SSA 265 – Communicating Deficiencies in Internal Control to those Charged with Governance and Management

SSA 265 Summary

The auditor is required to obtain an understanding of internal control relevant to the audit when identifying and assessing the risks of material misstatement. Auditor can consider internal control when developing audit procedures, but there is no need to express opinion on internal control effectiveness.

The auditor needs to communicate appropriately with those charged with governance (CWG) on any deficiencies (must explain potential effects) in internal control identified during the audit. This must be done in writing. However, it is okay if there is earlier communication orally. The level of detail in the communication depends on auditor’s professional judgment.

Auditor should clarify with appropriate level of management (one that has authority to evaluate deficiencies and take necessary remedial action) if one or more deficiencies in internal control are identified. If the finding calls into question management’s integrity/competence, it may not be appropriate to discuss it directly with management.

This SSA also indicates examples and indications of significant deficiencies in internal control.

If the significant deficiency is not rectified in prior years, the auditor can communicate the same deficiency in the current year.

The communication of other deficiencies (not significant) may be communicated to management orally only. Communication of this to those CWG is also optional and dependent on the auditor’s professional judgment.

auditing-service-singapore

 

Advertisements

SSA 260 – Communication with Those Charged with Governance

SSA 260 – Communication with Those Charged with Governance

This SSA 260 concerns auditor’s responsibility to communicate with those charged with governance (CWG) in an audit of Financial Statements.

SSA 265 talks about the requirements to communicate (in writing), in a timely manner, significant deficiencies to those CWG.

There is a need for two-way communication between the auditor and those CWG.

Management also needs to communicate important matters to those CWG.

Some of the things to be communicated by the auditor are auditor’s responsibilities (express opinion on the FS, significant risks etc), scope and timing of the audit. In additions, matters like accounting policies, accounting estimates and financial statement disclosures should be communicated. Other things include whether the firm has complied with relevant ethical requirements regarding independence, safeguards to eliminate threats of independence. Significant difficulties faced in the audit should also be highlighted.

A subgroup of those CWG could be the audit committee. Auditor must assess whether this must also be highlighted to the Board.

Good governance principles highlight that (i) Auditor will be invited to attend meetings of the AC; (ii) Chair of the AC and other members will liaise with the auditor periodically; (iii) AC will meet the auditor without management’s presence.

Often, critical accounting estimates and critical accounting policies or practices are required to be disclosed in the FS.

pic_internal_audit_big

SSA 250 – Consideration of Laws and Regulations in an Audit of FS

This SSA is for periods after 15 Dec 2009.

This SSA concerns auditor’s responsibility to consider laws and regulations in an audit of FS.

There are many sorts of possible laws and regulations: regulated industries, OSH, equal employment opportunity. However, not all will affect the FS.

It is management’s responsibility, with the oversight of those charged with governance, to ensure entity’s operations are conducted in accordance with the provisions of laws and regulations.

This SSA will help the auditor to identify material misstatements of the FS due to non-compliance with laws and regulations. There is an inherent risk that auditor may not uncover all of them due to (i) many laws and regulations that affect operations and do not affect the FS; (ii) collusion or management override of controls; (iii) whether an act is a non-compliance should be determined by a court of law.

Generally, the auditor should be concerned with those laws/regulations that have a direct determination of material amounts and disclosures in the FS, like tax laws etc. For other laws/regulations, auditor only needs to consider those non-compliance that has material effect on FS.

Auditor is expected to maintain professional skepticism throughout the audit.

Auditor needs to obtain audit evidence regarding laws/regulations that have an impact on the FS.

Auditor needs to understand the entity and the environment and the legal regulatory framework for the entity/industry and how is the entity complying.

Written representations from management on compliance/non-compliance should be obtained.

If auditor suspects non-compliance, investigation into the effect on the FS must be performed. If insufficient evidence is obtained or management cannot demonstrate compliance, the auditor shall consider modifying the audit opinion.

There must be audit documentation on identified or suspected non-compliance and relevant correspondences.

Management can institute controls like monitoring of legal requirements, internal controls for systems, develop a code of conduct, ensuring employees are trained, monitor compliance with the code of conduct, engage legal advisors etc, in order to ensure compliance with laws and regulations.

Internal-Audit

audit financial company tax investigation process business accounting

SSA 210 – Agreeing the Terms of Audit Engagement

This SSA is effective after periods ending 15 Dec 2016.

This SSA deals with auditor’s responsibilities in agreeing the terms of the audit engagement with management and those charged with governance.

The objective of the auditor is to accept or continue an audit engagement only when the basis upon which it is to be performed has been agreed:

  1. a) Establish whether preconditions for an audit are present; and b) confirm whether there is a common understanding between auditor and management

Preconditions are firstly that the FR framework is acceptable. Next, management understands its responsibility to prepare FS in accordance with the FR framework and to have internal controls to enable the preparation of FS to be free from material misstatement, whether due to fraud or error (via a management representation to the auditor). Agreeing the terms of the audit engagement will help avoid misunderstanding about one another’s responsibilities.

Management should allow the auditor (i) access to information; (ii) any additional information; (iii) unrestricted access to persons for whom the auditor determines necessary to obtain audit evidence.

If the preconditions are not met, auditor shall discuss with management and auditor will consider not to accept the proposed engagement. If not possible due to law/regulations, auditor will need to explain to management the importance of these matters and implications for the auditor’s report.

Auditor needs to draft an engagement letter. Auditor should not agree to changes to the terms when there is no reasonable justification for doing so, for instance from changing from an audit engagement to a review engagement in order to avoid the qualified opinion that will be issued by the auditor. If there are changes, both parties will need to acknowledge them.

Assurance and audit engagements may only be accepted when the practitioner considers that relevant ethical requirements such as independence and professional competence will be satisfied, and when the engagement exhibits certain characteristics.

Some general purpose frameworks are the Financial Reporting Standards (FRS) promulgated by the Accounting Standards Council etc.

Please read the SSA for more details of what sections are required in the engagement letter.

For Singapore incorporated companies, the description of responsibilities for the financial statements is as follows:

Management is responsible for the preparation of FS that give a true and fair view in accordance with the provision of the Companies Act, Chapter 50 and Financial Reporting Standards in Singapore, and for devising and maintaining a system of internal accounting controls sufficient to provide a reasonable assurance that assets are safeguarded against loss from unauthorized use or disposition; and transactions are properly authorized and that they are recorded as necessary to permit the preparation of true and fair financial statements and to maintain accountability of assets.

auditing-service-singapore

SSA 220 – Quality Control for an Audit of Financial Statements

This SSA concerns the responsibilities of the auditor relating to quality control procedures and also the responsibilities of the EQCR (engagement quality control reviewer). This is necessary in order to comply with SSQC1. EQCR is useful as it gives assurance that the audit complies with professional standards and applicable legal and regulatory requirements.

The engagement partner shall take responsibility for the overall quality on each audit engagement. Quality is essential in performing audit engagements. He needs to remain alert for evidence of non-compliance with ethical requirements (ACRA code). If there is non-compliance, appropriate action must be taken.

The partner also needs to assess and conclude on the independence requirements (eliminate the activity, withdraw the engagement if not-independent). He needs to be satisfied on appropriate procedures in relation to acceptance and continuance of client relationships and audit engagements. He needs to be satisfied that the engagement team has the right competence and capabilities. He is also responsible for the right direction, supervision (track progress of engagement, address significant matters, identify matters for consultation) and performance of the audit engagement.

In addition, they are responsible for consultations that are taken within the engagement team.

For audits that require EQCR, the partner shall discuss significant matters arising during the engagement with the EQCR reviewer. The audit report should only be stated on or after the EQCR review and the EQCR should be conducted in a timely manner.

The EQCR needs to look at discussion of significant matters, review of FS, review of selected audit documentation and evaluation of the conclusions reached. They also might need to examine independence of the audit firm, and whether there is appropriate consultation.

There needs to be a proper monitoring process for EQCR as well, and to ensure that P&P relating to system of quality control are relevant, adequate and operating effectively. Partners can usually rely on the system of quality control and the role of engagement teams.

Reviews by the engagement partner must be timely in nature and they should examine areas like critical areas of judgment, significant risks, other areas etc. The engagement partner need not review all audit documentation, but may do so. However, as required by SSA230, the partner documents the extent and timing of the reviews.

pic_internal_audit_big

 

IIA Magazine Apr 2016 issue

Soft skills seem to be lacking in some of the IA teams. There is the art of interviewing that must be executed properly. IA can set aside time to work with other parts of the business. Audit reports are not the only communication channel.

Time to Shift the Mindset. Pulse report urges IA to focus on culture and cybersecurity response. Board members should discuss with management to ensure that there is a common understanding. There is a risk of poor vendors and that firms could suffer from reputational damage. There needs to be strong third party risk practices.

Fraud Prevention. An effective control environment can deter or minimize the occurrence of fraudulent activities. Internal controls may not always be designed to prevent fraud. There must be a strong control environment for fraud prevention. Background checks and fraud related training can be useful indeed. Whistle-blowing hotlines can be set up. A certain level of anonymity must be ensured. No one person should complete control over a whole particular process, from start to end. Monitoring activities should take place on a frequent basis.

The Call no CAE wants to receive. A strong working relationship between IA and the CIO is essential to responding quickly to a cyber incident. This is important as cyber attacks can lead to reputational damage. One can verify the controls at the vendor and get them to fill up a data security risk assessment questionnaire. IA can be the trusted advisor that an organization needs.

Collaborative Risk Management. As organizations consolidate their risk processes, IA may not be able to continue to stand alone. Risk collaboration and organizing risks are more important nowadays. There is a need to be efficient about going about this. Risk needs to be organized neatly. ERM is one way to link everything together. Auditors should be open to other ideas on organizing and mitigating risk.

The Ticking Ethical Time Bomb. The financial loss from theft was secondary to the effect on company culture. Sometimes, the most obvious issue is no the more important one. Small frauds can lead to large ones. Reinforcing identity is also very smart sometimes, as it can help with ethical reinforcement. Increasing controls should not be done as a knee-jerk reaction sort of thing.

A Matter of Trust. Attention to detail and focused effort can help IA build the relationships required to be perceived as valued advisers. IA should be given time to innovate, gain an understanding of evolving challenges and talk to people in the business regularly about the issues they face. You help to build trust if you know what the regulators or other people are doing. Sometimes, top management might even tell CAE the problems that are upcoming. Relationship building and being part of the management team is crucial. However, there is still a need to be independent even if IA is like a trusted advisor. Try to leverage on technology.

‘IA can often be forgotten if it is not part of the core team, because it is less visible than those functions that meet and talk regularly.’

‘Auditors are there to make organizations better – it is a key part of the way they can add value. Not commenting when they see a better way to do something could show a certain lack of moral courage.’

Proactive Fraud Analysis. Integrating advanced forensic data analytics capabilities can help auditors mitigate fraud risks and demonstrate returns. IA can invest in such tools as it can help in the monitoring of risk. IA should ask ‘What are the high risk accounts?’; ‘When?’; ‘Where?’ etc. IA should focus on the low-hanging fruit first. The first project undertaken should be easy. Learn to go beyond the descriptive analytics. Learn to embrace both structured and unstructured data. Communication is the key. It would be good to automate the tests and involve the end-users. Also, learn to set a realistic timetable. Keep analytics simple and intuitive – don’t include too much information in one report so it isn’t easy to understand.

Getting More from Interviews. Instead of emphasizing formalities, IA should approach each interview like a conversation. You can gain insight into the way operations work and identify gaps etc. Plan your questions beforehand and be prepared. However, the less formal it is, the more information you can find out from the interview. Try to make it a conversation. Learning about the auditees’ life can help to build rapport and build the bond. Talk to others within the auditees’ same department. The interview’s purpose should be specific, attainable and outcome oriented. Preparing for the interview helps a lot. The location matters as well. Try to open in a way that makes the auditee at ease. Try to explain the purpose and the outcome of the interview. Learn to practise effective listening. One can ask thought provoking questions that will help to elicit information. Learn to practise active listening and show positive body language such as being attentive. You can prepare questions but there is no need to follow to a list strictly. It can be difficult to build rapport. Do not try to tell the interviewee that the interview must be done to complete the audit. Have lunch with auditees once in a while. People love to hear about themselves.

‘Auditors should be curious about the way processes work, the way the organization works, and perhaps most importantly, the people who make it work. Curiosity will lead to a better understanding of the organization, better ideas for improving the organization, and a better rapport with the individuals within the organization.’

On the Hunt for Payroll Fraud. Taking a close look at payroll risks can enable IA to help their organizations save money and identify wrongdoing. Payroll fraud is more common if there is irregular workforce patterns. Payroll is usually shrouded in secrecy. Overpayment is more common than underpayment. IA can also examine to seek actual cost savings/ productivity gains. IA can adopt a helicopter overview of payroll data and the payroll process. One can compare payroll costs with other organizations. Rosters should be designed to optimize the allocation of employees to operational needs. Management welcomes findings that reveal specific wrongdoing because they provide hard-to-dispute evidence. IA can look out for certain insights and then drill further. There are many common findings. The audit fieldwork needs to be well-researched and planned.

Guardians of Integrity. IA can provide insight into corporate identity and people-related risks. For instance, IA can evaluate the ethics and organizational integrity. IA must communicate with the board and management and be the corporate conscience. Testing the effectiveness of the ethics programs can be tough. It is important to understand how an organization defines success. It is important to uphold the code of ethics: integrity; objectivity; confidentiality; competence. IA should examine incident reports too. IA must be as wise as the board, as savvy as management, and as shrews as attorneys. Stakeholder surveys could be used to understand the management and employee ethics. IIA needs to exercise fair and ethical decision making.

Internal-Audit

audit financial company tax investigation process business accounting

IIA Magazine Aug 2017 issue

The Technology Issue

 A technology revolution. Tech is moving at a fast pace and some businesses may not be able to reap the benefits. IA needs to understand the evolving risk landscape related to the business. Tech will continue to disrupt the landscape and IA needs to reassess what data means to them going forward. Auditors help organizations avoid getting into trouble by identifying issues early and avoid them being surfaced by regulators or the media.

The Cyber Readiness Gap. Organizations may not be prepared for the attacks they are expecting. Ransomware is a big issue and thinks will get worse. Only half the organizations surveyed have a plan to address ransomware attacks. IA can help to scrutinize cybersecurity practices and plans. IT security governance needs to include the human factor in corporate risk analysis and assessment. IA can move from a supportive to front-seat role when building crisis-resilient culture.

More than Compliance with ‘A’. Transforming a compliance program into a value-adding activity starts with IA. Compliance with AML regulations are important. However, many managers do not see value in compliance work. IA needs to ensure compliance can provide real assurance. It is important to do the right thing and do things correctly. Ask yourself why there is a compliance requirement in the first place. IA needs to work with the first and second line of defence to ensure all risks are being addressed. IA should also question the need for, existence of, and adequacy of compliance with A. Sometimes, the original risks may not be present and hence the compliance requirement should not be relevant. One needs to examine the adequacy and effectiveness of the mitigating control. The audit needs to maximize the use of resources and analytics. One can use trend analysis to understand whether risk is increasing or decreasing. Effectiveness of controls can be tested with analytics.

‘But it should not be compliance simply for compliance sake. Internal audit should consider the overarching business objective and the controls that help mitigate risk to the achievement of the objective – even when examining compliance-related controls.’

Stop Clicking, Start Coding. SQL queries can enable internal auditors to uncover greater insights from organizational data. Data needs to be analysed etc. Some auditors are required to learn SQL. It is a language for managing data held in databases. To be good, logical thinking and reasoning are important and necessary for coding. SQL can be tailored for auditing needs and for ad-hoc queries. SQL and other audit software can form a powerful set of analytical tools.

Internal Audit needs risk management too. Managing its own risks can improve the audit function’s performance and demonstrate that it practices what it preaches. One key risk of IA is whether the department is strategically positioned within the organization its objectives. Other risks are whether the department has enough staff, on assurance etc. Reputation risks are important too, and so is compliance risks. Operational risks are like the resourcing problems, annual audit plan etc. If audits are behind schedule by about a month, it needs to be highlighted as a red flag. IA can also do a risk control self-assessment to evaluate internal controls in place.

The Cashier Cash Thief. Mounting family pressures and opportunity cause a trusted warranty clerk to pocket payments from customers. IA must emphasize the importance of SOD and monitor any exceptions. Trend analysis would allow organization to detect fraud more timely. Routine audits are vital for all cash processes. Mandatory vacations and rotation of duties should have prevented fraud from happening.

In Safe Hands. Organizations must grapple with a host of issues when determining how to best protect their data and manage the way it’s used. In Europe, there is a General Data Protection Regulation that goes into effect in spring 2018. It is a stricter regulation than ever before. Firms need to obtain consent for data collected from individuals. IA needs to go back to the drawing board to strike a balance. Respecting someone’s privacy rights is actually a soft skill and needs a soft approach. Privacy controls need to be engineered into business processes. Businesses must be clear about what they need the data for. Many companies do not know where their data comes from and how it is used. IA can be a role model in innovation etc.

Great tech expectations. As technology becomes more integrated with business processes, auditors must raise their IT skills. New auditors usually have better skills than older ones. People with expertise in IT will be in demand. Those with experience in DA will have an advantage over those who don’t. Experience with audit-specific software is also a plus. Auditors need to have an understanding of the infrastructure and applications being used. New authors are not usually well versed in soft skills. IA needs to have a good understanding of flow, controls and governance. Determine the specialty skills needed. Maintaining the right mix of generalists and specialists is a key IT challenge. IA needs to have a training plan for the IT risk and controls. Training hours need to be tracked and there needs to be information sharing at every meeting.

Building a data analytics program. Six strategies can facilitate progress when starting or furthering an analytics program. Many functions suffer from pitfalls/ setbacks. The six strategies are (1) create awareness rather than a silo; (2) understand the data before investing in a tool; (3) plan sufficiently; (4) think big picture; (5) Partner with IT; (6) Take advantage of visualization tools for inspired reporting.

#PurposeServiceImpact. The IIA’s 2017-2018 Global Chairman of the Board J Michael Peppers encourages IA to unify around the three concepts in his powerful hashtag. Purpose, Service and Impact are important words for our profession. It is about the why we do things. We should help enhance shareholder value through our work. Service is basically walking the talk. It is important to establish credibility with clients. We are both change agents and educators and need to do the right thing. Volunteering is important and internal auditors should strive to give back to the society. Always try to make a positive difference. We need to understand the purpose of the organization.

‘The best and most successful internal auditors I know understand that internal auditing is more than just a job: it is a sincere effort to improve the lot of others, whether organizations or individuals.’

The Root of the Matter. Performing root-cause analysis requires that auditors recognize common myths associated with the process. Addressing root cause will prevent the issue from recurring. Complex problems may be due a variety of factors. There may not be a single root cause at times. Use the 5 Why techniques. Sometimes, two root causes can lead to one problem. Some brainstorming is required to address all the root causes. One can use the fishbone diagram and identify problems in different categories like: Man, Machine, Measurements, Method, Materials, and Mother Nature. One can also use scatter diagrams to pair cause and effect and look for relationships. Good recommendations in the audit report should address the root causes of a problem. However, IA should understand that RCA requires time and resources and the organization must weigh the pros and cons of doing it.

Seven Steps to Transformation. IA can assist management throughout the many stages of business change. The first is pre-implementation review. It helps management to identify problems at the planning stage. Ask yourself what is the best ERP project model for ERP packages? The other steps are process/controls analysis, In-flight reviews, IT and User Acceptance Testing and Output/Results testing. The last 2 steps are post-implementation reviews and comparison to project management reviews.

It’s only one word. Excessive audit report wordsmithing is often a disservice to the client – and the audit function. Let those who did the work have a say in the changes. Never make a change unless you can explain why that change is necessary. Otherwise, you are just changing for personal preference. Always explain the reasons for any change to the person who wrote the original drafts. Do not be too anal about phrasing as this will result in rewriting and delays and frustrations.

‘Far too often, the lead, manager, chief audit executive doesn’t like what is written and starts editing the audit report. The process often results in a report the auditor no longer recognizes and, in the worst situations, it says something the auditor never intended it to say.’

The Data Analytics Strategy. Adding analytics to the audit methodology requires careful change management. Funding and resources needs to be provided. Integrate data analytics requirements into the audit methodology. Look for quick wins if possible. Use a champion to lead the strategy. CAE must emphasize that analytics is good as it improves audit efficiency. Analytics can add value not just to fieldwork, but also risk assessment and planning. Data is also evidence and that’s what sells well.

From ratings to Recommendations. Behavioural psychology suggests internal auditors’ approach could benefit from more carrot and less stick. Audit gradings are hated by auditees as it sends a signal that they did something wrong and that things are really bad. The SDT (self-determination theory) shows that human motivation is optimized when the following 3 are present: developing one’s skills (competency); exercising free will (autonomy); feeling connected with others (relatedness). Give your auditee the chance by sharing about common goals and building good relationships with them.

auditing-service-singapore