Newcomers about to enter the audit industry are often confused about the audit operation mechanism between parent companies and subsidiaries. This article explains three typical questions to help understand common practices and boundary conditions in practice.

Auditor Arrangements After Acquisition: Unified or Dual-Track?

When a company (parent company) acquires another company (subsidiary), and the two parties originally engaged different auditors, there is no mandatory "takeover" rule in practice. Whether the parent company's auditor takes over the subsidiary's audit usually depends on multiple factors, including:

  • The integration needs of the group audit—if the parent company needs consolidated financial statements, its auditor typically needs to perform audit or review procedures on the subsidiary's financial information to support the group audit opinion.
  • Whether the subsidiary's existing auditor's independence, professional competence, and industry experience meet the requirements of the group auditor.
  • Cost and efficiency considerations—unifying the auditor may reduce communication costs, but changing auditors may also bring transition risks.

It is worth noting that even if the subsidiary wishes to retain its original auditor (for example, based on a better working relationship), such an arrangement may be permitted, provided that the group auditor can obtain sufficient and appropriate audit evidence. In a group audit, the parent company's auditor typically reviews or directs the work of the subsidiary's auditor and assesses their independence and competence. Therefore, a more common practice is: the parent company's auditor leads the group audit, but the subsidiary's auditor may continue to perform statutory audits or special audits, forming a "dual-track" but controlled system.

Key point: The acquisition itself does not automatically lead to a change of auditor, but the integration needs of the group audit often prompt the parent company's auditor to become involved in the subsidiary's audit process.

SEC Compliance Obligations: Does the Subsidiary Automatically Apply SOX?

Regarding the compliance requirements of the U.S. Securities and Exchange Commission (SEC), if the parent company is a listed company, its subsidiaries do not automatically become direct subjects of the Sarbanes-Oxley Act (SOX). SOX compliance obligations (such as internal control assessment and audit) mainly target the "consolidated reporting scope" of listed companies and their management and auditors. Specifically:

  • The parent company, as an SEC registrant, must conduct an annual assessment of the effectiveness of internal controls over its consolidated financial statements (including subsidiaries), and an independent auditor must issue an attestation report.
  • If the subsidiary itself is not separately listed, it usually does not directly bear SEC reporting obligations, but its financial data and internal controls must be included in the parent company's consolidated assessment scope.
  • If the subsidiary itself is an SEC registrant (for example, separately listed), it must independently comply with SOX and SEC rules.

Therefore, the subsidiary's audit procedures may be strengthened due to the parent company's compliance needs, but the statement that it "automatically begins to comply with all SEC rules" is not accurate. The transmission of compliance obligations depends on the consolidation scope and registration status, not simply on the equity relationship.

Group Audit Reporting Process: Decentralized Execution or Centralized Handling?

For listed companies with multiple diversified subsidiaries and headquarters located in different places, the audit reporting process typically adopts a "layered integration" model rather than a single extreme. Common practices are as follows:

  1. Each subsidiary (or business segment) performs local audits or financial information reviews based on local statutory requirements or the group's unified policies. If the subsidiary itself is an SEC registrant, it must separately submit SEC reports.
  2. Subsidiaries report audited or reviewed financial data, adjustment items, and internal control deficiencies to the parent company's finance team.
  3. The parent company's auditor (usually the group's lead audit firm) is responsible for consolidation adjustments, eliminating intercompany transactions, and issuing an audit opinion on the consolidated financial statements as a whole.
  4. Finally, the parent company submits consolidated financial reports to the SEC, which include summarized data from each subsidiary, but the reporting entity is the parent company.

Therefore, not all subsidiaries "do their own SEC audits"—only those that are separately listed need independent SEC filings. For non-listed subsidiaries, their audit work serves more for group consolidation purposes, coordinated by the parent company's auditor. The parent company's headquarters typically bears the ultimate responsibility for aggregation and external reporting, but specific execution may rely on the local teams or auditors of each subsidiary.

Practical Recommendations

For auditors just entering the profession, understanding the above mechanisms helps to quickly adapt to project roles. It is recommended to pay attention to the provisions regarding "component auditors" in group audit standards (such as International Standard on Auditing ISA 600 or U.S. PCAOB standards), which detail how the parent company's auditor can use the work of subsidiary auditors.

In summary, parent-subsidiary audits are not simply a "choose one" or "all-inclusive" model, but a balance based on regulations, contracts, and efficiency. Actual arrangements need to consider the specific equity structure, listing status, and auditor judgment.