects, with no non-compliance.
• Satisfactory but with findings: met in all significant respects, with limited or minor non-compliance.
• Partially satisfactory: many minor, or more than minor, instances of non-compliance, none of them significant or severe.
• Not satisfactory: extensive, significant or severe, or repeated non-compliance.

In a practice review, each finding is weighed for how far the work departs from the standard and the materiality of any misstatement, and the PAOC also takes the public accountant's inspection history into account. In a quality control review, findings are weighed by their nature, severity and pervasiveness.

After a partially satisfactory or not satisfactory practice review, the PAOC may order:

• structured training;
• a root cause analysis and a remediation plan that addresses the causes;
• a hot review, in which another public accountant reviews a set number of audits before the reports are signed.

After a not satisfactory outcome, it may also:

• restrict which audits the public accountant may sign, for example public interest entities or companies above a size;
• for a public interest entity audit, order the findings sent to its audit committee or board;
• suspend or cancel the public accountant's registration.

The root cause analysis and remediation plan are due within one month of being told the outcome, and ACRA checks that the actions link back to the findings. ACRA publishes not satisfactory outcomes, and failures to comply with orders, under its Practice Direction No. 1 of 2024.

These are Nebis's suggestions, drawn from ACRA's process and its published findings.

1. Read a file as a stranger would. Pick recent files and ask whether an experienced auditor with no contact with the team could see what was done, by whom, and why the conclusion holds.
2. Start with the common themes. Accounting estimates, the auditor's report and group audits lead ACRA's engagement findings; fraud risk assessment and business combinations were new to the top five in 2024. See what ACRA's inspections find.
3. Check the auditor's reports. Every required element, the right opinion for the facts, and, since 6 May 2026, the name of the public accountant primarily responsible.
4. Check archiving. Files assembled within the firm's deadline, which should ordinarily be no more than 60 days after the report date. See SSA 230 file assembly.
5. Back independence with evidence. Test personal declarations against records, and monitor non-assurance service approvals, fee levels, overdue fees and rotation.
6. Bring the SoQM up to date. Quality objectives complete, risk ratings applied consistently, a monitoring plan that covers the key responses, the annual evaluation done, and safeguards where one person holds several roles.
7. Make the EQR visible. The engagement quality reviewer's scope, timing, what was challenged and how it was resolved, recorded through the audit.
8. Close earlier findings properly. Show the root cause of each, not the symptom, and evidence that the remediation worked. ACRA's Audit Practice Guidance No. 1 of 2024 covers this.

Inspectors judge the work on what was known and done up to the date of the auditor's report. SSA 230 lets a firm clarify existing documentation after the file is assembled, including in response to inspection comments, but each change must record why it was made, when and by whom, and who reviewed it. Nothing added later can show work that was not done before the report date. In our view, any change made after the inspection notice should be pointed out to the reviewers. Explain judgements from what the file shows, and put any disagreement and its reasons in writing, since the findings go to a committee for a decision.

If the outcome needs a remediation plan, the one-month deadline is short. Starting the root cause analysis when the findings arrive, rather than when the outcome is formally notified, leaves more time to get it right.

In the Nebis workspace, AI prepares and the firm's people review and sign. Each answer carries its reasoning and evidence, and every change, sign-off and upload is kept in the engagement's audit trail. The report cannot be signed until the engagement quality review is complete. At archive, the file becomes a pack of the final papers, the evidence and the audit trail, readable without Nebis. Where the firm uses the SSQM module, automated tests read the engagement records for its monitoring.

How it works · SSQM module · EQR module