ACCA P7 (INT) Advanced Audit & Assurance - Study Text - 2010 (Emile Woolf Publishing)
Подождите немного. Документ загружается.
Chapter 4: Professional responsibility and liability
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 75
Managing the auditor’s liability
Avoiding liability
Meeting claims: professional indemnity insurance
Limiting liability
4 Managing the auditor’s liability
4.1 Avoiding liability
Clearly, it is preferable to avoid claims arising for negligent auditing. Firms can
minimise the risks of being sued by ensuring that their staff perform high-quality
audit work. Auditors should therefore:
follow appropriate auditing standards
use effective quality control procedures
train staff to an appropriate level of knowledge and skill
ensure that the firm is up-to-date with modern auditing methods.
4.2 Meeting claims: professional indemnity insurance
If successful legal claims are made (or if out-of-court settlements are reached, where
the audit firm agrees to make a payment to settle the dispute) the auditor will have
to pay damages. If the damages are so large that they are more than the firm can
afford, the law in some countries may also allow claims to be made against the
personal assets of partners of the audit firm.
The threat of very high claims for damages, beyond the financial means of the audit
firm, applies to the major audit firms as well as smaller firms.
The professional accountancy bodies take the view that the image of the profession
would be seriously damaged if claims awarded against auditors and accountants
are not met because of a lack of financial resources. As a result, the ACCA and other
professional bodies require members in practice to carry professional indemnity
insurance (PII).
PII is an insurance policy that provides cover against all civil liabilities that are
incurred as a result of the conduct of the firm’s business. Money is paid out by the
insurance firm on these policies if the firm itself is unable to pay.
However, the requirement for compulsory PII has the following disadvantages:
It may increase the frequency and size of claims made against firms, which are
seen to have large amounts of funds at their disposal to meet claims.
It may encourage more careless auditing.
It imposes a high cost on audit firms. These costs of insurance are likely to rise as
the general level of legal claims rises.
Paper P7: Advanced audit and assurance (International)
76 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
4.3 Limiting liability
Because of the high costs of legal claims and professional indemnity insurance, a
number of suggestions have been made for finding other ways of limiting claims
against auditors.
One suggestion is that there should be a statutory limit on claims, either a
maximum percentage of the audit fee or a maximum fixed amount.
Another suggestion is that auditors should be permitted to agree a ‘cap’ (limit)
on their liability with their clients, so that a company cannot make a claim
against its auditors for more than the agreed amount (cap). This is now
permissible in the UK, where a company and its auditors can agree to a specified
monetary sum as a ceiling or use a formula.
The use of ‘limited liability partnerships’ (already available under UK law),
whereby an audit firm that is structured as a limited liability partnership cannot
lose more than its total fixed capital. This is similar to limited liability for
companies.
The use of the equivalent of PII for directors of client companies. This may
expose the directors of companies to legal actions by other parties, rather than
the audit firm, because the plaintiffs will know that the directors can afford to
pay any successful claims for negligence.
Including disclaimers of liability to parties other than the company and its
shareholders in the auditors’ report.
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 77
Paper P7 (INT)
Advanced audit and assurance
CHAPTER
5
Practice management
Contents
1 Quality control: ISA 220 and ISQC 1
2 Changes in professional appointment
3 Obtaining and charging for professional work
4 Agreeing the terms of audit engagements: ISA
210
Paper P7: Advanced audit and assurance (International)
78 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Quality control: ISA 220 and ISQC 1
The need for a quality control system in audit firms
Quality control procedures
Quality control arrangements for individual engagements: ISA 220
Quality control arrangements at the audit firm level: ISQC 1
Quality control procedures specific to individual engagements
Quality control in large firms and small firms
1 Quality control: ISA 220 and ISQC 1
It is important to remember that a firm of external auditors is a business, whose
objective is to make a profit. This business is subject to regulation, such as the
regulation of quality control and fees regulations, and the nature of the regulation
may influence the way the business is managed.
This chapter looks at ‘business’ aspects of running an audit practice that are
sometimes referred to as ‘managing the client-auditor relationship’.
1.1 The need for a quality control system in audit firms
The ACCA and IFAC codes of conduct both require that members should perform
their professional work with due skill and care and with a proper degree of
technical competence.
Audit work may be performed by members of a large team of auditors (the
‘engagement team’). If so, the members may have different levels of knowledge and
experience. To satisfy the professional requirements for due skill and care and
technical competence, audit firms need to have a strong system of quality control.
Good procedures for quality control should reduce the risk for the audit firm that it
will:
issue an incorrect audit opinion, and
be sued for negligence.
The consequences of poor audit work and legal action by the client could be any (or
all) of the following:
legal damages and legal costs
the loss of the client
adverse publicity and damage to the reputation of the audit firm
disciplinary proceedings by a professional body such as the ACCA.
It is also important for the audit profession as a whole that all audit firms should
have good procedures for quality control. If the profession as a whole gained a
reputation for poor quality audits, its public image would be damaged.
Chapter 5: Practice management
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 79
1.2 Quality control procedures
Quality control procedures can be considered at two levels:
the audit firm as a whole
each individual audit.
1.3 Quality control arrangements for individual engagements: ISA 220
The objective of the auditor as set out in ISA 220 Quality control for an audit of
financial statements is to implement quality control procedures at the engagement
level to provide reasonable assurance that:
the audit complies with professional standards and applicable legal and
regulatory regulations, and
the audit report is issued is appropriate.
This means that quality control procedures should be implemented that are
applicable to the individual audit engagement.
ISA 220 places the responsibility for key quality control matters on the engagement
partner. The engagement partner has responsibility for the overall quality of the
audit and is required to put procedures in place to ensure that:
ethical standards are complied with and appropriate action taken if there is
evidence to the contrary
independence requirements are met, including:
- identifying circumstances and relationships that might give rise to threats
to independence
- assessing the impact of breaches of the firm’s independence policies and
procedures and whether such breaches create a threat to independence
- taking suitable action to eliminate identified threats or to withdraw from
the engagement if appropriate
procedures are in place to deal with the acceptance of new engagements and the
continuance of existing engagements
the audit is carried out by an audit team with the appropriate competence and
capabilities
appropriate management of the engagement is in place, including the direction
and supervision of staff and the review of audit work. On or before the date of
the audit report the engagement partner must, through a review of audit
documentation and discussion with the audit team be satisfied that sufficient,
appropriate evidence has been obtained to support the conclusions reached
adequate consultation has taken place on difficult or contentious matters and the
conclusions from such consultation implemented
an appropriate monitoring system is in place
the following matters are documented:
Paper P7: Advanced audit and assurance (International)
80 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
- issues in respect of compliance with ethical requirements and how they
were resolved
- conclusions on compliance with independence requirements
- conclusions in respect of new and continuing engagements
- the nature and scope of conclusions from consultations undertaken.
For audits of listed companies, and any other audits where the firm has determined
that an engagement quality control review is required, the engagement partner is
also required to appoint an engagement quality control reviewer, who:
performs an objective evaluation of the significant judgements made by the
audit team and the conclusions reached, including:
- discussion of significant matters with the engagement partner
- review of the financial statements and the proposed audit report
- review of selected audit documentation relating to significant judgments
- an evaluation of the conclusions reached and whether the proposed audit
report is appropriate
considers the engagement team’s evaluation of the firm’s independence in
relation to the audit engagement
considers whether appropriate consultation has taken place on difficult or
contentious matters
considers whether audit documentation selected for review reflects the work
performed and the conclusions reached.
The engagement quality control reviewer is required to document confirmation
that:
the firm’s procedures in respect of engagement quality control reviews were
followed
the review was completed on or before the date of the audit report
he is not aware of any unresolved matters that would cause him to believe that
the significant judgements made by the audit team and the conclusions they
reached were inappropriate.
More detail on many of the above procedures is given in a later section.
1.4 Quality control arrangements at the audit firm level: ISQC 1
Quality control policies and procedures at a firm level are set out in ISQC 1 Quality
control for firms that perform audits and reviews of financial statements, and other
assurance and related services engagements.
The objective of the firm as set out in ISQC 1 mirrors that of the auditor in ISA 220.
The objective of the firm is to establish and maintain a system of quality control to
provide it with reasonable assurance that:
Chapter 5: Practice management
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 81
the firm and its personnel comply with professional standards and applicable
legal and regulatory regulations, and
reports issued by the firm are appropriate.
The quality control procedures that are applied within an audit firm will reflect the
nature and size of the audit practice. However, personnel within the firm who are
responsible for establishing and maintaining quality control procedures must have
an understanding of the entire text of ISCQ 1. As the firm must meet the
requirements of ISQC 1, it should have a system in place which addresses each of
the following elements:
Leadership responsibilities for quality
Ethical requirements
Acceptance and continuance of engagements
Human resources
Engagement performance
Monitoring
Documentation
The requirements of ISQC 1 in each of these areas are considered in turn below.
Leadership responsibilities for quality
ISQC 1 requires the firm to establish policies and procedures designed to promote
an internal culture recognising that quality is essential. Ultimate responsibility for
quality control policies and procedures should rest with the firm’s CEO (or
equivalent) or managing board of partners (or equivalent).
Any person to who has operational responsibility for quality control should have
appropriate experience and ability and the necessary authority.
Ethical requirements
ISQC 1 requires the firm to establish policies and procedures to provide it with
reasonable assurance that the firm and its staff:
comply with relevant ethical requirements, and
maintain independence where required to do so by those requirements.
The firm should:
communicate its independence requirements to staff, and
identify and evaluate circumstances and relationships that create threats to
independence, assessing the impact of such threats and applying safeguards or
withdrawing from the engagement if appropriate.
The policies and procedures should include requiring:
staff to notify the firm of circumstances and relationships that might create a
threat to independence
Paper P7: Advanced audit and assurance (International)
82 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
staff to notify the firm of any breaches of independence of which they have
become aware
the firm to communicate such breaches to the engagement partner and other
relevant staff
the engagement partner to advise the firm of action to be taken.
At least annually, the firm should obtain written confirmation from all staff of
compliance with the firm’s policies and procedures on independence.
The firm should also establish criteria for determining the use of safeguards to
reduce the familiarity threat to an acceptable level when the same senior personnel
have been used on an assurance engagement for a long time. For listed entity
clients, there must be rotation of the engagement partner after a specified period, in
compliance with relevant ethical requirements.
Acceptance and continuance of engagements
ISQC 1 requires the firm to establish policies and procedures to provide it with
reasonable assurance that the firm will only take on or continue work where the
firm:
is competent to perform the engagement
has the capabilities (including the necessary resources) to do so
can comply with the relevant ethical requirements, and
has considered the integrity of the client and does not have information which
would lead it to conclude that the client lacks integrity.
The policies and procedures should include requiring the firm to:
obtain sufficient information to make such decisions (for new or existing
engagements)
consider potential conflicts of interest (and therefore whether it should accept
the engagement)
document all identified issues and how they were resolved.
These requirements mean that there should be a review of proposed new clients and
(at regular intervals) of existing clients, to make sure that the firm will be
independent, that there are no conflicts of interest and the firm has the technical
competence to do the audit work.
When an audit firm accepts an audit engagement from a new client, suitable
procedures should therefore be carried out to ensure that:
the firm will be independent and there are no conflicts of interest
the firm has the technical competence to do the work
professional clearance has been obtained from the previous auditors of the new
client
Chapter 5: Practice management
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 83
appropriate anti-money laundering (client identification) procedures are
performed.
Before the start of the audit each year, the engagement partner for the audit should:
ensure that all members of the audit team are independent of the client and there
are no conflicts of interest
be satisfied with the ethical integrity of the client entity and its management.
Human resources
ISQC 1 requires the firm to ensure:
it has sufficient personnel with the competence, capabilities and commitment
to ethical principles to meet its overall quality control objectives, and
that for each engagement an appropriate engagement partner and team are
assigned.
Policies should therefore exist for the recruitment, training and development of
staff. The firm should ensure compliance with ISAs and audit staff should have a
good knowledge of accounting standards and local/national statutory accounting
regulations.
The firm’s technical auditing procedures should be set out in a manual and
reinforced by training. Newsletters and/or meetings could be used as a means of
ensuring that professional staff are kept up-to-date on current developments.
Work should be assigned to staff who are competent to perform that work. There
should be procedures for ensuring that an audit team collectively has the
appropriate level of technical knowledge for the audit engagement and includes
individuals with:
experience of audits of a similar complexity, and
an ability to apply professional judgement.
Engagement performance
Policies and procedures are required to include:
those to promote consistent quality engagement performance
supervision responsibilities
review responsibilities (on the basis that more experienced team members
review the work of less experienced team members)
guidance on consultation to ensure that:
- appropriate consultation takes place on difficult or contentious matters
- sufficient resources are available for such consultation
- the nature, scope and conclusions of the consultation are documented (by
both parties)
- conclusions arising from the consultation are implemented.
Paper P7: Advanced audit and assurance (International)
84 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
guidance on engagement quality control reviews to ensure that:
- an engagement quality control review is required for audits of all listed
entity clients
- criteria are established to determine which other engagements should be
subject to a engagement quality control review
- the review covers certain procedures (the same as set out in ISA 220 – see
above)
- engagement quality control reviewers are eligible to carry out such
reviews via technical qualifications, experience, authority and objectivity
from the engagement
- engagement quality control reviews are properly documented (again, as
also set out in ISA 220)
procedures for dealing with any differences of opinion between the engagement
team and those consulted or between the engagement partner and the
engagement quality control reviewer
procedures in respect of completion of the final audit files on a timely basis and
the confidentiality and safe custody of such documentation for an appropriate
period.
Monitoring of quality control procedures
The firm is required to establish a monitoring process designed to provide it with
reasonable assurance that its quality control system is relevant, adequate and
operating effectively. This process should include inspecting, on a cyclical basis, at
least one completed engagement for each engagement partner.
Responsibility for the monitoring process should be given to a partner or other
appropriate person with sufficient experience and authority. When monitoring
reviews are carried out they should not be performed by those involved with the
engagement or the engagement quality control review.
The firm should:
evaluate the effect of any deficiencies found to determine if they do indicate a
failing in the firm’s quality control system
communicate such deficiencies to relevant personnel, together with appropriate
remedial action.
Appropriate remedial action might include:
action in relation to individual engagements or employees
communication of findings to those responsible for training and professional
development
changes to the firm’s quality control system
disciplinary action, especially against repeat offenders.
If the results of monitoring procedures indicate that:
an inappropriate report may have been issued, or