ACCA P7 (INT) Advanced Audit & Assurance - Study Text

Подождите немного. Документ загружается.

Chapter 13: Internal audit and outsourcing

Types of internal audit

 Introduction

 Financial audits

 Operational audits

 Compliance audits

2 Types of internal audit

2.1 Introduction

Internal auditors may be involved in ‘financial’ audits, focusing on the audit of

items in the income statement/statement of comprehensive income and statement

of financial position. When the internal auditors perform this type of work, they

may duplicate work that the external auditors might otherwise be expected to do.

The external auditors might therefore be able to rely on the work of the internal

auditors in reaching their audit conclusion. This was considered in Chapter 8.

However, the internal audit function often has a much wider role than simply

performing financial audits, and in many entities (particularly large entities) the

internal auditors are involved in other aspects of auditing, such as:

 energy audits: these are checks on how the entity is making use of energy and

whether its operations are energy-efficient

 social audits: these are checks on the impact of the entity on the society in which

it operates

 environmental audits: these are checks on the effect the entity is having on its

natural environment, and considers issues such as the use of sustainable

materials, re-cycling, reducing pollution, and so on

 human resource audits: these are audits into the work force of an entity, to

check whether the entity has adequate systems for the recruitment, training and

development of employees to meet its current and future needs.

2.2 Financial audits

Performing financial audits is the traditional role of the internal auditor. Internal

auditors may be asked by management to review accounting records and other

records to substantiate figures appearing in financial statements and management

accounts.

This work overlaps with the work of the external auditor. Consequently, this aspect

of internal audit work is now seen as a relatively minor part of the total work of an

internal audit department.

Paper P7: Advanced audit and assurance (International)

296 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

However, it is important to remember that by performing financial audits, the

internal auditor is able to look at the internal controls that are in place to minimise

risks, to identify weaknesses and to recommend improvements in the internal

control system.

2.3 Operational audits

Operational audits examine the entity’s internal control procedures and whether or

not the control systems that have been established by management are operating

effectively. As a result of the audit, the internal audit department will make

recommendations to management for improvements to the system or the way in

which it is operated.

The value for money (or VFM) audit was described in an earlier chapter as an

assurance service that might be performed for a client by an external accountancy

firm. VFM audits may be carried out instead by the internal audit department.

Finding the best possible combination of the 3Es is seen as a strategy for

maximising profit performance. It is not usually possible to achieve objectives

(effectiveness) by using the cheapest resources (economy) in the most productive

way possible (efficiency). Sometimes, greater efficiency can only be achieved by

spending more, so a balance must be found between economy and efficiency.

Sometimes, the benefits of greater effectiveness are not justified by the extra cost, so

a balance must be found between economy and effectiveness.

One of the purposes of a VFM audit should be to check whether the most

appropriate balance between economy, efficiency and effectiveness is being

achieved.

2.4 Compliance audits

Entities are subject to a large number of laws and regulations, and they may be

exposed to the risk of regulatory action by the authorities if they fail to comply with

the regulations. The nature of important regulations varies from one industry to

another. Controls over health and hygiene are important for the food manufacturing

industry, for example. Controls over pollution are important for companies

involved in oil and gas exploration. Controls over money laundering are important

for financial services; and controls over safety are important for companies in the

public transport industry.

Internal audit can be used by management as a tool to confirm that significant laws

and regulations are being complied with by the company.

Chapter 13: Internal audit and outsourcing

Outsourcing

 Financial operations that might be outsourced

 Advantages and disadvantages of outsourcing

 Outsourcing the internal audit function

 Outsourcing other finance or accounting functions

 ISA 402: Audit considerations relating to entities using service organisations

3 Outsourcing

3.1 Financial operations that might be outsourced

‘Outsourcing’ by a company means arranging for an external entity to perform a

task that would otherwise be performed by the company’s own staff. It usually

refers to routine and repetitive procedures and operations.

Outsourcing of work to ‘external suppliers’ and service organisations is a common

practice. Examples of work that may be outsourced include:

 payroll operations

 internal auditing

 financial and management accounting activities (for example data processing or

pensions)

 IT services

 work relating to taxation compliance and tax consultancy

 due diligence procedures for acquisitions and mergers

 non-financial services, such as catering, cleaning, motor vehicle fleet

management, and staff recruitment and selection.

Entire functions may be outsourced. For example, an entity may outsource all the

financial accounting function, from book-keeping through to the preparation of final

financial statements.

Alternatively, only parts of functions may be outsourced, with the remainder of the

function being retained ‘in house’. For example, an entity may outsource its payroll

function, but perform the rest of the accounting and finance function itself.

A problem for the auditors (internal and external) is that when work is outsourced,

they need to satisfy themselves that the external agencies are performing their work

properly. It may be necessary to check that the information provided by the external

agency is correct (and not subject to misstatement) and that the internal controls

applied by these external agencies are effective.

Paper P7: Advanced audit and assurance (International)

298 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

3.2 Advantages and disadvantages of outsourcing

Advantages

There are several reasons why entities outsource their operations.

 Cost savings. It may be cheaper to outsource work to an external service

provider than to do the work in-house.

 The skills of the external agency or service provider. An external service

provider may have skills and expertise for doing the work, that the entity itself

does not have ‘in house’.

 Access to the most up-to-date techniques and technology might not be readily

available within the entity, but the external agency may have them.

 The management of the entity are able to focus their time and effort on ‘core

activities’, and do not have to spend as much time monitoring the out-sourced

activities.

Disadvantages

There are also disadvantages with outsourcing.

 The management of the entity needs to make sure that the service provider

understands the requirements of the entity in respect of the service that it is

providing. If the work is not properly specified, the service provider may fail to

do everything that the entity requires it to do.

 The entity relies on the service provider to do its work on time and have it ready

at the time that the entity requires it. This is particularly important, for example,

when payroll operations are outsourced.

 There may be problems with negotiating an appropriate fee for the work with

the service provider.

 Management need to ensure that the service provider gives the organisation an

appropriate level of priority and ‘customer care’. This means that management

must carry out regular reviews of the service level and service quality provided.

In general, the outsourcing arrangement needs to be effectively managed and

controlled by the organisation.

3.3 Outsourcing the internal audit function

Some entities outsource the work of the internal audit function. When this happens,

the service provider is often the accountancy firm that provides the entity with its

external audit services.

Several factors need to be considered when an entity outsources its internal audit

function.

 The audit firm must have a greater level of independence than the entity’s own

internal audit staff. If the external audit firm is not properly independent from

the executive management of the entity, it should not be given any internal audit

work.

Chapter 13: Internal audit and outsourcing

 The audit firm may have access to more highly trained, specialist employees.

 The audit firm will have greater numbers of employees available for any urgent

internal audit assignments.

 Professional codes of conduct and standards of behaviour will regulate the audit

firm. This might not be the case with an in-house internal audit department.

 The audit firm may be sued for breach of contract or for negligent work and

should have professional indemnity insurance to meet claims for losses due to

negligent work.

However, there are a number of disadvantages with outsourcing the internal audit

function to the external audit firm.

 Professional firms are not under the control of the entity in the same way as their

‘in house’ internal audit employees.

 Fees for internal audit work can be high.

 Professional firms may not have the same level of detailed knowledge of the

entity and its operations that ‘in house’ internal auditors (working in the

organisation on a daily basis) should have.

 There may be threats to the independence of the external audit where the firm

acts as both internal auditors and external auditors.

3.4 Outsourcing other finance or accounting functions

A list of examples of other functions that could be outsourced was given at the start

of this section. In the exam, you may be required to comment on the specific

advantages and disadvantages of outsourcing any of these.

An important aspect of outsourcing accounting functions may be that the external

supplier controls the accounting records from which figures for the financial

statements are obtained. For example if payroll work is outsourced, the data for

employee costs and any liabilities for payroll (such as tax liabilities) may be held by

the service provider, not by the audit client.

The audit client may hold none of this information. The auditor is engaged by the

audit client and has no contractual relationship with the service organisation.

However the auditor may need to obtain audit evidence from the service

organisation. Clearly it is important that if the service organisation controls any

accounting information for the audit client, the contractual arrangement between

the audit client and the service organisation should include an obligation for the

service organisation to provide the auditor with access to the information required.

Issues for the auditor to consider in this type of situation are as follows.

 Materiality. The auditor should decide whether the outsourced operation is

material in terms of the financial statements. If payroll work is outsourced, this

is likely to be a material item and the auditor will have to consider how to obtain

sufficient appropriate evidence about payroll costs.

 Accessibility to the records. This point was considered earlier. It is important

that access to the relevant records is available for the auditor, and the auditor

Paper P7: Advanced audit and assurance (International)

300 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

should discuss with the service organisation the arrangements for obtaining the

information required.

 Control risk. The auditor will need to make an assessment of control risk in the

outsourced operation. A systems audit will be possible only if the auditor is

satisfied with the control system in the service organisation. Otherwise

substantive auditing procedures will be needed.

 Compliance. Where the outsourced work is subject to regulatory requirements,

the auditor will need to consider how to gather evidence about compliance with

the regulations. An example is the need to check compliance with tax regulations

for deductions from tax, in the case of outsourced payroll activities.

 Transfer of information. It may also be necessary to check the procedures for

the transfer of information between the service organisation and the audit client,

to establish how information is transferred, how often it is transferred and

whether the method of transfer is reliable.

If you are asked in an exam question to comment on outsourcing any function,

remember to think specifically about the relevant function you are being asked

about, and think through factors such as:

 the logistics/practical issues of the outsourced operation

 the confidentiality associated with the source information (for example, in

respect of payroll, pension details are considered highly confidential by staff)

 the speed of technological advancement in the area

 the responsibility for the function: for example, directors will still be legally

responsible to ensure that proper accounting records are kept, even if they

outsource them.

3.5 ISA 402: Audit considerations relating to an entity using a service

organisation

ISA 402 provides guidance to external auditors where clients outsource some of

their operations to service organisations. The services provided by a service

organisation are relevant to the audit when those services, and the controls over

them, are part of the entity’s information system. Such controls are most likely to

relate to financial reporting but other controls could also be relevant to the audit –

such as controls over the safeguarding of assets.

When the client uses the services of a service organisation, the objectives of the

auditor, per ISA 402, are:

 to obtain an understanding of the nature and significance of those services and

their effect on his client’s internal controls, sufficient to identify and assess the

risks of material misstatement, and

 to design and perform audit procedures in response to the assessed risks.

Chapter 13: Internal audit and outsourcing

Obtaining an understanding of the services provided

In obtaining an understanding of the services provided the auditor is applying ISA

315, which was discussed in a previous chapter. The auditor is required to:

 understand how his client uses the services provided, and

 evaluate the controls at his client which relate to the services provided.

For example, a client may have outsourced its payroll transactions, and have

established controls over the submission and receipt of payroll information that

would prevent or detect material misstatements. Testing these controls may enable

the auditor to conclude that payroll is not materially misstated, regardless of the

controls in place at the service organisation.

If the auditor is unable to obtain a sufficient understanding from the client then

he should use one or more of the following procedures:

 Obtain a Type 1 or Type 2 report (see below).

 Contact the service organisation, via the client, to obtain specific information.

 Visit the service organisation and perform appropriate procedures to give the

necessary information.

 Use another auditor to perform such procedures.

Type 1 and Type 2 reports

A Type 1 report comprises:

 A description of the service organisation’s system, control objectives and

controls as at a specified date (prepared by the management of the service

organisation), and

 A “reasonable assurance” report on the above description and the suitability of

the controls to achieve the specified control objectives (prepared an auditor

instructed by the service organisation).

A Type 2 report is a more detailed report, covering not only the theoretical controls

in place, but also whether, in practice, the controls have achieved their objectives.

The description may now cover a specified period, and may also report on the

operating effectiveness of the controls over that period. The report will now also

give:

 the “service auditor’s” opinion on the operating effectiveness of the controls,

and

 a description and the results of his tests of controls.

In common with earlier theory in this chapter, before relying on a Type 1 or Type 2

report the “user auditor” must be satisfied as to:

 the service auditor’s professional competence and independence from the

service organisation, and

 the standards under which the report was issued.

Paper P7: Advanced audit and assurance (International)

Responding to the assessed risks of material misstatement

In responding to the assessed risks, the auditor is applying ISA 330, which was

discussed in a previous chapter. The auditor is required to:

 determine whether sufficient appropriate audit evidence is available from

records held at the client, and, if not

 perform further audit procedures to obtain such evidence or use another auditor

to perform those procedures at the service organisation on his behalf.

If the auditor wishes to perform tests of controls he should use one or more of the

following procedures:

 Obtain a Type 2 report.

 Perform appropriate tests of controls at the service organisation.

 Use another auditor to perform such procedures on his behalf.

Other requirements

The auditor should enquire of management as to whether the service organisation

has reported any fraud, non-compliance or uncorrected misstatements to them.

If the auditor is unable to obtain sufficient appropriate audit evidence regarding the

services provided by the service organisation he should express a modified opinion

in his audit report. (The different types of audit opinions are discussed in a later

chapter.)

The auditor should not refer in his report to the work of a service auditor unless

that is required by law or regulation. Even then, or if the auditor refers to the

expert’s work in his report because it is relevant to an understanding of a modified

opinion, then he must make it clear that such a reference does not reduce his

responsibility for that opinion in any way.

Paper P7 (INT)

Advanced audit and assurance

CHAPTER

Reporting

Contents

1 The audit report and the meaning of ‘a true and

fair view’

2 The unmodified audit report: ISA 700

3 The modified audit report: ISAs 705 and 706

4 The impact on the audit report of opening

balances and comparatives: ISAs 510 and 710

5 The impact of going concern on the audit report:

ISA 570

6 Communicating with those charged with

governance: ISA 260

7 Communicating deficiencies in internal control:

ISA 265

8 Special purpose audit reports

Paper P7: Advanced audit and assurance (International)

The audit report and the meaning of ‘a true and fair view’

 The audit report

 The meaning of a ‘true and fair view’

1 The audit report and the meaning of a ‘true and fair

view’

1.1 The audit report

The auditor’s report on the financial statements is the only direct communication

between the auditor and the owners of the company (to whom the auditor normally

reports).

In the past, the auditor’s report was criticised for being too brief to allow the general

reader to understand the nature of an audit and the meaning of the auditor’s report.

This was seen to be a major cause of the ‘expectation gap’ – the problem that users

of financial statements expect more from the audit than statutory and other

regulations require.

The expectation gap

The term ‘expectation gap’ refers to the fact that the public perception of the role

and responsibilities of the external auditor is different from his statutory role and

responsibilities. The expectations of the public are often set at a level higher than

that at which the external auditor actually operates.

Some examples of the misunderstandings inherent in the public’s expectations are

as follows:

 The public believes that the audit opinion in the audit report amounts to a

‘certificate’ that the financial statements are correct and can be relied upon for all

decision-making purposes, including decisions about takeovers.

 The public also believes that the auditor has a duty to prevent and detect fraud

and that this is a purpose of the audit.

 The public assumes that in carrying out his audit work, the auditor tests 100% of

the transactions undertaken during the accounting period.

One consequence of these misunderstandings has been an increasing tendency in

some countries to undertake legal action against the auditors, sometimes on a

‘frivolous’ basis, in the belief that the auditor should have prevented misstatements

in the financial statements or should have prevented fraud.

Responses to the problem of the expectation gap have varied between countries. In

some countries, corporate governance codes have been changed to strengthen the

role and responsibilities of directors for sound internal control and accounting

systems.

ACCA P7 (INT) Advanced Audit &amp; Assurance - Study Text - 2010 (Emile Woolf Publishing)

Подождите немного. Документ загружается.

ACCA P7 (INT) Advanced Audit & Assurance - Study Text - 2010 (Emile Woolf Publishing)