Feedback Statement on consultation on proposed revisions to International Standards on Auditing (UK and Ireland) addressing the use of internal audit,

Transcription

1 Feedback Statement and Further consultation Financial Reporting Council February 2013 Feedback Statement on consultation on proposed revisions to International Standards on Auditing (UK and Ireland) addressing the use of internal audit, and Further consultation on timing of prohibiting the use of internal auditors to provide direct assistance

2 The FRC is responsible for promoting high quality corporate governance and reporting to foster investment. We set the UK Corporate Governance and Stewardship Codes as well as UK standards for accounting, auditing and actuarial work. We represent UK interests in international standard-setting. We also monitor and take action to promote the quality of corporate reporting and auditing. We operate independent disciplinary arrangements for accountants and actuaries; and oversee the regulatory activities of the accountancy and actuarial professional bodies. The FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indrectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of any person relying on or otherwise using this document or arising from any omission from it. The Financial Reporting Council Limited 2013 The Financial Reporting Council Limited is a company limited by guarantee. Registered in England number Registered Offi ce: 5th Floor, Aldwych House, Aldwych, London WC2B 4HN.

3 Contents Page 1 Introduction 2 2 Responses to the May 2012 consultation 3 3 Prohibiting direct assistance further consultation 5 4 Process for consulting on adoption of new/revised ISAs 7 Appendix Respondents to the May 2012 consultation 1

4 1. Introduction 1.1 In 2012, the International Auditing and Assurance Standards Board (IAASB) issued a revision of International Standard on Auditing (ISA) 610, Using the Work of Internal Auditors. Other than redrafting for the IAASB s Clarity Project, this standard had not been previously revised by the IAASB since 1994 and did not address subsequent developments in the internal audit environment and changes in external audit practice matters that were highlighted during the Clarity Project. The revised standard is updated for these developments and aims to enhance the performance of external auditors by: (a) Enabling better consideration and leveraging, as appropriate, of the knowledge and findings of the internal audit function in making risk assessments; and (b) Strengthening the framework for the evaluation and, where appropriate, use of the work of internal auditors in obtaining audit evidence, including resolving the ambiguity regarding whether the ISAs, as issued by the IAASB, permit the use of internal auditors to provide direct assistance. 1.2 ISA 315, Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment, has also been revised by the IAASB to: (a) (b) Introduce a new requirement for the auditor s risk assessment procedures to include inquiries of appropriate individuals within the internal audit function (if such a function exists); and Where an entity has an internal audit function, amend the wording of the requirements to clarify the auditor obtains an understanding of its responsibilities, organisational status and activities performed, to conform with the changes in ISA 610 (Revised). 1.3 A small number of related conforming amendments have also been made to other ISAs. 1.4 The former Auditing Practices Board (APB) of the FRC had commented on the exposure drafts that were issued by the IAASB and was satisfied that the significant issues it identified had been satisfactorily addressed in the final standards. 1.5 In revising ISA 610, the IAASB also agreed on requirements and guidance that specify the conditions under which the external auditor is permitted to use internal auditors to provide direct assistance during the audit and establishes the responsibilities of the external auditor if they do so. However, these requirements and guidance were not included at the time the revised standard was issued by the IAASB. The reason for this is that there was a perceived inconsistency between the revised ISA 610 and the International Ethics Standards Board for Accountants (IESBA) Code of Ethics for Professional Accountants (the IESBA Code) regarding the ability of external auditors to use internal auditors to provide direct assistance. 1.6 The IESBA has consulted on a change to the definition of engagement team in the IESBA Code to eliminate this inconsistency (by stating that it excludes individuals within an audit client s internal audit function providing direct assistance on the engagement in accordance with revised ISA 610). Having regard to the responses to its consultation, the IESBA is changing the definition to accommodate direct assistance where it is not prohibited at a national level. 1.7 The issue of direct assistance was previously considered by the APB when the Clarity ISAs were being implemented in the UK and Ireland in Following public 2

5 consultation, it agreed that direct assistance could be allowed in limited circumstances subject to appropriate safeguards. Accordingly, the current ISA (UK and Ireland) 610 provides guidance on using internal auditors to provide direct assistance. The definition of audit team for the purpose of the APB Ethical Standards for Auditors specifically excludes internal audit personnel who are involved in directly assisting the external auditor in carrying out external audit procedures provided that appropriate quality control arrangements are established as described in ISA (UK and Ireland) In May 2012 the FRC issued a consultation paper setting out proposed revisions to the corresponding ISAs (UK and Ireland) to implement the revisions to the ISAs, including those that had been developed by the IAASB relating to direct assistance. Those revisions addressing direct assistance incorporate in substance the limitations and safeguards that are included in the current ISA (UK and Ireland) The opportunity was also taken in that consultation to consider, and seek views on, the process for the FRC consulting on the adoption of future new/revised ISAs. 2. Responses to the May 2012 consultation 2.1 The consultation period closed on 31 August Thirteen responses were received from: Audit firms 8 Professional and public sector bodies 5 Copies of all the responses are available on the FRC website 1. A list of respondents is given in the Appendix. Revision of the ISAs (UK and Ireland) 2.2 There was strong overall support for revising the ISAs (UK and Ireland) to implement the underlying revised ISAs as issued by the IAASB. With respect to the regulatory impact, there was general agreement that the effects would not be disproportionate to the total work effort and that any increase in work effort would be justified by benefits. 2.3 A few issues of principle were raised by a small minority of commentators. A description of these issues and the FRC responses to them are set out below. 1 The consultation paper on the proposed revisions to ISAs (UK and Ireland), and the responses received, can be obtained from: Revision-of-ISAs-(UK-and-Ir.aspx 3

6 Issue A Do not mandate making inquiries of internal audit as a part of risk assessment FRC Response Such inquiries are particularly relevant to the external auditor when identifying and assessing risks of material misstatement. This is because it cannot be assumed that, where such a risk has been identified by internal audit, it would necessarily also be identified by the external auditor without making inquiries of internal audit. This requirement is retained. B Eliminate all supplementary FRC material. C Timely finalisation and issuance is important so as to enable firms to consider the new requirements at the planning stages of their December 2013 audits, and to have appropriate discussions with internal audit functions whom may be planning to commence their work in early There was very little FRC originated supplementary material proposed in the consultation. Primarily, this comprised a paragraph identifying the sources of ethical requirements for auditors in the UK and Ireland and some footnotes clarifying that responsibilities ascribed to management in the ISAs would be responsibilities of those charged with governance in the UK and Ireland. This material is consistent with similar supplements in the other ISAs (UK and Ireland) and was supported by a majority of respondents. The FRC continues to believe that it is helpful and, therefore, it is retained. The FRC is aiming to finalise the revised standards as early as practicable, having regard to the need for the final position in ISA 610 as issued by the IAASB to be determined and to address issues that have been identified by the FRC in relation to direct assistance (see further discussion below). 2.4 Suggestions for improving some of the text in the standards were also given. These generally related to text developed by the IAASB. They did not identify fundamental flaws and the FRC does not believe that it is necessary to either amend the IAASB text directly (which would introduce inconsistency with the IAASB standards) or to add supplementary FRC text. 2.5 The FRC has concluded that the proposed changes to ISA (UK and Ireland) 315 and the related conforming changes to the other ISAs (UK and Ireland) should be finalised as published in the consultation paper. With respect to ISA (UK and Ireland) 610, the FRC now believes that direct assistance should not be allowed as explained below and is undertaking a further consultation on prohibiting it for UK and Ireland audits. For the other material in the proposed revision of ISA (UK and Ireland) 610 on using the work of the internal audit function, the FRC has concluded that it should be finalised as published in the consultation paper. 4

7 3. Prohibiting direct assistance further consultation 3.1 Factors the APB took into consideration when originally agreeing the limited use of direct assistance in the extant ISA (UK and Ireland) 610 included that direct assistance is arguably more reliable for the external auditor than the separate work of the internal audit function, given that direct assistance work is directed, supervised and reviewed by the external auditor and not by members of the internal audit function. The APB had also believed that the threats associated with using internal audit staff to carry out external audit procedures (such as the threat to objectivity) are similar to situations where reliance is placed on other work carried out by the internal audit function, and that such threats could be addressed by applying a threats and safeguards approach as established in the APB s Ethical Standards for Auditors (the APB obtained support for this in separate consultations on proposed changes to the Ethical Standards and revision of ISA (UK and Ireland) 610 in 2009). 3.2 In the May 2012 consultation respondents were specifically asked whether they agree that it is acceptable to use internal auditors to provide direct assistance in appropriate limited areas as set out in the consultation draft of proposed revised ISA (UK and Ireland) 610, based on the revisions developed by the IAASB. Only one respondent was of the view that internal auditors providing direct assistance was not appropriate. Respondents were also asked whether, in the event the international standards are not ultimately updated to support the use of internal auditors to provide direct assistance, they would continue to support the FRC following that approach. In response to this, more respondents indicated that the FRC should consider whether its position needs to be revisited - only a small majority (a margin of 1) gave outright support to continuing to support direct assistance in such a circumstance. 3.3 The FRC, having considered the background described above, and the responses to the consultation on the proposed changes to ISA (UK and Ireland) 610, has now concluded that it would not be appropriate to allow the use of direct assistance for the following reasons: Direct assistance to the external auditor is undertaken by individuals that are not independent of the audited entity under the Ethical Standards the internal auditors are employed by the audited entity and also may have financial interests in it, a situation that would be seen to compromise the independence of other members of the audit engagement team employed by the audit firm. In order to address this, the definition of the audit team had been amended in the Ethical Standards to exclude any internal auditor providing direct assistance. Since 2009, concerns about auditor independence have not abated and stakeholders generally expect that external auditors should be seen to be free from threats to their independence. Specifically permitting the direct use of internal auditors involves agreeing lower independence standards for some members of the audit engagement team, which would seem to lean against this expectation. Further, the FRC noted that the risk to audit quality is heightened by the use of direct assistance. The individual(s) providing the direct assistance would not be familiar with the external auditor s processes, including those for quality control, and would be operating outside of the internal audit processes with which they are familiar. This contrasts to the auditor s reliance on work carried out by the internal audit function which may be relied on provided, inter alia, the auditor evaluates and is satisfied with the function s quality control processes. Accordingly, despite the support from auditors and professional bodies who responded to the consultation, the FRC has concluded that the use of internal auditors to provide direct assistance cannot be justified and that the rationale for doing so may not be 5

8 understood by wider stakeholders, depending, as it does, on the application of special limitations and safeguards and the disapplication of the normal independence rules for some members of the audit engagement team. Therefore, the FRC has concluded that direct assistance should be prohibited for audits conducted in accordance with ISAs (UK and Ireland) and that this should be extended in a group audit to any component auditor whose work is relied upon by the group auditor, including for overseas components. 3.4 A prohibition on direct assistance would not represent a divergence from ISA 610 (Revised). The IAASB makes clear that its requirements and guidance in this area will not be applicable in jurisdictions where direct assistance in prohibited. 3.5 When the final revised ISA (UK and Ireland) 610 is issued, the following supplementary paragraph will be included in the introductory section that describes the scope of the standard The use of internal auditors to provide direct assistance is prohibited in an audit conducted in accordance with ISAs (UK and Ireland). For a group audit this prohibition extends to the work of any component auditor which is relied upon by the group auditor, including for overseas components. Accordingly, the requirements and related application material in this ISA (UK and Ireland) relating to direct assistance are not applicable. A footnote will be added to specifically identify the relevant requirements and application material paragraphs. 3.6 The FRC has been advised that in practice there are relatively few UK and Ireland audits for which direct assistance is used to a significant extent in terms of volume of work. However, it appreciates that for those audits where direct assistance is a feature there may be impacts such as on the planning and timing of work to be performed. 3.7 The FRC has concluded that, before finalising the timing of the prohibition on direct assistance, it should consult to obtain a more full understanding of the possible impact. Accordingly the FRC would welcome responses to the questions below. The FRC is not inviting further comment on the material in the proposed revision of ISA (UK and Ireland) that does not relate to direct assistance. Effective date 3.8 Given the delay in finalising all the revisions to the ISAs (UK and Ireland) regarding the use of internal audit, recognising that arrangements with internal auditors are often agreed early in the period to be audited and also that external auditors may need time to identify and assign their own staff with appropriate knowledge and competencies to work that has previously been undertaken with direct assistance from internal auditors, the FRC proposes to defer the effective date of the final revised standards to audits of financial statements for periods ending on or after 15 March Early adoption would be permitted so that auditors who wish to be able to claim compliance with the corresponding ISAs issued by the IAASB would be able to do so. 6

9 Q1 Q2 Q3 Q4 To what extent is direct assistance a feature of current audits? Would the prohibition of direct assistance have a significant proportional impact on the costs of those audits where it is currently a feature? If yes, please give an estimate of the proportional cost. Other than cost, are there other significant possible impacts that may result from the prohibition of direct assistance? If yes, please describe them and how difficult, or easy, it would be to overcome them. The FRC is particularly interested to have views on the possible impact, if any, on audit quality. Does the proposed effective date of the revised standards that would bring the prohibition into effect (audits of financial periods ending on or after 15 March 2014 see paragraph 3.8 above) allow sufficient time to overcome any practical difficulties that may arise from the prohibition, such as a need for external auditors to assign their own staff with appropriate knowledge and competencies to the work? If not, please explain why and identify what would be an appropriate effective date. The FRC would prefer to receive letters of comment in an electronic form that facilitates copy and paste : these may be sent by to k.billing@frc.org.uk. If this is not possible, please send letters of comment to: Keith Billing Project Director Financial Reporting Council 5 th Floor Aldwych House Aldwych LONDON WC2B 4HN Given the limited focus of this consultation a comment period of 60 days is provided. Accordingly, letters of comment should be sent so as to be received no later than 12 April All comments will be regarded as being on the public record unless otherwise requested, and will be posted to the FRC website soon after receipt. 4. Process for consulting on adoption of new/revised ISAs 4.1 There was clear majority support for the general process described in the consultation paper, a key element of which is that where the IAASB has finalised a new/revised ISA the FRC ordinarily will look to implement it for the UK and Ireland. This position has regard to the actions the FRC takes to actively influence the IAASB when developing new/revised ISAs. Also, the FRC when proposing a standard finalised by the IAASB as an ISA (UK and Ireland) would consider aspects such as whether the new standard is fit for purpose and an improvement on the previous standard; whether FRC comments made in response to the IAASB exposure draft have been resolved to its satisfaction; and the possible need for additional requirements or guidance for the UK and Ireland. 4.2 A minority of respondents were of the view that, once the standards were finalised by the IAASB, the FRC should not need to further consider whether they were fit for purpose and that any supplementary material should be restricted to that necessary to 7

10 address specific national legal/regulatory requirements. The FRC view is that this is not appropriate. The FRC has responsibility for establishing and maintaining the auditing standards that apply in the UK and Ireland and needs to be satisfied that those standards are appropriate for their purpose. 4.3 There was also clear support for the proposals that the FRC seek views from interested parties in the UK and Ireland on IAASB exposure drafts, although some concerns were expressed as to the practicalities of this given the relatively limited exposure period. Other suggestions for doing more than was set out in the consultation paper included organising roundtables, the FRC publishing its draft response and seeking views on that, and consulting with investor groups during the development phase of the IAASBs ED. The FRC already undertakes some of these additional information gathering activities on an informal basis (round tables, seeking views during development) when it considers it appropriate and will continue to do so, with the merits of possible activities considered on a case by case basis. 8

11 Appendix RESONDENTS TO THE MAY 2012 CONSULTATION Professional and public sector bodies ACCA CAI ICAEW ICAS Wales Audit Office Firms Baker Tilly BDO Deloitte Ernst & Young Grant Thornton KPMG Mazars PwC 9

12 Financial Reporting Council 5th Floor, Aldwych House Aldwych London WC2B 4HN +44 (0)