Module C Business Assurance - Part 1
Module C Business Assurance - Part 1
Qualification Programme
Qualification Programme
4th EDITION F O U RT H E D I T I O N
LEARNING PACK
Qualification Programme
Module C
Business Assurance
First edition 2010
Fourth edition 2013
Published by
www.bpp.com/learningmedia
©
HKICPA and BPP Learning Media Ltd
2013
ii
Contents
Page
Director's message v
Introduction vi
Module structure vii
Chapter features viii
Learning outcomes ix
Introduction iii
Page
Index 731
iv Business Assurance
Director's message
Welcome to the Qualification Programme (QP) of the Hong Kong Institute of Certified Public
Accountants (HKICPA).
You have made the decision to complete the HKICPA's QP which entails completing the training
programme, passing professional examinations and acquiring practical experience under an
authorized employer or supervisor. This marks a further step on your pathway to a successful
business career as a CPA and becoming a valued member of the HKICPA.
The QP comprising four core modules and a final examination will provide you with a foundation for
life-long learning and assist you in developing your technical, intellectual, interpersonal and
communication skills. You will find this programme challenging with great satisfaction that will open
a wide variety of career opportunities bringing in attractive financial rewards.
A module of the QP involves approximately 120 hours of self-study over fourteen weeks,
participation in two full-day workshops and a three-hour open-book module examination at the
module end. We encourage you to read this Learning Pack which is a valuable resource to guide
you through the QP.
The four core modules of the QP are as follows:
Module A: Financial Reporting
Module B: Corporate Financing
Module C: Business Assurance
Module D: Taxation
Should you require any assistance at any time, please feel free to contact us on (852) 2287 7228.
May I wish you every success in your QP!
Jonathan Ng
Executive Director
Hong Kong Institute of Certified Public Accountants
Introduction v
Introduction
This is the fourth edition of the Learning Pack for Module C Business Assurance of the HKICPA
Qualification Programme.
The Institute is committed to updating the content of the Learning Pack on an annual basis to keep
abreast of the latest developments. This edition has been developed after having consulted and
taken on board the feedback received from different users of the previous edition. Some of the
examples and self-test questions have been rewritten to better reflect current working practices in
industry and facilitate the learning process for users of the Learning Pack.
The Learning Pack has been written specifically to provide a complete and comprehensive
coverage of the learning outcomes devised by HKICPA, and has been reviewed and approved by
the HKICPA Qualification and Examinations Board for use by those studying for the qualification.
The HKICPA Qualification Programme comprises two elements: the examinations and the
workshops. The Learning Pack has been structured so that the order of the topics in which you
study is the order in which you will encounter them in the workshops. There is a very close inter-
relationship between the module structure, the Learning Pack and the workshops. It is important
that you have studied the chapters of the Learning Pack relevant to the workshops before you
attend the workshops, so that you can derive the maximum benefit from them.
On page (ix) you will see the HKICPA learning outcomes. Each learning outcome is mapped to the
chapter in the Learning Pack in which the topic is covered. You will find that your diligent study of
the Learning Pack chapters and your active participation in the workshops will prepare you to
tackle the examination with confidence.
One of the key elements in examination success is practice. It is important that not only you fully
understand the topics by reading carefully the information contained in the chapters of the Learning
Pack, but it is also vital that you take the necessary steps to practise the techniques and apply the
principles that you have learned.
In order to do this, you should:
work through all the examples provided within the chapters and review the solutions,
ensuring that you understand them;
complete the self-test questions within each chapter, and then compare your answer with the
solution provided at the end of the chapter; and
attempt the exam practice questions that you will find at the end of the chapter. Many of
these are HKICPA past examination questions, which will give an ideal indication of the
standard and type of question that you are likely to encounter in the examination itself. You
will find the solutions to exam practice questions at the end of the book.
In addition, you will find at the end of the Learning Pack a bank of past HKICPA case-study style
questions. These are past ‘Section A' examination questions, which present a case study testing a
number of different topics within the syllabus. These questions will provide you with excellent
examination practice when you are in the revision phase of your studies, bringing together, as they
do, the application of a variety of different topics to a scenario.
Please note that the Learning Pack is not intended to be a 'know-it-all' resource. You are required
to undertake background reading including standards, legislation and recommended texts for the
preparation for workshop and examination.
vi Business Assurance
Module Structure
This module will enable you to perform effective assurance and related assignments. You will also
understand the importance of corporate governance and be able to ensure it has been effectively
set up in an organisation. Please refer to the QP Learning Centre for the six-month rule and
examinable standards.
Overall Structure of Module C (Business Assurance)
Introduction vii
Chapter features
Each chapter contains a number of helpful features to guide you through each topic.
Topic list Tells you what you will be studying in the chapter. The topic items form the
numbered headings within the chapter.
Learning focus Puts the chapter topic into perspective and explains why it is important, both
within your studies and within your practical working life.
Learning The list of Learning Outcomes issued for the Module by HKICPA,
Outcomes referenced to the chapter in the Learning Pack within which coverage will be
found.
Topic highlights Summarise the key content of the particular section that you are about to
start. They are also found within sections, when an important issue is
introduced other than at the start of the section.
Key terms Definitions of important concepts. You really need to know and understand
these before the examination, and understanding will be useful at the
workshops too.
Case study An example or illustration not requiring a solution, designed to enrich your
understanding of a topic and add practical emphasis. Often based on real
world scenarios and contemporary issues.
Self-test questions These are questions that enable you to practise a technique or test your
understanding. You will find the answer at the end of the chapter.
Formula to learn You may be required to apply financial management formulae in Module B,
Corporate Financing.
Topic recap Reviews and recaps on the key areas covered in the chapter.
Exam practice A question at the end of the chapter to enable you to practise the
techniques that you have learned. In most cases this will be a past HKICPA
examination question, updated as appropriate. You will find the answers in a
bank at the end of the Learning Pack entitled Answers to Exam Practice
Questions.
Further reading In Modules B and D you will find references to further reading that will help
you to understand the topics and put them into the practical context. The
reading suggested may be books, websites or technical articles.
Bold text Throughout the Learning Pack you will see that some of the text is in bold
type. This is to add emphasis and to help you to grasp the key elements
within a sentence or paragraph.
HKICPA's learning outcomes for the Module are set out below. They are cross-referenced to the
chapter in the Learning Pack where they are covered.
Fields of competency
The items listed in this section are shown with an indicator of the minimum acceptable level of
competency, based on a three-point scale as follows
1 Awareness
To have a general professional awareness of the field with a basic understanding of relevant
knowledge and related concepts.
2 Knowledge
The ability to use knowledge to perform professional tasks competently without assistance in
straightforward situations or applications.
3 Application
The ability to apply comprehensive knowledge and a broad range of professional skills in a
practical setting to solve most problems generally encountered in practice.
Topics
Chapter
where
Competency covered
Introduction ix
Chapter
where
Competency covered
x Business Assurance
Chapter
where
Competency covered
Introduction xi
Chapter
where
Competency covered
Introduction xiii
Chapter
where
Competency covered
Introduction xv
Chapter
where
Competency covered
This Part explains the importance and implication of corporate governance in an assurance
process.
Practical situations and requirements for good corporate governance are also discussed and
presented.
1
Business Assurance
2
chapter 1
Scope of corporate
governance
Topic list
Learning focus
Corporate governance is the system by which a company is directed and controlled. There are
a number of separate codes of corporate governance with which companies must be familiar.
3
Business Assurance
Learning outcomes
Competency
level
3.01 Background to corporate governance developments 2
4
1: Scope of corporate governance | Part A Corporate governance
Topic highlights
There is no single definition of what corporate governance really means. The most widely accepted
definition is defined by the UK Cadbury Committee Report (1992) as the “system by which a
company is directed and controlled”. It can also be considered as the “set of relationships between
the management, the Board of Directors (BOD), the shareholders as well as other stakeholders to
the corporation” (HKICPA, 2006). It is needed because of the agency problem: this arises due to
the separation of ownership and control of the company, ie the owners of a company and the
people who manage it are not always the same.
Key terms
Corporate governance is the system by which companies are directed and controlled. Linked to
corporate governance is Stewardship, which refers to taking care of something (the company and
its assets) which is owned by someone else (shareholders).
Corporate governance includes managing the relationships among the many parties interested in
an entity and providing transparent, responsible management practices to meet the entity's
objectives. The first corporate governance code was the Cadbury Report, published in the UK in
1992. This identified a number of internal and external parties who hold an interest in the effective
corporate governance of an entity:
Directors: responsible for corporate governance
Shareholders: linked to the directors as users of the financial statements and as individuals
who stand to directly benefit financially from the activities of the entity
Other relevant parties: these may be numerous but include employees, customers,
suppliers, the tax authorities and any special interest groups, regulators, and the wider
public.
5
Business Assurance
As a result, there is the potential for conflicts of interest between management and
shareholders.
The current framework of corporate governance in Hong Kong and China lays down both statutory
and non-statutory requirements as to how directors should run a business to best enhance and
keep in balance stakeholders' interests. Statutory requirements consist of the Companies
Ordinance, Securities (Disclosure of Interests) Ordinance, Securities (Insider Dealing) Ordinance,
and Takeover Codes. Non-statutory requirements are those specified by the Hong Kong Stock
Exchange relating to Listing Rules and Code of Corporate Governance Practice. The Hong Kong
Code is based on the UK Combined Code of July 2003, which was renamed as the UK Corporate
Governance Code in 2010, with additional rules on connected transactions and non-controlling
interests, together with changes that tailor the approach to the Hong Kong environment (family
control and Mainland Enterprises).
There are a number of different facets to corporate governance:
Commitment to ethical values
Transparency in company activities
Managing stakeholders' interests
Safeguarding of the company's assets
Establishing strong internal controls to deter and detect fraud
Ensuring the efficient use of resources to create and enhance shareholder value
Accountability, which ultimately rests with the directors and those charged with governance.
Good corporate governance is essential in today's global business environment, and especially so
in Hong Kong, if the Territory is to maintain its competitive status as one of the world's major
financial centres, in addition to acting as a premier international capital market for Mainland China
and the region.
In summary, it is necessary for processes to be in place in every entity to ensure that the interests
of every stakeholder are safeguarded. It is a fiduciary duty of management that they act in the best
interests of the shareholders, employees and the external parties to whom they are accountable.
6
1: Scope of corporate governance | Part A Corporate governance
by all market participants, the overall standard of corporate governance in Hong Kong has been
improving.
There are two levels of recommendations:
(a) Code provisions
(b) Recommended best practices.
Hong Kong listed companies are expected to comply with the provisions of the Code, but may
choose to deviate from them. If they deviate then they need to explain why in the annual report, this
is called the “comply or explain approach”. The recommended best practices are for guidance
only, although companies are encouraged to comply. Hong Kong companies may also devise their
own code on corporate governance practices on such terms as they may consider appropriate.
In late 2010, The Hong Kong Stock Exchange published its “Consultation Conclusions on Review
of the Corporate Governance Code and Associated Listing Rules” (Consultation Conclusions). The
Consultation Papers contain proposals to amend the Corporate Governance Code (as renamed)
and the Rules pertaining to corporate governance.
The consultation period ended in March 2011 where the Hong Kong Stock Exchange adopted most
of the proposals outlined in the Consultation Paper, subject to certain modifications as set out in
the Consultation Conclusions.
The amendments will keep the Corporate Governance Code in line with international best practice.
In its first interim/half year or annual report covering a period after 1 April 2012, the issuer must
state, in that report, whether it has, for that period, complied with the Code Provisions in the revised
Code as well as those of the former Code. Issuers may adopt the revised Code at an earlier date
than 1 April 2012.
7
Business Assurance
Topic highlights
The OECD Principles of Corporate Governance set out the rights of shareholders, the
importance of disclosure and transparency and the responsibilities of the board of directors.
An important question to consider is “will the same way of managing companies be the best
method for all companies?” The answer is likely to be no. Companies are different from each other,
and globally, they operate in different legal systems with different institutions, frameworks and
traditions. It would not be possible to construct one single approach to operating companies that
could be described as best practice for all.
The key issue in corporate governance is that “a high degree of priority [is] placed on the interests
of shareholders, who place their trust in corporations to use their investment funds wisely and
effectively”. Shareholders in a company might be a family, they might be the general public or they
might be institutional investors representing, in particular, people's future pensions. These
shareholders will vary in their degree of interaction with the company and their directors.
Codes such as the OECD Code have been developed from best practice in a number of
jurisdictions. As such, they can be seen as representing an international consensus on common
elements that underlie good corporate governance. They stress global issues that are important to
companies operating in a number of jurisdictions. The OECD Code for example, emphasises the
importance of eliminating impediments to cross-border shareholdings and treating overseas
shareholders fairly.
In the context of this great variety in the basic element of these companies, the OECD has
established a number of Principles of Corporate Governance, which were issued in 1999 and
reviewed in 2004, and which serve as a reference point for countries (to develop corporate
governance codes if they wish) and companies. They were developed in response to a mandate
given to the OECD to develop a set of standards and guidelines on good corporate governance.
8
1: Scope of corporate governance | Part A Corporate governance
The above Principles are non-binding on countries and companies. Rather they seek to identify
objectives and various means for achieving them. Their purpose is to serve as a reference point
that can be used by policy makers to analyse and develop their own legal and regulatory
frameworks for corporate governance, given their individual mixes of economic, social and legal
circumstances.
In order to obtain the best of the advantages and avoid the worst disadvantages, countries may
take a hybrid approach and make some elements of corporate governance mandatory and some
voluntary.
Self-test question 1
Keepalive Life Assurance Company is a mutual organisation, owned by its policyholders. Owing to
changes in capital adequacy requirements imposed by the regulator and pressure from lobby
groups, it has decided to convert to a public limited company and float on the stock exchange.
The board of directors is anxious to ensure that the very highest standards of governance are
adopted in the transition to the new corporate form. It has decided to review the scope of its
policies in this respect.
The policyholders, who own the voting rights in the company, have expressed concerns about the
company's plans for several reasons. First, some doubt that the existing directors have the
experience necessary to manage the company in the new form. Many of the directors only have
experience in the life assurance industry and have been with the company for a long time. The two
previous chief executives remain on the board. Second, the company had to increase its provisions
for losses last year, causing an embarrassing admission by the board that the financial statements
were “distorted”. One major investor has accused the board of a “clear lack of probity”. Third, when
the company is floated it is likely that its shares will be purchased by a few very large institutional
investors who may force the company to adopt a less “customer friendly” approach to business. At
the moment, the company offers many investment products that are highly valued by smaller, less
wealthy customers but apparently make little profit for the company.
(a) With reference to an appropriate framework, such as the one proposed by the OECD,
explain the matters that the board of directors of Keepalive Life Assurance Company should
consider in its review of corporate governance arrangements.
(b) Explain what is meant by “lack of probity” and why probity is important.
(The answer is at the end of the chapter)
Key term
Transparency means open and clear disclosure of relevant information to shareholders and
other stakeholders, and not concealing information which may affect decision-making. It means
open discussion, with a default position of information provision rather than concealment.
9
Business Assurance
Disclosure in this context obviously includes information in the financial statements, not just the
numbers and notes to the financial statements but also narrative statements such as the directors'
report and the operating and financial review. It also includes all voluntary disclosure, that is
disclosure above the minimum required by law or regulation. Voluntary corporate communications
include management forecasts, analysts' presentations, press releases, information placed on
websites and other reports such as stand-alone environmental or social reports.
The main reason why transparency is so important relates to the agency problem (the potential
conflict between owners and managers). This will be discussed further in section 2 of this chapter.
Without effective disclosure the position could be unfairly weighted towards managers, since they
have far more knowledge of the company's activities and financial situation than owner/investors.
Avoiding the creation of an information asymmetry between managers and owners requires not
only effective disclosure rules, but strong internal controls that ensure the reliability of information
disclosures.
Linked with the agency issue, publication of relevant and reliable information underpins stock
market confidence in how companies are being governed and thus significantly influences
market prices. International Financial Reporting Standards (IFRSs), Hong Kong Financial
Reporting Standards (HKFRSs), and stock market regulations based on corporate governance
codes require published financial statements to present a true and fair view. Information can only
fulfil this requirement if adequate disclosure is made of uncertainties and adverse events.
Circumstances where restricted disclosure may be justified include discussions about future
strategy (knowledge of which would benefit competitors), confidential issues relating to
individuals and discussions leading to an agreed position that is then made public.
1.5.3 Independence
Independence is an important concept in relation to directors. Corporate governance reports have
increasingly stressed the importance of independent non-executive directors; directors who are
not primarily employed by the company and who have very strictly controlled other links with it. As
a result they should be free from conflicts of interest and in a better position to promote the
interests of shareholders and other stakeholders. Freed from pressures that could influence
their activities, independent non-executive directors should be able to carry out effective
monitoring of the company in conjunction with equally independent external auditors on behalf of
shareholders.
Non-executive directors' lack of links and limits on the time that they serve as non-executive
directors should promote avoidance of managerial capture – accepting executive managers'
views on trust without analysing and questioning them.
In the Hong Kong context, the Hong Kong Stock Exchange Listing Rules specify that there must be
at least three independent non-executive directors on the main board for listed companies.
10
1: Scope of corporate governance | Part A Corporate governance
1.5.5 Responsibility
Responsibility means management accepting the credit or blame for governance decisions.
Management theories stress that for management to be held properly responsible, there must be a
system in place that allows for corrective action and penalising mismanagement. Responsible
management should act in the best interests of the company and take the necessary steps to
ensure the company stays on the right path.
The board of directors must act responsively to, and with responsibility towards, all stakeholders of
the company. However, the responsibility of directors to other stakeholders, both in terms of to
whom they are responsible and the extent of their responsibility, remains a key point of contention
in corporate governance debates. We shall discuss the importance of stakeholders later in this
chapter.
1.5.6 Accountability
Key term
Corporate accountability refers to whether an organisation (and its directors) are answerable in
some way for the consequences of their actions.
Accountability of directors to shareholders has always been an important part of company law, well
before the development of the corporate governance codes. For example, companies have been
required to provide financial information to shareholders on an annual basis and hold annual
general meetings. However, particularly because of the corporate governance scandals of the last
30 years, investors have demanded greater assurance that directors are acting in their interests.
This has led to the development of corporate governance codes, which we shall consider in the
next chapter. The UK Cadbury Report stresses that making the accountability work is the
responsibility of both parties. Directors, as we have seen, do so through the quality of information
that they provide whereas shareholders do so through their willingness to exercise their
responsibility as owners, which means using the available mechanisms to query and assess the
actions of the board.
As with responsibility one of the biggest debates in corporate governance is the extent of
management's accountability towards other stakeholders such as the community within which
the organisation operates. This has led on to a debate about the contents of financial statements
themselves; for what should financial statements actually account.
1.5.7 Reputation
An organisation's reputation depends on how likely other risks are to crystallise. In the same way
directors' concern for an organisation's reputation will be demonstrated by the extent to which they
fulfil the other principles of corporate governance. There are purely commercial reasons for
promoting the organisation's reputation, that the price of publicly traded shares is often dependent
on reputation and hence reputation is often a very valuable asset of the organisation.
1.5.8 Judgment
Judgment means the board making decisions that enhance the prosperity of the organisation.
This means that board members must acquire a broad enough knowledge of the business and its
environment to be able to provide meaningful direction to it. This has implications not only for the
attention directors have to give to the organisation's affairs, but also the way the directors are
recruited and trained.
The complexities of senior management mean that the directors have to bring multiple
conceptual skills to management that aim to maximise long-term returns. This means that
corporate governance can involve balancing many competing people and resource claims against
each other; although, as we shall see, risk management is an integral part of corporate
governance, corporate governance is not just about risk management.
11
Business Assurance
1.5.9 Integrity
Key term
Integrity means straightforward dealing and competence. Financial reporting should be honest
and should present a balanced picture of the state of the company's affairs. The integrity of reports
depends on the integrity of those who prepare and present them.
Integrity can be taken as meaning someone of high moral character, who sticks to principles no
matter the pressure to do so otherwise. In working life this means adhering to principles of
professionalism and probity. Straightforward dealing in relationships with the different people
and constituencies whom you meet is particularly important; trust is vital in relationships and belief
in the integrity of those with whom you are dealing underpins this. The Cadbury Report definition
highlights the need for personal honesty and integrity of preparers of financial statements. This
implies qualities beyond a mechanical adherence to accounting or ethical regulations or guidelines.
At times accountants will have to use judgment or face financial situations which aren't covered by
regulations or guidance, and on these occasions integrity is particularly important.
Integrity is an essential principle of the corporate governance relationship, particularly in
relationship to representing shareholder interests and exercising agency. As with financial reporting
guidance, ethical codes don't cover all situations and therefore depend for their effectiveness on
the qualities of the accountant. In addition, we have seen that a key aim of corporate governance is
to inspire confidence in participants in the market and this significantly depends upon a public
perception of competence and integrity.
12
1: Scope of corporate governance | Part A Corporate governance
Non-audit fees paid Disclosure of any non-audit fees should be disclosed as this would
to the auditors affect auditor's independence.
In May 2004, HKICPA issued the Guide Corporate Governance for Public Bodies – a Basic
Framework for the purpose to provide a basic framework for public sector corporate governance
and provide recommendation on good corporate governance.
It outlines a basic framework of corporate governance principles and recommended best practice
for such organisations to adopt, as appropriate.
The Guide aims to assist governing boards, councils and management of public sector bodies to
establish and maintain a clear focus on performance, transparency and accountability. It identifies
certain fundamental principles expected of an organisation, namely openness, integrity and
accountability, and key personal qualities required of governing board members, namely
selflessness, integrity, objectivity, accountability, openness, honesty and leadership, and applied
these principles and qualities to four dimensions of the governance of public sector organisations.
13
Business Assurance
Accountability, (i) Committees should have regular and informative reporting to the
reporting and governing board
disclosure (ii) Any major issues should be brought to the attention of the board
on a timely basis
(iii) An annual report incorporating financial statement should be
published on a timely basis after the end of the financial year
(iv) Appropriate accounting policies and standards should be adopted
in preparation of financial statements
(v) Financial and non-financial performance measures should be
established and reported.
The Guide draws reference from important overseas studies to provide a set of recommendations
that are suitable for the public sector environment in Hong Kong. It should be applicable to
most types of organisations in the public sector, and the recommendations contained therein can
be tailored to the circumstances of individual organisations, depending on their size, complexity
and resources.
In June 2005, HKICPA issued a Guide Internal Control and Risk Management – a Basic
Framework for the purpose of providing a basic conceptual framework, general principles and
recommendations for a system of internal control and risk management. It also outlines the
responsibilities of the board and senior management in this regard, and the role that other parties,
such as the audit committee and internal auditors, can play. It should help listed companies to
understand and fulfil the requirements on internal controls contained in the revised Code on
Corporate Governance Practices and the disclosure requirements of the new Corporate
Governance Report (Main Board and the GEM Listing Rules, respectively).
The Guide also emphasises that establishing effective internal controls should not be seen as an
exercise in compliance but is about putting in place processes that will help a business to achieve
its corporate objectives and to identify, assess and manage the significant risks that could
otherwise prevent it from doing so. It is also a question of being more transparent and
accountable to shareholders and other stakeholders about how the business is being run.
In producing this Guide, the Institute has looked at conditions in Hong Kong and has drawn on
important international benchmarks in this field, such as the report published in the US by the
Committee of Sponsoring Organisations of the Treadway Commission, commonly known as
COSO, and the Turnbull Guidance, which formed part of the Combined Code, now known as the
UK Corporate Governance Code.
While the Guide is not intended to be exhaustive or prescriptive in nature, the Institute believes that
the principles and recommendations contained therein will provide a useful reference for listed and
group companies, as well as other companies that aim to implement or enhance their system of
internal control.
In December 2008, HKICPA published a Guide Defining and Developing an Effective Code of
Conduct for Organisations.
This was originally produced by the International Federation of Accountants (IFAC). Acknowledging
its value to listed companies, public interest and other organisations, the Institute, together with the
Hong Kong Stock Exchange, the Hong Kong Institute of Directors and the Hong Kong Ethics
Development Centre, Independent Commission Against Corruption republished the guide with the
addition of an explanatory foreword by the four bodies.
The Guide is designed to assist professional accountants, and the organisations in which they
work, to develop a code of conduct of their own or to improve an existing code. While it does not
aim to provide detailed and prescriptive terms that are applicable to all organisations, it sets out key
principles and general guidance that should help all types of organisation to develop a more
detailed code of conduct that takes account of their own individual circumstances.
14
1: Scope of corporate governance | Part A Corporate governance
The following are the key principles in the guide, demonstrating widely accepted good practice:
Commitment from Ultimately, ethical responsibility lies with the board of directors (or its
board of directors equivalent), the body that has power to influence an organisation's
culture and behaviour.
Boards should specifically oversee the development of the code of
conduct (and a wider initiative to achieve a values-based organisation),
and formally appoint a senior manager to supervise that development.
Personnel A multi-disciplinary and cross-functional group including international
personnel should lead code development where organisational size
permits.
Groups of employees and other key stakeholders can help to identify
risks to corporate culture and business conduct and consider potential
vulnerabilities arising from these risks and can usefully assist in defining
and reviewing code content.
Process for Clearly identifying the established process for defining, developing and
defining, reviewing a code will promote understanding of, and agreement on, the
developing and key stages and activities.
reviewing the code
Application across A code of conduct should apply across all jurisdictions in which an
jurisdictions organisation operates, unless contrary to local laws and regulations.
Continuous Continuous awareness and promotion of the code and the wider approach
awareness to ethics and compliance is an important part of conveying management's
and promotion commitment to their underlying principles. A continuous awareness
programme should sustain interest in and commitment to the code.
Employees and others should be made aware of the consequences of not
adhering to the code.
15
Business Assurance
Key term
Agency relationship is a contract under which one or more persons (the principals) engage
another person (the agent) to perform some service on their behalf that involves delegating some
decision-making authority to the agent. In other words, in a company, the shareholders are actually
the owners (the principal) of the company, who delegate decision-making authority to the senior
management (the agents). Since the interests of the managers are not always in line with those of
shareholders, they may act in a way that is detrimental to the company as a whole.
There are a number of specific types of agent. These have either evolved in particular trades or
developed in response to specific commercial needs. Examples include factors, brokers, estate
agents, del credere agents, bankers and auctioneers.
Key term
In the context of agency, accountability means that the agent is answerable under the contract
to his principal and must account for the resources of his principal and the money he has gained
working on his principal's behalf.
What if the agent is accountable to parties other than his principal – how does he
reconcile possibly conflicting duties?
16
1: Scope of corporate governance | Part A Corporate governance
Key term
Fiduciary duty is a duty imposed upon certain persons because of the position of trust and
confidence in which they stand in relation to another. The duty is more onerous than generally
arises under a contractual or tort relationship. It requires full disclosure of information held by the
fiduciary, a strict duty to account for any profits received as a result of the relationship, and a duty
to avoid conflicts of interest.
In Hong Kong, the general duties of directors are mainly found in case law (leaving aside certain
specific obligations imposed by the Companies Ordinance and by the memorandum and articles of
association of a company). Directors' duties can be classified into two broad categories: fiduciary
duties, and duties of skill and care. For accountability purposes, the fiduciary duty is directly
relevant. The fiduciary duties of directors, which are generally based on equitable principles, mainly
include:
(1) duty to act in good faith in the interests of the company
(2) duty to exercise powers for proper purpose
(3) duty to avoid conflicts of duty and interest
However, at present Hong Kong has still not codified any directors' duties into our Companies
Ordinance, though the Registrar of Companies has issued several Non-statutory Guidelines on
Directors' Duties in Hong Kong. By way of contrast, in the UK, the Companies Act 2006 introduced
a statutory statement on directors' duties which covered specific general duties such as:
(1) duty to act within powers
(2) duty to promote the success of the company
(3) duty to exercise independent judgment
(4) duty to exercise reasonable care, skill and diligence
(5) duty to avoid conflicts of interest
(6) duty not to accept benefits from third parties
(7) duty to declare interest to proposed transaction or arrangement
As such under the Hong Kong Companies Ordinance, directors owe a fiduciary duty to the
company to exercise their powers bona fide in what they honestly consider to be the interests of
the company. This duty is owed to the company and not generally to individual shareholders. In
exercising the powers given to them by the constitution, the directors have a fiduciary duty not only
to act bona fide but also only to use their powers for a proper purpose. The powers are restricted
to the purposes for which they were given.
Clearly the concepts of fiduciary duty and accountability are very similar though not identical.
Where certain wider responsibilities are enshrined in law, do directors have a duty to go beyond the
law, or can they regard the law as defining what society as a whole requires of them?
17
Business Assurance
Topic highlights
The agency problem arises from separation of ownership from management of the entity and
can cause a conflict of interests if there is a breach of trust by directors by intentional action,
omission, neglect or incompetence.
The agency problem arises when a principal hires an agent to perform in the interest of principal.
In listed companies the agency problem derives from the principals (shareholders) not being able
to run the business themselves and therefore having to rely on agents (board of directors) to do so
for them. This separation of ownership from management can cause a conflict of interest or
moral hazard if there is a breach of trust by directors by intentional action, omission, neglect or
incompetence. This breach may arise because the directors are pursuing their own interests
rather than the shareholders (conflict of interest). Alternatively, the board of directors may
undertake a risky project without considering carefully the full consequences as they have a
different attitude to risk-taking to the shareholders (moral hazard).
For example, if managers hold none or very little of the equity shares of the company they work for,
what is to stop them from working inefficiently, concentrating too much on achieving short-term
profits and hence maximising their own bonuses? Without the incentive of equity ownership the
agent may not look for profitable new investment and growth opportunities, or may over-consume
perquisites such as high salaries and other benefits.
There are two possible approaches to aligning the interests between agent and principal, in order
to remedy this agency problem. One would be to offer incentive plans such as stock options or
equity in the company; the alternative would be to curb managerial controlling powers within the
firm. Ultimately shareholders do possess the right to remove the directors from office. But
shareholders have to take the initiative to do this, and in many companies they may lack the energy
and organisation to take such a step. As a last resort, they can vote in favour of a takeover or
removal of individual directors or entire boards, but this may be undesirable for other reasons.
Key term
Alignment of interests is accordance between the objectives of agents acting within an
organisation and the objectives of the organisation as a whole. Alignment of interests is sometimes
referred to as goal congruence, although goal congruence is used in other ways.
Alignment of interests may be better achieved and the “agency problem” better dealt with by giving
managers the appropriate incentives, such as profit-related pay, or by providing more longer-term
incentives that are related to the overall company performance. Examples of such remuneration
incentives are:
profit-related/economic value-added pay
rewarding managers with shares
executive share option plans
18
1: Scope of corporate governance | Part A Corporate governance
Such measures might merely encourage management to adopt more “creative accounting”
methods which will distort the reported performance of the company in the service of the managers'
own ends.
An alternative approach is to attempt to monitor managers' behaviour, for example by
establishing “management audit” procedures, to introduce additional reporting requirements, or
to seek assurances from managers that shareholders' interests will be foremost in their priorities.
The most significant problem with monitoring is likely to be the agency costs involved, as they
may imply significant shareholder engagement with the company.
Topic highlights
Directors and managers need to be aware of the interests of stakeholders in governance issues.
Governance reports have emphasised the role of institutional investors (insurance companies,
investment houses, or pension funds such as CalPers) in directing companies towards good
corporate governance.
3.1 Stakeholders
Key term
Stakeholders are any entity (person, group or possibly non-human entity) that can affect or be
affected by the achievements of an organisation's objectives. It is a bi-directional relationship.
Each stakeholder group has different expectations about what it wants and different claims upon
the organisation.
19
Business Assurance
We shall examine the major areas that have been affected by corporate governance.
20
1: Scope of corporate governance | Part A Corporate governance
21
Business Assurance
receive all material information that may affect the value of their investment and to vote on
measures affecting the organisation's governance.
Commencing on 1 April 2012, under the new Code Provisions an issuer must disclose the following
“shareholder rights” information in its Corporate Governance Report:
The way in which shareholders can convene an extraordinary general meeting;
The procedures for sending enquiries to the board (with sufficient contact details); and
The procedures for making proposals at shareholders’ meetings (with sufficient contact
details).
Previously it was a recommendation only that this information should be disclosed.
22
1: Scope of corporate governance | Part A Corporate governance
Case study
Robert Maxwell was a Czech refugee who came to the UK in 1940. He served in the British Army
and was awarded the Military Cross. After the war, he built up a massive publishing empire that
included at various times the Pergamon Press, Mirror Group Newspapers, the Berlitz language
guides and the New York Daily News. He was a famous celebrity, well-known to millions as a
flamboyant Member of Parliament and was heavily involved in professional football as the owner of
Oxford United Football Club and a director of Derby County Football Club.
Maxwell's success meant that at its peak Maxwell Communications plc was one of the largest
publicly quoted companies in the UK.
Like many publishing companies it was necessary to borrow to lever future growth. Maxwell
appeared to have no difficulty in financing his businesses. Although over time there were many
rumours about his business affairs, he adopted a highly litigious approach to his critics and took
several successful libel actions against popular magazines.
As it happened, Maxwell borrowed significant funds from the pensions funds run on behalf of his
companies' employees. Although this practice is subject to rigorous controls today, it was both
unregulated and quite common practice in the 1980s. In the same period he bought and sold
companies frequently in order to disguise the true financial position of his businesses.
In 1991 it was reported that Maxwell's companies were not meeting the statutory reporting
requirements in respect of the pension schemes. Members of these schemes made complaints in
both the UK and the USA. Maxwell's situation was worsened by the fact that he had used his
shares in his own companies to secure long-term borrowings. When the creditors sold these
shares it caused their prices to fall in the market. Maxwell responded by using borrowed funds,
including some of the operating balances of his companies and pension funds, to purchase shares
in order to support the share price.
23
Business Assurance
Maxwell died by drowning in 1991. The official verdict was accidental death, though inevitably there
have been numerous conspiracy theories surrounding the accident even since. As is often the
case, the true situation concerning his businesses did not emerge immediately. It transpired that he
had used many millions of pounds belonging to occupational pension schemes to support his
businesses. Many employees lost their pensions as a result.
In 1995 several directors of Maxwell companies, including his two sons, were tried for fraud but
were acquitted.
The Maxwell scandal and the resultant consequences led to the enactment of stringent new
legislation imposing strict controls on pension funds and their relationships with employers
contributing to the schemes.
24
1: Scope of corporate governance | Part A Corporate governance
25
Business Assurance
Self-test question 2
Omnipower is an energy producer selling electricity and gas to private and business consumers.
It is a newly-established company, owned by a consortium of energy companies from different
countries.
The production of energy is a topical and controversial issue in the country in which Omnipower
operates. The country is very beautiful and rich in natural resources, so tourism is vital to the
national economy. The inhabitants of the country are fiercely protective of the environment and
their quality of life.
Anxious to build a positive relationship with the communities in which it will operate, Omnipower
has decided to produce a corporate social responsibility statement that will guarantee certain
principles to which it will adhere.
Greenspace, a local environmental pressure group, has already resisted the entry of new energy
companies to the country and has pledged that it will relentlessly pressurise Omnipower to adopt
environmentally friendly policies.
(a) Identify the stakeholders in relation to Omnipower. Compare and contrast their respective
needs.
(b) Set out the matters that should be included in Omnipower's corporate social responsibility
(CSR) statement, including details of commitments that the company should make to its
stakeholders.
(The answer is at the end of the chapter)
26
1: Scope of corporate governance | Part A Corporate governance
Topic recap
• Rights of shareholders
• Treatment of stakeholders Code Recommended
• Disclosure/transparency provisions best practices
• Board responsibility
International impact
27
Business Assurance
Answer 1
(a) The OECD Framework proposes that corporate governance be considered in relation to five
areas:
Rights of shareholders
The corporate governance framework should protect shareholders and facilitate their rights
in the company. Companies are obliged to generate investment returns for the risk capital
put up by the shareholders. Directors should be accountable to shareholders in this respect.
Equitable treatment of shareholders
All shareholders should be treated equitably (fairly), including those who constitute a
minority, individuals and foreign shareholders. Shareholders should have redress when their
rights are contravened or where an individual shareholder or group of shareholders is
oppressed by the majority.
Stakeholders
The corporate governance framework should recognise the legal rights of stakeholders.
The company should facilitate co-operation with stakeholders in order to create wealth,
employment and sustainable enterprises.
Disclosure and transparency
Companies should make relevant and timely disclosures on matters affecting financial
performance, management and ownership of the business.
Board of directors
The board of directors is responsible for setting the direction of the company and monitoring
the management of the company in order to achieve its stated objectives. The corporate
governance framework should underpin the board's accountability to the company and its
members.
(b) The term “probity” relates to honesty but goes further than simply telling the truth. Being
dishonest implies telling lies. A lack of probity, on the other hand, is not giving the true
picture of a situation, or acting in a manner that is misleading to others.
For example, giving raw data or incomplete financial information that may lead to inaccurate
conclusions demonstrates a lack of probity.
The term has been used by several judges in cases of wrongful trading. Often, a business
person may not intend to defraud creditors but may present an over-optimistic view of the
business based on a belief that its fortunes can be turned around.
Answer 2
(a) The stakeholders in this situation are:
customers of Omnipower
owners of Omnipower
the community and the local environment
residents who are not customers
the government
Greenspace (whose members may also be customers, residents or both)
employees of Omnipower
28
1: Scope of corporate governance | Part A Corporate governance
It can be seen from the table that the needs polarise into two sets of stakeholders. The first
set wants the company to be efficient and deliver energy as cost-effectively as possible.
A secondary concern here might be environmental impact. The second set are more
concerned with the impact on the environment as a primary need.
Energy companies are in an almost impossible position in relation to reconciling the needs of
stakeholders when there is polarisation of views.
(b) A CSR statement should address all major concerns in relation to social responsibilities.
In the case of Omnipower, it should address both social and environmental concerns.
One example of CSR policy is the stakeholder analysis that forms the basis of CSR in
Scottish Power, a UK-based energy company. It defines accountabilities in relation to:
provision of energy (the primary economic aim)
health and safety
customer experience (satisfaction)
climate change and emissions
waste and resource usage
biodiversity
sites, siting and infrastructure
employees
customers with special circumstances
community
procurement
economic
It will be apparent from the above list that most of the concerns of the stakeholders of
Omnipower fall into one or more categories.
29
Business Assurance
Exam practice
30
chapter 2
Corporate governance
reports and practice
Topic list
Learning focus
You may well have to discuss the implications of basing governance guidance on principles.
Knowledge of the main features and advantages and disadvantages of corporate governance
codes in general is important, but line-by-line knowledge is not required. Questions normally
require assessment of the strength of corporate governance arrangements in a particular
organisation.
As regards specific codes, the main themes of Sarbanes-Oxley may be tested. The UK
Corporate Governance Code (formerly known as the Combined Code) sets out good practice
but students should be aware of Hong Kong local codes of practice.
The existence of wider social responsibilities is likely to be a theme in questions.
31
Business Assurance
Learning outcome
Competency
level
3.01 Background to corporate governance developments 2
3.01.03 Explain corporate governance developments in Hong Kong
and the structure of the Code on Corporate Governance
Practices and Corporate Governance Report in Hong Kong
3.02 Key issues relating to corporate governance including 2
directors' remuneration, board composition, audit
committee and non-controlling interests
3.02.02 Describe the corporate governance requirements as set out in
the Companies Ordinance and Hong Kong Stock Exchange
Listings Requirements relating to directors' responsibilities (for
example, risk management and internal control) and the
reporting responsibilities of auditors
3.03 Management's responsibilities to comply with corporate 3
governance requirements and to implement related
practices
3.03.01 Explain the responsibilities of management within the
corporate governance framework
3.03.02 Analyse the structure and roles of board committees and
discuss their drawbacks and limitations
3.04 Auditor's responsibilities to consider and address 3
corporate governance requirements
3.04.01 Explain the auditor's responsibility to consider and address
corporate governance requirements
32
2: Corporate governance reports and practice | Part A Corporate governance
Although the OECD Code (mentioned in Chapter 1) is non-binding and voluntary, its principles
have been incorporated into national guidance by a number of countries. The OECD Principles
have also been used by world-wide organisations as a basis for assessing the corporate
governance frameworks and practices in individual countries. These assessments are used to
determine the level of policy dialogue with, and technical assistance given to, these countries.
The fact that the local codes of different countries are based on the same international code means
that compliance costs for companies who are operating in many jurisdictions will be reduced.
It also gives investors some confidence about the application of governance rules.
The development of international codes should also be seen in the context of the development of
robust financial reporting rules, since investors' concerns with unreliable accounting information
has meant that they have questioned corporate governance arrangements. Developments in
international accounting standards aim to promote greater international harmony in accounting
practice, and international convergence on corporate governance is consistent with this.
33
Business Assurance
Topic highlights
The Hong Kong Stock Exchange published the Code on Corporate Governance Practices (the HK
Code) and the Corporate Governance Report (CGR) in November 2004, which is included into the
Appendix (Appendix 14) of the Main Board Listing Rules and the Growth Enterprise Market (GEM)
Listing Rules. The HK Code and CGR became effective in 2005.
A range of code provisions (“CP”), recommended best practices (“RBP”) and rules have been
amended. Most of the rule amendments will be effective on 1 January 2012 whilst other Code
amendments will be effective on 1 April 2012.
Listed companies are required to confirm their compliance with the HK Code or, where they do not
comply, to provide explanations for any variation in practice.
The HK Code is broken down into six main areas which will be examined later in this chapter:
1 Directors
2 Remuneration of Directors and Senior Management and Board Evaluation
3 Accountability and Audit
4 Delegation by the Board
5 Communication with Shareholders
6 Company Secretary
The UK Corporate Governance Code (formally known as the Combined Code) similarly contains
detailed guidance on good corporate governance, and strongly influences the corporate
governance requirements in other jurisdictions around the world including Hong Kong.
34
2: Corporate governance reports and practice | Part A Corporate governance
35
Business Assurance
36
2: Corporate governance reports and practice | Part A Corporate governance
Section A: Directors
The Board
An issuer should be headed by an effective board, which should assume responsibility for
leadership and control of the issuer, and be collectively responsible for promoting the success of
the issuer by directing and supervising the issuer's affairs. Directors should take decisions
objectively and in the interests of the issuer.
Directors’ duties
The rule emphasises directors’ duties as it requires directors to take an active interest in the
issuer’s affairs, to obtain a general understanding of its business and follow up any relevant
matters that come to their attention. The directors are required to apply the required levels of skill,
care and diligence as failure to discharge their duties and responsibilities may result in disciplinary
action by the Hong Kong Stock Exchange and may attract civil and/or criminal liabilities. The rule
was implemented commencing on 1 January 2012.
Chairman and Chief Executive Officer
There are two key aspects of the management of every issuer – the management of the board, and
the day-to-day management of the issuer's business. There should be a clear division of these
responsibilities at the board level so that power is not concentrated in any one individual.
The new CP places greater emphasis on the roles and responsibilities of the chairman. The CP
was implemented commencing on 1 April 2012.
Board composition
The board should have a balance of skills and experience appropriate for the requirements of the
business of the issuer. The board should ensure that changes to its composition can be managed
without undue disruption.
The new rule requires that at least one-third of an issuer’s board should be independent non-
executive directors (INEDs). Listed companies must comply with the rule by 31 December 2012.
Companies which do not satisfy this rule have a three-month period to appoint a sufficient number
of INEDs.
37
Business Assurance
38
2: Corporate governance reports and practice | Part A Corporate governance
The new CP states that management should provide monthly updates to board members giving a
balanced and understandable assessment of the issuer’s performance, position and prospects in
sufficient detail to enable them to discharge their duties. This information may include information
such as monthly management accounts and management updates.
(Implementation date: 1 April 2012)
Corporate governance functions
The new CP states that the board should be responsible for corporate governance and in addition,
says that an issuer should establish terms of reference on duties that should be performed by the
board or committees delegated by the board.
A new rule has also been introduced which requires issuers to disclose the corporate governance
policy and duties performed in the Corporate Governance Report.
(Implementation date: 1 April 2012)
Board evaluation
An RBP has been introduced recommending that the board conducts a regular evaluation of its
performance.
(Implementation date: 1 April 2012)
Directors’ insurance
The RBP had been upgraded requiring that an issuer should arrange appropriate insurance
coverage for directors.
Directors’ attendance at board meetings
The new CP states that non-executive directors, including INEDs, should attend board, committee
and general meetings and contribute to the issuer’s strategy and policies.
The new requirement also states that issuers must disclose details of the attendance at general
meetings of each director by name in its Corporate Governance Report.
Further, it should disclose the attendance at the AGM of the chairman of the board and the
chairmen of the audit, remuneration and nomination committees and other chairmen of “any other
committee”.
The new CP clarifies that, subject to the issuer’s constitutional documents and the laws and
regulations of its place of incorporation, it may count directors’ attendance by electronic means
(including telephonic or video-conferencing) as attendance at a physical board meeting.
A new rule which should be implemented from 1 April 2012 removes the 5 per cent threshold for
voting on a resolution in which a director has an interest.
39
Business Assurance
Notes
1 Under paragraph 24 of Appendix 16, directors' fees and any other reimbursement or
emolument payable to a director must be disclosed in full in the annual reports and
accounts of the issuer on an individual and named basis.
2 Under paragraph 24B of Appendix 16 of the Listing Rules, issuers are required to give a
general description of the emolument policy and long-term incentive schemes of the group
as well as the basis of determining the emolument payable to their directors.
Disclosure of senior management remuneration by band
A new CP states that senior management remuneration should be disclosed by band.
(Implementation date: 1 April 2012)
Disclosure of chief executive’s remuneration
Issuers are required to disclose the remuneration of a chief executive who is not a director.
(Implementation date: 1 January 2012)
The board should ensure that the issuer maintains sound and effective internal controls to
safeguard the shareholders' investment and the issuer's assets.
– To ensure achievements of the company’s objectives, including its stated goals and business
targets in an effective and efficient manner
– To ensure economical and effective use of resources and adequately safeguard the Group’s
assets against unauthorised use or disposition
– To ensure maintenance of proper records for providing reliable financial, managerial and
operating information for decision-making, evaluation of activities or publication
40
2: Corporate governance reports and practice | Part A Corporate governance
Board committees
Board committees should be formed with specific written terms of reference which deal clearly
with the committees' authority and duties.
Section E: Communication with shareholders
Effective communication
The board should endeavour to maintain an on-going dialogue with shareholders and in particular,
use annual general meetings or other general meetings to communicate with shareholders and
encourage their participation.
A new CP states that issuers should establish a shareholder communication policy.
Issuers should also avoid “bundling” resolutions and, where they are “bundled”, issuers are
required to explain the reasons and material implications in the notice of meeting.
(Implementation date: 1 April 2012)
Voting by poll
The issuer should ensure that shareholders are familiar with the detailed procedures for conducting
a poll.
The rule has been amended to allow a chairman at a general meeting to exempt certain
prescribed procedural and administrative matters from a vote by poll.
Publishing constitutional documents on website
A new rule requires an issuer to publish an updated and consolidated version of its constitutional
documents on its own website and the HKEx website. Any significant changes to constitutional
documents during the year in its Corporate Governance Report should be disclosed.
In addition, issuers are required to publish on their websites the procedures shareholders can use
to propose a person for election as a director.
(Implementation date: 1 April 2012)
Section F: Company Secretary
The company secretary plays an important role in supporting the board by ensuring good
information flow within the board and that board policy and procedures are followed. The company
secretary is responsible for advising the board through the chairman and/or the chief executive on
governance matters and should also facilitate induction and professional development of directors.
Functions of the Company Secretary
The Company Secretary supports the Chairman in promoting the highest standards of corporate
governance, and facilitating the effective functioning of the board and its committees, where
appropriate.
The Company Secretary reports to the Chairman on Board/committee matters and to the
Chief Executive on administrative matters. The appointment and removal of the Company
Secretary is a matter for the Board as a whole.
All directors have direct access to the advice and services of the Company Secretary for the
ongoing discharge of their duties and responsibilities.
The key functions of the Company Secretary include:
– assisting the Chairman in ensuring that there are timely and appropriate information
flows to the board and between the non-executive Directors and the management, to
enable directors to discharge their responsibilities
– ensuring that board’s policy and procedures, and all applicable rules and regulations,
are complied with by each and every director
41
Business Assurance
In comparison, the UK Corporate Governance Code sets out standards of good practice in
relation to board leadership and effectiveness, remuneration, accountability and relations with
shareholders.
All companies with a premium listing of equity shares in the UK (“premium listed companies”) are
required under the Listing Rules to report on how they have applied the UK Corporate Governance
Code in their annual report and accounts.
The UK Code contains broad principles and more specific provisions, but does not contain
recommended best practices. Listed companies are required to report on how they have applied
the main principles of the Code, and either to confirm that they have complied with the Code's
provisions or – where they have not – to provide an explanation (“comply or explain”).
Compared with the HK Code, the UK Corporate Governance Code is substantially more detailed.
42
2: Corporate governance reports and practice | Part A Corporate governance
2.1.4 Directors
Directors are usually responsible for setting an entity's strategy, formulating policies and identifying
systems and controls and monitoring performance. Let's break this down further:
Setting strategy and guiding policy
Directors are ultimately responsible for the safe stewardship of the company, and this includes
all aspects of its management: formulating strategic plans, and translating this into budgets, HR
plans, developing and maintaining assets, investing in technology and ensuring corporate
governance rules or any industry regulation or tax rules are complied with. One important area in
formulating strategy is identifying and controlling risks. Internal audit may have a very important
role to play in this area, although it is a decision made by the directors as to whether to set up an
internal audit department, and if so, to direct relevant work activity to that department.
In an effective board, there should be a balance of power as well as a balance of skills and
experience, and a single individual should not be able to dominate the board. One way of achieving
this is to comply with the provision in the HK Code that the roles of Chairman of the board and
Chief Executive Officer should be separate and should not be performed by the same individual.
This means that no one individual should have unfettered powers of decision.
The board should also take responsibility for monitoring its own fitness to manage the company.
This means an assessment of the knowledge, experience, and skills of the directors in areas core
to the entity's business as well as the directors' personal characteristics, such as integrity.
judgment and available energy and time to invest in the business. It also involves decisions as to
new members, good induction procedures and personal development.
The board relies on reliable, timely information from the entity's systems in order to make decisions
and should review the availability and quality of the information available and set up procedures to
improve any deficiencies.
43
Business Assurance
Turnbull Guidelines
Have a defined process for the effectiveness of internal control
Review regular reports on internal control
Consider key risks and how they have been managed
Check the adequacy of action taken to remedy weaknesses and incidents
Consider the adequacy of monitoring
Conduct an annual assessment of risks and the effectiveness of internal control; and
Make a statement on this process in the annual report
Key term
Non-executive directors are directors who do not have day-to-day operational responsibility for
the company. They are not employees of the company or affiliated with it in any other way.
Non-executive directors may be independent or they may not be independent. When a non-
executive director is considered “not independent”, this means that the individual may be subject to
the views and influence of others. For example a non-executive director may represent the
interests of a major shareholder, or the director may be subject to the influence of the executive
management team, especially after serving as a non-executive director many years.
The Listing Rules provide guidelines on how the “independence” of a non-executive director may
be assessed. The HK Code also specifies that if a non-executive director has been on the board for
more than nine years, this would be a factor to consider when judging whether he is still
independent.
Board composition has a significant impact on corporate performance. The importance of
independent non-executive directors is their detachment from the day to day operational
responsibility of the company, in other words they are “objective”. As already stated in Section
2.1.2, at least one-third of an issuer’s board should be independent non-executive directors
(INEDs).
A company should also maintain on its website an up-to-date list of all its directors, indicating their
function or role and whether they are independent non-executive directors.
Non-executive directors may be appointed to oversee a particular sensitive area such as company
reporting, nomination of directors and remuneration of executive directors. Often entities establish
sub-committees of board members to deal with these issues. We will consider one such sub-
committee, the audit committee, in more detail in Section 4.1.
44
2: Corporate governance reports and practice | Part A Corporate governance
Self-test question 1
The HK Code on Corporate Governance Practices is a Hong Kong Stock Exchange requirement
for listed companies. It is recommended for other companies. Some argue that the HK Code
should be mandatory for all companies.
Required
(a) Discuss the benefits of the HK Code to shareholders and other users of financial statements.
(b) Discuss the merits and drawbacks of having such provisions in the form of a voluntary code.
(The answer is at the end of the chapter)
Topic highlights
Many governance codes have adopted a principles-based approach allowing companies
flexibility in interpreting the codes' requirements and to explain if they have departed from the
provisions of the code.
A continuing debate on corporate governance is whether the guidance should predominantly be in
the form of principles, or whether there is a need for detailed laws or regulations.
45
Business Assurance
Hong Kong has adopted a non-statutory approach for its corporate governance framework, based
on the UK's Corporate Governance Code. This means that the Code is voluntary in nature, with HK
companies being asked to “comply or explain” any deviation from the code. The Hong Kong Stock
Exchange requires that disclosures be made as to whether it has been complied with, but there are
no statutory requirements to comply.
Principles-based approaches have often been adopted in jurisdictions where the governing bodies
of stock markets have had the prime role in setting standards for companies to follow. By
comparison the USA has adopted a more rules-based approach in their corporate governance
framework.
46
2: Corporate governance reports and practice | Part A Corporate governance
(e) There may be confusion over what is compulsory and what isn't. Although codes may
state that they are not prescriptive, their adoption by the local stock exchange means that
specific recommendations in the codes effectively become rules, which companies have to
obey in order to retain their listing.
(f) Some companies may perceive a principles-based approach as non-binding and fail to
comply without giving an adequate or perhaps any explanation. Not only does this
demonstrate a failure to understand the purpose of principles-based codes but it also
casts aspersions on the integrity of the companies' decision-makers.
47
Business Assurance
48
2: Corporate governance reports and practice | Part A Corporate governance
The board should present a balanced, clear and comprehensive assessment of the
company's position, performance and prospects.
The board should maintain a sound system of internal control to safeguard
shareholders' investment and the company's assets.
The directors should, at least annually, conduct a review of the effectiveness of the
group's system of internal controls and report to shareholders that they have done so in
their annual report. The review should consider the adequacy of resources,
qualifications and experience of staff of the issuer's accounting and financial reporting
functions, and their training programmes and budget.
49
Business Assurance
50
2: Corporate governance reports and practice | Part A Corporate governance
51
Business Assurance
The New Companies Ordinance ("the new CO"), which consists of more than 900 sections and
11 schedules, provides a modernised legal framework for the incorporation and operation of
companies in Hong Kong. It aims to achieve four main objectives, namely, to enhance corporate
governance, ensure better regulations, facilitate business and modernise the law.
To facilitate implementation of the new CO, over ten regulations will have to be made in 2013-14.
In parallel, the Companies Registry will enhance its information system and carry out an overall
review of its procedures and forms for the implementation of the new legislation. The new CO is
expected to commence operation in 2014.
Under the new CO, there are new measures for enhancing corporate governance and the following
are some of the major measures for the enhancement:
(a) Strengthening the accountability of directors
Restricting the appointment of corporate directors by requiring every private company to
have at least one natural person to act as director, to enhance transparency and
accountability.
Clarifying in the statute the directors’ duty of care, skill and diligence with a view to providing
clear guidance to directors.
(b) Enhancing shareholder engagement in the decision-making process
Introducing a comprehensive set of rules for proposing and passing a written
resolution.
Requiring a company to bear the expenses of circulating members’ statements relating to
the business of, and proposed resolutions for, Annual General Meetings, if they are received
in time to be sent with the notice of the meeting.
Reducing the threshold requirement for members to demand a poll from 10% to 5% of the
total voting rights.
(c) Improving the disclosure of company information
Requiring public companies and the larger (i.e., companies that do not qualify for simplified
reporting) private companies and guarantee companies to prepare a more comprehensive
directors’ report which includes an analytical and forward-looking “business review”, whilst
allowing private companies to opt out by special resolution. The business review will provide
useful information for shareholders. In particular, the requirement to include information
relating to environmental and employee matters that have a significant effect on the
company is in line with international trends to promote corporate social responsibility.
(d) Fostering shareholder protection
Introducing more effective rules to deal with directors’ conflicts of interests, including
expanding the requirement for seeking shareholders’ approval to cover directors’
employment contracts which exceed three years.
Requiring disinterested shareholders’ approval in cases where shareholders’ approval is
required for transactions of public companies and their subsidiaries.
Requiring the conduct of directors to be ratified by disinterested shareholders’ approval to
prevent conflicts of interest and possible abuse of power by interested majority shareholders
in ratifying the unauthorised conduct of directors.
Replacing the “headcount test” with a not more than 10% disinterested voting requirement
for privatisations and specified schemes of arrangement, while giving the court a new
discretion to dispense with the test (in cases where it is retained) for members’ schemes.
Extending the scope of the unfair prejudice remedy to cover “proposed acts and omissions”,
so that a member may bring an action for unfair prejudice even if the act or omission that
would be prejudicial to the interests of members is not yet effected.
52
2: Corporate governance reports and practice | Part A Corporate governance
4 Board committees
Topic highlights
Many companies operate a series of board sub-committees responsible for supervising specific
aspects of governance. Operation of a committee system does not clear the main board of its
responsibilities for the areas covered by the board committees.
Good use of committees seems to have had a positive effect on the governance of many
companies. It is found that committees had given assurance that important board duties were being
discharged rigorously.
Topic highlights
An audit committee can help a company maintain objectivity with regard to financial reporting and
the audit of financial statements.
Appendix 14, Section C.3 of the HK Code sets the minimum duties for the audit committee and
Section B.1 covers the remuneration committee. The HK Code further determines the role of the
audit committee and its role in monitoring the integrity of the company's financial statements as well
as being primarily responsible for the company's relationship with the external auditors, reviewing
the internal controls and recommending the appointment of external auditors. The company should
provide sufficient resources to the audit committee to discharge its duties.
A former partner of the company's existing auditing firm should be prohibited from acting as a
member of the company's audit committee for a period of one year commencing on the date of
53
Business Assurance
ceasing to be partner of the auditing firm or ceasing to have any financial interest in the auditing
firm (whichever is later).
4.1.1 Role and function of audit committees
An audit committee should be set up. It should consist entirely of non-executive directors and there
should be at least three non-executive directors on the committee. The board should satisfy
itself that at least one member of the audit committee is an independent non-executive director who
has appropriate professional qualifications, or accounting or related financial management
expertise.
The majority of the audit committee members must be independent non-executive directors, and
the chairman of the audit committee must be an independent non-executive director as well.
The exact role of an audit committee will vary from entity to an entity. The audit committee terms of
reference should be set out in writing and publicly available or described in a report.
The Code requires that the board should establish formal and transparent arrangements for
considering how it should apply the financial reporting and internal control principles for maintaining
an appropriate relationship with the company's auditors. The provisions relating to this principle are
set out below.
54
2: Corporate governance reports and practice | Part A Corporate governance
(c) To monitor and review the effectiveness of the company's internal audit function.
Where there is no internal audit function, the audit committee should consider annually
whether there is a need for an internal audit function and make a recommendation to the
board, and the reasons for the absence of such a function should be explained in the
relevant section of the annual report.
(d) To make recommendations to the board on the appointment, reappointment and
removal of the external auditors, to approve the remuneration and terms of engagement
of the external auditors and any questions of resignation or dismissal of the external
auditors (section C.3.3(a) of Appendix 14).
If the board does not accept the audit committee's recommendation, it should include in
the annual report, and in any papers recommending appointment or re-appointment, a
statement from the audit committee explaining the recommendation and should set out
reasons why the board has taken a different position.
(e) To monitor and review the external auditor's independence, objectivity and effectiveness
of the audit process in accordance with applicable standards (section C.3.3(b) of
Appendix 14).
To seek information from the external auditors on an annual basis on the external
auditors' processes for maintaining independence and monitoring compliance with
relevant requirements, including any applicable requirement on rotation of engagement
team members.
(f) To develop and implement policy on engagement of the external auditor to supply non-
audit services, taking into account relevant ethical guidance regarding the provisions of
non-audit services by the external audit firm and to report to the board, identifying any
matters in respect of which it considers that action or improvement is needed, and
making recommendations as to the steps to be taken (section C.3.3(c) of Appendix 14).
(g) The amended CP states that an audit committee should meet the external auditor at
least twice a year.
(h) To ensure co-ordination between the internal audit function (where it exists) and the
external auditors.
(i) To review the external auditors' management letter, any material queries raised by the
external auditors to management in respect of the accounting records, financial
statements or systems of control and management's response.
(j) To ensure that the board provides a timely response to the issues raised in the external
auditors' management letter.
(k) The RBP was upgraded to CP, stating that an audit committee’s terms of reference
should include arrangements for employees to raise concerns about financial reporting
improprieties; and
(l) A new RBP was introduced recommending the audit committee establish a
whistleblowing policy and system.
All these new amendments should be implemented commencing on 1 April 2012.
55
Business Assurance
(c) To enable the non-executive directors to inject their experience, expertise and an
independent judgment into the entity's affairs.
(d) To help the Chief Financial Officer, by providing a forum in which he can raise matters of
concern, and a mechanism for resolving potentially difficult issues.
(e) To work with and improve the quality and efficiency of the external auditor, by providing a
means of communication and apparatus to resolve issues of concern.
(f) To provide a framework within which the external auditor can assert his position in the event
of a dispute with management.
(g) To strengthen the status of the internal audit function, by providing a greater degree of
independence from management.
(h) To increase public confidence in the reliability and objectivity of financial statements.
Opponents of audit committees argue the following:
(a) The executive directors may not understand the purpose of an audit committee and may
perceive that it detracts from their authority.
(b) There may be difficulty selecting sufficient non-executive directors with the necessary
competence in auditing matters for the committee to be really effective.
(c) The establishment of such a formalised reporting procedure may dissuade the auditors
from raising matters of judgment and limit them to reporting only on matters of fact; and
(d) Costs may be increased.
56
2: Corporate governance reports and practice | Part A Corporate governance
Self-test question 2
(a) Summarise the principles in the HK Corporate Governance Code relating to remuneration of
directors.
(b) Describe the main areas of concern that should be addressed by a remuneration committee.
(c) Explain the relationship between the audit committee and the public sector.
(The answer is at the end of the chapter)
57
Business Assurance
jurisdictions the legal duties of directors apply to both executive and non-executive directors.
Section A of Appendix 14 covers the issues relating to directors.
58
2: Corporate governance reports and practice | Part A Corporate governance
Other disclosures that may be required by law or considered as good practice include the duration
of contracts with directors, and notice periods and termination payments under such
contracts. Details of external remuneration consultants employed by the remuneration
committee to advise on determining remuneration should be provided.
59
Business Assurance
Topic recap
60
2: Corporate governance reports and practice | Part A Corporate governance
Answer 1
(a) Benefits of the HK Code
Shareholders
Of key importance to the shareholders are the suggestions that the HK Code makes in
respect of the annual general meeting. In the past, particularly for large listed companies,
AGMs have sometimes been forbidding and unhelpful to shareholders. The result has been
poor attendance and low voting on resolutions.
The HK Code requires that separate resolutions are made for identifiably different items
which should assist shareholders in understanding the proposals laid before the meeting.
It also requires that director members of various important board committees (such as the
remuneration committee) be available at AGMs to answer shareholders' questions.
Internal controls
Another important area for shareholders is the emphasis placed on directors monitoring and
assessing internal controls in the business on a regular basis. While it is a statutory
requirement that directors safeguard the investment of the shareholders by instituting
internal controls, this additional emphasis on quality should increase shareholders'
confidence in the business.
Directors re-election
The requirements of the HK Code also make the directors more accessible to the
shareholders. They are asked to submit to re-election every three years. They are also
asked to make disclosure in the financial statements about their responsibilities in relation to
preparing financial statements and going concern.
Audit committee
Last, some people would argue that the existence of an audit committee will lead to
shareholders having greater confidence in the reporting process of an entity.
Other users
The key advantage to other users is likely to lie in the increased emphasis on internal
controls as this will assist the company in operating smoothly and increasing viability of
operations, which will be of benefit to customers, suppliers and employees.
(b) Voluntary code
Adherence to the HK Code is not a statutory necessity, although it is possible that in the
future, such a code might become part of company law.
Advantages
The key merit of the HK Code being voluntary for most companies is that it is flexible.
Companies can review the Code and make use of any aspects which would benefit their
business.
If they adopt aspects of the HK Code, they can disclose to shareholders what is being done
to ensure good corporate governance, and what aspects of the HK Code are not being
followed, with reasons.
This flexibility is important, for there will be a cost of implementing such a Code, and this
cost might outweigh the benefit for small or owner-managed businesses.
61
Business Assurance
Disadvantages
Critics would argue that a voluntary code allows companies that should comply with the
Code to get away with non-compliance unchallenged.
They would also argue that the type of disclosure made to shareholders about degrees of
compliance could be confusing and misleading to shareholders and exacerbate the
problems that the Code is trying to guard against.
Answer 2
(a) Remuneration levels should be sufficient to attract directors of sufficient calibre to run the
company effectively, but companies should not pay more than is necessary.
Directors should consider whether to include compensation commitments in the contracts
of service.
Companies should establish a formal and clear procedure for developing policy on
executive remuneration and for fixing the remuneration package of individual directors.
Directors should not be involved in setting their own remuneration. A remuneration
committee, staffed by non-executive directors (NEDs), should make recommendations
about the framework of executive remuneration, and should determine specific remuneration
packages. The board should determine the remuneration of NEDs.
(b) The remuneration committee should consider the following:
Choice of criteria through which performance is measured, including the goals of the
organisation
Time scales over which performance is measured
The balance between the historic assessment and the potential impact of decisions
Differentials between different members of the board
The need to retain good quality directors
Public perceptions of pay awarded to directors
Shareholder perceptions of pay awarded to directors
Of particular importance is the need to align medium to long-term performance outcomes
with remuneration packages, and to avoid short-term rewards for results that may not
necessarily be in the medium to long-term interests of the company.
(c) The audit committee is an integral element of public accountability and governance. It plays a
key role with respect to the integrity of the entity’s financial information, its system of internal
controls, and the legal and ethical conduct of management and employees. An audit
committee’s responsibility will vary depending upon the entity’s complexity, size, and
requirements. Typical audit committee responsibilities include approving the overall audit
scope, recommending the appointment of the external auditor, overseeing the entity’s
financial statements and internal controls, helping to ensure that the audit is conducted in a
cost-effective manner, and risk management oversight.
Independence. In the public sector, the structure of entities does not separate the governing
authority and oversight responsibility from the day-to-day management. For example, a
public university president may be both the Chief Executive Officer and a board member.
Public sector audit committees should be independent both in fact and in appearance, and
have processes in place to ensure such independence.
62
2: Corporate governance reports and practice | Part A Corporate governance
Communication. Communication between a governing body and its finance officers can be
difficult at times. For example, external financial reporting follows standard principles;
however, budgets and expressions of policy are unique to the circumstances of the
organisation and its jurisdiction. Communication may be complicated when a governing body
approves a budget but not the financial statements. The GAO has indicated that audit
committees can provide assistance if they have the necessary technical skills in accounting
and auditing and are able to communicate with finance officers and auditors on complex
issues.
63
Business Assurance
Exam practice
DREIT 25 minutes
Dummy Real Estate Investment Trust (DREIT) is a mid-size real estate investment trust listed in
Hong Kong. With a portfolio of 50 real estates comprising retail malls, commercial premises and
car park facilities, DREIT was established by a trust deed (Trust Deed).
DREIT has a manager (Manager) who has the general power to manage DREIT’s assets in the
interests of its unitholders (Unitholders) in accordance with the Trust Deed. A Board of Directors is
responsible for the Manager’s overall governance, including establishing targets for executive
management and monitoring the achievement of these targets. DREIT’s trustee (Trustee) is
responsible under the Trust Deed for the safe custody of DREIT’s assets and holds the same for
and on behalf of the Unitholders. The Manager is independent of the Trustee.
DREIT aims to produce a sustainable stream of income from its portfolio and to maximise the value
through the enhancement of its physical built structure, trade-mix, marketing and customer service.
As these enhancement projects progress, the portfolio offers customers better shopping facilities
with more choices at reasonable prices, whilst improving returns for the Unitholders.
Since its listing on the Hong Kong Stock Exchange in December 20X8, DREIT has been paying the
Unitholders at about 90% of its net income and has demonstrated consistent growth in distribution
per unit. A substantial portion of the remuneration of DREIT’s senior executives is closely linked to
the growth rate of the distribution per unit.
Certain DREIT’s financial and operating data are set out as follows:
Mr Kwok is the audit director of a CPA incorporated practice in charge of the audit of DREIT’s
financial statements for the year ended 31 December 20Y0.
In April 20Y0, DREIT made an acquisition of a block of low-rise commercial premises in the New
Territories. Part of the premises suddenly collapsed in December 20Y0. There was no casualty
reported and DREIT’s manager believed that the damages are fully covered by its group insurance
policy. However, emerging evidence indicates that there was an illegal extension built on the
premises which might have caused the collapse. If it is the case, the damage could be an
uninsured loss.
(Note. DREIT is a collective investment scheme in the form of a unit trust established by a trust
deed, authorised by the Securities and Futures Commission under the Securities and Futures
Ordinance and regulated by the provisions of the Code on Real Estate Investment Trusts.)
64
2: Corporate governance reports and practice | Part A Corporate governance
DREIT has established an audit committee to comply with the Listing Rules of the Hong Kong
Stock Exchange.
Required
(a) To what extent can the establishment of an effective audit committee improve DREIT’s
corporate governance in the context of external auditing, financial reporting and internal
control? (8 marks)
(b) Describe some ways to gauge the effectiveness of DREIT’s audit committee. (6 marks)
(Total = 14 marks)
HKICPA December 2011
65
Business Assurance
66
Part B
Internal assurance
67
Business Assurance
68
chapter 3
Internal assurance
Topic list
Learning focus
Internal assurance can be regarded as a key concept that underpins the whole of business
assurance. As we shall see in this chapter, internal assurance relates both to the wider
principles of corporate governance that we have discussed in the first two chapters of this
Learning Pack and also to the role of internal audit within the context of an individual entity.
69
Business Assurance
Learning outcome
Competency
level
2.09 Audit procedures 3
2.09.05 Explain the importance of internal control to auditors and the
execution of tests of control
2.11 Internal audit 2
2.11.01 Explain the relationship between internal auditors and external
auditors
2.11.02 Discuss why auditors may rely on the work of others, including
internal audit, experts and service organisations
3.05 Implications of overseas legislation such as the Sarbanes- 2
Oxley Act 2002 on Hong Kong companies and auditors
3.05.01 Explain the effect of the Sarbanes-Oxley Act 2002 on Hong
Kong companies and their auditors
70
3: Internal assurance | Part B Internal assurance
71
Business Assurance
governance responsibilities. An internal audit department is not essential for monitoring the system
of internal control, but provision C.2.6 of the Code states that Issuers (companies) without an
internal audit function should:
review the need for one on an annual basis, and
report on the outcome of this review in its Corporate Governance Report.
The annual review of the internal control system is explained in more detail below.
The report should comprise an assessment of internal controls and should confirm that the board
has considered all significant aspects of internal control based on its identification of business
risks. In particular, the annual review should consider in particular:
(a) Any changes since the last assessment in the nature and extent of the significant risks
faced by the company, and the company's ability to respond to changes in its business
environment.
(b) The scope and quality of the monitoring by management of risk and internal control, and
the scope and quality of the work of the internal audit function, if such a function exists in the
company.
(c) The extent and frequency of reporting to the board (or board committee) on the results of
this ongoing monitoring activity. This regular reporting enables the board or committee to
build up a cumulative assessment of the state of the controls and the effectiveness of risk
management.
(d) The incidence of any significant control failings or weaknesses that have been identified
which have a material impact on the company’s financial performance or condition, or might
have a material impact in the future.
(e) The effectiveness of the company’s processes for compliance with financial reporting
rules and Listing Rules.
Section C of the Code also requires issuers to include, as part of their Corporate Governance
Report, a narrative statement about how they have complied with the Code provisions on internal
control during the reporting period. This statement should include:
(a) the processes used by the company for identifying, evaluating and managing the risks that it
faced
(b) any additional information for understanding the company’s risk management process or
system of internal control
(c) an acknowledgement that the board of the company is responsible for the system of internal
control and for reviewing its effectiveness
(d) the process used by the company to review the effectiveness of the system of internal
control
(e) the process used by the company to deal with the material internal control aspects of any
serious problems that are disclosed in the annual report and accounts.
72
3: Internal assurance | Part B Internal assurance
(b) The processes that deal with material internal control aspects of significant risk areas do
not reflect the auditors' understanding of those processes
(c) The board has not made an appropriate disclosure if it has failed to conduct an annual
review, or the disclosure made is not consistent with the auditors' understanding.
Self-test question 1
The Code on Corporate Governance Practices in Hong Kong ("the Code") clearly states the
responsibilities of the board of directors relating to internal controls.
Required
Explain the responsibilities of the board of directors relating to internal controls in the context of
principle and code provisions under the Code.
(3 marks)
HKICPA December 2012 (Amended)
(The answer is at the end of the chapter)
73
Business Assurance
2.1 Introduction
The following definition of internal auditing was given for comparison with other forms of assurance
service and providers:
Key term
Internal auditing is an appraisal or monitoring activity established within an entity as a service to
the entity. It functions by, amongst other things, examining, evaluating and reporting to
management and the directors on the adequacy and effectiveness of components of the
accounting and internal control systems.
74
3: Internal assurance | Part B Internal assurance
In addition, in order for the board to comply with the requirements of the Code where there is no
internal audit function:
The audit committee should consider annually whether there is a need for this function and
make a recommendation to the board; and
To explain in the Corporate Governance Report the absence of such a function.
The following summarises the key responsibilities of the board in relation to internal control:
Assess the scope and effectiveness of the internal control being established by the
management
Ensure appropriate internal control in place for monitoring compliance with related laws and
regulations
Monitoring the process of internal audit
Ensure the internal audit departments has sufficient resources and empowerment to perform
their work
Approving the appointment or dismissal of the head of internal audit
Considering the management response to the suggestions made by the internal audit
function
Role of internal audit in corporate governance
Internal audits are placed perfectly to assist management in the assessment of risks and internal
controls. The UK Internal Control: Guidance to Directors (also known as the Turnbull Report) in
particular highlights the role internal audit can have in providing objective assurance and advice on
risk and control. The following summarises the key role of internal audit, which is to assist the
board in practice:
An objective evaluation of the existing risk and internal control framework
Analysis of business processes and associated internal controls
Reviews of existence and the value of assets
Information on frauds and irregularities
Ad hoc reviews on any other area for which the risk level is unacceptable
Reviews on the financial and operational activities of the company
Reviews of the compliance framework and specific compliance issues
Recommendations for more effective and efficient uses of the company’s resources
Assessment on the accomplishment on the company’s goals and objectives
The UK Internal Control: Guidance to Directors sets out some key guidelines for the board.
Have a defined process for the review of effectiveness of internal control
Review regular reports on internal control
Consider key risks and how they have been managed
Check the adequacy of action taken to remedy weaknesses and incidents
Consider the adequacy of monitoring
Conduct an annual assessment of risks and the effectiveness of internal control; and
Make a statement on this process in the annual report
The traditional definition of internal audit given at the start of the section shows how internal audit
can help the directors achieve these objectives; the traditional purpose of internal audit was to
review controls.
The third of the above guidelines refers to risk. All companies face risks arising from their
operational activities. Risks arise in different areas.
Risk the company will go bankrupt
Risks arising from regulations and law; and
Risks arising from publicity
The guidelines require that risk be managed. This gives rise to another role for the internal audit
function, risk management.
75
Business Assurance
Risk awareness and management should be the role of everyone in the organisation. The
extended role of internal audit with regard to risk is the monitoring of integrated risk management
within a company, and the reporting of results to the board to enable them to report to
shareholders.
Internal auditor relationships
Internal auditors have relationships with the following people:
Management: by whom they are employed and may report to
Audit committee: to whom they report; and
External auditors: who may make use of their work
Reliance on the work of internal auditors by external auditors
HKSA The external auditors may make use of the work of internal audit. The guidance over when this is
610.13 appropriate is given to them in HKSA 610 (Revised 2013) Using the Work of Internal Auditors.
The HKSA states that the external auditors must determine whether the work of the internal audit
function can be used, and if so, in which areas and to what extent. If external auditors do use the
work of the internal audit function, they must determine whether the work is adequate for the
purposes of the audit.
In evaluating the internal audit function the following factors must be considered:
The objectivity of the internal audit function
Technical competence of the internal auditors
Whether the work is likely to be carried out with due professional care
Whether there is likely to be effective communication between the internal and external
auditors
Nature and scope of the work
Assessed risk of material misstatement
Degree of subjectivity involved in the evaluation of the audit evidence gathered by the
internal auditors
We will look at HKSA 610 (Revised 2013) in detail in section 4 of this chapter.
The internal audit department has a two-fold role in relation to risk management.
It monitors the company's overall risk management policy to ensure it operates
effectively; and
It monitors the strategies implemented to ensure that they continue to operate effectively.
A significant risk management policy in companies is to implement internal controls, and here
internal audit has a key role in assessing systems and testing controls.
Internal audit may assist in the development of systems. However, its key role will be in
monitoring the overall process and in providing assurance that the systems which the
departments have designed meet objectives and operate effectively.
76
3: Internal assurance | Part B Internal assurance
It is important that the internal audit department retains its objectivity towards these aspects of its
role, which is another reason why internal audit would generally not be involved in the assessment
of risks and the design of the system.
The UK guidance and internal audit's role in relation to risk management was touched on. In
response to this, directors need to ensure three steps are taken in their business.
Identify risks
Control risks
Monitor risks
It is not internal audit's primary role to manage risk in a company. It is the responsibility of the
directors, usually delegated to individual managers in various departments.
The risks are identified and assessed, and a policy is taken in respect of each of them. This policy
is usually one of four:
Accept risk (if it is low impact and likelihood)
Reduce risk (by setting up a system of internal control)
Avoid risk (by not entering market, accepting contract etc); and
Transfer risk (by taking out insurance)
With their skills in business systems, internal auditors are ideally placed to monitor this process
and add value to it. They can:
give advice on the best design of systems and monitor their operation
be involved in a process that continually improves internal control systems; and
provide assurance on systems set up in each department
The involvement of internal audit as a monitoring unit will help to ensure that the process of risk
identification and management in a business is a continual process rather than a one-off
exercise.
Topic highlights
Internal audit departments may consist of employees of the company, or may be outsourced to
external service providers. The advantages of outsourcing the internal audit function include
speed, cost and a tailored answer to internal audit requirements. One of the main disadvantages
may include threats to independence and objectivity if the external audit service is provided by the
same firm.
Key term
Outsourcing is the use of external suppliers as a source of finished products, components or
services. It is also known as sub-contracting.
While the scope of the internal auditor's work is different to that of the external auditor, there are
many features that can link them. One of the key factors is that the techniques which are used to
carry out audits are the same for internal and external auditors.
It can be expensive to maintain an internal audit function consisting of employees of the company.
It is possible that the monitoring and review required by a certain company could be done in a
small amount of time and full-time employees cannot be justified.
77
Business Assurance
It is also possible that a number of internal audit staff are required, but the cost of recruitment is
prohibitive, or the directors are aware that the need for internal audit is only short-term.
In such circumstances, it is possible to outsource the internal audit function, that is, purchase the
service from outside.
In this respect, many of the larger accountancy firms offer internal audit services. It is likely that the
same firm might offer one client both internal and external audit services. In such circumstances
the firm would have to be aware of the independence issues this would raise for the external
engagement team and implement safeguards to ensure that its independence and objectivity
were not impaired.
2.4.2 Advantages and disadvantages of outsourcing
The advantages and disadvantages of outsourcing the internal audit function are set out in the
following table:
(c) Reviewing working papers on a sample basis to ensure they meet internal
standards/guidelines
(d) Agreeing internal audit work plans in advance of work being performed
(e) If external auditor is used, ensuring the firm has suitable controls to keep the two functions
separate so that independence and objectivity is not impaired
78
3: Internal assurance | Part B Internal assurance
Case study
The Enron case is perhaps the best-known failure of a large American corporation.
Enron Corporation was an energy company based in Houston, Texas. At its peak it was one of the
world's largest producers of electricity and gas as well as having large-scale pulp, paper and
communications businesses. At the time it filed for Chapter 11 bankruptcy (protection from
creditors' claims under US law) in 2001, Enron employed over 20,000 personnel. By the end of that
year, it had been revealed that Enron had been used as a vehicle for systematic accounting fraud,
with its major executives directly involved in the criminal activities.
Prior to the disaster, Enron had been highly successful and reputable. It had been voted America's
most innovative company on several occasions. The company's business model was one of
integration and diversification. In addition to marketing energy, Enron actually built the pipelines
and power plants (backward integration). To spread its risks beyond the energy industry, it moved
successfully into telecommunications and e-commerce as well as trading derivatives.
Once the problems were uncovered, it emerged that Enron's financial statements were completely
misleading. Its recorded assets were inflated in value and in some cases non-existent. The
company had placed debts and other obligations with offshore entities, thereby not consolidating
them in the group financial statements.
The systematic false accounting that had taken place led to a criminal investigation and the arrest
and indictment of several senior figures in the company. Several of the directors paid significant
sums of money to settle law suits against them. Jeffrey Skilling, the former Chief Executive Officer,
was sentenced to 24 years in prison on numerous charges, including fraud.
The ramifications of the Enron case were not confined to the company. Serious questions were
raised about the failure of Arthur Andersen, the external auditors of the company, to identify the
inconsistencies in the Enron financial statements. This led to the subsequent break up and
dissolution of the accounting firm.
Enron's successor company, Enron Creditors Recovery Corporation, survives today with less than
500 personnel.
The Enron scandal, together with other high profile corporate failures, led to a reappraisal of
standards of corporate governance in the USA and further afield. The Enron case was the prime
mover for the introduction in 2002 of the Sarbanes-Oxley Act in the USA, which established a
79
Business Assurance
Public Company Accounting Oversight Board (“PCAOB”) to oversee the auditors of public
companies. Its stated purpose is to “protect the interests of investors and further the public interest
in the preparation of informative, fair, and independent audit reports”. The formation of the PCAOB
greatly reinforced the laws on senior executive accountability. The Act also influenced the stock
exchanges of many countries and accelerated the creation of codes of practice to which all listed
companies are now expected to adhere.
80
3: Internal assurance | Part B Internal assurance
81
Business Assurance
82
3: Internal assurance | Part B Internal assurance
For lawyers, the Act strengthens requirements on them to whistleblow internally on any wrongdoing
they uncover at client companies, right up to board level.
83
Business Assurance
4 Internal auditors
Topic highlights
External auditors may make use of the work of an internal audit department when carrying out
audit procedures.
Key term
Internal audit function. A function of an entity that performs assurance and consulting activities
designed to evaluate and improve the effectiveness of the entity's governance, risk management
and internal control processes.
84
3: Internal assurance | Part B Internal assurance
85
Business Assurance
Whether the internal auditors have adequate technical training and proficiency in
auditing.
Whether the internal auditors possess the required knowledge relating to the
entity's financial reporting.
Whether the internal auditors are members of relevant professional bodies that
oblige them to comply with the relevant professional standards including continuing
professional development requirements.
(c) Whether the internal audit function applies a systematic and disciplined approach,
including quality control.
Factors that may affect the external auditor's determination of whether the internal audit
function applies a systematic and disciplined approach include the following:
The existence, adequacy and use of documented internal audit procedures or
guidance covering such areas as risk assessments, work programs, documentation
and reporting, the nature and extent of which is commensurate with the size and
circumstances of an entity.
Whether the internal audit function has appropriate quality control policies and
procedures, for example, such as those policies and procedures in HKSQC 1
(Clarified) that would be applicable to an internal audit function (such as those relating
to leadership, human resources and engagement performance) or quality control
requirements in standards set by the relevant professional bodies for internal auditors.
4.4.1 Determining the nature and extent of work that can be used
The external auditor considers the nature and scope of the work that has been performed or is
planned to be performed by the internal audit function and assesses its relevance to the overall
strategy and plan for the external audit.
The external audit must make all significant judgments in relation to the audit and must prevent
undue use of the work of the internal auditor by performing more of the work directly. Examples of
internal audit work that might be used by the external auditor include:
Testing of the operating effectiveness of controls
Substantive procedures involving limited judgment
Observations of inventory controls
Tracing transactions through the information system relevant to financial reporting
Testing of compliance with regulatory requirements
86
3: Internal assurance | Part B Internal assurance
87
Business Assurance
The requirement to reperform some of the internal audit work is a new requirement
included in the revised HKSA.
HKSA
610.26-35 4.6 Using internal auditors to provide direct assistance
HKSA 610 (Revised 2013) now includes guidance for situations where the external auditor uses
the internal auditors to provide direct assistance.
Key term
Direct assistance. The use of internal auditors to perform audit procedures under the direction,
supervision and review of the external auditor
88
3: Internal assurance | Part B Internal assurance
It would not be appropriate for the internal auditors to provide direct assistance in respect of the
following:
Discussion of fraud
Determination of unannounced audit procedures in accordance with HKSA 240
Responsibilities regarding external confirmation requests and evaluation of results of
external confirmation procedures
The HKSA also makes the point that excessive use of internal auditors to provide direct assistance
may affect perceptions regarding the independence of the external audit.
HKSA
610.36-37 4.7 Documentation
If the external auditor uses the work of the internal audit function, the external auditor shall include
in the audit documentation:
(a) The evaluation of:
Whether the function's organisational status and relevant policies and procedures
adequately support the objectivity of the internal auditors;
The level of competence of the function; and
Whether the function applies a systematic and disciplined approach, including quality
control;
(b) The nature and extent of the work used and the basis for that decision; and
(c) The audit procedures performed by the external auditor to evaluate the adequacy of the
work used.
If the internal auditors provide direct assistance the external auditors must document the following:
(a) The evaluation of the existence and significance of threats to objectivity
(b) The basis for the decision regarding the nature and extent of the work performed by the
internal auditors
(c) Who reviewed the work performed and the date and extent of that review
(d) The written agreements required (see section 4.6.3 above)
(e) The working papers prepared by the internal auditors
Self-test question 2
As the external auditors for Union Bank, you are considering relying on the work of the internal
audit functions for testing the internal control. The internal audit function is part of the accounting
and finance division and reports to the Chief Financial Officer.
Being the audit senior, you have been assigned to review the work of internal auditors prior to the
commencement of this year's audit. The following issues are discovered:
(1) For most of the audit tests, there is no detailed documentation of the work by the internal
auditors that has been completed.
89
Business Assurance
(2) There is a high staff turnover within the internal audit department. There are five staff in the
department responsible to undertake internal control testing. The new staff employed have
no audit and accounting experience.
(3) Union Bank's audit plan and programme are developed based on the firm's standard audit
plan. However, the testing of wages is not selected. Upon discussion with the internal
auditors, the auditors reveal that the financial controller has altered the instructions as he
recognises that the risk of non-compliance in the wages area is minimal.
(4) For those areas that have been documented, the results are quite clear and competently
completed. However, three compliance errors are detected in the loan approvals and there
are no follow up procedures, as the entity believes these incidents are immaterial.
Required
Demonstrate the weaknesses in the internal audit department and your consideration whether you
consider the audit firm should rely on Union Bank's internal audit function.
(The answer is at the end of the chapter)
The external audit is focused on the financial statements, whereas the internal audit function
is focused on the operations of the entire business.
The following table highlights the differences between internal and external audit:
The table demonstrates that the whole basis and reasoning of internal audit work is
fundamentally different to that of external audit work.
90
3: Internal assurance | Part B Internal assurance
Topic highlights
It is the responsibility of management and those charged with governance to prevent and detect
fraud, and in this respect, the internal audit function may have a role to play.
Fraud is a significant business risk. It is the responsibility of the directors to prevent and detect
fraud. However, as the internal audit function plays an important role in the management of risk so
it is by implication involved in the process of managing the risk of fraud. It is not the responsibility of
the external auditors to prevent and detect fraud, although they may uncover fraud while carrying
out their audit of the financial statements, which will be undertaken with the possibility of material
misstatement through fraud in mind. We will study the external auditor's responsibilities for the
detection of fraud and error in more detail in Chapter 10.
The internal audit function can help to prevent fraud by carrying out timely reviews on the
adequacy and effectiveness of control systems and making appropriate recommendations. The
internal audit function may be able to detect fraud by being mindful to the possibility when
carrying out its work and reporting any suspicions.
Establishing an internal audit department and investing it with appropriate authority and
stature may act as a powerful deterrent to fraud in itself. Management may require the internal
auditors to undertake special projects to investigate any reported suspicions.
91
Business Assurance
Topic recap
Sarbanes-Oxley requires:
– directors to report on
Assists management internal control effectiveness
– limits on non-audit services
– listed companies to establish
audit committees
Part of corporate
INTERNAL AUDIT FUNCTION
governance framework
Evaluate internal Similar Different Internal auditor Risk management Risk strategies
audit work and techniques basis and may provide direct system operates operate effectively
assess adequacy reasoning assistance effectively
Reperformance
of procedures
92
3: Internal assurance | Part B Internal assurance
Answer 1
The general principle of the Code on Corporate Governance Practices (“the Code”) in Hong Kong
requires the board of directors to maintain a sound and effective system of internal control to
safeguard the shareholder’s investment and the company’s assets.
In Section C of the Code, the board is required to conduct a review of the effectiveness of the
company’s system of internal controls and report to the shareholders that they have done so in
their Corporate Governance Report at least annually.
The review should cover all material controls, including financial, operational and compliance
controls and risk management functions; and consider the adequacy of resources, qualifications
and experience of staff of the company’s accounting and financial reporting functions, and their
training programmes and budget.
Answer 2
The weaknesses in the internal audit department may be identified as follows:
(1) The new staff are not competent and do not have any professional qualifications or
accounting experience. More competent staff should be engaged.
(2) The internal audit function reporting to the chief financial officer is not an independent act.
The internal auditors should report to the highest level of management such as the board or
the audit committee.
(3) There is no documentation of work performed and this is inadequate. Proper documentation
should be in place.
(4) Errors in the compliance tests have not been followed up and this shows lack of competence
and professional due care.
(5) The audit programme has been altered by the Financial Controller. Internal auditors should
not be influenced by any other management person.
Under HKSA 610 (Revised 2013), external auditors should consider the following before relying on
the work of the internal audit function:
The extent to which the internal audit function’s organisational status and relevant policies
and procedures support the objectivity of the internal auditors
The level of competence of the internal audit function
Whether the internal audit function applies a systematic and disciplined approach, including
quality control.
Overall, it seems that it is not desirable to rely on internal auditing work.
93
Business Assurance
Exam practice
(Total = 15 marks)
HKICPA February 2004 (amended)
94
Part C
Professional standards and
guidance
Professional standards and guidance are a must to have a job done properly in any
accountancy and auditing engagement. The practice of arbitrary techniques and scandals
developed from creative procedures are damaging the accountancy profession. Students are
expected to learn the Code of Ethics by heart and become a CPA of the highest calibre. They
are then more ready to face ethical dilemmas and carry out their responsibilities in a creditable
way.
95
Business Assurance
96
chapter 4
Code of Ethics
Topic list
Learning focus
Professional accountants are sometimes faced by ethical dilemmas. Codes of ethics, such as
that issued by the Hong Kong Institute of Certified Public Accountants, give guiding principles
to help professional accountants carry out their responsibilities to both their profession and the
wider public.
There are also a number of practical measures (safeguards) that a firm may implement to
ensure that these ethical principles are not breached.
97
Business Assurance
Learning outcomes
Competency
level
ETHICAL REQUIREMENTS
"Code of Ethics"
OBJECTIVITY INTEGRITY
THE FIRM CLIENT OBLIGATION FREEDOM
V V TO TO
THE CLIENT DISCLOSE DISCLOSE
CLIENT
IDENTIFY THREATS TO
INDEPENDENCE
Self-Interest Threat
Self-Review Threat
Familiarity Threat
Advocacy Threat
Intimidation Threat Provide Obligated Protect
safeguard by law the firm’s
to reduce interests
the conflict
SAFEGUARDS AGAINST
THREATS TO INDEPENDENCE
By legislation and regulation
Firm wide
Engagement specific Decline the Accept
engagement client
98
4: Code of Ethics | Part C Professional standards and guidance
It is important that you understand the topic well. Auditors are subject to ethical requirements
imposed by the accountancy bodies; in Hong Kong, it is the HKICPA.
Code of Ethics for Professional Accountants Revised June 2010; February 2012
This Code of Ethics for Professional Accountants (the Code) is effective on 1 January 2011.
It replaces the version issued in December 2005 which is effective from 30 June 2006 until
31 December 2010.
All Professional Accountants are required to comply with the Code.
Section A – GENERAL APPLICATION OF THE CODE
Section B – PROFESSIONAL ACCOUNTANTS IN PUBLIC PRACTICE
Section C – PROFESSIONAL ACCOUNTANTS IN BUSINESS
Section D – ADDITIONAL ETHICAL REQUIREMENTS
Section E – SPECIALISED AREAS OF PRACTICE
Professional Accountant in Professional Accountant in
Public Practice Business
Definition: Professional accountant in a Professional accountant
firm that provides professional employed or engaged in an
services executive or non-executive
capacity ie commerce, industry,
service etc
Adoption of which Parts of the Code: A,B,D,E of the Code A,C D,E of the Code
Independence
99
Business Assurance
100
4: Code of Ethics | Part C Professional standards and guidance
101
Business Assurance
Topic highlights
Professional accountants rely on the guidance of an ethical code because they hold positions of
trust, and people rely on them. In their business dealings they may encounter situations or be put
under pressure to act in ways that further their own advantage, or that of an entity, against the wider
public interest or the interest of their profession.
'A distinguishing mark of the accountancy profession is its acceptance of the responsibility to act in
the public interest. Therefore, a professional accountant's responsibility is not exclusively to satisfy
the needs of an individual entity or employer.
The public interest is considered to be the collective well-being of the community of people and
institutions the professional accountant serves, including entities, lenders, governments, employers,
employees, investors, the business and financial community and others who rely on the work of
professional accountants.'
Two points are very clear from this: first, the key reason that professional accountants must behave
ethically is that a very wide range of people rely on them and their expertise. The second is that
the accountant has a duty to serve not only the entity who has engaged his services or his employer,
but the wider public interest – that is, he must be, and must be seen to be, independent.
Professional accountants hold positions of trust by the entities whom they serve, and the users of the
information they provide through statutory reporting. They have access to sensitive financial and
strategic information which may have a significant impact on the future direction of the business and
its stakeholders.
Undertaking these professional obligations may give rise to ethical dilemmas and conflicts of interest;
when it does the professional accountant may turn to the guidance laid down by the accountancy
bodies, such as the Hong Kong Institute of Certified Public Accountants. As it is impossible to
anticipate the very many scenarios which may give rise to these difficulties the guidance is given in
the form of fundamental principles, guidance and explanatory notes. The professional accountant is
given the freedom to use his own judgment as to how to apply the principles or may seek advice
from the HKICPA.
102
4: Code of Ethics | Part C Professional standards and guidance
103
Business Assurance
104
4: Code of Ethics | Part C Professional standards and guidance
HKICPA issues ethical standards, quality control standards and auditing standards which work
together to ensure independence is safeguarded and quality audits are carried out.
Examples of safeguards in the work environment:
(a) Strong firm leadership to emphasise the importance of compliance with the fundamental
principles and their expectation that members of the assurance team will act in the public
interest
(b) Establish policies and procedures to implement and monitor quality control of assurance
engagement
(c) Document the firm’s independence policies including identification and evaluation of threats
(d) Document the internal policies and procedures requiring compliance with the fundamental
principles
(e) Establish policies and procedures to identify interests or relationships between the firm or
assurance team members, to monitor and manage the undue dependence on fee from a
single entity
(f) Rotate senior audit staff, partners with separate reporting lines of the provision of non-
assurance services to an entity
(g) Establish policies and procedures to prohibit non-team members influence the outcome of the
engagement
(h) Update all partners and professional staff of firm’s policies and procedures including giving
appropriate training
(i) Senior management should review the adequate functioning of the safeguarding system
(j) Advise partners and professional staff to be independent
(k) Establish disciplinary mechanism to promote compliance with the firm’s policies and
procedures
(l) Involve an additional professional accountant to review the work done or otherwise advise as
necessary
(n) Use different partners and engagement teams with separate reporting lines for the provision of
non-assurance services to entities
(p) Disclose to those charged with governance the nature of services provided and extent of fees
charged
(q) Involve another firm to perform or reperform part of the engagement
Example of safeguards created by the individual:
(a) Comply with continuing professional development requirements
(b) Keep records of contentious issues and approach to decision-making
(c) Maintain a broader perspective on how similar organisations function through establishing
business relationships with other professionals
(d) Use an independent mentor
(e) Maintain contact with legal advisers and professional bodies
105
Business Assurance
Stage 2
Evaluate the significance of those threats
Significant or not?
Stage 3
Identify and apply safeguards to eliminate the threats
The guidance states its purpose in a series of steps. It aims to help firms and members:
Step 1
Identify threats to independence.
Step 2
Evaluate whether the threats are insignificant.
Step 3
If the threats are not insignificant, identify and apply safeguards to eliminate risk, or reduce it to an
acceptable level.
It also recognises that there may be occasions where no safeguard is available. In such a
situation, it is only appropriate to:
eliminate the interest or activities causing the threat
decline the engagement, or discontinue it
106
4: Code of Ethics | Part C Professional standards and guidance
Key terms
Independence of mind: The state of mind that permits the expression of a conclusion without being
affected by influences that compromise professional judgment, thereby allowing an individual to act
with integrity, and exercise objectivity and professional scepticism.
Independence in appearance: The avoidance of facts and circumstances that are so significant that
a reasonable and informed third party would be likely to conclude weighing all the specific facts and
circumstances that a firm’s or a member of the engagement team’s integrity, objectivity or
professional scepticism has been compromised.
Firms must evaluate the significance of any threats to independence and then put safeguards in
place, where this is possible, to reduce the threat to acceptable levels. If it is not possible to put
adequate safeguards in place, it may be better to withdraw services than to risk a conflict of interest.
Certain entities, listed companies or those deemed to be of significant public interest due to the wide
range of stakeholders involved may be subject to more stringent rules.
* Applicable to the assurance team, the firm and the network firm
Topic highlights
HKICPA’s Code of Ethics gives examples of a number of situations where independence might be
threatened and suggests safeguards to protect independence.
HKICPA’s Code gives extensive lists of examples of threats to independence and applicable
safeguards. In the rest of this chapter, these threats and some relevant factors and potential
safeguards are outlined. Definite rules are shown in bold. You should learn these.
107
Business Assurance
Key term
A financial interest exists where a firm has a financial interest in an entity’s affairs, for example, the
firm owns shares in the entity, or is a trustee of a trust that holds shares in the entity.
When considering whether a financial interest in a client constitutes a self interest threat, the
significance of the threat should be considered in the light of the following factors:
Whether the financial interest is direct or indirect
Role of the owner
Materiality of the interest
Examples:
Beneficial interests in shares/other interest
Overdue fees
Hold shares in a company’s client
Being trustee of a trusts that holds the shares in the company
Having a retirement plan that owns shares in the company
Material indirect ownership of shares
Financial interest in an audit entity may create a self-interest threat.
If a member of the engagement team, a member of that individual’s immediate family or a firm has a
direct financial interest or a material indirect financial interest in the audit client the self-interest threat
created would be so significant that no safeguards could reduce the threat to an acceptable level.
The parties listed below are not allowed to own a direct financial interest or an indirect material
financial interest in a client:
The assurance firm
A member of the assurance team
An immediate family member of a member of the assurance team
108
4: Code of Ethics | Part C Professional standards and guidance
Key terms
Direct financial interests are:
financial interests owned directly by and under the control of an individual or entity
beneficially owned through a collective investment vehicle such as trust over which the
individual or entity has control.
Indirect financial interests are:
beneficially owned through a collective investment vehicle such as trust over which the
individual or entity has no control.
When a close family member has a direct financial interest or a material indirect financial interest in
the entity, a self-interest threat is created.
Safeguards available to eliminate the threat or reduce it to an acceptable level are:
(a) the close family member should dispose of all, or a sufficient amount of the financial interest,
at the earliest practical date
(b) use an additional professional accountant who did not participate in the assurance
engagement to review the work done
(c) remove the member from the engagement team
If a firm or a partner or employee of the firm or a member of that individual’s immediate family
receive the financial interest by way of inheritance, gift or through a merger, this will cause a self-
interest threat.
Safeguards available to eliminate the threat or reduce it to an acceptable level include disposing of
the financial interest at the earliest practical date.
Such matters will involve judgment on the part of the partners who are charged with making
decisions about ethical issues. For example, what constitutes a material interest? A small
percentage stake in a company might be material to its owner. How does the firm judge the
closeness of a relationship between staff and their families, in other words, what does immediate
mean in this context?
Firms should have quality control procedures requiring staff to disclose relevant financial interests for
themselves and close family members. They should also foster a culture of voluntary disclosure on
continuous basis so that any potential problems are identified in a timely manner.
109
Business Assurance
Where the significance and nature of the threat to independence involves a single individual member
(or a close relation of his), appropriate ethical behaviour would demand that the individual is
removed from the engagement team.
110
4: Code of Ethics | Part C Professional standards and guidance
111
Business Assurance
acceptable level. One safeguard likely to be used is an independent review (by a partner from
another office in the firm).
However, the firm or an individual on the assurance engagement should never enter into any
loan or guarantee arrangement with an entity that is not a bank or similar institution.
The advice on loans and guarantees falls into two categories:
client is a bank or similar institution
other situations
Key term
Contingent fees are fees which are calculated on a predetermined basis relating to the outcome of
a transaction or the result of the services performed by the firm.
A firm should not enter into a contingent fee arrangement for any assurance engagement as
payment arrangements based on outcomes create self-interest and advocacy threats which cannot
be reduced to acceptable levels through the application of suitable safeguards.
Contingent fees charged on non-assurance engagement
A contingent fee charged directly or indirectly by a firm in respect of a non-assurance service
provided to an audit client may also create a self-interest threat. The threat created would be so
significant that no safeguards could reduce the threat to an acceptable level if:
the fee is charged by the firm expressing the opinion on the financial statements and the fee
is material or expected to be material to that firm;
the fee is charged by a network firm that participates in a significant part of the audit and the
fee is material or expected to be material to that firm; or
the outcome of the non-assurance service, and therefore the amount of the fee, is dependent
on a future or contemporary judgment related to the audit of a material amount in the financial
statements.
All arrangements shall be prohibited.
Compensation and evaluation policies
A self-interest threat is created when a member of the engagement team is evaluated on or
compensated for selling non-assurance services to that audit client.
The significance of the threat shall be evaluated and, if the threat is not at an acceptable level, the
firm shall either revise the compensation plan or evaluation process for that individual or apply
safeguards to eliminate the threat or reduce it to an acceptable level.
A key audit partner shall not be evaluated on or compensated based on that partner’s success in
selling non-assurance services to the partner’s audit client. This is not intended to prohibit normal
profit-sharing arrangements between partners of a firm.
112
4: Code of Ethics | Part C Professional standards and guidance
2.3.11 Lowballing
Lowballing is the term used to describe the situation where a firm quotes a significantly lower fee
level for an assurance service than would have been charged by the predecessor firm usually in
order to gain other more lucrative business. A self-interest threat arises which must be safeguarded
against. If the firm wins the tender the following safeguards should be applied:
Careful record keeping to demonstrate that the firm used appropriate staff, spent sufficient
time, and adhered to appropriate technical and professional standards in carrying out the
engagement;
Demonstration that the assurance engagement complied with all applicable assurance
standards, guidelines and quality control procedures
In other words, the low generation of fee revenue must not have any adverse impact on the quality of
the review carried out. Lowballing and the significant low fee issue below carry the risks of fee
disputes, if the company is eventually forced to make a choice between losing money or
compromising on quality or if the lucrative other business the firm hoped to win on the back of the
loss-making audit does not materialise.
2.3.12 Significant low fee
A firm is entitled to charge a significant low fee for any reason but should be aware of the threat to
objectivity this creates. This fee strategy may cause a self-interest threat and call into question the
113
Business Assurance
professional competence and due care owed by the firm. Both independence and quality of work
may be compromised as it may be difficult to perform the engagement in accordance with applicable
technical and professional standards for the fee charged.
The professional accountant should consider if there is:
any terms on securing the contract to supply other non-audit services (lowballing issue)
any compromise on the quality of the audit work
any restriction on senior staff working on the audit
any possibility the entity was misled as to the basis on which fees for the current and
subsequent years were to be determined
awareness by the entity of all the terms of the engagement and fees charged
appropriate review to ensure work is done fully in accordance with auditing standards; and
should
appropriate time and competent staff assigned to the engagement.
By engaging in these risky pricing strategies the firm not only threatens its independence but also
raises the risk of fee disputes and negligence claims that could do long-term damage to the
business.
2.3.13 Recruitment
Professional accountants may offer HR consultancy services (see the further discussion of this in 2.4
below). However, recruitment and assurance services offered by the same firm may result in a
conflict of interest and either the assurance business or the consultancy business should be
declined. It may be acceptable for the assurance firm to play a limited part in say, the recruitment of
a senior officer at an entity who uses their assurance services, if the final decision for the
appointment rests with another party.
Self-test question 1
Kwok & Co have been the auditors of Kowloon Bank for a number of years.
(a) Kowloon Bank operates a staff scheme offering all members of staff low rate mortgage deals.
The staff rate is currently set at 3.5% below the bank prime rate. The Head of Lending of
Kowloon Bank tells the audit engagement partner at Kwok & Co, with whom he has dealt for a
number of years, that Kowloon Bank would like to extend the staff scheme in respect of low
rate mortgages to all members of staff at Kwok & Co, as a token of their appreciation of Kwok
& Co’s services.
(b) An audit assistant, who was on the audit of Kowloon Bank last year is considering resignation
from Kwok & Co to accept a trainee manager position at Kowloon Bank.
The audit engagement partner for Kowloon Bank has just become aware of this situation.
114
4: Code of Ethics | Part C Professional standards and guidance
Required
Explain any professional and ethical issues in each of the above situations.
(11 marks)
HKICPA February 2006
(The answer is at the end of the chapter)
Corporate
Internal audit Tax services
finance
services
Self-review threats arise when a professional accountant, or a firm of professional accountants, have
previously been involved in performing a service which they are then called upon to review. This
may include setting up financial systems they are then asked to review, or preparing financial
records or valuations for the financial statements they are then asked to audit. The risk is greater
when the service was performed very recently. As market competition has encouraged firms of
professional accountants to expand the range of services they may offer entities, so the risk of self-
review has increased. The table below shows a range of the services that may be provided and there
follows a discussion about how the provision of these services may impair independence.
Bookkeeping
Preparation of financial statements
Tax services, although generally these are not seen to impair independence
Design and implementation of financial information systems
Appraisal, valuation services and fairness opinions
Actuarial services Risk of
self-
Internal audit services review
Management functions, but there are strict rules about the degree to which
assurance advisers may intervene in the management decisions of the entity
Human resources – such as recruitment and selection of senior management,
provision of temporary staff cover and so on
Corporate finance, broker-dealer services, accessing finance and so on
Legal services and litigation support
115
Business Assurance
The HKICPA Code gives rules about the other services firms may provide to their entities, (see
sections 2.4.2–2.4.9 below).
The distinction between listed companies, (or public interest companies), and private companies is
an important one in the provision of other services to entities. The rules are much more stringent for
listed companies and those deemed to be of public interest.
Key terms
Listed companies are those whose shares have been admitted to a recognised exchange, such as
the Stock Exchange of Hong Kong.
Public interest companies are those which for some reason (size, nature, product) are in the
“public eye”. Professional accountants should treat these as if they are listed companies.
116
4: Code of Ethics | Part C Professional standards and guidance
117
Business Assurance
Key term
A valuation comprises the making of assumptions with regard to future developments, the
application of certain methodologies and techniques, and the combination of both in order to
compute a certain value, or range of values, for an asset, a liability or for a business as a whole.
If a firm performs a valuation to be included in the entity’s financial statements which are then
subsequently audited by the firm, a self-review threat arises.
A firm should not carry out valuations on matters:
(a) which are material to the financial statements and
(b) if the valuation is subject to high degree of subjectivity.
No safeguard is available to reduce the threat to an acceptable level under these circumstances.
If the valuation is neither material nor subject to high degree of subjectivity, the firm may apply
safeguards to ensure that the risk is reduced to an acceptable level. The following matters need to
be considered:
The extent of the entity’s knowledge of the relevant matters in making the valuation
The degree of judgment involved
How much use is made of established methodologies
The degree of uncertainty in the valuation
The firm may use the following safeguards to manage the risk:
Second partner review
Confirming that the entity understands how the valuation is reached and the underlying
assumptions
Ensuring the entity acknowledges its responsibility for the valuation
Using separate staff for the valuation and the audit
For audit clients that are public interest entities
A firm shall not provide valuation services to an audit client that is a public interest entity if the
valuations would have a material effect, separately or in the aggregate, on the financial statements
on which the firm will express an opinion.
118
4: Code of Ethics | Part C Professional standards and guidance
Self-test question 2
You are the audit manager of a CPA firm, Yu & Yu. You are responsible for the audit of the financial
statements of a manufacturing and trading group, La’Monsa Limited (“La’Monsa”), for the year ended
31 December 20X6. The group’s principal product is clothing. In the last financial year, La’Monsa set
up a subsidiary to manufacture footwear products. They acquired a brand and set up a production
line.
When planning the audit work for the year ended 31 December 20X6, you learnt that the footwear
business had not been successful and production had been suspended.
In a meeting with Mr. Jun, the Chief Executive Officer (“CEO”) of La’Monsa, you raised your
concerns regarding valuation of the brand and production facilities in the footwear business. The
CEO believed that the brand was acquired last year and was still quite popular, and the machinery
and equipment were still workable. He also advised you that a merger of La’Monsa with another
footwear company was under negotiation. As valuation services were provided by your firm, he
suggested your firm, Yu & Yu, prepare a valuation report on the brand and the machinery and
equipment. Mr. Jun also suggested your firm use the valuation report in the audit of the financial
statements for the year ended 31 December 20X6.
Required:
(a) Discuss the general independence consideration for Yu & Yu in accepting non-assurance
engagements by its existing audit client. (5 marks)
(b) Discuss the independence consideration in the specific circumstances of La’Monsa’s
suggestion that Yu & Yu be appointed to provide valuation services. (10 marks)
(Total = 15 marks)
HKICPA May 2007
(The answer is at the end of the chapter)
Tax return Tax calculations for the Tax planning and other Assistance in the
preparation purpose of preparing tax advisory services resolution of tax
the accounting entries disputes
119
Business Assurance
Where the effectiveness of the tax advice depends on a particular accounting treatment or
presentation in the financial statements and the self-review threat would be so significant that
no safeguards could reduce the threat to an acceptable level. Accordingly, a firm shall not
provide such tax advice to an audit client.
Assistance in the resolution of tax disputes
An advocacy or self-review threat may be created when the firm represents an audit client in the
resolution of a tax dispute once the tax authorities have notified the client that they have rejected the
client’s arguments on a particular issue and either the tax authority or the client is referring the matter
for determination in a formal proceeding,
Where the taxation services involve acting as an advocate for an audit client before a public tribunal
or court in the resolution of a tax matter and the amounts involved are material to the financial
statements on which the firm will express an opinion, the advocacy threat created would be so
significant that no safeguards could eliminate or reduce the threat to an acceptable level.
120
4: Code of Ethics | Part C Professional standards and guidance
121
Business Assurance
Legal services
In each case, the firm should consider whether there are any barriers to independence and whether
these can be reduced by appropriate safeguards. Among the scenarios which might fall into this
category are where a firm is asked to design internal control IT systems, which it would later review
as part of its audit, or a professional accountant from the firm was seconded to cover the finance
director’s maternity leave. Before you read on, what would you consider to be appropriate ethical
behaviour in those two circumstances?
122
4: Code of Ethics | Part C Professional standards and guidance
Corporate finance
An advocacy threat often arises in the provision of legal or corporate finance services. To avoid this
threat firms must avoid being in the position of taking the entity’s part in a dispute or somehow acting
as their advocate in a way that threatens the appearance of independence. Examples are when a
firm has provided legal services to an entity and, perhaps defended them in a legal case. Corporate
finance examples are where the firm gives such as advice on debt reconstruction and negotiates
with the bank on the entity’s behalf or deals or acts as a promoter of shares for an entity. In these
instances a professional accountant may promote or may be seen to promote an entity’s position
to the point that objectivity may be impaired.
Again, the firm may be able to reduce the threat by using appropriate safeguards, including separate
teams and disclosures, but if the threat cannot be reduced to an acceptable level the firm must
withdraw from the engagement.
123
Business Assurance
In addition, the Code of Ethics goes further for listed and public interest entities with a list of specific
rules to prevent this situation from arising. It is in your interest to learn them!
The rules state that for the audit of listed or other public interest entities:
The engagement partner should be rotated after a pre-defined period
Other key audit partners should be rotated after a pre-defined period, normally no more than
seven years, and should not return to the engagement until a period of two years has
elapsed
The individual responsible for the engagement quality control review should be rotated
after a pre-defined period
If an entity becomes a listed entity, the engagement partner, other key partners and quality
control personnel should only continue in those positions for another two years. Judgment
may need to be exercised for more junior staff based on the length of time they have been involved
with the audit.
Flexibility is required for smaller firms where the size constraint may mean rotation is impracticable
or reliance on a key person’s expertise would mean the risk to technical quality is greater than that
derived from the previous connection. In this case, the firm must devise suitable safeguards to make
sure independence is preserved.
(a) Listed companies and other public interest entities:
The rules state that for the audit of listed or other public interest entities:
The engagement partner should be rotated after a pre-defined period
Other key audit partners should be rotated after a pre-defined period, normally no
more than seven years, and should not return to the engagement until a period of
two years (or five years if returning as engagement partner) has elapsed
The individual responsible for the engagement quality control review should be rotated
after a pre-defined period, normally no more than seven years, and should not
return to the engagement until a period of two years has elapsed.
If an entity becomes a listed entity, the engagement partner, other key partners and quality
control personnel should only continue in those positions for another two years. Judgment
may need to be exercised for more junior staff based on the length of time they have been
involved with the audit.
(b) Rotation of key audit partners
Familiarity and self-interest threats are created by using the same senior personnel on an
audit engagement over a long period of time.
Despite the above, key audit partners whose continuity is especially important to audit quality
may, in rare cases due to unforeseen circumstances outside the firm’s control, be permitted
an additional year on the engagement team as long as the threat to independence can be
eliminated or reduced to an acceptable level by applying safeguards.
When an audit client becomes a public interest entity, the length of time the individual has
served the audit client as a key audit partner before the client becomes a public interest entity
shall be taken into account in determining the timing of the rotation.
If the individual has served the audit client as a key audit partner for five years or less
when the client becomes a public interest entity, the number of years the individual may
continue to serve the client in that capacity before rotating off the engagement is seven years
less the number of years already served.
When a firm has only a few people with the necessary knowledge and experience to serve as
a key audit partner on the audit of a public interest entity, rotation of key audit partners may
not be an available safeguard.
124
4: Code of Ethics | Part C Professional standards and guidance
125
Business Assurance
under pressure to change the audit opinion in order to preserve the client relationship. In effect, a
self-interest threat arises.
In practice, second opinions often cause independence issues for firms of professional accountants
and care should be taken if asked to provide one.
A company director is free to talk to a another firm about the treatment of matters in the financial
statements if he believes there is a good reason for doing so. However, new accounting standards
are increasingly prescribing a single method of treatment reducing the scope for subjectivity and the
need for this kind of second opinion. Where an opinion like this is sought, the second firm is relying
on the director to communicate all of the relevant information on which the original opinion has been
based in a factual manner ie without any bias which may lead the professional accountants to take a
view that the entity might prefer. It is usual for the second firm to request the co-operation of the
appointed firm in order to ensure they have all the information they need. If this is refused, there are
probably good reasons why the engagement should be declined.
Safeguards are:
obtain the entity’s consent
describe the limitations surrounding any opinion in communications with the entity
provide the existing professional accountant with a copy of the opinion
126
4: Code of Ethics | Part C Professional standards and guidance
The firm shall establish policies and procedures designed to provide it with reasonable assurance
that the firm, its personnel and, where applicable, others subject to independence requirements
(including network firm personnel), maintain independence where required by the Code. Such
policies and procedures shall enable the firm to:
(a) communicate its independence requirements to its personnel and, where applicable, others
subject to them, and
(b) identify and evaluate circumstances and relationships that create threats to independence,
and to take appropriate action to eliminate those threats or reduce them to an acceptable level
by applying safeguards, or, if considered appropriate, to withdraw from the engagement.
127
Business Assurance
(a) Personnel to promptly notify the firm of independence breaches of which they become aware
(b) The firm to promptly communicate identified breaches of these policies and procedures to:
(i) the engagement partner who, with the firm, needs to address the breach, and
(ii) other relevant personnel in the firm and those subject to the independence
requirements who need to take appropriate action, and
(c) Prompt communication to the firm, if necessary, by the engagement partner and the other
individuals referred to in subparagraph 23 (b)(ii) of the actions taken to resolve the matter, so
that the firm can determine whether it should take further action.
At least annually, the firm shall obtain written confirmation of compliance with its policies and
procedures on independence from all firm personnel required to be independent by the HKICPA
Code and national ethical requirements.
(b) requiring for audits of financial statements of listed entities, the rotation of the engagement
partner and the individuals responsible for engagement quality control review, and, where
applicable, others subject to rotation requirements after a specified period in compliance with
relevant ethical requirements.
Topic highlights
HKICPA recognises a duty of confidentiality and several exceptions to it.
128
4: Code of Ethics | Part C Professional standards and guidance
Voluntary disclosure. In certain cases voluntary disclosure may be made by the professional
accountant:
to protect the professional accountant's interests (for instance, to defend in litigation against him)
where it is in the public’s interest
where it is authorised by statute
to non-governmental bodies
HKICPA Code of Ethics for Professional Accountants
to comply with technical standards and ethical requirements
to comply with the quality review of a member or professional body
to respond to an inquiry or investigation by a member body or regulatory body (i.e. disciplinary
actions from HKICPA)
to enable the firm to sue for its fee
to resist an action for negligence brought against the professional accountant by an entity
129
Business Assurance
Also, having decided that confidential information can be disclosed, professional accountants should
consider:
whether all relevant facts are known and substantiated
what type of communication is expected and to whom it should be addressed
whether the professional accountant will incur any legal liability as a result of disclosure
HKICPA guidance
The size of the amounts involved and the extent of likely financial damage
Whether members of the public are likely to be affected
The possibility or likelihood of repetition
The reasons for the entity's unwillingness to make disclosures to the authority
The gravity of the matter
Relevant legislation, accounting and auditing standards
Any legal advice obtained
Preparation comments
If you are required to make judgments about whether such a disclosure should be made in a given
scenario, you should apply a checklist like this to the scenario to ensure you have shown evidence of
your consideration of all the relevant factors.
130
4: Code of Ethics | Part C Professional standards and guidance
(c) if he agrees with a client or anyone else to pervert or obstruct the course of justice by
concealing, destroying or fabricating evidence or by misleading the police by statements which
he knows to be untrue.
Members are advised not to attempt to avoid the awkward responsibility of qualifying the report
on the accounts by refusing to report and by resigning.
Members may find that they are requested in their professional capacity by the Independent
Commission Against Corruption (ICAC) to assist in investigation of certain corruption allegations,
mainly against their own clients. Such assistance usually is requested in the form of furnishing
information to ICAC officers either orally or in writing.
Self-test question 3
You are the senior manager in a medium-size CPA firm. You are responsible for the audits for the
following entity and you are reviewing the ethical issues attached to the engagement.
Johnco Co (Johnco) is a manufacturer of kitchen appliances which are exported all over the world.
The following matter has been brought to your attention by the audit senior, who has just completed
the planning of the forthcoming audit for the year ending 31 March 20X0.
During a discussion with the production manager, it was revealed that there have been some quality
control problems with the kitchen appliances manufactured in the middle of the year. It was
discovered that some of the stainless steel used in the manufacture of the entity’s products did not
comply with the international quality standards. Johnco did not recall any of the products which had
been manufactured during that time from customers, as management felt that the risk of any injury
being caused was remote.
Required
Assess the ethical issues raised, and recommend any actions necessary, in respect of the stainless
steel used by Johnco Co.
(The answer is at the end of the chapter)
Topic highlights
Professional accountants should identify potential conflicts of interest as they could result in ethical
codes being breached.
A conflict of interest is a situation that may undermine the judgment of a professional accountant.
There may be too much personally at stake either for himself or for his firm for the professional
accountant to reconcile the stakeholders’ or public interest against his own. In these situations:
principles of independence, integrity and objectivity are not satisfied
promoting personal interest may result in adverse consequences to stakeholders
Firms should take reasonable steps to identify circumstances that could pose a conflict of interest
before they happen. A conflict of interest may result in the Code being breached (often conflicts of
interest give rise to self-interest threats).
The key principle for the firm is that it firm should not accept an engagement in which there is
likely to be a significant conflict of interest.
131
Business Assurance
132
4: Code of Ethics | Part C Professional standards and guidance
Self-test question 4
You are an audit manager in MKJ & Co, a local CPA firm. Your firm has been approached by a new
entity, Washington, which wants to engage your firm for both audit and advisory work.
Washington has expanded rapidly over the last few years and is planning to list in the next financial
year. Washington’s Financial Controller, Mr. Otto, is an old friend of one of your senior partners, Mr.
Man.
Mr. Otto has indicated that if Washington can successfully list its shares, the taxation and
consultancy work would be performed by your firm. Within your firm’s portfolio, you have also an
entity which is Washington’s rival.
One of your audit seniors has resigned recently to take up the post as Human Resources Manager in
Washington. Before any acceptance, Mr. Otto has invited your firm to join a very extravagant
cocktail party. Washington will distribute its prospectus during the occasion.
Required
(a) Identify and explain the ethical issues in the above situation.
(b) Give three examples for safeguards within the firm to be used for reducing the threat to
independence.
(The answer is at the end of the chapter)
Topic highlights
The Code of Ethics gives some general guidance to professional accountants who encounter a
conflict in the application of the fundamental principles.
133
Business Assurance
134
4: Code of Ethics | Part C Professional standards and guidance
135
Business Assurance
136
4: Code of Ethics | Part C Professional standards and guidance
6.7 Inducements
Inducements would cause a self-interest threat and an intimidation threat. The professional
accountant in business or their immediate close family member may be offered, or may offer,
inducements such as gifts, hospitality or any other preferential advantages.
Receiving an offer
The self-interest threat (or confidentiality) occurs when an inducement is made in an attempt to:
unduly influence actions or decisions
encourage illegal or dishonest behaviour, and
obtain confidential information.
137
Business Assurance
An intimidation threat (or breach of confidentiality) will occur when an inducement is accepted and
followed by threats to make that offer public and damage the reputation of the professional
accountant in business or his immediate family members.
There is no significant threat to compliance with the fundamental principles if the offer is made in the
normal course of business.
The inducement shall not be accepted when the threats cannot be eliminated or reduced to an
acceptable level through the application of safeguards.
Making an offer
A professional accountant in business should not offer an inducement to improperly influence the
professional judgment of a third party.
When an unethical inducement is offered from the employing organisation, the professional
accountant should follow the principles and guidance regarding ethical behaviour.
Actions to be taken when there is an inducement offered:
Inform higher levels of management or those charged with governance
Inform third parties of the offer – ie a professional body, and
Advise immediate or close family members of the situation after receiving such inducements.
Self-test question 5
DEF is a company incorporated in Hong Kong. It is listed on the Hong Kong Stock Exchange. The
principal activities of the company are property investment, management and development.
Mr. Chan, DEF’s Chief Executive Officer (“CEO”), Chairman of the Board and major shareholder,
has asked Simon, FCPA and DEF’s financial controller, to falsify certain documents and accounting
records of DEF so that Mr. Chan can misappropriate $1 billion of DEF’s cash for his personal
investments. Mr. Chan promises to pay back the $1 billion to DEF in a month and indicates that he
will give Simon a very favourable assessment for Simon’s bonus and promotion evaluation for the
current year; otherwise, he will replace Simon with someone who will work better with him.
Required
Based on the information given above:
(a) Comment on the ethical issues; and (5 marks)
(b) Outline the possible actions Simon would need to take to address these ethical issues.
(5 marks)
(Total = 10 marks)
HKICPA May 2009
(The answer is at the end of the chapter)
7 Other issues
138
4: Code of Ethics | Part C Professional standards and guidance
The significance of any threats should be evaluated and safeguards should be applied to eliminate
them or reduce them to an acceptable level.
If it is not possible to reduce the threat to an acceptable level, the professional accountant in public
practice should decline the engagement.
For recurring entity engagement, acceptance decisions should be reviewed annually.
139
Business Assurance
140
4: Code of Ethics | Part C Professional standards and guidance
Topic recap
Public interest in
accounting and auditing PROFESSIONAL ETHICS
services
• Integrity
• Objectivity
• Professional Accountant in
competence public practice
• Confidentiality
• Professional behaviour
• Self-interest Threats to
• Self-review fundamental Safeguards
• Management principles
• Advocacy
• Familiarity
• Intimidation
Specific examples
141
Business Assurance
Answer 1
(a) In accordance with Code of Ethics the relevant threats to independence in this case relating to
acceptance of a loan are: self-interest threat and familiarity threat.
The self-interest threat occurs when a firm or a member of the assurance team could benefit
from a financial interest in, or other self-interest conflict with, an assurance client, such as a
loan or guarantee to or from an assurance client or any of its directors or officers.
The familiarity threat occurs when, by virtue of a close relationship with an assurance client,
its directors, officers or employees, a firm or a member of the assurance team becomes too
sympathetic to the client’s interests, such as by acceptance of gifts or hospitality, unless the
value is clearly insignificant, from the assurance client, its directors, officers or employees.
The revised Code requires that if a member of the assurance team or his/her immediate family
member has a material indirect financial interest in the assurance client, the self-interest threat
created would be so significant that the only safeguards available to eliminate the threat or
reduce it to an acceptable level would be:
disposal of the indirect financial interest in total;
disposal of a sufficient amount of it so that the remaining interest is no longer material
prior to the individual becoming a member of the assurance team; or
removal of the member of the assurance team from the assurance engagement.
Similarly, there would be no problem if the client, whose normal course of business was to
lend, lent to audit staff members on normal commercial terms. However, the offer is a benefit
to audit and other firm staff, as the interest rate would be significantly below the market rate.
This puts it within the context of the guidelines on gifts and hospitality, because, although
strictly, it is neither, it is a benefit to staff.
Regarding gifts and hospitality, Audit staff members are entitled to accept gifts or hospitality of
trivial or inconsequential value. Clearly, what is considered trivial will vary from person to
person according to his circumstances.
However, it is important to note at this point, that, whatever the circumstances of individuals
are, the firm should decide on a rule that applies to all staff, and should not create a situation
where some staff members are entitled to the benefit and others are not.
When considering whether a benefit is trivial, the firm must consider the materiality of the
benefit to each recipient, or, in other words, the recipient to whom it would be least trivial.
In this question, the low rate would apply to the individuals over a number of years, and
represents a significant discount, much greater than that generally available to the public.
The amount is therefore unlikely to be trivial. As such, Kwok & Co should conclude that to
accept such a benefit would represent a significant threat to the objectivity of the firm, through
its staff, in relation to the audit, and should refuse the offer.
Regarding accepting loans, the audit firm could accept a loan from a client whose normal
course of business is lending on normal commercial terms. In such circumstance, it might be
wise for the audit firm to consider the need to put additional safeguards in place.
142
4: Code of Ethics | Part C Professional standards and guidance
Answer 2
(a) Section 290 of the Code of Ethics provides specific guidance on independence requirements
for audit and review engagements. Independence requires independence of mind and
independence in appearance.
Independence of mind is the state of mind that permits the expression of an opinion without
being affected by influences that compromise professional judgment, allowing an individual to
act with integrity, and exercise objectivity and professional scepticism.
Independence in appearance is the avoidance of facts and circumstances that are so
significant that a reasonable and informed third party, would be likely to conclude, weighing all
specific facts and circumstances, that a firm’s or a member of the engagement team’s integrity,
objectivity or professional scepticism have been compromised.
The provision of non-assurance services to assurance clients may create threats to the
independence of the firm, particularly with respect to perceived threats to independence
(independence in appearance).
Consequently, it is necessary to evaluate the significance of any threat created by the
provision of such services.
In some cases, it may be possible to eliminate or reduce the threat created by the application
of safeguards. In other cases no safeguards are available to reduce the threat to an
acceptable level.
(b) A valuation comprises the making of assumptions with regard to future developments, the
application of certain methodologies and techniques, and the combination of both in order to
compute a certain value for an asset.
A self-review threat may be created if Yu & Yu performs a valuation for the assets of La’Monsa
that are to be incorporated into the financial statements for the year ended
31 December 20X6.
If the valuation service involves the valuation of matters material to the financial statements
and the valuation involves a significant degree of subjectivity, the self review threat could not
be reduced to an acceptable level by the application of any safeguard. Accordingly, such
valuation services should be not provided; alternatively, the only course of action would be to
withdraw from the financial statement audit engagement.
If the brand and the machinery and equipment are material, Yu & Yu cannot accept the
engagement to provide valuation services unless they withdraw from the financial statement
audit engagement.
143
Business Assurance
It is not easy to quote a market price for the brand. The valuation may involve a significant
degree of subjectivity in the assumptions regarding future developments of the business after
merger with another company. It is not advisable to accept the valuation of the brand for
La’Monsa.
If the services are neither material to the financial statements nor involving a significant degree
of subjectivity, the self-review threat could be reduced to an acceptable level by the application
of safeguards.
The net realisable value of plant and machinery can be quoted from the market. If the value of
the machinery and equipment is not material, and net realisable value rather than value in use
(which entails a significant degree of subjectivity in the assumptions regarding future
developments of the business after merger with another company) is adopted in the valuation,
Yu & Yu could reduce the self-review threat by applying the following safeguards:
Involving an additional professional accountant who was not a member of the
assurance team to review the work done or otherwise advise as necessary;
Obtaining La’Monsa’s acknowledgement of responsibility for the results of the work
performed by Yu & Yu; and
Making arrangements so that personnel providing such services do not participate in the
audit engagement.
Answer 3
Management has decided not to recall any products and this indicates problems with management
integrity. The defects in the products have potential effects on Johnco’s customers. It would still be
ethically appropriate to announce the problem, allowing customers to return potentially harmful
products. There might be still inventories that are defected in Johnco’s warehouses, waiting to be
sold. Professional accountants should try to explain to management the reasons why they should
disclose and should convince management that this is the way to proceed.
If management still refuse to make a disclosure, the professional accountants should consider their
obligatory duty of confidentiality. The HKICPA’s Code of Ethics recognises that information
discovered while performing a professional engagement must not be disclosed without the entity’s
consent unless there is a legal or professional right or duty to disclose.
In deciding whether to disclose in the public interest, the professional accountants should consider
the reasons for the entity’s unwillingness to disclose, the materiality of the matter ie the probability of
harm being caused to the customers, and the relevant laws and regulations being breached.
The professional accountants could consider the option of resigning from the audit. The firm could
inform audit committee or board of directors the reason for the resignation, including details of the
faulty products, disagreements with the management and the lack of management integrity.
Finally, the lack of management integrity also affects on the nature, extent and timeliness of audit
procedures that are currently being planned. Any defective inventory still held by Johnco should be
written off as obsolete goods, and provisions may be necessary for refunds of returned products or
future claims by customers. The financial statements may need to contain disclosures relating to
contingent liabilities, or provisions may need to be recognised in respect of damages claimed by
customers in the event of any injuries occurring and legal action being taken against Johnco.
144
4: Code of Ethics | Part C Professional standards and guidance
Answer 4
(a) Washington – ethical issues
In accordance with the Code of Ethics, MKJ & Co should consider ethical issues in its entity
acceptance procedures. In considering accepting Washington as its client entity, MKJ & Co
should consider any relevant threats to independence which may impair the firm’s objectivity
and independence.
Self-interest threat
There are no details mentioned regarding the fee income obtained from Washington.
However, as Washington will soon list, MKJ should ensure no more than 10%of its recurring
practice income (assuming advisory work, taxation and consultancy work to be performed
annually) should be derived from Washington. Obtaining over 10% could indicate undue
dependence on an entity and objectivity would be likely to be impaired resulting in a self-
interest threat.
MKJ & Co should review its proposed fee and should consider whether it should limit other
services so that independence is not impaired. An annual review would be required on
Washington if the fee is close to 10% of its total fee.
Self-review threat
A self review threat may be created when MKJ & Co provides advisory work and consultancy
work for Washington, especially when the works are on financial accounting.
Familiarity threat
The familiarity threat may occur when there exists a close relationship with an entity, its
directors, officers or employees; a firm or a member of the assurance team becomes too
sympathetic to the entity’s interest.
In accordance with the facts, Mr. Otto, Washington’s Financial Controller is an old friend of
one of the senior partners, Mr. Man. The firm should consider whether a different partner
should take the lead on Washington’s work.
Conflict of interest
Within MKJ & Co’s portfolio, there is an entity who is also a competitor of Washington. There
is nothing improper in a firm having two or more entities whose interests are in dispute, as
long as the work the firm does is not the subject of the dispute.
In this case, MKJ & Co’s work should be managed so as to avoid the interests of one entity
adversely affecting the other. The firm should review its relationship with prospective entity ie
Washington and the rival entity before accepting/continuing the engagement. If a material
conflict of interest is identified, the firm should disclose sufficient information to entities so that
they can make an informed decision as to whether to continue with the firm.
Advocacy threat
Since Washington is about to list, if MKJ & Co agrees to attend the cocktail party, there may
be threats to independence through an advocacy threat. This occurs when the firm may be
perceived to be a promoter of shares in Washington, as the prospectus is being distributed
during the party. The firm should consider how likely this perception is, for example, whether
their name appears on the prospectus or the party invitation. In addition, they should consider
whether hospitality at an “extravagant cocktail party” is “clearly insignificant”.
145
Business Assurance
(b) Safeguards
Self-interest threat – fee
MKJ & Co should start monitoring when the fee is approaching 10% of its total fee of the firm.
If there is undue dependence on Washington, MKJ should be selective of the engagements.
MKJ & Co should install appropriate safeguards especially the firm should not act in the
management role, making managerial decisions. The rule should be strictly complied with as
Washington will be listed in next financial year.
Familiarity threat
A familiarity threat may have been created. Mr. Man should not be assigned as the
engagement partner on the audit.
One of the audit seniors has become an employee of Washington, however since the
employee is to become Human Resources Manager, there is very little direct and significant
influence over the financial accounting aspect. MKJ & Co may instruct the partner in charge to
modify the audit plan normally used as a safeguard, but this appears to be an insignificant risk.
Conflicts of interest
Some of the most common safeguards to manage this conflict of interest would be using
different engagement teams to handle Washington’s work and its rival’s work. The firm should
have standing instructions to prevent the leakage of confidential information or prevent access
to information.
Advocacy threat
MKJ & Co should not participate in any activities relating to the promotion of the shares of
Washington and should make clear to Washington’s management that they cannot be
perceived to.
146
4: Code of Ethics | Part C Professional standards and guidance
Answer 5
(a) Ethical issues
Since Simon is a salaried employee of DEF, Simon is a professional accountant in business
and is required to comply with the Code of Ethics for Professional Accountants.
A professional accountant in business should prepare or present financial and other
information fairly, honestly and in accordance with relevant professional standards.
Financial and non-financial information should be maintained in a manner that describes
clearly the true nature of business transactions, assets or liabilities and classifies and records
entries in a timely and proper manner.
Self-interest or intimidation threats may occur where a professional accountant in business
may be pressured (either externally or by the possibility of personal gain) to become
associated with misleading information or to become associated with misleading information
through the actions of others.
In this case, Mr. Chan’s request for Simon to falsify certain documents and accounting records
of DEF in return for a favourable assessment for Simon’s bonus and promotion evaluation for
the current year represents a self-interest threat.
Also, Mr. Chan’s threat to replace Simon if Simon does not accede to the request represents
an intimidation threat.
(b) Actions to be taken
Since Mr. Chan is the CEO and major shareholder of DEF, it is inappropriate to report the
fraud or suspected fraud to other senior management who are actually Mr. Chan’s
subordinates.
As Mr. Chan is also the Chairman of the board of directors, reporting the matter to the
Chairman of the board of directors might not be desirable for Simon either.
DEF is a listed company and all listed companies in Hong Kong are required to establish an
audit committee, of which the Chairman should be an independent non-executive director.
Simon should thus report the matter to the Chairman of the audit committee.
As a last resort, Simon may consider making a report to an appropriate external authority such
as the police or the ICAC in line with the ethical guidance on the duty of confidentiality.
When in doubt, Simon is recommended to seek legal advice.
Simon should be aware that he himself commits a criminal offence if he helps Mr. Chan in the
planning or execution of his plan to misappropriate DEF’s $1 billion cash.
Simon should also be aware that he may incur civil liability to third parties if he is involved in
Mr. Chan’s unlawful conduct by assisting him in the planning or execution of the unlawful
conduct.
147
Business Assurance
Exam practice
DEL 21 minutes
Carol is a CPA working in Yvonne & Zoe CPA (“Y&Z”) as a manager in charge of the audit of Daisy
Emma Limited (“DEL”) for the year ended 30 June 20X1. DEL, which is not a public interest entity,
has recently offered Carol a part-time position as the company secretary to commence as soon as
possible.
Carol accepts DEL’s offer this week on the grounds that she will only be required to carry out routine
administrative services to support the corporate secretarial function and to make decisions in respect
of corporate secretarial matters at the annual general meeting. In addition, Carol considers that
Y&Z’s audit report on DEL’s financial statements will be signed by her audit partner, and Carol is not
an audit partner at Y&Z.
Having been formally appointed as DEL’s company secretary this week, Carol thinks she ought to
discuss the matter with Yvonne (who is Y&Z’s partner in charge of the audit of DEL) in order to
implement certain safeguards just in case of any possible conflict of interest.
Required
(a) Analyse the situation of Carol in the context of the HKICPA’s ethical requirements. (8 marks)
(b) Discuss any safeguards or actions Yvonne could implement in order to reduce the threats
against the HKICPA’s ethical requirements to an acceptable level. (4 marks)
(Total = 12 marks)
HKICPA June 2012
148
chapter 5
1 Overview of the Hong Kong Framework for 4 Reviews and other assurance engagements
Assurance Engagements 4.1 Review engagements
1.1 Hong Kong Framework for Assurance 4.2 Assurance engagements not dealing
Engagements with historical financial information
1.2 Adherence to professional standards 4.3 Investment circular reporting
and guidance engagements
2 Assurance engagements 5 Non-assurance engagements
2.1 Purposes of an assurance engagement
2.2 Elements of an assurance engagement
2.3 Assurance engagement or not?
2.4 Types of assurance engagements
2.5 Accepting and continuing appointment
3 The purpose of external audit engagements
3.1 Objective of external audit
3.2 Materiality
3.3 Professional scepticism
Learning focus
This chapter explains the basis of auditing and the distinction between audit and other review
assignments. Students are expected to know the Framework that governs these assurance
engagements.
149
Business Assurance
Learning outcomes
Competency
level
1.02 Professional standards and guidance 3
1.02.01 Explain the importance of adherence to professional standards and
guidance
1.03 Legal and regulatory framework governing the profession 3
1.03.01 Explain the regulatory framework for assurance and non-assurance
engagements in Hong Kong
1.03.02 Explain the nature and purpose of assurance and non-assurance
engagements
150
5: Framework for assurance engagements Part C Professional standards and guidance
The Hong Kong Institute of CPAs (HKICPA) is pursuing a policy of achieving convergence with
International Standards issued by the International Auditing and Assurance Standards Board
(IAASB). Hong Kong Clarified Pronouncements on Auditing are issued in response to the IAASB's
Clarity Project to improve the understandability of auditing standards.
The following table shows the list of Hong Kong Standards on Quality Control, Auditing, Assurance
and Related Services in issue at 31 May 2013:
151
Business Assurance
152
5: Framework for assurance engagements Part C Professional standards and guidance
These standards will be referred to later in this Learning Pack when detailed auditing issues are
introduced.
153
Business Assurance
2 Assurance engagements
Topic highlights
Assurance engagements may give reasonable assurance or limited assurance.
Key term
An assurance engagement is an engagement in which a practitioner expresses a conclusion
designed to enhance the degree of confidence of the intended users other than the responsible
party about the outcome of the evaluation or measurement of a subject matter against criteria.
The outcome of the evaluation or measurement of a subject matter is the information that results
from applying the criteria to the subject matter.
INTENDED USERS
Shareholders
Auditors (the practitioners) provide assurance to intended users (shareholders) about a subject
matter (the financial statements) that is the responsibility of a responsible party (the board of
directors).
The intended user is the person for whom the auditors prepare a report for a specific use or
purpose – usually the shareholders and others users that can be established by law.
154
5: Framework for assurance engagements Part C Professional standards and guidance
The “responsible party” is the person (or persons) who is responsible for the subject matter (in a
direct reporting engagement) or subject matter information of the assurance engagement.
(Refer also to B Kwok in his book, Financial Analysis in Hong Kong, for the tripartite relationship of
audit.)
155
Business Assurance
Control risk: the risk that a material misstatement that could occur will not be prevented, or
detected and corrected, on a timely basis by related internal controls. When control risk is relevant
to the subject matter, some control risk will always exist because of the inherent limitations of the
design and operation of internal control.
Detection risk: the risk that the practitioner will not detect a material misstatement that exists.
We shall look at the above risks in more detail in Chapter 8.
Topic highlights
HKSAE 3000 Assurance Engagements other than Audits or Reviews of Historical Financial
Information refers to two types of engagement: “reasonable assurance engagement” and “limited
HKSAE assurance engagement”. Remember that absolute assurance can never be given on an assurance
3000.2
engagement due to the inherent limitations of such engagements.
“Assurance” here means the professional accountants' satisfaction as to the reliability of the
assertion made by one party for use by another party.
Key term
Reasonable assurance in the context of an audit of financial statements is a high, but not an
absolute, level of assurance.
HKSA Professional accountants have gained sufficient appropriate evidence to conclude the subject
200.13m
matter conforms in all material aspects with identified suitable criteria. Professional accountants
should design the engagement so that the risk of expressing an inappropriate conclusion that
the subject to reduce risk of inappropriate conclusion respects with suitable criteria is reduced to an
acceptably low level. Reasonable assurance relates to the whole audit process.
For example, an audit provides a reasonable assurance level but not absolute assurance and the
report contains a positive assurance on assertions for example, “the financial statements give a
true and fair view of …”.
156
5: Framework for assurance engagements Part C Professional standards and guidance
The standard requires that practitioners ensure they comply with the Code of Ethics for
Professional Accountants and the Quality Control Standard (HKSQC 1 (Clarified)) with regard to
the assignment.
Key term
The objectives of an audit are:
(a) to obtain reasonable assurance about whether the financial statements as a whole are
free from material misstatement, whether due to fraud or error, thereby enabling the
auditor to express an opinion on whether the financial statements are prepared, in all
material respects, in accordance with an applicable financial reporting framework: and
(b) to report on the financial statements, and communicate as required by HKSAs, in
accordance with the auditor’s findings.
157
Business Assurance
158
5: Framework for assurance engagements Part C Professional standards and guidance
Key terms
True: Information is factual and conforms with reality. In addition, the information conforms with
required standards and law. The financial statements have been correctly extracted from the books
and records.
Fair: Information is free from discrimination and bias and in compliance with expected standards
and rules. The financial statements should reflect the commercial substance of the entity's
underlying transactions.
The professional accountant's task is to decide whether the financial statements show a true and
fair view. Professional accountants are not responsible for establishing whether the financial
statements are correct in every particular detail. This is because it can take a great deal of time and
trouble to check the accuracy of even a very small transaction and the resulting benefit may not
justify the effort. Also financial accounting inevitably involves a degree of estimation which means
that financial statements can never be completely precise.
159
Business Assurance
3.2 Materiality
HKSA 200.6 Materiality is an expression of the relative significance or importance of a particular matter in the
financial statements as a whole.
Any matter is material if its omission or misstatements would reasonably influence the economic
decisions of users. Materiality has both quantitative and qualitative aspects. A misstatement can be
quantitatively immaterial but qualitatively material eg omission of disclosure of major litigation.
The materiality level is determined at the planning stage to ensure any material misstatement in
the financial statements can be discovered. The materiality level must be considered by the auditor
in order to determine the nature, extent and timing of audit procedures and to evaluate the effect of
misstatements discovered.
Some useful guidelines for measuring the materiality level are given below:
10% of pre-tax profits (normal criteria and applicable to most entities)
5% of gross profits (applicable to trading entities)
0.5–1% of revenue
0.5–1% of total assets (applicable to asset holding companies)
Other factors should be considered.
The assurance given by the auditor is governed by the fact that the auditor uses judgment in
deciding what audit procedures to use and what conclusions to draw, and also by the limitations
of every audit.
Key term
Professional scepticism is an attitude that includes a questioning mind, being alert to conditions
HKSA 200.15 which may indicate possible misstatement due to error or fraud, and a critical assessment of audit
evidence.
Auditors should never assume the management is dishonest but should approach the audit with a
questioning mind and a critical assessment of audit evidence, being alert to conditions which may
indicate possible misstatement due to error or fraud. The professional accountant should adopt the
following behaviours:
Plan and perform an audit with an attitude of professional scepticism
Be aware when audit evidence contradicts other audit evidence obtained
Raise awareness to audit evidence that casts doubt on the reliability of documents or
management representations
Be cautious for any suspicious and unusual circumstances that may increase the risks of
misstatement of financial statements
Avoid using unrealistic assumptions in designing audit procedures or evaluating audit
evidence
Consider the reasonableness of responses
Consider conditions that may indicate possible fraud
160
5: Framework for assurance engagements Part C Professional standards and guidance
Key term
The objective of a review engagement is to obtain limited assurance, primarily by performing
HKSRE inquiry and analytical procedures, about whether the financial statements as a whole are free from
2400.14 material misstatement, thereby enabling the practitioner to express a conclusion on whether
anything has come to the practitioner’s attention that causes the practitioner to believe the financial
statements are not prepared, in all material respects, in accordance with an applicable financial
reporting framework.
The Preface to Hong Kong Quality Control, Auditing, Review, Other Assurance and Related
Services Pronouncements (The Preface) requires that HKSREs are to be applied in the reviews of
historical financial information. HKSRE 2400 (Revised) Engagement to Review Historical Financial
Statements should be applied when a professional accountant, other than the auditor of an entity,
undertakes an engagement to review historical financial statements. When an auditor of the
reporting entity undertakes the engagement to review financial statements, the auditor should apply
HKSRE 2410 Review of Interim Financial Information Performed by the Independent Auditor of the
Entity.
The major outcome for recipients of a review engagement is that the level of assurance they gain
from it is not as high as from an audit, although the procedures carried out in a review engagement
are similar to an audit. We discuss review reports in more detail in Chapter 19.
161
Business Assurance
5 Non-assurance engagements
Topic highlights
No assurance is given for compilation or agreed-upon procedures engagements.
Self-test question 1
You are an audit senior of a CPA firm, Zeta & Partners (“Z&P”). Your manager has referred several
cases to you to follow up. You find that the situations are quite different from the audits you
normally perform and they are as follows:
(a) The Dutch holding company of A Limited (“A”) requires all of its subsidiaries to prepare
special six-month interim financial statements. However, A has insufficient accounting
resources to prepare the financial statements and requests Z&P to perform it for them.
(b) B Limited (“B”) is listed on the Stock Exchange of Hong Kong. Members of the audit
committee have resigned early in the financial year and have not been replaced yet. The
remaining members are not comfortable to review the interim report on their own. The audit
committee requests your firm to perform a review on the interim report.
(c) The firm of the Japanese holding company of C Limited (“C”), which is a private company
incorporated in Hong Kong, engaged in trading electronic components, send referral
instructions to Z&P and request Z&P to perform a review on the interim consolidation
package. In the referral instructions, the referring professional accountant requires Z&P to
perform the review in accordance with HKSRE 2410 Review of Interim Financial Information
Performed by the Independent Auditor of the Entity.
(d) D Limited (“D”) is a retail company. In accordance with the tenancy agreement, D should pay
the landlord a rent contingent on D's monthly sales revenue, evidenced by a sales certificate
verified by D's professional accountants. Z&P is asked by D to verify and to issue such a
sales certificate.
(e) The New York Office of Z&P has sent referral instructions to Z&P to attend an inventory
count on E Limited (“E”). E was incorporated in the United States and it has a liaison office
and a warehouse in Hong Kong. Significant amount of inventory is kept in the warehouse.
Therefore, it is a necessary procedure to perform the inventory count for obtaining audit
evidence. The referral instructions have included detailed procedures for the inventory count.
The fee will be allocated from the New York Office for this engagement.
Required
Explain to your audit manager the kind of services to be provided in each case. Where appropriate
state the responsible party, the intended users, subject matter information, criteria of the
engagements; and the relevant standards or other related guidance that should be followed when
Z&P performs the engagement.
(The answer is at the end of the chapter)
162
5: Framework for assurance engagements Part C Professional standards and guidance
Topic recap
ENGAGEMENT
Assurance Non-assurance
engagement engagement
163
Business Assurance
Answer
(a) The preparation of interim financial statements is not an assurance engagement. Z&P should
follow HKSQC 1 (Clarified) and HKSRS 4410 (Revised) Compilation Engagements. In
addition, the firm should consider imposing safeguards on the staff being engaged to
prepare the interim financial statements of the Company.
(b) A review of interim financial report is an example of a review of financial statements and a
form of limited/negative assurance engagement. The responsible party is the board of
directors of B and the intended users are the shareholders. The subject matter information is
the recognition, measurement, presentation and disclosure represented in the interim
financial statements. The criteria is Hong Kong Accounting Standards. Z&P should follow
HKSQC 1 (Clarified) Quality Control for Firms that Perform Audits and Reviews of Financial
Statements, and Other Assurance and Related Services Engagements, Hong Kong
Framework for Assurance Engagements and HKSRE 2400 (Revised) Engagements to
Review Historical Financial Statements.
(c) A review of an interim consolidation package is a limited assurance engagement. The
responsible party is the board of directors of C and the intended user is the auditor of C.
The subject matter information is the recognition, measurement, presentation and disclosure
represented in interim consolidation package. The criterion is the relevant accounting
standards, which may be International Accounting Standards or Hong Kong Accounting
Standards. Z&P should follow HKSQC 1 (Clarified), Hong Kong Framework for Assurance
Engagements and HKSRE 2410 Review of Interim Financial Information Performed by the
Independent Auditor of the Entity.
(d) The nature of the engagement depends on the details of the terms of engagement. Based on
the information given, the engagement is likely to be an agreed-upon procedures
engagement to provide factual findings on the amount of revenue during the period under
consideration. An agreed-upon procedures engagement is not an assurance engagement.
Z&P should follow HKSQC 1 (Clarified) and HKSRS 4400 Engagements to Perform Agreed-
Upon Procedures Regarding Financial Information.
(e) This is a referred audit work on attending an inventory count. The engagement should be
performed in accordance with the instructions. Although this is part of the audit work to be
performed for E by Z&P's office in New York, it is not an audit engagement for the purpose of
Z&P's Hong Kong office. The work should be performed in accordance with the procedures
as stated in the instructions, which are probably based on the US Auditing Standards or
ISAs. Z&P should also follow HKSQC 1 (Clarified) and HKSRS 4400 Engagements to
Perform Agreed-Upon Procedures Regarding Financial Information.
164
5: Framework for assurance engagements Part C Professional standards and guidance
Exam practice
Noble Co 18 minutes
Your friend, a director of Noble Co, has written to you, in your capacity as an auditor, seeking
clarification on several audit matters. These concern the appointment of auditors to Noble Co and
the audit procedures they are likely to carry out. The following paragraphs have been extracted
from his letter to you.
'To date Noble Co has not required a formal audit and it will not do so for the foreseeable future.
However, the shareholders are now insisting that the annual financial statements must be audited
by a firm of CPAs. I need confirmation of the primary objective of the audit of a limited liability
company and also of how our shareholders and directors should benefit from an audit.'
Required
Write a letter to your friend which:
(a) states the primary objective of the audit of a limited liability company; (2 marks)
(b) outlines how the shareholders and directors of Noble Co should benefit from an audit of the
company's financial statements by a firm of Certified Public Accountants. (8 marks)
(Total = 10 marks)
165
Business Assurance
166
Part D
Assurance engagements
This Part discusses and explores different auditing techniques and standards employed in an
assurance engagement. Students are expected to have a good understanding of them and
appreciate the rationale or limitation associated. Further, students are expected to be able to
apply what they have learnt in various practical cases.
167
Business Assurance
168
chapter 6
Quality control
Topic list
Learning focus
Issues relating to quality control are linked with both ethics and liability. In this chapter you will
study the principles and purpose of quality control and how they can be applied at firm and
individual audit level.
169
Business Assurance
Learning outcomes
Competency
level
2.06 Quality control considerations 3
2.06.01 Explain the principles and purposes of quality control of audit and
other assurance engagements
2.06.02 Identify the features of a system of quality control relevant to a
specific firm
2.06.03 Choose and explain quality control procedures that are relevant to a
specific audit engagement
2.06.04 Assess and explain whether an engagement has been performed in
line with professional standards and whether reports issued are
appropriate
170
6: Quality control | Part D Assurance engagements
Topic highlights
Audit quality is not defined in law or through regulations, nor do auditing standards provide a simple
definition.
Although not defined in law or through regulations, audit quality is necessary as the firm faces a
variety of business risks in its operations, such as:
disciplinary action against the firm from HKICPA
litigation against the firm
loss of entity due to competition, litigation or entity closure
bad publicity
Although each stakeholder in the audit will give a different meaning to audit quality, at its heart it is
about delivering an appropriate professional opinion supported by the necessary evidence and
objective judgments. Note you studied the roles of different stakeholders in more detail in
Chapter 1.
Many principles contribute to audit quality including good leadership, experienced judgment,
technical competence, ethical values, appropriate entity relationships, proper working practices and
effective quality control and monitoring review processes.
The standards on audit quality provide guidance to firms on how to put these principles into
practice.
Topic highlights
In Hong Kong, it is the Hong Kong Standard on Quality Control (HKSQC 1 (Clarified)) that ensures
that the firm and its staff comply with professional standards, and regulatory and legal
requirements.
The fact that professional accountants follow accepted auditing standards (such as HKSAs)
provides a general quality control framework within which audits should be conducted. There are
also specific quality control standards.
The quality control standard ensures all firms (regardless of size) and their staff comply with
professional standards, regulatory and legal requirements.
171
Business Assurance
Quality control policies and procedures should be implemented to maintain audit work of a high
standard. HKSQC 1 (Clarified) states that all quality control policies and procedures should be
documented and should be properly communicated to all the partners and staff.
The engagement partner should take responsibility for the overall quality on each audit
engagement to which that partner is assigned.
HKSQC 1 (Clarified) requires a firm to establish and maintain a system of quality control that
includes policies and procedures that address the issues relating to the following areas:
Leadership responsibilities for quality within the firm
Relevant ethical requirements
Acceptance and continuance of entity relationships and specific engagements
Human resources
Engagement performance (see also below, the requirements of HKSA 220 (Clarified))
Monitoring
172
6: Quality control | Part D Assurance engagements
standards and that they are encouraged to further their own professional development in order to
benefit, not only themselves, but their firm and their profession.
The standard states that the firm must provide itself with:
... “reasonable assurance that it has sufficient personnel with the capabilities, competence, and
commitment to ethical principles necessary to perform its engagements in accordance with
professional standards and applicable legal and regulatory requirements, and to enable the firm or
engagement partners to issue reports that are appropriate in the circumstances”.
173
Business Assurance
2.6.1 Consultation
The firm shall establish policies and procedures designed to provide it with reasonable assurance
that:
(a) appropriate consultation takes place on difficult or contentious matters
(b) sufficient resources are available to enable appropriate consultation to take place
(c) the nature, scope and conclusions of such consultations are documented
(d) conclusions resulting from consultations are implemented
The firm may provide itself with reasonable assurance where necessary through external
consultation with other firms, or the Institute. When there are differences of opinion on an
engagement team, a report should not be issued until the disagreement has been resolved. The
conclusions reached should be documented and implemented. Sometimes, the involvement of the
quality control reviewer may be required. The firm should have procedures in place for dealing with
and resolving differences of opinion.
Key terms
A peer review is a review of an audit file carried out by another partner in the assurance firm.
A hot review is a peer review carried out before the audit report is signed.
A cold review is a peer review carried out after the audit report is signed.
Quality reviews usually include an appraisal of working paper preparation, audit programmes,
internal control, audit reports, staff functions, scheduling, supervision, client relations, and training.
Whether a quality review will be undertaken for a specific engagement should be determined by
criteria laid down in pre-determined policies established by the firm. Quality reviews are always
undertaken on audits of the financial statements of listed entities and it is the responsibility of the
engagement partner to find a suitable reviewer to undertake the work and ensure any contentious
matters are resolved before the auditors' report is issued. The review will include an evaluation of
any significant judgments made by the assurance team during the engagement and discussion of
any matters which arise. The firm must also have procedures in place by which it can assess
whether other engagements require review (ie those other than listed entities).
Each firm will have an established format for the quality control reviews it carries out: within this
prescribed format standards will be laid down for the nature, timing and extent of the review, what
qualifications and personal qualities need to be demonstrated by the reviewer and how the
outcomes and processes of the review should be documented.
Nature, timing and Usually the review includes discussion with the engagement partner,
extent review of the financial statements or other subject matter information
and the report. It will consider whether the final opinion is appropriate.
There may also be a review of working papers relating to the most
significant judgments made.
Eligibility The reviewer must through their technical expertise and independence
be qualified to undertake the review.
Documentation Documentation must show that the firm's criteria for a review were met,
that the review was finalised before the report was issued and include
a representation that the reviewer is not aware of any unresolved
issues.
174
6: Quality control | Part D Assurance engagements
2.7 Monitoring
HKSQC1.48 The standard states that firms must have policies in place to ensure that their quality control
procedures consistently meet the following criteria:
Quality control procedures are: Quality control procedures:
Relevant, and Operate effectively
Adequate
Effectively the standard requires firms to continually evaluate and, where necessary, improve their
quality controls to ensure that they consistently achieve high standards, reporting to senior
management on the findings of quality monitoring.
There are two types of monitoring activity:
Ongoing evaluation of the system An ongoing evaluation might include such questions as, “has it
of quality control kept up to date with regulatory requirements”?
Periodic inspection of a sample of A period inspection cycle would usually take place over a
completed engagements period of say, three years, in which time, at least one
engagement per engagement partner would be inspected.
The staff responsible for monitoring the control system are also required to evaluate the impact of
any deficiencies identified. If the deficiencies are found to be single occurrences as a result of a
specific set of circumstances corrective action might not be needed. Monitors are more concerned
with systematic or repetitive deficiencies that require corrective action to strengthen
performance and the reliability of internal controls in the future.
From time to time monitoring may highlight evidence that suggests an inappropriate opinion might
have been issued in the auditors' report, and the firm may wish to seek legal advice. Where this is
the case, the firm should follow the recommendations of their counsel.
The firm should also have policies and procedures in place in how to deal with complaints or
allegations that the firm has failed to comply with professional standards including a process for
investigating and defending these claims. Findings should be fed back into the quality control
system to strengthen it in the future.
175
Business Assurance
Self-test question 1
You established your own CPA practice six years ago which has now grown into a 15-staff firm.
Your firm has been the auditor of an unlisted company, PQR Investment Limited (“PQR”), for six
years. The shareholders of PQR have recently injected HK$90 million of new capital into PQR with
a view to acquiring companies in India, Thailand and Japan.
Required
Discuss what your CPA firm should consider before continuing to serve as the auditor of PQR in
the forthcoming year. In particular, your discussion should be put in the context of PQR’s
circumstances.
(13 marks)
HKICPA June 2011
(The answer is at the end of the chapter)
Topic highlights
HKSA 220 (Clarified) requires firms to implement quality control procedures over individual audit
engagements.
HKSA 220 (Clarified) Quality Control for an Audit of Financial Statements sets down requirements
regarding quality control on individual audits. This HKSA applies the general principles of the
HKSQC 1 (Clarified). The engagement team should implement quality control procedures that are
applicable to the individual audit engagement under the direction of the audit engagement partner.
The objective of the auditor is to implement quality control procedures at the engagement level that
provide the auditor with reasonable assurance that the audit complies with professional standards
and applicable legal and regulatory requirements and that the auditor’s report issued is appropriate
in the circumstances.
The engagement partner shall take responsibility for the overall quality on each audit engagement
to which that partner is assigned.
Engagement partners should emphasise the importance of audit quality and the fact that quality is
essential in performing audit engagements to the engagement team such as:
performing work that complies with professional, regulatory and legal requirements;
complying with the firm's quality control policies and procedures;
176
6: Quality control | Part D Assurance engagements
The engagement partner should be on constant alert for evidence of non-compliance with the
ethical Code and any threats to the independence of the assurance team. Inquiry and observation
on ethical matters among the engagement partner and other members of the engagement team
may occur as often as is deemed necessary throughout the audit engagement. If matters come to
the engagement partner's attention through the firm's systems or otherwise that indicate that the
independence of a member of the engagement team is in any way compromised, the partner
should consult with other senior members of the firm to devise an appropriate course of action,
which may include removal of the individual from the team, appropriate disclosures to the entity or
other safeguards which you studied in detail in Chapter 3.
177
Business Assurance
3.5.1 Direction
It is the engagement partner who gives overall direction to the audit. Other auditing standards list
among his responsibilities the requirement to holds a meeting with the engagement team to
discuss the audit scope and plan, in particular the associated risks. This standard suggests that
direction includes reminding or informing members of the engagement team of:
their responsibilities (including objectivity of mind and professional scepticism)
objectives of the work to be performed
the nature of the entity's business
risk-related issues
problems that may arise
the detailed approach to the performance of the engagement
3.5.2 Supervision
The audit is supervised overall by the engagement partner, but at an operational level supervision
is given by senior team members to more junior members. More experienced members of the team
will also review the work carried out by more junior members at appropriate stages during the
engagement. The reviews should include the following:
(a) Monitoring the progress of the audit engagement
(b) Reviewing the capabilities and competence of individual team members, including whether
they have sufficient time and understanding to carry out their work competently and within
the audit plan
(c) Addressing significant issues arising during the audit engagement and modifying the audit
plan if necessary
(d) Identifying matters to be referred to more experienced engagement team members
3.5.3 Review
Review includes consideration of whether the following requirements have been met:
(a) The work has been performed in accordance with professional standards and regulatory and
legal requirements
(b) Significant matters have been raised for further consideration
(c) Appropriate discussions have taken place, any conclusions have been documented and
implemented
(d) There is a need to revise the nature, timing and extent of work performed
(e) The work performed supports the conclusions reached and is appropriately documented
(f) The evidence obtained is sufficient and appropriate to support the auditor's report
(g) The objectives of the engagement procedures have been achieved
Before the audit report is issued, the engagement partner must be sure that sufficient and
appropriate audit evidence has been obtained to support the audit opinion.
3.5.4 Consultation
The engagement partner should be satisfied that members of the engagement team have
undertaken appropriate consultation on any contentious matter. This may be within the
178
6: Quality control | Part D Assurance engagements
engagement team, or between the engagement team and others at the appropriate level either
within or outside the firm. The technical partner or a panel of partners may be involved.
The engagement partner should be involved in these consultations and be satisfied that the
matters are resolved satisfactorily and any actions are documented and implemented.
From time to time differences of opinion may arise between the engagement partner and the team,
or between the engagement partner and the quality control reviewer. The firm should have an
established procedure for resolution of differences of opinion.
179
Business Assurance
3.6 Monitoring
HKSA 220.23 The audit engagement partner is required to take account of the results of monitoring the firm's
quality control systems and consider whether they have any impact on the specific audit to which
he is assigned. The engagement partner considers:
whether deficiencies noted in that information may affect the audit engagement; and
whether the measures the firm took to rectify the situation are sufficient in the context of that
audit.
Self-test question 2
You are an audit senior working for the firm Chan & Chan. You are currently carrying out the audit
of Kleaner Co (“Kleaner”), a manufacturer of waste paper bins. You are unhappy with Kleaner's
inventory valuation policy and have raised the issue several times with the audit manager who has
dealt with the entity for a number of years and does not see what you are making a fuss about. He
has refused to meet you on site to discuss these issues.
The former engagement partner to Kleaner retired two months ago. As the audit manager had dealt
with Kleaner for so many years, the other partners have decided to leave the audit of Kleaner in his
capable hands.
Required
What are the quality control issues arising in the situation above?
(The answer is at the end of the chapter)
180
6: Quality control | Part D Assurance engagements
Topic recap
– Leadership – Direction
– Ethics – Supervision
– Acceptance / continuing – Review
– Human resources – Consultation
– Engagement performance – Quality control review
– Monitoring
181
Business Assurance
Answer 1
HKSQC 1 (Clarified) Quality Control for Firms that Perform Audits and Reviews of Financial
Statements, and Other Assurance and Related Services Engagements requires your firm to
consider and document certain matters before continuing to serve as PQR’s auditor.
Those matters include:
the integrity of PQR (ie its shareholders, directors and management);
whether your firm is competent to do the work; and
whether your firm meets ethical requirements in relation to the work.
There is no clear evidence compromising the integrity of PQR even though you may question the
source of the new funding into PQR.
As your firm has been the auditor of PQR for six years, competency is not likely to be questioned.
However, the increase of PQR’s scale of activities and its forthcoming overseas acquisitions may
challenge your firm’s competency.
Challenges may include the industries, locations and sizes of those companies being acquired as
well as the forms of investments (eg equity, debt or quasi-equity) and the availability of properly
audited financial statements.
Being associated with PQR (as its auditor) for six years may indicate a close relationship. However,
it is not entirely clear if the extent of relationship may pose any familiarity threat to your firm.
You should be satisfied that appropriate procedures regarding the continuance of client relationship
and audit engagement with PQR have been followed, and that conclusions reached in this regard
are appropriate and have been documented.
Answer 2
Several quality control issues are raised in the scenario:
Engagement partner
An engagement partner is usually appointed to each audit engagement undertaken by the firm, to
take responsibility for the engagement on behalf of the firm. Assigning the audit to the experienced
audit manager is not sufficient.
The lack of an audit engagement partner also means that several of the requirements of HKSA 220
(Clarified) about ensuring that arrangements in relation to independence and directing, supervising
and reviewing the audit are not in place.
Conflicting views
In this scenario the audit manager and the audit senior have conflicting views about the valuation of
inventory. This does not appear to have been handled well, with the audit manager refusing to
discuss the issue with the audit senior.
HKSA 220 (Clarified) requires that the audit engagement partner takes responsibility for settling
disputes in accordance with the firm's policy in respect of resolution of disputes as required by
HKSQC 1 (Clarified). In this case, the lack of an engagement partner may have contributed to this
failure to resolve the disputes. In any event, at best, the failure to resolve the dispute is a breach of
the firm's policy under HKSQC 1 (Clarified). At worst, it indicates that the firm does not have a
suitable policy for resolving such disputes as required by HKSQC 1 (Clarified).
182
6: Quality control | Part D Assurance engagements
Exam practice
183
Business Assurance
(8) A typical product of ABC has a two-year use-by-date from the date of production.
(9) Inventory levels of one product line, Series X, have increased steadily throughout the year
under review. ABC's management assured you that since this is a new line, it would take
time for the market to get used to it.
(10) The recent launch of a new product, Z, resulted in poorer than expected sales.
Consequently, ABC has excess inventory in finished goods, amounting to HK$3,800,000.
The use-by-date of this product is eleven months after the reporting date.
Required
In accordance with HKSQC 1 (Clarified) and HKSA 220 (Clarified):
(a) Explain the engagement partner's responsibility regarding compliance with the
independence requirements; and (5 marks)
(b) Determine whether the familiarity threat has been properly addressed in this audit
engagement. (3 marks)
(Total = 8 marks)
HKICPA May 2005 (amended)
184
chapter 7
Changes in auditor
appointment
Topic list
Learning focus
It is very important for professional accountants to understand the rules with regard to the
appointment of auditors and changes in auditors. The contents of an engagement letter can
be vitally important if there is subsequently a dispute between auditor and client as to the
nature of the engagement. Consequently, it should never be regarded as routine
correspondence.
185
Business Assurance
Learning outcomes
Competency
level
2.03 Client and engagement acceptance procedures 3
2.03.01 Explain the reasons why entities change their auditors /
professional accountants
2.03.02 Explain the requirements relating to the appointment of auditors
under the Hong Kong Companies Ordinance
2.03.03 Explain the procedure for a change of auditors
2.03.04 Explain the rights of the auditors in the process of a change of
auditors
2.03.05 Explain the professional clearance procedures
2.03.06 Explain the matters to be considered and the procedures that an
audit firm/professional accountant should carry out before
accepting a specified new client/engagement including:
2.03.06.01 Client acceptance
2.03.06.02 Engagement acceptance
2.03.06.03 Agreement of the terms of engagement
2.03.07 Identify the issues relating to the agreement of the scope and
terms of an engagement with a client
2.03.08 Explain the procedures for the transfer of books, papers and
information following a new appointment
186
7: Changes in auditor appointment | Part D Assurance engagements
2 Appointment of auditors
Topic highlights
The Hong Kong Companies Ordinance sets out the legal requirements associated with the
appointment and removal of auditors.
187
Business Assurance
Under s. 131(1) of the Hong Kong Companies Ordinance, every company must appoint an auditor
at its Annual General Meeting (AGM) to hold office from the conclusion of that meeting until the
conclusion of the next AGM. By s. 131(2) of the Hong Kong Companies Ordinance, if an auditor is
not appointed or reappointed at the AGM, any member of the company may submit an application
to the court for the appointment of auditor.
According to s. 131(5) of the Hong Kong Companies Ordinance, the directors may appoint the
auditor to fill a casual vacancy. This arises on disqualification, removal or resignation of the auditor
before the end of term. The auditor being appointed by the company must be qualified and must
not have been previously disqualified from acting as an auditor. The auditor must also hold a
practising licence issued under the Professional Accountants Ordinance.
Topic highlights
The Hong Kong Companies Ordinance gives auditors both rights and duties. This allows auditors
to have sufficient power to carry out an independent and effective audit.
The rights and duties of auditors are set out in the Hong Kong Companies Ordinance, to ensure
that the auditors have sufficient power to carry out an effective audit.
188
7: Changes in auditor appointment | Part D Assurance engagements
189
Business Assurance
190
7: Changes in auditor appointment | Part D Assurance engagements
Dear Sirs
We have been nominated to act as auditors of …………………….. Limited.
In order to assist us in determining whether to accept such nomination, we should be grateful if you
would advise if there are any circumstances surrounding the proposed change of which we should
be aware.
Yours faithfully,
Self-test question 1
Engineering Materials Manufacturing Company Limited is a company listed on the Hong Kong
Stock Exchange. Engineering Materials Manufacturing Company and its subsidiaries (“EMM”), are
principally engaged in the manufacture and trading of engineering materials, including steel, iron,
aluminium, cement, timber and asphalt. EMM’s customers are mainly construction and engineering
companies in Mainland China, Hong Kong and other Asian countries. As at 31 December 20X6,
over 90% of EMM’s assets were located in Mainland China.
In view of the booming economy in Mainland China, EMM embarked on an expansion plan two
years ago to double the group’s revenue within five years. EMM plan to implement this strategy
through acquisition of other manufacturers as well as setting up new plant in strategic locations in
the Mainland. In the last two years, an increasing trend in revenue and receivables has been noted.
On 21 December 20X6, EMM succeeded in issuing debentures of US$130,000,000 at an interest
rate of 9.5% per annum. The debentures are listed on an overseas exchange. The proceeds
received were used partly to repay bank loans when they were due, while the remaining cash was
kept in banks in Mainland China.
EMM’s previous auditor, XYZ & Co, was re-appointed in April 20X6 after it reported on EMM’s
financial statements for the year ended 31 December 20X5. However, XYZ & Co resigned in
November 20X6.
XYZ & Co had proposed a fee which doubled the fee it charged EMM in the last year but EMM did
not accept the increment. According to EMM, they wanted to change auditors periodically to ensure
independence. According to XYZ & Co, the firm is prepared to rotate the engagement partner in
accordance with quality control standards.
The directors of EMM approached ABC & Co in January 20X7 and proposed to appoint them as
the auditor of EMM’s financial statements for the year ended 31 December 20X6.
191
Business Assurance
Required
Determine XYZ & Co’s ethical obligations in relation to the change in auditors.
HKICPA May 2007 (amended)
(The answer is at the end of the chapter)
Topic highlights
HKSQC 1 (Clarified) sets out what a firm must consider and document in relation to accepting or
continuing an engagement which is the integrity of the entity, whether the firm is competent to do
the work and whether the firm meets ethical requirements in relation to the work.
HKSQC1.26
HKSQC 1 (Clarified)
The firm shall establish policies and procedures for the acceptance and continuance of entity
relationships and specific engagements designed to provide the firm with reasonable assurance
that it will only undertake or continue relationships and engagements where it:
(a) has considered the integrity of the entity and does not have information that would lead it
to conclude that the entity lacks integrity
(b) is competent to perform the engagement and has the capabilities, time and resources to do
so, and
(c) can comply with relevant ethical requirements.
The firm should obtain such information as it considers necessary in the circumstances before
accepting an engagement with a new entity, when deciding whether to continue an existing
engagement, and when considering acceptance of a new engagement with an existing entity.
Where issues have been identified, and the firm decides to accept or continue the entity
relationship or a specific engagement, it should document how the issues were resolved.
192
7: Changes in auditor appointment | Part D Assurance engagements
(h) Consider unusual high business risk – any complex transactions, aggressive deals or
attitude towards matters such as aggressive interpretation of accounting standards or the
internal control environment
(i) Consider management's attitude towards compliance with regulatory or contractual
obligations
(j) Consider any indication of money laundering or other criminal activities committed by
management
For an existing entity, the firm should consider its ability to continue the engagement and if there is
any significant change in management/financial condition which affects the firm's ability to
continue the relationship. The firm should reassess the integrity of management if there is a
change in management.
193
Business Assurance
Matters to consider
Integrity of The identity and business reputation of the entity's principal owners, key
an entity management, related parties and those charged with governance
Nature of the entity's operations, including its business practices
Information concerning the attitude of the entity's principal owners, key
management, those charged with governance towards matters such as
aggressive interpretation of accounting standards/internal control
environment
Whether the entity is aggressively concerned with keeping the firm's fees
as low as possible
Indications of an inappropriate limitation in the scope of work
Indications that the entity might be involved in money laundering or other
criminal activities
The reasons for the proposed appointment of the firm and non-
reappointment of the last appointed auditors
Identity and business reputation of related parties
Competence Do firm personnel have knowledge of relevant industries/subject matters?
of the firm
Do firm personnel have experience with relevant regulatory or reporting
requirements, or the ability to gain the necessary skills and knowledge
effectively?
Does the firm have sufficient personnel with the necessary capabilities and
competence?
Are experts available, if needed?
Will staff need further training to do the work?
Are individuals meeting the criteria and eligibility requirements to perform
the engagement quality control review available where applicable?
Is the firm able to complete the engagement within the reporting deadline?
In addition, the firm needs to consider whether acceptance would create any conflicts of interest.
HKSQC1 (Clarified)
The firm shall establish policies and procedures on continuing an engagement and the client
relationship, addressing the circumstances where the firm obtains information that would have
caused it to decline the engagement had that information been available earlier. Such policies and
procedures shall include consideration of:
(a) the professional and legal responsibilities that apply to the circumstances, including whether
there is a requirement for the firm to report to the person or persons who made the
appointment or, in some cases, to regulatory authorities, and
(b) the possibility of withdrawing from the engagement or from both the engagement and the
entity relationship.
Such procedures might include discussions with the entity's management and those charged with
governance, and, if required, discussions with the appropriate regulatory authority.
There are requirements for the engagement partner in relation to specific engagements as follows:
194
7: Changes in auditor appointment | Part D Assurance engagements
Self-test question 2
(a) You are a partner in Talent and Co (“Talent”), a firm of Certified Public Accountants. You
have just successfully tendered for the audit of Lunch Co (“Lunch”), a chain of sandwich
shops. The tender opportunity was received cold, that is, the entity and its officers are not
known to the firm. The entity has just been incorporated and has not previously had an audit.
You are about ready to accept nomination.
Required
Explain the procedures should you carry out prior to accepting nomination.
(b) In the course of your acceptance procedures you received a reference from a business
contact of yours concerning one of the five directors of Lunch, Mr Lau. It stated that your
business contact had done some personal tax work for Mr Lau ten years previously, when he
had found Mr Lau to be difficult to keep in contact with, slow to provide information and he
had suspected Mr Lau of being economical with the truth when it came to his tax affairs. As a
result of this distrust, he had ceased to carry out work for him.
Required
Comment on the effect this reference would have on accepting nomination.
(The answer is at the end of the chapter)
195
Business Assurance
CONSIDER:
Ethical issues (the Code)
Legal and technical barriers; and
Management integrity
PROCEDURES: PROCEDURES:
Obtain details of last appointed auditors Consider ability to serve
Consult last appointed auditors Consider any significant change
Review available financial statements Consider change in management
Inquire of a third party
196
7: Changes in auditor appointment | Part D Assurance engagements
4 Engagement letters
Topic highlights
Certain issues must be agreed in writing when an audit is accepted.
197
Business Assurance
198
7: Changes in auditor appointment | Part D Assurance engagements
In addition, there are certain other matters which, according to the circumstances, may need
to be dealt with in our report. For example, where the financial statements do not give
details of directors' remuneration or of loans to officers, the Companies Ordinance requires
us to disclose such matters in our report.
3.2 We have a professional responsibility to report if the financial statements do not comply in
any material respect with [insert applicable financial reporting framework] [Hong Kong
Financial Reporting Standards][Hong Kong Financial Reporting Standard for Private
Entities], unless in our opinion the noncompliance is justified in the circumstances.
In determining whether or not the departure is justified, we consider:
a. whether the departure is required in order for the financial statements to give a true and
fair view; and
b. whether adequate disclosure has been made concerning the departure.
Scope of audit
4.1 Our audit will be conducted in accordance with Hong Kong Standards on Auditing issued by
the Hong Kong Institute of Certified Public Accountants. Those standards require that we
comply with ethical requirements and plan and perform the audit to obtain reasonable
assurance about whether the financial statements are free from material misstatement.
An audit involves performing procedures to obtain audit evidence about the amounts and
disclosures in the financial statements. The procedures selected depend on the auditor’s
judgment, including the assessment of the risks of material misstatement of the financial
statements, whether due to fraud or error. An audit also includes evaluating the
appropriateness of accounting policies used and the reasonableness of accounting
estimates made by you, as well as evaluating the overall presentation of the financial
statements.
4.2 Because of the inherent limitations of an audit, together with the inherent limitations of
internal control, there is an unavoidable risk that some material misstatements may not be
detected, even though the audit is properly planned and performed in accordance with
HKSAs.
4.3 In making our risk assessments, we consider internal control relevant to the entity’s
preparation of the financial statements in order to design audit procedures that are
appropriate in the circumstances, but not for the purpose of expressing an opinion on the
effectiveness of the entity’s internal control. However, we will communicate to you in writing
concerning any significant deficiencies in internal control relevant to the audit of the financial
statements that we have identified during the audit. Any such report may not be provided to
third parties without our prior written consent. Such consent will be granted only on the
basis that such reports are not prepared with the interests of anyone other than the
company in mind and that we accept no duty or responsibility to any other party as concerns
the reports.
4.4 As part of our audit procedures, we will request you to provide written confirmation
concerning representations which we have received from you during the course of the audit
on matters having a material effect on the financial statements. In connection with
representations and the supply of information to us generally, we draw your attention to
section 134 of the Companies Ordinance.
4.5 In order to assist us with the examination of your financial statements, we shall request sight
of all documents or statements, including the chairman's statement, operating and financial
review and the directors' report, which are due to be issued with the financial statements.
We are also entitled to attend all general meetings of the company and to receive notice of
all such meetings.
199
Business Assurance
4.6 The responsibility for safeguarding the assets of the company and for the prevention and
detection of fraud, error and non-compliance with law or regulations rests with you.
However, we shall endeavour to plan our audit so that we have a reasonable expectation of
detecting material misstatements in the financial statements or books of account (including
those resulting from fraud, error or non-compliance with law or regulations), but our
examination should not be relied upon to disclose all such material misstatements or frauds,
errors or instances of non-compliance as may exist.
4.7 (Where appropriate - Note) We shall not be treated as having notice, for the purposes of our
audit responsibilities, of information provided to members of our firm other than those
engaged on the audit (for example, information provided in connection with accounting,
taxation and other services).
4.8 Once we have issued our report we have no further direct responsibility in relation to the
financial statements for that period. However, we expect that you will inform us of any
material event occurring between the date of our report and that of the Annual General
Meeting which may affect the financial statements.
(Consolidated financial statements
5. As the auditor of the holding company we are required to report, in similar terms to those
outlined in paragraph 3.1 above, on the group's consolidated financial statements, which
comprise the financial statements of the holding company and its subsidiaries. In order to
express an opinion on group's consolidated financial statements which include the financial
information of subsidiaries, joint ventures or associated companies of which we are not the
auditor, it will be necessary for us to communicate directly with the other auditor(s)
concerned to satisfy ourselves that:
a. so far as is practicable, there is uniformity within the group in the application of
accounting policies;
b. the consolidated financial statements give the information required by the Companies
Ordinance, applicable accounting standards and any other legislation or non-statutory
requirements affecting the presentation of financial statements; and
c. all material aspects of the consolidated financial statements have been subjected to an
audit examination, the nature and extent of which is adequate and reasonable, in our
view, for the purpose of forming an opinion on the group's consolidated financial
statements.)*
Reporting
6.1 [Insert appropriate reference to the expected form and content of the auditor's report.]
6.2 The form and content of our report may need to be amended in the light of our audit
findings.
(Other services
7. You have requested that we provide other services in respect of ...... The terms under which
we provide these other services are dealt with in a separate letter.)*
Fees
8. Our fees are computed on the basis of the time spent on your affairs by the partners and
our staff and on the levels of skill and responsibility involved plus out-of-pocket expenses.
Unless otherwise agreed, our fees will be billed at appropriate intervals during the course of
the audit and will be due on presentation.
Agreement of terms
9.1 Once it has been agreed, this letter will remain effective, from one audit appointment to
another, until it is replaced. Please sign and return the enclosed copy of this letter to
indicate your acknowledgement of, and agreement with, the arrangements for our audit of
the financial statements including our respective responsibilities.
200
7: Changes in auditor appointment | Part D Assurance engagements
(9.2 Since the terms of our engagement as auditors of the subsidiaries listed in the attached
appendix are the same, we will not send separate letters to the board of directors of each
subsidiary. We would therefore be grateful if you would forward copies of this letter to the
boards of directors of each such subsidiary and confirm that these boards have also agreed
and confirmed their acceptance of this letter.)*
Yours faithfully,
ABC & Co.
Certified Public Accountants (Practising) [or Certified Public Accountants]
Date
We agree to the terms of this letter.
(Signed)
................................. Director, for and on behalf of the board of
_____________________________
Date
* Delete where not applicable.
Note
When accounting, taxation or other services are undertaken on behalf of an audit client,
information may be provided to members of the audit firm other than those engaged on the audit.
In such cases, it may be appropriate for the audit engagement letter to include this or a similar
paragraph to indicate that the auditor is not to be treated as having notice, for the purposes of the
auditor's responsibilities, of such information, to make it clear that a company would not be
absolved from informing the auditor directly of a material matter.
Topic highlights
Audit working papers belong to the auditor. Sometimes, the terms “working papers” or “work
papers” are used.
HKSA 230.5,
7-11
5.1 Audit documentation
Audit documentation refers to the record of audit procedures performed, relevant audit evidence
obtained, and the conclusions the auditor reached.
In accordance with HKSA 230 (Clarified) Audit Documentation, the auditor prepares, on a timely
basis, audit documentation that provides:
a sufficient and appropriate record of the basis for the auditor's report
evidence that the audit was performed in accordance with HKSAs and applicable legal and
regulatory requirements.
HKSA 230 (Clarified) requires that the auditor prepares audit documentation on a timely basis in
order to enhance the quality of the audit. This is to allow sufficient time to review and evaluate the
audit evidence obtained and conclusions reached before the auditor's report is finalised.
201
Business Assurance
5.2 Ownership
Audit working papers are owned by the auditor. In the event of auditors taking over an audit
from another firm, they are not entitled to take over all the audit files that that firm has put together
on the entity.
The HKSA states that in order to ensure continuity of an entity's affairs, the last appointed auditors
must provide the new auditors with all the reasonable carry-over information they request, and
they should do this promptly. The last appointed auditor should ensure that he transfers all the
books and documents belonging to the entity to the new auditors without delay. He is only allowed
to keep entity's books where he is entitled to exercise a lien.
Key term
A lien is a supplier's right to retain possession of a customer's property until the customer pays
what is owed to the supplier.
If the last appointed auditor is still owed fees by the client, he may have a right under common law
to exercise a lien over some of the client's books. General liens over property can rarely be
established. However, it may be possible for an auditor to have a particular lien when a client owes
a debt specifically in respect of that property.
A right of particular lien will only exist where the following conditions are fulfilled:
The documents must be the property of the entity itself (not a closely related third party)
The documents must have come into the professional accountant's possession by proper
means
The work must have been done and a fee note rendered in respect of it
The fee must relate to the retained documents
202
7: Changes in auditor appointment | Part D Assurance engagements
The last appointed auditor shall provide promptly the requested information to the newly appointed
auditors. The information shall be relevant to the entity's affairs and no charge shall be made
unless there is good reason to the contrary.
The working papers belong to the last appointed auditor who is under no legal obligation to pass
his working papers to the newly appointed auditors for review. However, the last appointed auditor
has an ethical obligation to respond to the newly appointed auditor's specific inquiries and shall
pass the working papers relating to matters of continuing accounting significance in respect of
those specific areas.
203
Business Assurance
Topic recap
CHANGES IN AUDITOR
APPOINTMENT
Risk
– Sets out scope /
analysis
responsibilities
– Update when necessary
– Disclosure of terms
Client
screening
New Existing
client client
204
7: Changes in auditor appointment | Part D Assurance engagements
Answer 1
XYZ & Co’s ethical obligations in relation to the change in auditors of EMM are governed by the
Code of Ethics for Professional Accountants (“the Code”). In particular, XYZ & Co should comply
with the requirements of Section 441 “Change of Auditors of a Listed Issuer of the Stock Exchange
of Hong Kong” since EMM is listed on the Hong Kong Stock Exchange.
According to Section 441 of the Code, XYZ & Co should prepare a Letter of Resignation addressed
to the audit committee and the board of directors of EMM.
The Letter of Resignation should disclose all the occurrences that, in the opinion of XYZ & Co,
affect the relationship between EMM and XYZ & Co. Such occurrences include, but are not limited
to, “disagreements” and/or “unresolved issues”.
According to the Code, ABC & Co should make a request in writing to XYZ & Co to ask if there are
any unusual circumstances surrounding the proposed change which ABC & Co should be aware of,
so that ABC & Co may determine whether it should accept the nomination.
On receipt of the written request, XYZ & Co should act expeditiously. If there are no professional or
other reasons why ABC & Co should not accept the nomination, XYZ & Co should reply
accordingly without delay.
If XYZ & Co considers it appropriate to discuss EMM's affairs with ABC & Co, XYZ & Co should
request EMM’s permission to do so freely. If permission is not granted, XYZ & Co should report
that fact to ABC & Co (who should not accept the nomination).
If, in the opinion of XYZ & Co, there are matters of which ABC & Co should be made aware, XYZ &
Co should inform ABC & Co of those factors of which, in the opinion of XYZ & Co, ABC & Co
should be aware. XYZ & Co may, for example, inform ABC & Co that the reasons advanced by
EMM for the change are not in accordance with the facts.
For example, XYZ & Co may inform ABC & Co of the fact that it proposed a rotation of the
engagement partner as an appropriate safeguard against the familiarity threat to independence,
and that EMM did not accept the increase in audit fee.
If EMM are Hong Kong incorporated listed issuers, s 140A(2) of the Companies Ordinance requires
an auditor who resigns from office before the expiry of his term , if the resignation is to be effective,
to include in his resignation a statement of any circumstances connected with his resignation which
he considers ought to be brought to the notice of members or creditors of the company, or a
statement that there are no such circumstances.
205
Business Assurance
Answer 2
(a) The following procedures should be carried out:
(i) Ensure that I and my engagement team are professionally qualified to act and
consider whether there are ethical barriers to my accepting nomination.
(ii) Review the firm's overall work programme to ensure that there are sufficient resources
to enable my firm to carry out the audit.
(iii) Obtain references about the directors as they are not known personally by me or
anyone else in my firm.
(b) The auditor must use his professional judgment when considering the responses he gets to
references concerning new clients. The guidance cannot legislate for all situations so it does
not. In the circumstance given above there is no correct answer therefore, in practice an
auditor would have to make a justified decision which he would then document.
Matters to be considered
The reference raises three issues for the auditor considering accepting nomination.
(i) The issue that the director has been difficult to maintain a relationship with in the past
(ii) The issue that the director was slow to provide information in the past
(iii) The suspicion of a lack of integrity in relation to his tax affairs
The auditor must consider these in the light of several factors:
(i) The length of time that has passed since the events
(ii) What references which refer to the interim time say
(iii) The difference between accepting a role of auditing an entity and personal tax work
(iv) The director's role in the entity and therefore the audit
(v) The amount of control exercised by the director
– Relationships with other directors
– Influence
At this stage he should not be considering how highly he values the opinion of the referee.
That should have been considered before he sent the reference. At this stage he should only
be considering the implications of the reference for his current decision.
Auditing an entity is different from auditing personal affairs in terms of obtaining information
and contacting personnel. In this case, the key issue is the question over the integrity of the
director.
As we do not have information about interim references and details of the business
arrangements it is difficult to give a definite answer to this issue. However, Mr. Lau is likely to
only have limited control over decisions of the entity being one of five directors, which might
lead to the auditor deciding that the reference was insufficient to prevent him accepting
nomination. If Mr. Lau were the Chief Financial Officer, the auditor would be more inclined
not to take the nomination.
206
7: Changes in auditor appointment | Part D Assurance engagements
Exam practice
207
Business Assurance
208
chapter 8
Learning focus
Audit planning is a very important part of the audit process because it sets the direction for the
audit, based on an assessment of the risks relevant to the entity.
209
Business Assurance
Learning outcomes
Competency
level
2.05 Planning and risk assessment 3
2.05.01 Identify and explain:
2.05.01.01 The need for planning an audit
2.05.01.02 The contents of the overall audit strategy and the audit plan
2.05.01.03 The relationship between the overall audit strategy and the audit
plan
2.05.02 Develop and document an audit plan
2.05.03 Explain how auditors obtain an initial understanding of the entity
and its environment including the use of preliminary analytical
review procedures
2.05.04 Explain the components of audit risk
2.05.05 Assess the risk of material misstatement at the financial
statement level and assertion level
2.05.06 Recognise and suggest overall responses to assessed risk
2.05.07 Recognise and suggest specific procedures to respond to
assessed risks
2.07 Documentation 3
2.07.01 Document an audit plan
2.08 Materiality 3
2.08.01 Define materiality and demonstrate how it should be applied in
the context of financial reporting and auditing
210
8: Planning, materiality and risk assessment | Part D Assurance engagements
1 Audit planning
Topic highlights
Auditors must plan their work so that it is undertaken in an effective manner. The auditors formulate
an overall audit strategy which is translated into a detailed audit plan for audit staff to follow.
HKSA 300.2,
4, 6
1.1 The importance of planning
An effective and efficient audit relies on proper planning procedures. The planning process is
covered in general terms by HKSA 300 (Clarified) Planning an Audit of Financial Statements which
states that the objective of the auditor is to plan the audit so that the engagement is performed in
an effective manner.
Auditors should undertake the following:
(a) Plan the audit to enable it to be carried out in the most effective and efficient manner
(b) Consider whether to continue the entity relationship in the case of an existing entity
(c) Ensure the terms of the engagement are understood
(d) Consider ethical guidance including independence
(e) Consider entity acceptance procedures and professional clearance
(f) Establish the overall audit strategy for the audit and update any changes during the course
of the audit
(g) Develop and document an overall audit strategy for the expected scope and conduct of audit
in order to reduce audit risk to an acceptably low level
(h) Develop and document an audit plan which sets out the nature, extent and timing of planned
audit procedures
The audit strategy and plan should be revised during the audit when there are changes in
conditions or unexpected results are obtained.
Adequate planning benefits the audit in the following ways:
Helping the auditor to devote appropriate attention to important areas of the audit
Helping the auditor identify and resolve potential problems on a timely basis
Helping the auditor properly organise and manage the audit engagement so that it is
performed in an effective and efficient manner
Assisting in the selection of engagement team members with appropriate levels of
capabilities and competence to respond to anticipated risks, and the proper assignment of
work to them
Facilitating the direction and supervision of engagement team members and the review of
their work
Assisting, where applicable, in co-ordination of work done by auditors of components and
experts.
Audit procedures should be discussed with the entity's management, staff and/or audit committee
in order to co-ordinate audit work, including that of internal audit. However, all audit procedures
remain the responsibility of the external auditors.
211
Business Assurance
HKSA 300 (Clarified) requires that, at the beginning of the current audit engagement, the auditor
must perform the following preliminary engagement activities:
Perform procedures regarding the continuance of the client relationship and the specific
audit engagement (HKSA 220 (Clarified))
Evaluate compliance with ethical requirements such as independence (HKSA 220
(Clarified))
Establish an understanding of the terms of the engagement (HKSA 210 (Clarified))
Performing the preliminary engagement activities assists the auditor in identifying and evaluating
events or circumstances that may adversely affect the auditor’s ability to plan and perform the audit
engagement.
Key term
The audit strategy sets the scope, timing and direction of the audit, and guides the development
HKSA of the more detailed audit plan.
300.7-12
Each entity is unique and an audit strategy should be adapted to suit the particular requirements
and characteristics of the entity concerned. A strategy should be derived from the audit
engagement partner's understanding of the entity and its particular environment, which indicate
where the most significant risks of misstatements lie. The audit partner's responsibilities in this
regard are set out in HKSA 315 (Revised) – see below.
However, there are common elements to all strategies which are presented in the table that
follows:
212
8: Planning, materiality and risk assessment | Part D Assurance engagements
Key term
The audit plan converts the audit strategy into a more detailed plan and includes the nature, timing
HKSA 300.9 and extent of audit procedures to be performed by engagement team members in order to obtain
sufficient appropriate audit evidence to reduce audit risk to an acceptably low level.
213
Business Assurance
resulting changes to the planned nature, timing and extent of audit procedures, explains the overall
strategy and audit plan finally adopted for the audit and demonstrates the appropriate response to
significant changes occurring during the audit.
The form and extent of documentation depend on such matters as the size and complexity of the
entity, materiality, the extent of other documentation, and the circumstances of the specific audit
engagement.
214
8: Planning, materiality and risk assessment | Part D Assurance engagements
Key term
Risk assessment procedures are audit procedures performed to obtain an understanding of the
entity and its environment, including the entity’s internal control, to identify and assess the risks of
material misstatement, whether due to fraud or error, at the financial statement and assertion level.
The auditor must gather, review and analyse information through observation, inquiry and
discussion to create a picture of the whole entity in order to understand the particular risks the
entity faces, whether these are from its internal structure and control systems (fraud, human error,
aggressive targets putting management under undue pressure, high volume of transactions or
inexperienced staff) or the wider environment (political, technological, economic or market factors
which may expose the business to unforeseen challenges or uncertainty).
With this information, the auditor may then develop appropriate procedures in order to ascertain
where the most significant risks of material misstatement lie. Auditors may use data from prior
periods and knowledge built up from previous audits, but must evaluate the information for current
reliability.
215
Business Assurance
Why? To identify and assess the risks of material misstatement in the financial statements
whether due to fraud or error other factors
To enable the auditor to design and perform further audit procedures
To provide a frame of reference for exercising audit judgment, for example, when
setting audit materiality and identifying special audit areas
To evaluate sufficient and appropriate audit evidence
To develop expectations for use when performing analytical procedures
What? Industry, regulatory and other external factors, including the applicable financial
reporting framework
Nature of the entity, including operations, ownership and governance, investments,
structure and financing
Entity's selection and application of accounting policies
Objectives and strategies and related business risks that might cause material
misstatement in the financial statements
Measurement and review of the entity's financial performance
Internal control
Control environment
Entity’s risk assessment process
Information system
Entity’s communication of financial reporting matters
Control activities relevant to the audit
Activities to monitor internal control over financial reporting
How? Inquiries of management, the internal audit function and others within the entity
Analytical procedures to highlight areas of high risk
Observation and inspection of activities and operations of the entity
Prior period knowledge
Entity acceptance or continuance process
Discussion by the engagement team of the susceptibility of the financial
statements to material misstatement and the application of the applicable financial
reporting framework
Information from other engagements undertaken for the entity
Reconsider the nature, extent and timeliness of substantive testing
Key term
Analytical procedures consist of the evaluations of financial information through analysis of
HKSA 520.4 plausible relationships among both financial and non-financial data. They also encompass such
investigation as is necessary of identified fluctuations or relationships that are inconsistent with
other relevant information or that differ from expected values by a significant amount.
216
8: Planning, materiality and risk assessment | Part D Assurance engagements
217
Business Assurance
Appropriate individuals within the internal audit function with whom inquiries are made are those
who, in the auditor's judgment, have the appropriate:
knowledge
experience
authority
This will normally include the chief internal audit executive or, depending on the circumstances,
other personnel within the function. The auditor may also consider it appropriate to have periodic
meetings with these individuals.
Considerations specific to public sector entities
Auditors of public sector entities often have additional responsibilities with regard to internal
control and compliance with applicable laws and regulations. Inquiries of appropriate individuals in
the internal audit function can assist the auditors in identifying the risk of material non-compliance
with applicable laws and regulations and the risk of deficiencies in internal control over financial
reporting.
Audit evidence for elements of the control environment
The auditor may also consider how management has responded to the findings and
recommendations of the internal audit function regarding identified deficiencies in internal
control relevant to the audit, including whether and how such responses have been implemented,
and whether they have been subsequently evaluated by the internal audit function.
218
8: Planning, materiality and risk assessment | Part D Assurance engagements
If, based on the auditor's preliminary understanding of the internal audit function, the auditor
expects to use the work of the internal audit function to modify the nature or timing, or reduce
the extent, of audit procedures to be performed, HKSA 610 (Revised 2013) applies.
As is further discussed in HKSA 610 (Revised 2013), the activities of an internal audit
function are distinct from other monitoring controls that may be relevant to financial
reporting, such as reviews of management accounting information that are designed to
contribute to how the entity prevents or detects misstatements.
HKSA 200 (Clarified) discusses the importance of the auditor planning and performing the
audit with professional scepticism, including being alert to information that brings into
question the reliability of documents and responses to inquiries to be used as audit
evidence. Accordingly, communication with the internal audit function throughout the
engagement may provide opportunities for internal auditors to bring such information to the
auditor's attention. The auditor is then able to take such information into account in the
auditor's identification and assessment of risks of material misstatement.
Self-test question 1
In performing an audit of financial statements, auditors should have or obtain knowledge of the
business sufficient to enable them to identify and understand the events, transactions and practices
that, in the auditors’ judgment, may have a significant effect on the financial statements or on the
audit or the auditors’ report.
Required
(a) State how obtaining an understanding of the entity can assist the auditor in the planning of
an audit engagement.
(b) Assume that you have been recently appointed as an auditor of a large electronic
manufacturing company in Hong Kong with subsidiary operations in Guangzhou. Discuss
some of the matters you would consider in obtaining knowledge of the business under the
following headings:
(i) General economic factors;
(ii) the industry; and
(iii) the entity
(The answer is at the end of the chapter)
3 Materiality
Topic highlights
Materiality should be calculated at the planning stages of all audits. The calculation or
estimation of materiality should be based on experience and judgment.
Materiality should be reviewed throughout the audit and revised if necessary. An item might be
material due to its nature, value or impact on the readers of the financial statements.
Assessing whether an omission or misstatement may influence the decision-making by users,
requires consideration of the characteristics of those users and how the information may be used.
219
Business Assurance
Key term
Materiality is an expression of the relative significance or importance of a particular matter in the
context of financial statements as a whole.
220
8: Planning, materiality and risk assessment | Part D Assurance engagements
Auditors need to use professional judgment in determining materiality. The level of materiality is
affected by the auditor's perception of the financial information needs of the users of the financial
statements.
The concept of materiality is applied by the auditor in:
(a) planning and performing the audit;
(b) evaluating the effect of identified misstatements on the audit;
(c) evaluating the effect of uncorrected misstatements on the financial statements ie the nature
of the uncorrected misstatements; and
(d) forming the opinion in the auditor's report.
221
Business Assurance
HKSA
320.A10
3.4 Materiality for the particular classes of transactions, account
balances or disclosures
Auditors shall determine the materiality level or levels to be applied to those particular classes of
transactions, account balances or disclosures that are expected to be influential to the users of
financial statements. Where misstatements of lesser amounts than materiality for the financial
statements as a whole could affect the economic decisions of users, materiality levels for those
particular balances must be set. In deciding whether this is necessary auditors should consider:
whether law, regulations or the applicable financial framework affect users
the key disclosures in relation to the industry in which the entity operates
whether separate disclosure in the financial statements is required
Key term
Performance materiality means the amount set by the auditor at less than materiality for the
HKSA 320.9 financial statements as a whole to reduce to an appropriately low level the probability that the
aggregate of uncorrected and undetected misstatements exceeds materiality for the financial
statements as a whole. If applicable, performance materiality also refers to the amount or amounts
set by the auditor at less than the materiality level or levels for particular classes of transactions,
account balances or disclosures.
Planning the audit solely to detect individually material misstatements fails to take into account the
aggregated effect of individually immaterial misstatements on the overall financial statements.
The auditor is therefore required to determine performance materiality for purposes of:
(a) assessing the risks of material misstatement; and
(b) determining the nature, timing and extent of further audit procedures
It may relate to a particular class of transactions, account balance or disclosure.
As for the determination of materiality at the financial statement level, there is no single formula for
performance materiality.
The determination of performance materiality involves the exercise of professional judgment and is
affected by:
(a) the auditor's understanding of the entity, updated during the performance of the risk
assessment procedures; and
(b) the nature and extent of misstatements identified in previous audits and the auditor's
expectations in relation to misstatements in the current period.
If the auditor concludes that a lower materiality than that initially determined is appropriate for the
financial statements as a whole, the auditor must determine:
whether it is necessary to revise performance materiality, and
whether the nature, extent and timing of the further audit procedures remain appropriate
222
8: Planning, materiality and risk assessment | Part D Assurance engagements
Self-test question 2
J Limited (“J”) is a listed entity with a wide spread of shareholders. The entity is engaged in the
manufacture and trading of civil engineering products. Your firm has been the auditor of J for the
past five years, and has not encountered any significant audit problems during this period. J has
been operating with its present entity structure and its basic product range for the past three-and-a-
half years. The entity has built a strong reputation in the market place based on its astute,
conservative management style and quality product range. The “geotextile” products, targeted
mainly at the road construction market, which represent 40% of J's revenue, have come under
heavy competition in the last six months, eroding J's profit margins on these products significantly.
The following is a summary of J's key financial data:
Year Revenue Operating profit Total assets Net assets
$m $m $m $m
20Y0 1,324 56 1,555 755
20X9 1,266 72 1,494 685
20X8 1,275 90 1,617 615
20X7 1,512 78 1,387 580
20X6 1,739 67 1,629 605
Required
Determine the audit planning materiality figure to be adopted in the audit of J's financial statements
for the year ended 31 December 20Y0. Discuss and justify your selection of the key financial data
used as bases for the materiality calculations and the percentages applied to these bases.
(The answer is at the end of the chapter)
4 Risk
4.1 Audit risk
Topic highlights
Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial
statements are materially misstated. It is a function of the risk of material misstatement (inherent
risk and control risk) and the risk that the auditor will not detect such misstatement (detection
risk).
Key term
Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial
statements are materially misstated.
HKSA Audit risk has two major components. One is dependent on the entity, and is the risk of material
200.13c misstatement arising in the financial statements (inherent risk and control risk). The other is
dependent on the auditor, and is the risk that the auditor will not detect material misstatements in
the financial statements (detection risk).
223
Business Assurance
Audit risks
Key term
Inherent risk (IR) is the susceptibility of an assertion about a class of transactions, account
HKSA balance or disclosure to a misstatement that could be material either individually or when
200.13n
aggregated with other misstatements, before consideration of any related controls.
Inherent risks exist on two levels: at the entity level and for single items or balances, where there is
a significant risk of misstatement (assertion level). The risk of misstatement may be through error
particularly in the cases of very complex transactions, an inexperienced management team or lax
internal controls. Examples include the temptation to overstate sales in order to increase revenue,
or wrongful timing of revenue recognition and so forth.
The level of inherent risk is affected by the nature of the entity; the experience and ethos of its
management; the industry within which it operates; the degree to which that industry is regulated;
and also the strategies it chooses to pursue.
The degree of inherent risk is a matter for the auditors' professional judgment which must be based
on their understanding of the entity, its management, the nature of its transactions and the
reliability of the accounting systems. Where knowledge is limited then the inherent risk is deemed
to be high.
224
8: Planning, materiality and risk assessment | Part D Assurance engagements
Key term
Control risk (CR) is the risk that a misstatement that could occur in an assertion about a class of
HKSA transaction, account balance or disclosure and that could be material, either individually or when
200.13n
aggregated with other misstatements, will not be prevented or detected and corrected on a timely
basis by the entity's internal controls.
225
Business Assurance
A preliminary assessment of control risk at the planning stage of the audit is required to
determine the level of controls and substantive testing to be carried out. The Canadian Institute of
Chartered Accountants’ (“CICA”) Research Study “Extent of Audit Testing” identified four major
factors affecting the level of control risk and they are as follows:
(a) Evaluation of internal control. In general, the stronger the internal controls, the lower the
risk. After the assessment of control risk, auditors should carry out tests of control to obtain
reasonable assurance that the internal controls on which they intend to rely are operating
effectively during the reporting period. Controls testing will be examined in more detail in
Chapter 11.
(b) Work performed by internal and other auditors. If the audit client has an internal audit
function and the auditors decided to rely on the work performed by the internal auditors after
the assessment, the control risk can be adjusted to lower. In addition, if the auditor can rely
on the work performed by another independent auditor in the case of subsidiaries or
branches, the control risk can also be lowered. Use of the work of others will be discussed
further in Chapter 14.
(c) The nature of audit trail. As defined by CICA, audit trail refers to the documentary evidence
either of compliance with internal control procedures or of the transfer of accounting
information from its point of origin through intermediate records to its final inclusion in the
general ledger. Lack of audit trail suggests high control risk.
(d) Computerised accounting system. The existence of such a system and the use of the
computer as an audit tool will affect the assessment of control risk made by the auditor. We
will discuss this further in Chapter 20.
Key term
Detection risk (DR) is the risk that the procedures performed by the auditor to reduce audit risk to
HKSA an acceptably low level will not detect a misstatement that exists and that could be material, either
200.13e
individually or when aggregated with other misstatements.
The third element of audit risk is detection risk. This is the component of audit risk over which the
auditors have a degree of control, because, if risk is too high to be tolerated, the auditors can carry
out more work to reduce this aspect of audit risk. Sampling risk and non-sampling risk are
relevant and will be examined later.
Detection risk relates to the inability of the auditors to examine all evidence. Audit evidence is
usually persuasive rather than conclusive so some detection risk is usually present, allowing the
auditors only to seek “reasonable assurance” not absolute assurance. Detection risk relates to the
nature, timing and extent of the auditor's procedures that are determined by the auditor to reduce
audit risk to an acceptably low level. It is therefore a function of the effectiveness of an audit
procedure and of its application by the auditor.
There is an inverse relationship between IR and CR versus DR.
HIGH
226
8: Planning, materiality and risk assessment | Part D Assurance engagements
Topic highlights
Business risk is the risk arising to the entity through being in operation.
Key terms
Business risk is the risk resulting from significant conditions, events, circumstances, actions or
HKSA 315.4b inactions that could adversely affect an entity’s ability to achieve its objectives and execute its
strategies, or from the setting of inappropriate objectives and strategies. It is split into three
categories:
Financial risks are the risks arising from the financial activities or financial consequences of an
operation, for example, cash flow issues or overtrading.
Operational risks are the risks arising with regard to operations, for example, the risk that a major
supplier will be lost and the entity will be unable to operate.
Compliance risk is the risk that arises from non-compliance with the laws and regulations that
surround the business.
Business risk includes all risks facing the business. In other words, inherent audit risk may include
business risks.
In response to business risk, the directors institute a system of controls. These will include controls
to mitigate against the financial aspect of the business risk. These are the controls some of which
control risk incorporates.
Therefore, although audit risk is very financial statements focused, business risk does form part of
the inherent risk associated with the financial statements, not least, because if the risks materialise,
the going concern basis of the financial statements could be affected.
5 Risk assessment
Topic highlights
When the auditor has obtained an understanding of the entity, he shall identify significant risks and
assess the risks of material misstatement in the financial statements.
HKSA 315.25 5.1 Identifying and assessing the risks of material misstatement
HKSA 315 (Revised) says that the auditor shall identify and assess the risks of material
misstatement at the financial statement level and at the assertion level for classes of
transactions, account balances and disclosures.
It requires the auditor to take the following steps:
Step 1 Identify risks throughout the process of obtaining an understanding of the entity and its
environment.
Step 2 Assess the identified risks, and evaluate whether they relate more pervasively to the
financial statements as a whole.
Step 3 Relate the risks to what can go wrong at the assertion level.
Step 4 Consider the likelihood of the risks causing a material misstatement.
227
Business Assurance
Key term
Assertions are representations by management, explicit or otherwise, that are embodied in the
HKSA 315.4a financial statements, as used by the auditors to consider the different types of potential
misstatements that may occur. We look at these in detail in Chapter 9.
Auditors should determine risks that require special audit consideration (“significant risks”)
and consider whether controls are implemented to mitigate these risks.
Auditors should evaluate the design of the entity's controls and should determine the
implementation of the entity's controls. If it is not possible or impracticable to reduce the risks of
material misstatement at the assertion level to an acceptably low level with audit evidence obtained
by substantive testing, then the auditor should evaluate the design and implementation of the
entity's controls.
228
8: Planning, materiality and risk assessment | Part D Assurance engagements
Topic highlights
Significant risks are complex or unusual transactions that may indicate fraud, or other risks or are
unusual in their characteristics. Routine and non-complex transactions are less likely to give rise to
significant risk than unusual transactions.
Key term
Significant risks are those that require special audit consideration.
HKSA 315.4e
Significant risks are often related to:
HKSA
315.27-29 non-routine transactions
judgmental matters
229
Business Assurance
Self-test question 3
Nepco is a European entity that manufactures high quality computer components and assembles
computer parts. It has existed for some years and is part of a vertical supply chain for a well-known
brand of computer hardware. Profits are coming under increasing pressure from manufacturers in
the Far East and Asia with lower labour costs, and from rising raw material costs. Nepco is listed
on a stock exchange. There is pressure from institutional investors for better returns in the form of
dividends and the main institutional investors are considering selling a proportion of their shares in
the entity. The directors of Nepco are considering whether to move into new market areas.
Nepco has good accounting and internal control systems. Inventory is material to the financial
statements, and there is a good set of permanent inventory records. No year-end inventory count is
conducted. Operational compliance issues are important to Nepco. Many countries have inflexible
quality standards and some projects are being held up because of difficulties in obtaining approval
from regulators for new components.
All staff and directors of Nepco are remunerated (at least in part) on a performance-related basis,
some with share options. Staff are generally highly qualified and well paid. This is your first year as
auditors. Your firm has very little experience in this industry. External audit costs are tightly
controlled and your firm has agreed to a budget that will allow very little flexibility.
Required
Describe the risks relating to Nepco under the headings of inherent risk, control risk and detection
risk.
(The answer is at the end of the chapter)
230
8: Planning, materiality and risk assessment | Part D Assurance engagements
Topic highlights
The overall audit strategy and detailed audit plan may need to be revised to address the assessed
risk of material misstatement.
231
Business Assurance
AUDIT PROCEDURES
Key term
Tests of controls are audit procedures designed to evaluate the operating effectiveness of
HKSA 330.4b controls in preventing, or detecting and correcting, material misstatements at the assertion level.
When the auditor's risk assessment includes an expectation that controls are operating effectively,
the auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence
that the controls are operating in a satisfactory manner.
The auditor shall also undertake tests of controls when it will not be possible to obtain sufficient
appropriate audit evidence simply from substantive procedures alone. This might be the case if the
entity conducts its business using IT systems which do not produce documentation of the
transactions.
In carrying out tests of controls, auditors shall use inquiry, among other procedures, such as re-
performance and inspection.
When considering timing in relation to tests of controls, the purpose of the tests will be important.
For example, if the entity carries out a year-end inventory count, controls over the inventory count
can only be tested at the year-end. Other controls will operate all year round, and the auditor may
need to test that those controls have been effective throughout the period.
Some controls may have been tested in prior audits and the auditor may choose to rely on previous
evidence that they are effective. If this is the case, the auditor shall obtain evidence about any
232
8: Planning, materiality and risk assessment | Part D Assurance engagements
changes since the controls were last tested and shall test the controls if they have changed. In any
case, controls shall be tested for effectiveness at least once in every three audits.
If the related risk has been designated a significant risk, the auditor shall not rely on testing done in
prior years, but shall perform testing in the current year.
Key term
Substantive procedures are audit procedures designed to detect material misstatements at the
HKSA 330.4a assertion level. They consist of tests of details of classes of transactions, account balances and
disclosures, and substantive analytical procedures.
The auditor shall always carry out substantive procedures on material items. HKSA 330
(Clarified) says that irrespective of the assessed risks of material misstatement, the auditor shall
design and perform substantive procedures for each material class of transactions, account
balance and disclosures.
In addition, the auditor shall carry out the following substantive procedures:
Agreeing or reconciling the financial statements to the underlying accounting records
Examining material journal entries
Examining other adjustments made in preparing the financial statements
Substantive procedures fall into two categories: substantive analytical procedures and tests of
details. The auditor must determine when it is appropriate to use which type of substantive
procedure.
Substantive analytical procedures as substantive procedures tend to be appropriate for large
volumes of predictable transactions (for example, wages and salaries). Tests of details may be
appropriate to gain information about account balances for example, inventory or trade receivables.
Tests of details rather than substantive analytical procedures are likely to be more appropriate with
regard to matters which have been identified as significant risks, but the auditor must develop
procedures that are specifically responsive to that risk, which may include substantive analytical
procedures. Significant risks are likely to be the most difficult to obtain sufficient appropriate audit
evidence about.
233
Business Assurance
Topic recap
Must be
AUDIT PLANNING documented
Financial Performance
statements as materiality
a whole
Responding to
Business risk Audit risk
assessed risk
234
8: Planning, materiality and risk assessment | Part D Assurance engagements
Answer 1
(a) Understanding the entity can help the auditor in:
(i) fully understanding the client’s industry, business and organisation
(ii) assessing the engagement risks
(iii) communicating with client’s staff
(iv) assessing the reliability of written representations from management
(v) determining the appropriateness of accounting policies and disclosures
(b) (i) General economic factors include:
- general level of economic activity (eg recession, growth etc.)
- inflation
- interest rates and availability of financing
- government policies
- foreign currency rates
- commodity prices
(ii) Industry factors include:
Market competition
Changes in product technology
Business risk because of high technology
Environmental regulation and problems
(iii) The entity factors include:
Beneficial owners and related parties
Capital structure including any recent or planned changes
Acquisitions, mergers or disposal of business
Sources and methods of financing
Independence of board of directors
Answer 2
Materiality
There is no “right” answer as the determination of audit planning materiality is a judgment process
with only limited professional guidance offered.
The calculation needs to take into consideration both quantitative data (ie financial information, etc)
as well as qualitative aspects (eg users, risks, type of industry, etc).
The calculation generally involves a decision as to an appropriate base for materiality. This would
mainly be determined by the users (eg if J is listed, then profit will most likely be the key information
of interest), industry, the type of operations and other factors which affect the judgment as to which
financial information is of key importance and therefore should be the basis for the auditor's
materiality decision.
The next important decision relates to the choice of percentage. There are some generally
accepted percentage ranges (“rules of thumb”) in relation to the most common bases. The major
factor in determining the percentage used will be the overall risk of the entity.
235
Business Assurance
Profit 5–10% Profit is an appropriate base since the entity has a history
HK$2.8m – 5.6m of comparatively stable profitability and is listed. The users
will consider the profit an important indicator of the
performance of the entity and a suitable basis to determine
the value of the entity's shares.
The average profit over a number of years is a reasonable
choice as the base to determine the materiality level in this
case.
Revenue 0.5–1.0% Revenue is an important measure of the activities of an
HK$6.6m – 13.2m entity, it could be a good base to determine the materiality
level particularly when the profit is not stable over the
years. However, it is a less preferred choice as compared
to the profit in this case.
Total assets 0.5–1.0% Over the last two years, the total assets were around
HK$7.8m – 15.6m 20 % more than the annual revenue, which was a rather
significant level of investment in total assets. Total assets
may therefore be a suitable base. However, like revenue, it
is a less preferred choice as compared to the profit in this
case.
Equity 1.0–2.0% Over the last few years, the total assets were more than
HK$7.6m – 15.1m twice of the equity, which indicates that the level of
(net assets)
borrowing was relatively significant. Going concern may be
an issue. Equity may be a suitable base to determine the
materiality level. However, like revenue, it is a less
preferred choice as compared to the profit in this case.
Answer 3
Risks
HKSA 315 (Revised) states that audit risk is the product of the risk of material misstatement
(inherent risk and control risk) and detection risk.
(a) The following are some of the inherent risks involved:
(i) The competition from Asian and Far Eastern entities, and rising raw material prices.
This means that there is pressure on profits and the ability to reward employees and
pay dividends to institutional shareholders which increases the pressure to manipulate
the financial statements to show good returns.
(ii) The potentially volatile market (computer components) in which new technology can
render hardware obsolete in a very short time. This means that there is an ongoing
risk to the business as a whole (a potential going concern risk), the entity must be
adaptable.
(iii) The risk that regulators may reject a product which has taken many months or years
to develop.
(iv) The pressures for returns from institutional investors which means that there may be a
temptation to manipulate the financial statements.
(v) The possible sale of shares, increasing the pressure for returns in order to get the best
possible price, which increases the pressure to manipulate the financial statements.
236
8: Planning, materiality and risk assessment | Part D Assurance engagements
(vi) The inherent risks in diversification into unknown areas (the supply of other
customers) – but these are not current risks.
(b) Control risks: there are apparently very few except for the performance-related payment,
including share options, which provides an incentive to produce acceptable figures.
(c) Detection risk: this is the firm's first year as auditors and there are tight controls on audit
costs, which may lead to inadequate audit evidence unless the audit is properly directed,
supervised and reviewed. This is compounded by the firm's lack of experience in this area.
It is important that those with experience are employed on this audit, at least in a review
capacity.
237
Business Assurance
Exam practice
238
8: Planning, materiality and risk assessment | Part D Assurance engagements
test, your audit assistant circularised trade receivables and trade payables that showed
significant balances in the ledger at the period end, and reviewed the board minutes after the
year-end. The response rates for both the trade receivables and the trade payables
circularisation tests were considered to be satisfactory, and your assistant reported that no
material discrepancy was found from the confirmation procedures.
(6) Since March 20X5, ABC has been exploring the Mainland market by dispatching goods to a
number of drug stores in Guangdong Province on a consignment basis. Revenue from these
consignment sales is recognised on a monthly basis upon sales information supplied by the
respective drug stores, confirming the amount of goods eventually sold to the ultimate
customers. Invoices are then issued by ABC to the drug stores. The drug stores are allowed
the standard credit period of 60 days, from the invoice issuance date. According to the
records, goods with a cost of HK$5,000,000 have been sent to various drug stores on this
basis during the year. In the draft financial statements, ABC recognised revenue of
HK$6,000,000 from these consignment sales. This represents about 10 % of the sales
revenue for the year. Consignment goods of HK$2,000,000 were included as the year-end
inventory, representing about 10 % of the total inventory.
Required
Assess the risk of material misstatements at the financial statement level. You should write down
the specific circumstances of ABC that you have considered and your judgment about the risk
level.
(10 marks)
HKICPA May 2006 (amended)
239
Business Assurance
240
chapter 9
Learning focus
In this chapter you will study the different types of audit tests used to obtain audit evidence.
The tests used and evidence required will depend on the specific balances or transactions
being tested and also the areas where a higher risk of misstatement has been identified.
241
Business Assurance
Learning outcomes
Competency
level
2.04 Audit methodologies 3
2.04.01 Describe the key features of the following audit methodologies:
2.04.01.01 Risk-based auditing
2.04.01.02 Top-down auditing
2.04.01.03 System-based auditing
2.04.01.04 Systems audit
2.04.01.05 Balance sheet approach
2.04.01.06 Transaction cycle approach
2.04.01.07 Directional testing
2.04.02 Understand the cost and performance efficiency of different audit 2
methodologies
2.07 Documentation 3
2.07.02 Explain the need for and the importance of audit documentation
2.09 Audit procedures 3
2.09.01 Define audit sampling
2.09.02 Explain the need for sampling
2.09.03 Apply the basic principles of sampling
2.09.04 Assess and explain the results of sampling
2.10 Audit evidence 3
2.10.01 Explain the procedures by which audit evidence may be
obtained
2.10.02 Assess the appropriate and sufficiency (relevance and reliability)
of different sources of audit evidence
2.10.03 Explain the assertions contained in the financial statements and
their use in obtaining evidence
242
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
1 Audit evidence
Topic highlights
Auditors must obtain sufficient appropriate audit evidence. Audit evidence can be in the form of
tests of controls or substantive procedures.
Key term
Audit evidence is information used by the auditor in arriving at the conclusions on which the
HKSA 500.5c auditor’s opinion is based. Audit evidence includes both information contained in the accounting
records underlying the financial statements and other information
What constitutes audit evidence? Evidence includes the accounting data on which the balances in
the financial statements are based, and any other information sought by the auditors, such as
confirmations from third parties or management assertions. Audit evidence is cumulative in nature
and is obtained from procedures carried out during the course of the audit. It is not expected, or
realistic, that auditors might look at all the information that exists.
Under HKSA 500 (Clarified) Audit Evidence, the auditor is required to:
(a) obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on
which to base the audit opinion;
(b) ascertain the accuracy and completeness of the evidence; and
(c) use assertions for classes of transactions, account balances and presentation and
disclosures in sufficient detail to form a basis for the assessment of risks of material
misstatements.
It is management's responsibility to prepare financial statements based upon the accounting
records.
Key terms
Sufficiency is the measure of the quantity of audit evidence.
HKSA
200.13b Appropriateness is the measure of the quality or relevance and reliability of the audit evidence.
How much audit evidence is required depends on the level of risk in the area being audited, and
the quality of evidence which may be obtained. If the evidence is both highly relevant and reliable
then it may suffice. The quality of evidence can be measured by various criteria which we cover in
the paragraphs below.
243
Business Assurance
External Audit evidence from external sources is more reliable than that obtained from
the entity's records because it is from an independent source outside the
entity
Auditor Evidence obtained directly by auditors is more reliable than that obtained
indirectly or by inference
Entity Evidence obtained from the entity's records is more reliable when the related
control system operates effectively
Written Evidence in the form of documents (paper or electronic) or written
representations are more reliable than oral representations, since oral
representations can be retracted
Originals Original documents are more reliable than photocopies or facsimiles, which
can easily be altered by the entity
Auditors must use professional judgment and exercise professional scepticism when
evaluating the sufficiency and appropriateness of audit evidence to support the audit opinion.
244
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
In determining the sufficiency and sources of evidence required to support the audit opinion, the
auditor normally considers the following:
(i) Relevance and reliability of information obtained;
(ii) Materiality of the items being audited;
(iii) The cost of collection of audit evidence;
(iv) The consistency of audit evidence obtained from different sources.
Sources of information
The auditor is required to consider whether the collected information from the following sources is
also relevant to identifying risks of material misstatement:
(i) Client acceptance or continuous process;
(ii) Information obtained from other engagements the engagement partner has performed for the
entity;
(iii) The auditor’s previous experience with the entity; and
(iv) Audit procedures conducted in previous audits.
Auditors should determine whether changes have occurred since the previous audit that may affect
its relevance to the current audit.
Key term
Assertions are representations by management, explicit or otherwise, that are embodied in the
HKSA 315.4 financial statements, as used by the auditor to consider the different types of potential
misstatement that may occur.
HKSA 315. The auditor will carry out procedures that are designed to test the assertions made by
A111
management. HKSA 315 (Revised) identifies these as follows:
245
Business Assurance
Topic highlights
Audit evidence can be obtained by inspection, observation, inquiry and confirmation, recalculation,
re-performance and analytical procedures.
HKSA The auditor obtains audit evidence by undertaking audit procedures to do the following:
500.A10-25
(a) Obtain an understanding of the entity and its environment to assess the risks of material
misstatement, whether due to fraud or misstatement, at the financial statement and assertion
levels (risk assessment procedures)
(b) Test the operating effectiveness of controls in preventing, or detecting and correcting,
material misstatements at the assertion level (tests of controls)
(c) Detect material misstatements at the assertion level (substantive procedures)
The auditor must always perform risk assessment procedures to provide a satisfactory
assessment of risks.
Tests of controls are necessary to test the controls to support the risk assessment, and are used
when there is expectation of the operating effectiveness of controls and also when substantive
procedures alone do not provide sufficient appropriate audit evidence.
Substantive procedures must always be carried out for material classes of transactions, account
balances and disclosures.
The audit procedures described in the table below can be used as risk assessment procedures,
tests of controls and substantive procedures.
246
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
Key terms
Tests of controls are designed to evaluate the operating effectiveness of controls preventing, or
HKSA 330.4 detecting and correcting, material misstatements at the assertion level.
Substantive procedures are audit procedures designed to detect material misstatements at the
assertion level.
They are generally of two types:
Substantive analytical procedures
Tests of details of classes of transactions, account balances and disclosures
Procedures
Inspection of Inspection of tangible assets that are recorded in the accounting records confirms
tangible assets existence, but does not necessarily confirm rights and obligations or valuation.
Confirmation that assets seen are recorded in accounting records gives
evidence of completeness.
Inspection of This is the examination of documents and records, both internal and external, in
documentation paper, electronic or other forms. This procedure provides evidence of varying
or records reliability, depending on the nature, source and effectiveness of controls over
production (if internal).
Inspection can provide evidence of existence (eg a document constituting a
financial instrument), but not necessarily about ownership or value. In addition,
inspecting an executed contract may provide audit evidence to the entity's
application of accounting policies, such as revenue recognition.
Observation This involves watching a procedure or process being performed (for example,
post opening). It is of limited use, as it only confirms the procedure took place
when the auditor was watching, and because the act of being observed could
affect how the procedure or process was performed.
Inquiry This involves seeking information from entity staff or external sources.
Strength of evidence depends on the knowledge and integrity of source of
information. Inquiry alone does not provide sufficient audit evidence to detect a
material misstatement at assertion level nor is it sufficient to test the operating
effectiveness of controls.
Confirmation This is the process of obtaining a representation of information or of an existing
condition directly from a third party eg confirmation from bank of bank balances.
Confirmations are used to obtain audit evidence about the absence of certain
conditions.
Recalculation This consists of checking the mathematical accuracy of documents or records
and can be performed through the use of IT.
Reperformance This is the auditor's independent execution of procedures or controls that were
originally performed as part of the entity's internal control.
Analytical Evaluating and comparing financial and/or non-financial data for plausible
procedures relationships. Also include the investigation of identified fluctuations and
relationships that are inconsistent with other relevant information or deviate
significantly from predicted amounts.
247
Business Assurance
Self-test question 1
In auditing various accounts, there may be a choice of the types or amounts of evidence available
to evaluate management’s assertions. For the following three accounts, describe some high quality
forms of evidence that the auditor should obtain.
(a) The net balance in accounts receivable
(b) The additions to non-current assets
(c) The accounts payable
(The answer is at the end of the chapter)
3 Audit methodologies
3.1 Overview
Relies on analysis Efficient as limits
of audit risk substantive testing
Reliance on analytical
procedures
Auditor predominantly tests Method of undertaking substantive Substantiates the transactions which
controls and systems testing based on double entry principle appear in the financial statements
248
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
Under the risk-based approach audit resources are directed most heavily towards those areas that
have been identified as those where a misstatement is most likely to occur. This increases the
opportunities for detecting misstatements and avoids excessive time being spent testing areas
where the risk is relatively low.
The use of risk-based auditing has grown in response to two main factors:
(a) Increased complexity in the business environment augmenting the danger of fraud or
misstatement. Computerised systems where access and intervention by unauthorised
personnel are harder to detect, growing internationalisation of business and higher levels of
cross-border transactions add to the complexity.
(b) Auditors are under increased pressure to deliver an improved level of service while keeping
fee levels down.
Topic highlights
With a “top-down” approach (sometimes known as the business risk approach) controls testing is
targeted at high level controls and the amount of substantive testing is reduced.
HKSA 315 (Revised) (which you studied in Chapter 8) requires that, as part of obtaining an
understanding of the entity and its environment, auditors consider the entity's own process for
assessing its business and environmental risks, and the potential impact that these might have on
the risk of material misstatements in the financial statements.
This “business risk” approach was developed because sometimes the risk of the financial
statements being misstated arises predominantly from the business risks of the entity, as
discussed in Chapter 8.
Auditors must consider:
which factors lead to the problems which may cause material misstatements
how the audit may contribute to the business pursuing its goals
The business risk audit works by repeating the risk management steps used by the directors in
running the business. The auditors will check that the financial statement objectives have been
met, through a wider investigation as to whether the entity has successfully attained its other
business objectives and through using the process of analysis as a way of furthering their own
understanding about the entity, its management and the environment in which it operates.
This approach has been called a “top-down” approach, because it starts with a high level view of
the business and its objectives and works back down to the financial statements. It is more
traditional to start with the balances themselves and work up.
249
Business Assurance
The other advantage of a business risk approach is there is greater opportunity for the auditor to
add value to the entity's business and to enhance risk management strategies for the business in
the future.
Topic highlights
An auditor may predominantly test controls and systems, but substantive testing can never be
eliminated entirely.
As part of any audit, auditors assess the quality and effectiveness of the accounting system.
An auditor will focus especially on the system of controls put in place by the directors and ascertain
whether they believe it is effective enough for them to be able to rely on it for the purposes of their
audit. If they believe that the system is effective, auditors will carry out tests of controls to ensure
that the control system operates and, at the same time, auditors will reduce the amount of
substantive testing.
Increasingly, auditors must take consideration of computer systems. Auditors may accept an
assurance engagement to undertake this task outside of the main audit and to report on their
findings.
250
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
The following are the key areas on which they are likely to concentrate in order to establish how
reliable the systems are:
The system audit file usually contains the auditor's notes and procedures of the internal control and
accounting system on an entity. The documentation and the tests of controls performed may be
separately filed in a system audit file which is often assembled in the interim visit and updated in
the final visit.
Topic highlights
An auditor may choose predominantly to carry out substantive tests on year end balances.
251
Business Assurance
Therefore under this approach, the auditors seek to concentrate efforts on substantiating the
closing position in the year, shown in the statement of financial position, having determined that the
closing position from the previous year (also substantiated) has been correctly transferred to be the
opening position in the current year.
Topic highlights
Directional testing is a method of discovering misstatements and omissions in financial statements.
252
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
253
Business Assurance
Although an audit can be carried out with 100 % substantive procedures, it is not possible to carry
out a 100 % systems audit. There must always be some substantive testing before an audit opinion
can be delivered.
We shall look at each of the methodologies in turn.
254
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
For a small entity, the cost of auditing using the balance sheet approach will be low, since junior
auditors can be employed to carry out the work, and there will only be a moderate volume of work
to be done. Therefore this is the most efficient methodology for auditing a small entity.
For a large entity, the cost of the balance sheet approach will be prohibitive since the number of
individual assets and liability balances to be vouched will be large. Therefore, this is not an efficient
methodology for auditing a large entity.
Note.
In many cases the audit approach will involve aspects of more than one of the methods referred to
above.
4 Audit sampling
Topic highlights
Auditors usually seek evidence from less than 100 % of items of the balance or transaction being
tested by using sampling techniques.
HKSA 500.10 HKSA 500 (Clarified) Audit Evidence requires that when designing tests of controls and tests of
details, the auditor shall determine means of selecting items for testing that are most effective in
meeting the purpose of the audit procedures.
255
Business Assurance
Key terms
Audit sampling involves the application of audit procedures to less than 100 % of the items within
HKSA a population of audit relevance such that all sampling units have a chance of selection in order to
530.5a, b, g
provide the auditor with a reasonable basis on which to draw conclusions about the entire
population.
Population is the entire set of data from which a sample is selected and about which an auditor
wishes to draw conclusions.
Statistical sampling is any approach to sampling that involves random selection of a sample, and
the use of probability theory to evaluate sample results, including measurement of sampling risk.
Non-statistical sampling is the approach to sampling where the auditor does not use statistical
methods and draws a judgmental opinion about the population.
256
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
Key term
Sampling units are the individual items constituting a population.
HKSA 530.5f HKSA 530 (Clarified) requires that the auditor “shall select items for the sample in such a way that
each sampling unit in the population has a chance of selection”. This requires that all items in the
population have an opportunity of being selected.
257
Business Assurance
Key terms
Stratification is the process of dividing a population into subpopulations, each of which is a group
of sampling units, which have similar characteristics (often in monetary value).
Each sampling unit can only belong to one, specifically designed stratum, therefore reducing the
variability within each stratum. This enables the auditors to direct audit effort towards items which,
for example, contain the greatest potential monetary misstatement. Ways of dividing items into
strata include by age or by amount.
Key terms
HKSA 530.5c Sampling risk arises from the possibility that the auditor's conclusion, based on a sample may be
different from the conclusion if the entire population were subjected to the same audit procedure.
HKSA 530.5d Non-sampling risk is the risk that the auditor reaches an erroneous conclusion for any reason not
related to sampling risk.
258
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
Tests of controls Controls are more effective than they actually are (1)
Controls are less effective that they actually are (2)
Tests of details Material misstatement does not exist when in fact it does (1)
Material misstatement exists when in fact it does not (2)
(1) Auditors are most concerned with this type of erroneous conclusion as it affects audit
effectiveness and is more likely to lead to an inappropriate audit opinion.
(2) These types of erroneous conclusion affect audit efficiency as it would lead to additional
work.
Sampling risk may be reduced by increasing the sample size for both tests of control and
substantive procedures while non-sampling risk, may be reduced by effective engagement
planning, supervision and review.
How much sampling risk an auditor will tolerate depends on the degree of reliance on the results of
the procedure in question. Larger sample sizes generate lower risks and a higher degree of
tolerance.
When designing a sample, the auditor also determines tolerable rate of deviation and tolerable
misstatement for the subsequent evaluation of the results.
Non-sampling risk arises from factors that cause the auditor to reach an erroneous conclusion for
any reason not related to the size of the sample. For example, most audit evidence is persuasive
rather than conclusive, the auditor might use inappropriate procedures or the auditor might
misinterpret evidence or fail to recognise a misstatement or deviation.
259
Business Assurance
4.5.2 Anomaly
Key term
Anomaly is defined as a misstatement or deviation that is demonstrably not representative of
HKSA 530.5e misstatements or deviations in a population.
In the extremely rare circumstances, when the auditor considers a misstatement or deviation
discovered in a sample to be an anomaly, the auditor shall obtain a high degree of certainty that
such misstatement or deviation is not representative of the population. The auditor shall perform
additional procedures to obtain sufficient appropriate audit evidence that the misstatement or
deviation does not affect the remainder of the population. However, for anomalies, projecting
misstatements to the population is not required.
Key terms
HKSA 530.5j Tolerable rate of deviation is the rate of deviation from prescribed internal control procedures set
by the auditor in respect of which the auditor seeks to obtain an appropriate level of assurance that
the rate of deviation set by the auditor is not exceeded by the actual rate of deviation in the
population.
HKSA 530.5i Tolerable misstatement is a monetary amount set by the auditor in respect of which the auditor
seeks to obtain an appropriate level of assurance that the monetary amount set by the auditor is
not exceeded by the actual misstatement in the population.
260
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
The auditor may perform the following procedures when he concludes that audit sampling has not
provided a reasonable basis for conclusions about the population tested:
(a) Request management to investigate identified misstatements, potential misstatements and
to make necessary adjustments
(b) Modify nature, extent and timing of further audit procedures to achieve desired assurance.
When determining whether the sample provides a reasonable basis for the conclusions about the
population as a whole, the auditor should first set a level of tolerable misstatement. If when the
results of the test sample are projected for the population as a whole, and any anomalous results
taken into account, this level is exceeded, then the sample must be considered as not providing a
reasonable basis for conclusions about the population as a whole.
Self-test question 2
Consider each of the following independent situations:
(a) The auditor used non-statistical (judgmental) sampling techniques to determine an
appropriate sample size of 20 in testing the proper authorisation of purchases. After
randomly selecting 20 purchase transactions, the auditor performed appropriate testing and
found that three of the 20 transactions were not properly authorised.
(b) The auditor used attribute sampling techniques to test a key authorisation control. For a 5 %
risk of over reliance, a tolerable deviation rate of 10 % and an expected population deviation
rate of zero, the auditor determined the minimum sample size to be 29. The auditor selected
29 items using a systematic sampling technique, and found that one transaction was not
properly authorised.
Required
For each of the scenarios, (a) and (b), discuss the relevant issues in determining whether the
auditor can place reliance on the key control.
(The answer is at the end of the chapter)
5 Audit documentation
Topic highlights
It is important to document audit work performed in working papers to:
enable reporting partner to ensure all planned work has been completed adequately;
provide details of work done for future reference;
assist in planning and control of future audits; and
encourage a methodical approach.
261
Business Assurance
Key term
Audit documentation is the record of audit procedures performed, relevant audit evidence
HKSA 230.6a obtained and conclusions reached. The terms “working papers” or “work papers” are also
sometimes used.
HKSA 230.5, In accordance with HKSA 230 (Clarified) Audit Documentation, the auditor prepares, on a timely
7, 8 basis, audit documentation that provides:
(a) a sufficient and appropriate record of the basis for the auditor's report; and
(b) evidence that the audit was planned and performed in accordance with HKSAs and
applicable legal and regulatory requirements.
HKSA 230 (Clarified) requires that the auditor shall prepare audit documentation on a timely basis
in order to enhance the quality of the audit and to improve the review and evaluation process of the
audit evidence obtained and conclusions reached before the auditor's report is finalised.
Key term
An experienced auditor refers to an individual who has practical audit experience and a
HKSA 230.6c reasonable understanding of the audit processes, HKSAs and applicable legal and regulatory
requirements, the business environment in which the entity operates and the auditing and financial
reporting issues relevant to the entity's industry.
The auditor shall prepare audit documentation that is sufficient to enable an experienced auditor
having no previous connection with the audit, to understand:
(a) the nature, extent and timing of the audit procedures
(b) the results of the audit procedures performed; and
(c) significant matters arising during the audit ie significant risks or difficulties in applying audit
procedures (See Section 5.6)
The form and content of working papers are affected by matters such as:
(a) the size and complexity of the entity;
(b) the nature of the audit procedures to be performed;
(c) the identified risks of material misstatement;
(d) the significance of the audit evidence obtained;
(e) the nature and extent of exceptions identified;
(f) the need to document a conclusion or the basis for a conclusion not readily determinable
from the documentation of the work performed or audit evidence obtained; and
(g) the audit methodology and tools used.
262
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
263
Business Assurance
Key term
An audit file is one or more folders or other storage media in physical or electronic form,
HKSA 230.6b containing the records that comprise the audit documentation for a specific engagement.
264
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
The working paper files should also contain information covering each audit area. These should
include the following:
A lead schedule including details of the figures to be included in the financial statements
Problems encountered and conclusions drawn
Audit programmes
Risk assessments
Sampling plans
Analytical procedures
Details of substantive tests and tests of controls
If it later becomes necessary to add to or modify the documentation after it has been assembled,
then the following should be noted:
Who made the changes, when they were made, and by whom they were reviewed
The reasons behind the change
Whether there was any effect on the auditors' conclusions
Changes are made to an audit file after the audit report has been signed, only in exceptional
circumstances. The following should be recorded:
The circumstances
The audit procedures performed, evidence obtained, conclusions drawn
When and by whom changes to audit documents were made and reviewed
265
Business Assurance
266
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
267
Business Assurance
Topic recap
Relate to
Financial statement – classes of
assertions transactions
– account balances
– presentation and
disclosure
Relevant Direction
Sufficient Appropriate
Reliable Source
Audit
Risk-based
methodology
Risk
Top-down assessment
Audit
procedure procedures
Systems-based/ Test of
systems audit – Inspection controls
– Observation
– Inquiry
– Confirmation Substantive Can never be
Balance sheet – Recalculation procedures eliminated entirely
approach – Reperformance
– Analytical procedure
Statistical
Transaction
cycle approach Sampling
Non-statistical
Directional
testing – Sample design
– Sample size
– Projecting
misstatements
– Evaluating results
268
9: Audit evidence, procedures, audit methodologies and audit sampling | Part D Assurance engagements
Answer 1
(a) The balance of gross accounts receivable can best be assessed by the use of a receivables
circularisation. The allowance for doubtful accounts would be assessed by reviewing
management’s credit policies, ageing the accounts receivable, examining credit reports or
financial statements for major companies, and verifying subsequent remittances. Analytical
procedures would also be used.
(b) The additions to the non-current asset account can best be verified by an examination of the
client’s capitalisation policies and an examination of both the schedule of additions to non-
current assets, and a review of the repairs and maintenance expense account to ensure that
no items that should be capitalised are included as expenses. Any rental or lease agreement
should also be reviewed to ensure that nothing that should be capitalised has been
expensed.
(c) The accounts payable can be examined by the use of confirmation to test balances, or by a
reconciliation with suppliers’ statements.
Answer 2
(a) In determining reliance on this key control, the auditor has used non-statistical sampling.
Therefore, the decision as to whether or not the auditor would place reliance on this key
control without the undertaking of any further work depends on the auditor's expectations.
Such a high deviation rate would be unusual for accepting the control as operating
effectively, unless further audit evidence substantiating the initial assessment is obtained.
(b) The auditor has sampled the minimum size for zero expected deviations from the control
condition. As soon as one deviation is identified, as has occurred in this case, the auditor
cannot rely on the key control.
269
Business Assurance
Exam practice
270
chapter 10
Topic list
Learning focus
The extent of auditors' responsibilities in relation to fraud and error is a critical element of the
public's perception of the auditor's role. The requirements of HKSA 240 (Clarified) in this
regard are core knowledge for this chapter and may have to be applied in practical scenarios.
271
Business Assurance
Learning outcomes
Competency
level
2.05 Planning and risk assessment 3
2.05.08 Explain the effect of fraud and misstatements on audit planning and
work
2.05.09 Explain the effect of laws and regulations, and non-compliance
therewith, on audit planning and procedures
2.12 Completion procedures
2.12.04 Explain the follow up on illegal act or fraud found while performing 3
an audit especially in the case of money laundering or corruption
272
10: Fraud and irregularities | Part D Assurance engagements
1 Fraud
Topic highlights
When carrying out risk assessment procedures, the auditor shall also consider the risk of fraud or
non-compliance with laws and regulations causing a misstatement in financial statements.
Key term
Fraud is an intentional act by one or more individuals among management, those charged with
HKSA governance, employees or third parties involving the use of deception to obtain an unjust or illegal
240.11a
advantage.
HKSA 240.3 Fraud may be perpetrated by an individual, or colluded in, with people internal or external to the
business. When management or those charged with governance are involved in fraud, it is called
management fraud. When employees are involved it is called employee fraud.
Specifically, there are two types of fraud causing material misstatements in financial statements:
Fraudulent financial reporting; and
Misappropriation of assets
Key term
Fraudulent financial reporting involves intentional misstatements, including omissions of
HKSA 240. amounts or disclosures in financial statements, to deceive financial statement users.
A2
Management may intend to influence financial statement users' perceptions as to the entity's
performance and profitability.
This may include the following:
Omission of amounts or disclosures in the financial statements
Improper disclosure eg deception such as manipulation, falsification, alteration of accounting
records
Intentional misapplication of accounting principles eg delay in recognition
Concealing important information
Engaging in complex transactions, leading to inability to collect audit trail
Recording fictitious journal entries
Improper use of assumptions or estimates in financial reporting
Intentionally to reduce earnings for tax planning
Manipulation, falsification or alteration of accounting records or other documentations
Such fraud may be due to pressure and incentives and may arise due to management overriding
controls and by aggressive earnings management in order to maximise bonuses. Companies
273
Business Assurance
about to list may contain higher risk in this area due to pressure to meet market expectations or a
desire to maximise compensation based on performance. The auditor should be aware if there are
matters like unsuitable revenue recognition, inappropriate accruals, liabilities, provisions and
reserves accounting or large number of immaterial breaches of financial reporting requirements.
Material misstatements due to fraudulent financial reporting are often due to revenue recognition
and this is significant risk.
Key term
Misappropriation of assets involves the theft of an entity's assets and is often perpetrated by
HKSA 240.A5 employees in relatively small and immaterial amounts.
274
10: Fraud and irregularities | Part D Assurance engagements
HKSA
240.15-18,
1.4 Risk assessment
25-26, 31 HKSA 240 (Clarified) requires a discussion among the team members that places particular
emphasis on how and where the financial statements may be susceptible to fraud.
275
Business Assurance
276
10: Fraud and irregularities | Part D Assurance engagements
Those entities such as listed entities that may have pressures or incentives on management to
commit fraudulent financial reporting, may face greater risks of fraud in revenue recognition.
The auditor shall document the reasons for concluding that there is no presumption that there are
risks of fraud in revenue recognition.
277
Business Assurance
As we mentioned above, management fraud is more difficult to detect than employee fraud
because of management's ability to override controls and therefore manipulate accounting records.
HKSA 240 (Clarified) states that when auditor has to respond to the risk of management override of
controls, it is mandatory to perform procedures to:
(a) test the appropriateness of journal entries and other adjustments;
(b) review accounting estimates for bias; and
(c) for significant transactions outside the normal course of business, evaluate whether they
have been entered into to engage in fraudulent financial reporting or to conceal
misappropriation of assets.
Key term
Fraud risk factors are events or conditions that indicate an incentive or pressure to commit fraud
HKSA or provide an opportunity to commit fraud.
240.11b
HKSA 240 HKSA 315 (Revised) states that the auditor shall evaluate whether fraud risk factors exist when
Appendix 1 collecting information from risk assessment procedures or when performing related activities.
When obtaining an understanding of the entity and its environment and the internal control, an
auditor should consider whether the information obtained indicates any fraud risk factors. However,
remember that fraud risk factors may not necessarily indicate the existence of fraud.
Auditors should exercise professional judgment in determining whether actual fraud is present.
When the following fraud risk factors appear there is a chance for fraudulent reporting to occur:
278
10: Fraud and irregularities | Part D Assurance engagements
When the following fraud risk factors appear there is a good chance for misappropriation of assets
to occur:
279
Business Assurance
The size, complexity and ownership characteristics of the entity have a significant influence on the
consideration of relevant fraud risk factors. For example, a larger entity may have better internal
controls to prevent fraud.
280
10: Fraud and irregularities | Part D Assurance engagements
The following illustrates the change in nature, extent and timing of audit procedures:
Changing the nature of Obtain more reliable and relevant audit evidence
audit procedures
Obtain additional corroborative evidence
Use more physical inspection or observation
Consider the source of audit evidence, ie more external
evidence rather internal audit evidence, ie use more external
confirmations
Changing the extent of Increasing sample sizes
audit procedures
Performing analytical procedures at a more detailed level
Using CAATs for more extensive testing of electronic
transactions and account files
Changing the timing of Modifying the timing of substantive procedures
audit procedures
Performing substantive testing at or near the period end
Electing to apply substantive procedures to transactions
occurring earlier in or throughout the reporting period
281
Business Assurance
(b) have disclosed to the auditor management's assessment of the risk of fraud in the financial
statements;
(c) have disclosed to the auditor their knowledge of fraud/suspected fraud involving
management, employees with significant roles in internal control, and others where fraud
could have a material effect on the financial statements;
(d) have disclosed to the auditor their knowledge of any allegations of fraud/suspected
fraud communicated by employees, former employees, analysts, regulators or others; or
(e) acknowledge the effects of those uncorrected financial misstatements aggregated as a
whole that are immaterial to the financial statements.
1.13 Documentation
HKSA 240.44 The auditor must document:
the significant decisions as a result of the team's discussion of fraud
the identified and assessed risks of material misstatement due to fraud
the overall responses to assessed risks
results of specific audit tests
any communications with management; or
reasons for concluding that the presumption that there is a risk of fraud related to revenue
recognition is not applicable.
Self-test question 1
Tom is the Human Resources Manager of XXXX Limited in Hong Kong. XXXX Limited has a
number of production and management contracts with the public sector. Tom has created ten
fictitious employees in the company’s factory payroll. A number of pay cheques were issued to
these ten fictitious employees from October to December 20X6.
TUV & Co have been the auditors of XXXX Limited for the last two years, and the audit for the year
ended 31 December 20X6 is currently in progress. Before the discovery of Tom’s activities, TUV &
Co had assessed the risk of material misstatement due to fraud at the financial statement level as
low after performing the specific risk assessment procedures as required by auditing standards.
Required
(a) Explain the possible impacts of Tom’s activities on XXXX Limited’s financial statements.
(6 marks)
282
10: Fraud and irregularities | Part D Assurance engagements
(b) Explain how Tom’s activities may affect the risk assessment and the audit work responsive
to the assessed risk of material misstatement due to fraud. (9 marks)
HKICPA May 2007
(The answer is at the end of the chapter)
Topic highlights
Auditors must be aware of laws and regulations as part of their planning and must be aware of any
statutory duty to report non-compliance by the entity.
Key term
Non-compliance refers to acts of omission or commission by the entity, either intentional or
unintentional, which are contrary to the prevailing laws or regulations.
HKSA 250.11 Such acts include transactions entered into by the entity, or on its behalf by its management or
employees. It does not include personal misconduct. Non-compliances may result in financial
consequences, like fines and litigation and non-financial consequences, such as loss of reputation.
283
Business Assurance
(e) Monitor compliance with the code of conduct and act appropriately to discipline
employees who fail to comply with it;
(f) Engage legal advisers to assist in monitoring legal requirements; or
(g) Maintain a register of significant laws with which the entity has to comply within its
particular industry and a record of complaints.
284
10: Fraud and irregularities | Part D Assurance engagements
285
Business Assurance
286
10: Fraud and irregularities | Part D Assurance engagements
control activities and level of management or employees involved, especially when involving
highest authority within an entity.
When no remedial actions are taken by management and those charged with governance on the
non-compliances, auditors should consider withdrawal from the engagement and should consider
seeking legal advice first.
Topic highlights
A firm of Certified Public Accountants must establish policies and procedures in order to meet its
responsibilities in relation to money laundering.
287
Business Assurance
(b) except when he is prohibited by law from informing any party other than the proper authority
or when the matter casts doubt on the integrity of those charged with governance, discuss
the matter with those charged with governance, including any audit committee.
288
10: Fraud and irregularities | Part D Assurance engagements
Key terms
Money laundering is a process by which criminals attempt to conceal the true origin and
ownership of the proceeds of criminal activities. It is a way in which money earned from criminal
activities (“dirty money”) is transferred and transformed so it appears to have come from a
legitimate source (“clean money”). Money laundering includes a wide range of potential crimes
including possessing, dealing with, or concealing the proceeds of crime.
289
Business Assurance
external body. The MLRO should have an appropriate level of seniority and experience and
would usually be a senior partner.
(b) Customer identification procedures
This is often referred to as customer due diligence (CDD), or “know your client” (KYC)
procedures.
The point of these procedures is to ensure that the firm has verified the identity of clients
(whether the client is an individual or an entity), and has obtained evidence of that identity.
For an individual, typical evidence of identity would be a passport, driving licence, and
evidence of address such as a utility bill. For an entity evidence may include a certificate of
incorporation. The identification process for an entity would also involve identification of key
management personnel and those people in control of the entity, and an assessment as to
whether any connected individuals are politically exposed persons (PEP).
(c) Enhanced record keeping
Records must be kept of clients’ identity, the firm’s business relationship with them, and
details of transactions with the client. All records should be kept for five years after the end of
the business relationship or completion of the transactions. Internal and external reports
made in connection to money laundering should also be securely kept for five years.
(d) Communication and training
All relevant employees should receive training so that they are aware of the main provisions
of money laundering regulations, and so that they know how to recognise and deal with
activities which may be money laundering. The training programme should be offered to all
members of the firm with an involvement in audit engagements. Training should also be
provided on the firm’s internal policies and procedures with relation to money laundering.
In particular, all staff should be aware of appropriate lines of communication, and who they
should report suspicions of money laundering activities to. Training should be considered for
all staff, including support staff who do not carry out an advisory role.
(e) Internal controls, risk assessment, management and monitoring
The firm should establish systems and controls to effectively manage the risk that the firm is
exposed to in terms of money laundering activities. This could include:
client screening procedures to minimise the risk of taking on a new client with a high
risk of money laundering activities
systems and controls to ensure that training is taken/attended and understood by all
relevant employees
systems that allow periodic testing that the firms’ policies and procedures comply with
legislative and regulatory requirements
All of the above contribute to the acceptance and following of firm-wide practices by all relevant
individuals and can be seen as quality control measures.
3.3.4 Money laundering in Hong Kong
The Financial Action Task Force (FATF), the international AML standard-setter, completed an
evaluation on Hong Kong’s AML regime in 2008 and concluded inter alia that we should provide
statutory backing and appropriate sanctions for customer due diligence (CDD) and record-keeping
requirements for financial institutions, and put into place an AML regulatory framework for
remittance agents and money changers.
At present, the requirements on CDD and record keeping by financial institutions are implemented
mainly through guidelines issued by the Monetary Authority (MA), the Securities and Futures
Commission (SFC) and the Insurance Authority (IA) respectively. Hong Kong is required by FATF
to implement improvement measures to address these deficiencies. Failure to do so will result in
enhanced scrutiny by FATF and could subject Hong Kong to counter measures by other FATF
members, which would hinder our development as an international financial centre.
290
10: Fraud and irregularities | Part D Assurance engagements
In October 2012, the FATF recognised that Hong Kong had made significant progress in
addressing the deficiencies identified in the 2008 Mutual Evaluation Report. The FATF agreed that
Hong Kong should now report on any further improvements to its Anti-Money
Laundering/Combating the Financing of Terrorism (AML/CFT) system on a biennial update basis.
291
Business Assurance
Topic recap
Search for
indication of
Management Auditor Risk Responses Reporting non-compliance
responsibilities responsibilities assessment
procedures
Action on
discovery of
Presumed risk non-compliance
of fraud in
revenue recognition
292
10: Fraud and irregularities | Part D Assurance engagements
Answer 1
(a) The possible impacts of Tom’s activities on the financial statements of XXXX Ltd for the year
ended 31 December 20X6 are as follows:
XXXX Ltd’s bank and cash were misappropriated via the payments to ten fictitious
employees.
Staff costs are overstated, and, therefore, XXXX Ltd’s overall expenditure. XXXX Ltd’s
profit is understated.
Staff benefits or staff-related costs/deductions are overstated, eg employees’
insurance and severance payment provisions.
If staff costs are capitalised in inventories or other forms of assets (eg development
expenditure), the reported amount of those assets is overstated.
In cases where XXXX Ltd has cost-plus contracts with its customers (ie cost-
reimbursement plus margin arrangement), an overstatement of staff costs may
overstate the amount of revenue (reimbursement from customers).
A contingent liability may arise due to a possible breach of contract if one of the
purposes of overstating the headcount is to fulfil contract requirements (eg headcount
requirements as set out in contracts with the Government).
There may be a going concern issue due to the violation of contractual requirements
and other regulations for XXXX Ltd to carry on operating (and winning contracts) in the
public sector outsourcing market.
TUV & Co’s risk assessment at the financial statement level (as low) may not be
appropriate as the internal controls of XXXX Ltd on its payroll may be weak or subject
to management manipulation. This could cause material misstatements in other
aspects of XXXX Ltd’s financial statements to exist.
(b) Before the discovery of Tom’s activities, TUV & Co had assessed the risk of material
misstatement due to fraud at the financial statement level as low after performing the specific
risk assessment procedures as required by HKSA 240 (Clarified).
Tom’s activities indicate there are weaknesses in how those charged with governance
exercise oversight of management processes for identifying and responding to the risks of
fraud in the entity and also weaknesses in the overall control environment.
As the HR Manager of XXXX Ltd, Tom holds a senior position. Management override of
controls exists.
TUV & Co should also consider whether or not there is any evidence suggesting the
susceptibility of XXXX Ltd to management fraud and the competence and integrity of
management.
The insertion of fictitious employees into the payroll indicates a lack of controls in XXXX Ltd’s
payroll and cheque payment procedures. The internal controls that management has
established to mitigate these risks are proved to be ineffective.
Depending on the pervasiveness of the audit evidence, TUV & Co may need to revise its
assessment of the risk of material misstatement at the financial statement level to medium or
high.
293
Business Assurance
If TUV & Co obtains evidence indicating that the misappropriation of assets (pay cheques) is
restricted to Tom for the last three months of the year ended 31 December 20X6 and if the
amount of cash misappropriated is material to XXXX Ltd, TUV & Co may need to revise its
assessment of the risk of material misstatement of the occurrence of staff costs and the
existence of bank and cash to medium or high.
TUV & Co may also need to assess the risk of material misstatement of the completeness
assertion of staff costs and bank & cash (due to possible misappropriation of cheques or
cash by Tom to genuine employees) as medium or high. [Some candidates may argue that
the payment to fictitious employees is based on payroll records which are false. Therefore,
the controls in bank & cash may well be effective, but the controls in payroll records had
broken down so that Tom could create fictitious employees and working/attendance records.]
According to HKSA 330 (Clarified), TUV & Co’s responses to address the assessed risks of
material misstatement due to fraud at the assertion level should include changing the nature,
timing, and extent of audit procedures.
Changing the nature of audit procedures
As the key risks include the existence of employees, the occurrence of staff costs and the
existence and completeness of bank and cash, substantive procedures may become more
important, eg physical verification meetings with individual employees, physical observation
of pay cheque distribution, matching the payroll to personnel files and vouching clock cards
or time sheets.
Without Tom’s activities, TUV & Co may rely on the internal controls of XXXX Ltd and carry
out more tests of controls in the payroll and pay cheque procedures.
Changing the timing of audit procedures
In some cases, audit work at an interim date can make the year end audit more effective.
However, Tom’s activities took place during the last three months of the year ended
31 December 20X6, and any audit conclusions reached based on audit procedures
completed at an interim date may not be extended to the year end.
Therefore, it is not effective to carry out any substantial amount of audit work at an interim
date.
Changing the extent of audit procedures
TUV & Co may increase sample sizes when performing tests of details eg physical
verification meetings with individual employees, physical observation of pay cheque
distribution, matching payroll to personnel files and vouching clock cards or time sheets.
TUV & Co may perform analytical procedures at a more detailed level, eg comparison of
wages and salaries, MPF, staff-related costs/deductions of different periods, and among
different shifts, product lines and factories. Without Tom’s activities, TUV & Co may perform
these analytical procedures at the company level only.
294
10: Fraud and irregularities | Part D Assurance engagements
Exam practice
Unaudited Audited
Year ended 30 Jun 20X9 Year ended 30 Jun 20X8
$'million $'million
Trade receivables from customers in the US 27 20
Trade receivables from other customers 6 5
Total trade receivables 33 25
$'million $'million
Sales to customers in the US 110 100
Sales to other customers 55 50
Total sales 165 150
(3) Ms. Chan expects ABC to be ready for listing on the Hong Kong Stock Exchange in the near
future in order to stay competitive.
(4) Ms. Chan explains that ABC has recently changed the remuneration package for senior
managerial staff linking it more directly to ABC’s sales.
(5) Ms. Chan explains that ABC has recently established an affiliated entity in the US to provide
certain support services for ABC’s main products.
Required
(a) Define the auditor’s responsibility towards the risks of fraud in financial statements.
(3 marks)
(b) Define fraud risk factors and describe the three conditions that are generally present when
fraud exists.
(3 marks)
295
Business Assurance
(c) Explain four main fraud risk factors identified from the audit of ABC’s financial statements for
the year ended 30 June 20X9. (8 marks)
(d) Explain how, as part of the audit of ABC’s financial statements, Mr. Kwok may identify any
unusual or unexpected relationships amongst the figures provided by Ms. Chan (point (2)
above) that may indicate risks of material misstatement due to fraud. (6 marks)
(Total = 20 marks)
HKICPA May 2009
296
chapter 11
Learning focus
Auditors should evaluate the internal control system in order to determine whether to rely on
the entity's internal controls in order to reduce the level of substantive testing.
297
Business Assurance
Learning outcomes
Competency
level
2.09 Audit procedures 3
2.09.05 Explain the importance of internal control to auditors and the
execution of tests of control
2.09.06 Explain how auditors identify weaknesses in internal control
systems and how those weaknesses limit the extent of auditors'
reliance on those systems
2.10 Audit evidence 3
2.10.04 Explain the need to modify the audit strategy and audit plan
following the results of tests of control
2.13 Reporting 3
2.13.01 Discuss and provide examples of how the reporting of internal
control weaknesses and recommendations to overcome those
weaknesses are provided to management
4.02 Categories and types of controls 3
4.02.01 State examples of controls in a computerised system
4.02.02 Define and give examples of general and application controls
298
11: Internal control and tests of controls | Part D Assurance engagements
Topic highlights
The auditors must understand the accounting system and control environment in order to
determine their audit approach.
Key term
Internal control is the process designed, implemented and maintained by those charged with
governance, management, and other personnel to provide reasonable assurance about the
HKSA 315.4c
achievement of the entity's objectives with regard to reliability of financial reporting, effectiveness
and efficiency of operations and compliance with applicable laws and regulations.
HKSA 315 (Revised) Identifying and Assessing the Risks of Material Misstatement through
Understanding the Entity and its Environment deals with the whole area of controls.
Internal control has five elements:
The control environment;
The entity's risk assessment process;
The information system relevant to financial reporting;
Control activities; and
Monitoring of controls.
HKSA 315 (Revised) requires that the auditor shall obtain an understanding of internal controls
relevant to the audit. Most controls relevant to the audit are likely to relate to financial reporting but
there might be controls relevant to operations and compliances objectives. It is a matter of the
auditor’s professional judgment whether a control, individually or in combination with others, is
relevant to the audit.
In obtaining an understanding of internal control, the auditor must understand and evaluate the
design of the internal control (ie is it capable of preventing, detecting and correcting material
misstatements?) and the implementation of that control (ie has it been operated correctly in that
year?) by performing procedures in addition to inquiry of the entity’s personnel. In the following
sub-sections, we look at each of the elements of internal control in turn.
Key term
The control environment is the framework within which operational controls operate. Its
effectiveness is very much determined by management's attitudes, awareness of risk and actions
and the importance placed on internal control within the entity.
299
Business Assurance
It does not, on its own, guarantee the effectiveness of the overall control system, but reduces the
risks of material misstatement. A weak control environment can undermine the effectiveness of
specific operational controls.
Controls are more likely to operate well in an environment where they are regarded as being of
importance, that is, in entities where the ethos is set at the most senior levels of the company that
honest and transparent behaviour is paramount and deviations from ethical practice will not be
accepted. The responsibility for individual areas is then cascaded down through tiers of
management in the form of operational controls. The auditors, will perform procedures to ascertain
whether certain controls exist and are routinely adhered to. For example, the auditor may check
that a particular payment has been made to a supplier on an approved list.
HKSA 315 (Revised) states that auditors must understand an entity's control environment. The
types of check described above are relatively easy to perform as walk-through tests but auditors
must also use observation and inquiry to assess whether:
management, with the oversight of those charged with governance, has created and
maintains a culture of honesty and ethical behaviour
the strengths in the control environment provide an adequate foundation for the other
elements of internal control and whether those elements are weakened by deficiencies in the
control environment.
The following table illustrates this:
Control environment
Management's integrity Essential elements which influence the effectiveness of the
and ethical values design, administration and monitoring of controls; and
Overall attitude, awareness and actions of management on
the internal control system
Commitment to Management's assessment of the competency levels for
competence particular roles and how those levels translate into requisite
skills and knowledge
Participation by those Independence from management
charged with Experience and stature
governance
Extent of involvement and scrutiny of activities
Type of difficult questions resolved in between internal and
external auditors
Whether they understand the entity's business transactions
Management's Approach to taking and managing business risks
philosophy and Attitudes and actions towards financial reporting
operating style
Attitudes towards information processing and accounting
functions and personnel
Organisational The framework within which an entity's activities for achieving its
structure objectives are planned, executed, controlled and reviewed
(including segregation of duties, job rotation and so on)
Assignment of authority How authority and responsibility for business activities are
and responsibility allocated and how reporting lines and authorisation controls are
organised
Human resource How recruitment, induction, training, performance monitoring and
policies and practices career progression plans, work place counselling, remuneration,
and grievance and discipline matters are conducted
Finally, the auditor should form a conclusion as to whether the control environment is strong or
weak.
300
11: Internal control and tests of controls | Part D Assurance engagements
Key term
The information system relevant to financial reporting is a component of internal control that
includes the financial reporting system, and consists of the procedures and records established to
initiate, record, process and report entity transactions (as well as events and conditions) and to
maintain accountability for the related assets, liabilities and equity.
HKSA The auditor must obtain an understanding of the information system relevant to financial reporting
315.18-19 objectives, and the following in particular:
(a) The classes of transactions in the entity's operations that are of most significance to the
financial statements
(b) The procedures, within both computerised and manual systems, by which those transactions
are initiated, recorded, processed, corrected, and transferred to the general ledger and
reported in the financial statements
(c) The underlying accounting records, supporting information, and specific accounts in the
financial statements, in respect of initiating, recording, processing and reporting transactions
(d) How the information system records events and conditions, other than transactions, that are
significant to the financial statements
(e) The financial reporting process used to prepare the entity's financial statements, including
significant accounting estimates and disclosures
(f) Controls surrounding journal entries, including non-standard journal entries used to record
unusual one-off transactions or adjustments
The auditor should also obtain an understanding of how the entity communicates financial
reporting roles and responsibilities and significant matters relating to financial reporting to
management and those charged with governance or regulatory authorities.
301
Business Assurance
Self-test question 1
You are the audit senior responsible for the audit of Supreme Food Limited, a Hong Kong
company that runs a chain of fast food stores.
The major risk in this industry is always related to food quality which might result in damage claims
by customers.
After the risk assessment conducted at the interim audit on the company’s internal control system
regarding the purchases of food and its preparation process, you consider the risk to be low.
However, during your final audit you discover that an incident happened one month before the
year-end. A customer took legal action against the company for personal injury caused by food
poisoning, claiming an amount of $200,000 in compensation. This amount is material to the stated
profit of the company, but management believes that the company has a good defense against the
claim.
(i) State TWO controls that the company should have in place to reduce the risk associated
with purchases of food and its preparation in the kitchen; and
(ii) State TWO audit procedures you should carry out during controls testing to satisfy yourself
that control risk in this area is low.
Key term
Control activities are the policies and procedures that help ensure that management directives
are carried out.
HKSA HKSA 315 (Revised) states that the auditor shall obtain an understanding of control activities
315.20-21 relevant to the audit. This includes an understanding of how the entity has responded to risks
arising from IT. By relevant the standard means those the auditor deems it necessary to
understand in order to assess the risks of material misstatement at the assertion level, and which
are necessary to design further audit procedures responsive to the assessed risks.
Control activities that are relevant to the audit are:
(a) Control activities that relate to significant risks or relate to risks for which substantive
procedures alone do not provide sufficient appropriate audit evidence; or
(b) Those that are considered to be relevant in the judgment of the auditor.
302
11: Internal control and tests of controls | Part D Assurance engagements
Key term
Monitoring of controls is a process to assess the effectiveness of internal control performance
over time. It involves assessing the effectiveness of controls on a timely basis and taking
necessary remedial actions.
HKSA HKSA 315 (Revised) requires that the auditor shall obtain an understanding of the major activities
315.22-24 that the entity uses to monitor internal control over financial reporting, including those related to the
control activities relevant to the audit, and how the entity initiates corrective actions to deficiencies
in its controls. The entity will use ongoing monitoring activities that are often built into the entity's
routine operations, including regular management and supervisory activities or separate
evaluations or a combination of the two.
Monitoring control is also used to ensure that controls continue to operate effectively over time.
If the entity has an internal audit function, the auditor shall assess whether the internal audit
function is relevant to the audit through obtaining an understanding of the nature of its
303
Business Assurance
responsibilities and how the internal audit function fits in the organisational structure, and the
activities performed/to be performed.
The auditor shall also obtain an understanding of the sources of the information used in the
monitoring activities and the basis on which management considers it reliable.
Some of the monitoring controls are:
supervision of others – checking by others
comparison of actual performance to budgets and analysis of the variances
relationship of financial or operational data – sensitivity analysis
ratio analysis
review reconciliations
internal auditors' evaluation
304
11: Internal control and tests of controls | Part D Assurance engagements
Topic highlights
The auditors shall assess the adequacy of the systems as a basis for the financial statements and
shall identify risks of material misstatements to provide a basis for designing and performing
further audit procedures.
Auditors are only concerned with assessing policies and procedures which are relevant to the
financial statements. Auditors shall:
assess the adequacy of the accounting system as a basis for preparing the financial
statements;
identify the types of potential misstatements that could occur in the financial statements;
consider factors that affect the risk of misstatements; and
design appropriate audit procedures.
The assessment of the controls of an entity will have an impact on that risk assessment.
Risks arising from poor control environments are unlikely to be confined to particular assertions
in the financial statements, and, if severe, may even raise questions about whether the financial
statements are capable of being audited, that is, if control risk is so high that audit risk cannot be
reduced to an acceptable level.
On the other hand, some control procedures may be closely connected to an assertion in the
financial statements, for example, controls over the inventory count are closely connected with the
existence and completeness of inventory in the financial statements.
There may be occasions where substantive procedures alone are not sufficient to address the risks
arising. Where such risks exist, auditors shall evaluate the design and determine the
implementation of the controls, that is by controls testing. This is most likely to be the case in a
system which is highly computerised and which does not require much manual intervention.
Topic highlights
The auditors must keep a record of the entity's systems which must be updated each year. This
can be done through the use of narrative notes, flowcharts, questionnaires or checklists.
There are several techniques for recording the assessment of control risk, that is, the system. One
or more of the following may be used depending on the complexity of the system:
Narrative notes Questionnaires
Flowcharts Checklists
Whatever method of recording is used, the record will usually be retained on the permanent file and
updated each year. We will look at the use of questionnaires in a little more detail here. There are
two types, each with a different purpose:
Internal Control Questionnaires (ICQs) are used to ask whether controls exist which meet
specific control objectives. Although there are many different forms of ICQ in practice, they
all conform to the following basic principles:
305
Business Assurance
(a) They comprise of a list of questions designed to determine whether desirable controls
are present
(b) They are formulated so that there is one to cover each of the major transaction cycles.
Since it is the primary purpose of an ICQ to evaluate the system rather than to describe it,
one of the most effective ways of designing the questionnaire is to phrase the question so
that all the answers can be given as “YES” or “NO” with a “NO” answer indicating a
deficiency in the system.
Example
Are purchase invoices checked to goods received notes
before being passed for payment? YES/NO/COMMENT
A “NO” answer to the question clearly indicates a deficiency in the company’s payment procedures.
Internal Control Evaluation Questionnaires (ICEQs) are used to determine whether there
are controls which prevent or detect specified errors or omissions. This is achieved by
reducing the control criteria for each transaction stream down to a handful of key questions
(or control questions). The characteristic of these questions is that they concentrate on the
significant errors or omissions that could occur at each phase of the appropriate cycle if
controls are deficient.
Example
Is there reasonable assurance that:
Receipt of goods or services is required in order to establish a liability?
Each key control question is supported by detailed points to be considered.
Example
Is segregation of duties satisfactory?
Are controls over relevant master files satisfactory?
Is there a record that all goods received have been checked for weight or number and quality and
damage?
3 Tests of controls
Topic highlights
If the auditors believe the system of controls is strong, they may choose to test controls to assess
whether they can rely on the controls having operated effectively.
Key term
Tests of controls are the audit procedures designed to evaluate the operating effectiveness of
HKSA 330.4b controls in preventing, or detecting and correcting, material misstatements at the assertion level.
306
11: Internal control and tests of controls | Part D Assurance engagements
307
Business Assurance
(b) Inquiries about internal controls which leave no audit trail, eg determining who actually
performs each function not merely who is supposed to perform it;
(e) Testing of internal controls operating on computerised systems or over the overall IT
function, eg access controls; and
(f) Observation of controls to consider the manner in which the control is being operated.
Deviations in the operation of controls (caused by change of staff or similar) may increase control
risk and tests of controls may need to be modified to confirm effective operation during and after
any change.
The use of computer-assisted audit techniques (CAATs) may be appropriate and these are
discussed in detail in Chapter 20.
In a continuing engagement, the auditor will be aware of the accounting and internal control
systems through work carried out previously but will need to update the knowledge gained and
consider the need to obtain further audit evidence of any changes in control.
(b) The risks arising from the characteristics of the control, including whether it is manual or
automated;
(c) The effectiveness of general IT controls;
(d) The effectiveness of the control and its application by the entity, including the nature and
extent of deviations in the application of the control noted in previous audits, and whether
there have been personnel changes that significantly affect the application of the control;
(e) Whether the lack of a change in a particular control poses a risk due to changing
circumstances; and
(f) The risks of material misstatement and the extent of reliance on the control.
For example, in performing the prior audit, the auditor may have determined that an automated
control was functioning as intended. The auditor obtains audit evidence to determine whether
changes to the automated control have been made that affect its continued effective functioning,
for example, through inquiries of management and the inspection of logs to indicate what controls
have been changed.
308
11: Internal control and tests of controls | Part D Assurance engagements
Consideration of audit evidence about these changes may support either increasing or
decreasing the expected audit evidence to be obtained in the current period about the operating
effectiveness of the controls.
309
Business Assurance
Self-test question 2
A proper understanding of internal controls is essential to auditors in order that they understand the
business and are able to effectively plan and execute tests of controls and an appropriate level of
substantive procedures.
You are the auditor of an investment entity, Charter Great Limited ("Charter Great"), that pays its
staff payroll by bank auto transfer and in cash. The entity also uses a small stand-alone computer
for maintaining its payroll records.
Required
For the payroll charges and payroll balances (including cash) in the financial statements of Charter
Great:
(a) describe the external auditor audit's objectives;
310
11: Internal control and tests of controls | Part D Assurance engagements
(b) list the tests of controls and substantive procedures that will be applied in order to achieve
the audit objectives identified in (b) (i) above.
(The answer is at the end of the chapter)
Topic highlights
There are special considerations for auditors when a system is computerised. IT controls comprise
general and application controls.
The overall objective and scope of an audit do not change in a computer environment. However, as
the means of processing of transactions and the media of storage of data are different from those
of a manual system.
The internal controls in a computerised environment include both manual procedures and
procedures designed into computer programs. Such control procedures comprise two types of
control, general controls and application controls. (The impact of IT on the audit process is
covered in more detail in Chapter 20.)
Key terms
General controls are policies and procedures that relate to many applications and support the
effective functioning of application controls by helping to ensure the continued proper operation of
information systems. General controls commonly include controls over data centre and network
operations; system software acquisition, change and maintenance; access security; and application
system acquisition, development and maintenance. Examples include IT policies, standards, and
guidelines pertaining to IT security and information protection, application software development
and change controls, segregation of duties, service continuity planning, IT project management,
etc.
Application controls are manual or automated procedures that typically operate at a business
level. Application controls can be preventative or detective in nature and are designed to ensure
the integrity of the accounting records. Accordingly, application controls relate to procedures used
to initiate, record, process and report transactions or other financial data. Examples include system
edit checks of the format of entered data to help prevent possible invalid input, system enforced
transaction controls that prevent users from performing transactions that are not part of their
normal duties, and the creation of detailed reports and transaction control totals that can be
balanced by various units to the source data to ensure all transactions have been posted
completely and accurately.
311
Business Assurance
312
11: Internal control and tests of controls | Part D Assurance engagements
The auditors will wish to test some or all of the above general controls, having considered how they
affect the computer applications significant to the audit.
General controls that relate to some or all applications are usually interdependent controls, ie their
operation is often essential to the effectiveness of application controls. As application controls may
be useless when general controls are ineffective, it will be more efficient to review the design of
general controls first, before reviewing the application controls.
Application Examples
controls
Controls over input: Manual or programmed agreement of control totals
completeness
Document counts
Edit checks of input data
Numerical sequence checks with manual follow-up of exception
reports
One-for-one checking of processed output to source documents
Programmed matching of input to an expected input control file
Procedures over resubmission of rejected controls
313
Business Assurance
Application Examples
controls
Controls over input: Programs to check data fields (for example, value, reference
accuracy number, date) on input transactions for plausibility:
Digit verification (reference numbers are as expected)
Reasonableness test (sales tax to total value)
Existence checks (customer name)
Character checks (no unexpected characters used in reference)
Necessary information (no transaction passed with gaps)
Permitted range (no transaction processed over a certain value)
Manual scrutiny of output and reconciliation to source
Agreement of control totals (manual/programmed)
Controls over input: Manual checks to ensure information input was:
authorisation
authorised
input by authorised personnel
Controls over Similar controls to input must be in place when input is completed, for
processing example, batch reconciliations
Screen warnings can prevent people logging out before processing is
complete
Controls over One-to-one checking
master files and
Cyclical reviews of all master files and standing data
standing data
Record counts (number of documents processed) and hash totals
(for example, the total of all the payroll numbers) used when master
files are used to ensure no deletions
Controls over the deletion of accounts that have no current balance
Controls may be carried out by IT personnel, users of the system, a separate control group and
may be programmed into application software. The auditors may wish to test the following
application controls:
314
11: Internal control and tests of controls | Part D Assurance engagements
As we have already noted, general controls may have a pervasive effect on the processing of
transactions in application systems. If these general controls are not effective, there may be a risk
that misstatements occur and go undetected in the application systems. Although weaknesses in
general controls may preclude testing certain application controls, it is possible that manual
procedures exercised by users may provide effective control at the application level.
4.3 Documentation
Adequate documentation of both general and application controls is crucial. Proper documentation
by the entity ensures that adequate and up-to-date system documentation is maintained. The entity
should have procedures to ensure that:
(i) system documentation is sufficiently comprehensive;
(ii) documentation is updated to reflect system amendments; and
(iii) a back-up copy of the documentation is held.
Without good documentation, it will be difficult to ensure that controls operate on a continuous
basis and there will also be greater likelihood of error. Good documentation procedures reduce the
risk of users making mistakes or exceeding their authority. A review of comprehensive, up to date
documentation should aid the auditor in gaining an understanding and may help to identify
particular audit risks.
Self-test question 3
You are the audit senior on the XYZ Limited (“XYZ”) audit. XYZ is a distributor of hair care products
including shampoos, conditioners and mousses. XYZ uses an online computer system. No goods
are manufactured in-house. XYZ maintains an inventory of raw materials and subcontracts the
manufacture of its products to third parties. Approximately 50 suppliers and ten sub-contractors are
used and all have proven themselves to be reliable. All finished goods are sent to customers
directly from the sub-contractors, who send a weekly statement to XYZ. Your assistant has
prepared the following notes about the inventory system.
Purchase orders are automatically generated by the computer when inventories of any raw material
fall below 70 % of the prior month's usage. The purchase orders contain the following details:
Date
Supplier name and address
Raw materials needed
Three copies of the purchase order are produced and distributed as follows:
Copy 1 – to warehouse to enable follow up of late orders
Copy 2 – filed by accounts clerk in date order
Copy 3 – sent to supplier
When raw material inventories are received, the bar code attached to the delivery boxes by the
supplier is scanned into the system. A two-part Goods Received Note (“GRN”) is then produced:
Copy 1 – matched to warehouse copy of purchase order by stores staff
Copy 2 – filed by accounts clerk in date order
The scanning process is aborted if the codes do not match those on the master file. Production
orders are generated on receipt of a firm order from customers.
The inventory master file contains details of existing inventory items including code and warehouse
location; and approved suppliers and sub contractors.
Orders will only be generated to suppliers and sub-contractors recorded on the master file.
315
Business Assurance
Required
(a) Identify any deficiencies in the internal controls of XYZ. Discuss the implications of each of
the deficiencies you have identified.
(b) Assume that your Computer Information System “CIS” audit division is to perform tests of
controls for the inventory systems described. Make a list for the CIS audit manager of the
key tests that you recommend him to perform.
(The answer is at the end of the chapter)
Topic highlights
Auditors have responsibility to communicate appropriately to those charged with governance and
management deficiencies in internal control that the auditor has identified in an audit of financial
statements.
HKSA 265 (Clarified) Communicating Deficiencies in Internal Control to those Charged with
Governance and Management deals with the auditor's responsibility to communicate
appropriately to those charged with governance and management deficiencies in internal
control that the auditor has identified in an audit of financial statements. The HKSA states that
significant deficiencies in internal control must be communicated to those charged with
governance.
The auditor may identify and discuss the deficiencies in internal control not only during this risk
assessment process but also at any other stage of the audit. This HKSA specifies which identified
deficiencies the auditor is required to communicate to those charged with governance and
management.
For significant deficiencies, the appropriate level is likely to be the chief executive officer or chief
financial officer (or equivalent) as these matters are also required to be communicated to those
charged with governance.
For other deficiencies in internal control, the appropriate level may be operational management
with more direct involvement in the control areas affected and with the authority to take appropriate
remedial action.
316
11: Internal control and tests of controls | Part D Assurance engagements
Key terms
Deficiency in internal control – This exists when a control is designed, implemented or operated
HKSA 265.6 in such a way that it is unable to prevent, or detect and correct, misstatements in the financial
statements on a timely basis; or a control necessary to prevent, or detect and correct,
misstatements in the financial statements on a timely basis is missing.
Significant deficiency in internal control – A deficiency or combination of deficiencies in internal
control that, in the auditor's professional judgment, is of sufficient importance to merit the attention
of those charged with governance.
317
Business Assurance
318
11: Internal control and tests of controls | Part D Assurance engagements
communication. Auditors may have to inquire why the significant deficiency has not yet been
remedied.
Certain identified significant deficiencies in internal control may call into question the integrity or
competence of management. Without remedying the deficiencies, auditors may have further doubt
on management's integrity.
Nevertheless, the failure of management to remedy other deficiencies in internal control that have
been previously communicated may become a significant deficiency requiring communication with
those charged with governance.
Self-test question 4
Lewis (Clothing) Limited (“Lewis”) is a retailer of clothing and accessories. It operates in many
Asian countries and has expanded steadily from its base in Hong Kong. The company has a year
end of 31 December 20X0.
In the past, the company has ordered its clothing and accessories in bulk twice a year. From
experience, slow-moving goods and obsolete goods would be written off if these goods failed to
meet the key fashion trends.
The company has recently adopted a just in time ordering system. The fashion purchasers make
an assessment one year in advance as to what the key trends are likely to be.
The following describes the purchasing cycle of Lewis:
Ordering process
The purchasing manager from each country decides on the initial inventory levels for each store,
without consulting the sales manager or store managers. All the orders are communicated to the
central buying department at the head office in Hong Kong. An ordering clerk consolidates all the
orders and passes them to the purchasing director to review and authorise.
When the inventories are required to be re-ordered, it is the store manager's responsibility to re-
order the goods through the purchasing manager; they are prompted weekly to review inventory
levels as although the goods are just in time, it can still take up to at least five weeks for goods to
be received in store. All orders must be made through the purchasing manager. The store
managers cannot place orders independently. There is no centralised inventory system enabling
individual stores to check the availability of an item at other locations. Customers who require a
specific item of clothing which is not available in a particular store, have to contact other branches
themselves or search through the Lewis’s main website.
Goods received and Invoicing
Goods received are delivered directly from the suppliers to the individual stores. Upon receiving the
goods, the quantities are checked by the shop’s sales assistant against the supplier's delivery note,
and then the assistant produces a goods received note (GRN).
The checked GRNs are sent to head office for matching with purchase invoices.
The current system is very time-consuming as purchase invoices are manually checked with the
GRNs from the stores. Once the invoice has been agreed then it is sent to the purchasing director
for authorisation. It is at this stage that the invoice is entered onto the purchase ledger.
Required
As the external auditors of Lewis, identify and explain the deficiencies in the purchasing system
and describe the possible implication of each deficiency. Recommendations should be made to
address each deficiency identified.
(16 marks)
(The answer is at the end of the chapter)
319
Business Assurance
Topic recap
INTERNAL CONTROL
Substantive
Test of controls
approach
Significant
deficiencies: Results Result
communicate to unsatisfactory satisfactory
those charged
with governance
Other
deficiencies Extend tests of Substantive Auditor places
in internal controls testing reliance on controls
control
320
11: Internal control and tests of controls | Part D Assurance engagements
Answer 1
Controls that the company has in place to reduce the risk associated with purchases of food and its
preparation in the kitchen, together with relevant audit procedures on controls testing, would
include the following:
(ii) There should be a list of approved suppliers to Examine the list of approved suppliers of food
ensure that the food comes from sources and check that there are no purchases of food
known for their quality. from other parties.
(iii) On receipt of food, whether meat, fish, or Examine a sample of GRNs to ensure that all
vegetables and fruit, it should be carefully bear an approved signature indicating that food
inspected by informed people, including those has been inspected for quality on receipt.
responsible for food preparation.
This would be to ensure that it was of the
desired quality (as well as quantity). A goods
received note (GRN) should be signed to
provide evidence of receipt and inspection.
(iv) Food purchased should be kept in a clean Examine the food storage areas, including
place and refrigerated, if necessary. This refrigerators, on a surprise basis to ensure they
would be to ensure that it has kept its quality. are clean and tidy.
Ensure that the refrigerators are maintained at
the correct temperature. Another test in this
area might be to examine reports of local
authority and other inspectors to ensure they
were happy that the food was being properly
stored.
(v) Strict adherence to use-by dates to ensure Check that there is no food on the premises
that no poor quality food is prepared. which is past its use-by date.
Discuss with management what happens to
food which is past its use-by date, that is, how it
is disposed of.
Additionally someone in the company should have responsibility for health and safety and should
have the relevant training.
321
Business Assurance
Answer 2
Audit objectives, tests of controls and substantive procedures
Objective: Existence: of assets and liabilities such as cash on hand and in the bank, and of
the liability to pay staff and the associated tax and social insurance liabilities.
Tests of controls and substantive procedures
Testing controls over the security of cash to ensure that they are operating effectively
throughout the relevant period.
Performing cash counts, with reconciliations to the records and observing cash payments to
staff, ensuring that appropriate signatures are obtained and that unclaimed cash is promptly
re-banked, for example. Making checks on the physical existence of staff to ensure that the
related expenses and liabilities are genuine. Checking after date payments to staff and for
tax and social insurance contributions.
Objective: Completeness: there are no unrecorded assets or liabilities (such as those noted
under “existence”, above) or transactions (such as payroll payments) or undisclosed items
(such as unrecorded payroll liabilities).
Tests of controls and substantive procedures
Manually checking the accuracy of payroll calculations to ensure that correct payments and
deductions are being made in accordance with approved pay rates and approved deduction
rates for tax and social insurance. Reviewing evidence of authorisation controls to ensure
that the payroll has already been checked.
Performing starters and leavers tests to ensure that staff are not paid before they join the
entity and are not paid after they leave – this involves checking the payroll for two separate
periods and examining entries relating to starters and leavers in the intervening period.
Objective: Occurrence: payroll transactions occurred during the relevant accounting period.
Tests of controls and substantive procedures
Performing cut-off tests to ensure that payroll costs incurred during the period have been
recorded during the period by examining entries in the payroll records just before and just
after the period-end and checking back to source documentation, such as time sheets or
clock cards.
Objective: Presentation and disclosure: an item is disclosed and described in accordance
with accounting standards and legislation.
Tests of controls and substantive procedures
Reviewing the financial statements with the aid of a disclosure checklist to ensure that
disclosure requirements have been met.
Reviewing the overall presentation of payroll transactions and balances.
322
11: Internal control and tests of controls | Part D Assurance engagements
Answer 3
(a)
Internal control deficiencies Implications
Order of raw materials is based on prior Purchase orders could have been sent for raw
month's usage and computer generated materials not required or insufficient for
purchase orders are not reviewed prior production in the current or coming months or
to being sent. raw materials could have been ordered in times
of tight cash flows when insufficient funds are
available to pay for them. However, this
weakness rebounds more on the efficient
operation of the entity. It does not have much
direct bearing on financial statement
assertions, but would in remote cases that the
purchase of raw materials is so excessive that it
may materially affect the valuation assertions of
inventories.
(b) Key tests that CIS auditors should perform are on controls which are difficult to test using
manual methods. This will be the most efficient use of their limited time. Given the high level
of reliance placed on computer-generated data, controls tested may include those designed
to ensure that:
suppliers and sub-contractors used are selected only from the list of approved
suppliers and sub-contractors maintained on the master file;
codes scanned on goods received match those on the master file; and
password access is functioning as expected and staff only have access to the
functions they need.
323
Business Assurance
Answer 4
Deficiency 1
The purchasing manager decides on the inventory levels for each store without consulting with
store or sales managers. The purchasing manager may not have the appropriate knowledge of the
local market and the inventories level for a particular store. This may result is inventory lines being
purchased which are unpopular with customers and therefore do not sell. In appropriate amounts of
inventory may be purchased resulting in stock-outs or high levels of unsold inventory.
The purchasing manager should initially communicate with the local store managers to understand
the market needs and sales volumes before placing the orders.
Deficiency 2
The purchasing director reviews and approves the purchase orders in a wholly aggregated manner.
Without the details of the orders, it will be difficult for the purchasing director to assess whether
overall the correct buying decisions are being made.
A purchasing senior manager should review the information prepared for each country and discuss
with local purchasing managers the specifics of their orders. These should then be authorised and
passed to the purchasing director for final review and sign off.
Deficiency 3
The re-ordering process is reliant on the store managers placing an order with the purchasing
manager.
As the re-ordering process can take up to five weeks, any delay by the store managers in placing
the orders could result in stock-outs, causing loss of income and reputation.
Automatic re-order levels should be set up in the inventory management systems.
Deficiency 4
There is no centralised inventory system connecting all the stores, therefore it is not possible for a
store to order goods from other local stores to serve the customers promptly. Instead customers
are told to contact the stores themselves, or use the company website.
Customers are less likely to make an effort to contact individual stores themselves and this could
result in the company losing out on valuable sales.
A centralised inventory system should be maintained which allows inter-branch transfers between
stores.
Deficiency 5
The sales assistants are only instructed to check the suppliers’ delivery notes to the actual
quantities delivered, without checking the quality. In addition there is no checking procedure for
goods received against purchase orders.
The stores are receiving goods without checking that the quantity matches the amount ordered and
that the quality is adequate. Inaccurate quantity of goods and poor quality of goods may be
accepted. Lewis may receive and pay for goods not ordered.
Deliveries from suppliers should only be accepted when the goods have been checked on arrival
for quantity and quality prior to acceptance from the supplier. A responsible official at each store
should produce the GRN from the supplier's delivery information.
A copy of the authorised order form should be sent to the store. This should then be checked to the
GRN. Once checked the order should be sent to head office and logged as completed. On a
regular basis the purchasing clerk should review the order file for any outstanding items.
(Any further deficiency can be suggested)
324
11: Internal control and tests of controls | Part D Assurance engagements
Exam practice
Explain the meaning of control activities and the required procedures relating to control
understanding in addressing significant risks.
(5 marks)
325
Business Assurance
326
chapter 12
Substantive procedures,
including analytical
procedures
Topic list
Learning focus
Substantive procedures are designed to ensure that the balances in the financial
statements are not materially misstated, that is, to detect whether there are any material
errors in the financial statements which have not been prevented by the entity’s internal
controls. Auditors should consider whether they should use analytical procedures as
substantive testing or use only tests of details or even a combination of the two.
327
Business Assurance
Learning outcomes
Competency
level
2.09 Audit procedures 3
2.09.07 Explain the types of substantive procedures and the issues in
evaluating the results obtained
2.09.08 Explain what is meant by analytical review and how analytical
review procedures are used in an audit
328
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
1 Substantive procedures
Topic highlights
Auditors need to obtain sufficient appropriate audit evidence to support the financial statement
assertions. Substantive procedures can be used to obtain that evidence.
HKSA 330 (Clarified) The Auditor’s Responses to Assessed Risks requires that auditors shall
design and perform substantive procedures for each material class of transactions, account
balance and disclosure, irrespective of the assessed risks of material misstatement as the risk
assessment is judgmental and may not identify all risks of material misstatement and there are
always inherent limitations to internal control.
In relation to any assessed risk of material misstatement at the assertion level that is a significant
risk, the auditor must plan and perform substantive procedures that are specifically responsive
to that risk in addition to tests of controls. When the approach to a significant risk consists of
only substantive procedures, those procedures shall include tests of details.
Topic highlights
Substantive tests are designed to discover errors or omissions.
329
Business Assurance
Substantive testing
Account balances
Existence Completeness
330
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
Classes of transactions
Occurrence Completeness
331
Business Assurance
332
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
333
Business Assurance
or no audit evidence for the current period unless the related subject matter has not
fundamentally changed.
334
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
You should bear in mind that the chart attempts to generalise and show a simplified depiction of the
flow and decision-making points in an audit approach. Audit approaches are bound to differ from
client to client in practice, depending on the nature of the business and the nature and level of risk
and so on. So the chart below should not be regarded as prescriptive.
HKSA 315 (REVISED) IDENTIFYING AND ASSESSING THE RISKS OF MATERIAL MISSTATEMENTS
THROUGH UNDERSTAND THE ENTITY AND ITS DEVELOPMENT
[1. Accounting system 2. Control system 3. Control procedures]
Procedures: Walk-through test, inquiries, review documents, observation, inspection
DEVELOP OVERALL AUDIT PLAN
TEST OF CONTROL
335
Business Assurance
2 Analytical procedures
Topic highlights
Analytical procedures are used at all stages of the audit, including as substantive procedures.
When using analytical procedures as substantive tests, auditors should consider the information
available, assessing its availability, relevance and comparability.
Key term
Analytical procedures means evaluations of financial information through analysis of plausible
HKSA 520.4 relations among both financial and non-financial data. Analytical procedures also encompass such
investigation as is necessary of identified fluctuations or relationships that are inconsistent with
other relevant information or that differ from expected values by a significant amount.
HKSA 520.3 The objectives of the auditors as specified in HKSA 520 (Clarified) Analytical Procedures are:
(a) To obtain relevant and reliable audit evidence when using substantive analytical procedures;
and
(b) To design and perform analytical procedures near the end of the audit that assist the auditor
when forming an overall conclusion as to whether the financial statements are consistent
with the auditor’s understanding of the entity.
According to HKSA 520 (Clarified) analytical procedures include the following:
(a) Comparisons of data such as:
(i) comparable information from previous reporting periods
(ii) forecast results using budgets or estimates
(iii) predictions extrapolated from current data and their understanding of the entity
prepared by the auditors
(iv) data derived from wider industry information, secondary research and so on
(b) Ratio analysis to test the relationship of those elements of financial information that are
expected to conform to a predicted pattern because of past behaviour. This may be the
relationship of gross profit to sales, for example
(c) Comparing financial information and relevant non-financial information where there should
be an obvious link, such as the relationship of payroll expenses to number of employees
(d) Sensitivity analysis.
Analytical procedures can be used throughout the audit but their use in some circumstances is
stated in HKSA 315 (Revised) and HKSA 520 (Clarified) as essential:
(a) As risk assessment procedures to obtain an understanding of the entity and its
environment
(b) Towards the end of the audit to help inform the overall conclusion as to the
reasonableness of the financial statements assertions.
They may also be used as substantive procedures, either alone or in combination with tests of
details.
336
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
337
Business Assurance
(ii) In general, substantive analytical procedures are more applicable to large volumes of
transactions that tend to be predictable over time and where an expectation of
relationship among data exists.
(b) Develop an expectation of recorded amounts or ratios and evaluate whether the
expectation is sufficiently precise by considering:
(i) the accuracy with which the expected results of substantive analytical procedures can
be predicted;
(ii) the degree to which information can be disaggregated; and
(iii) the availability of financial and non-financial information.
(c) Evaluate the reliability of data from which the auditor’s expectation of recorded amounts or
ratios is developed. For example:
(i) When controls are effective, auditors have greater confidence in the reliability of the
information and therefore, in results of analytical procedures;
(ii) The controls over non-financial information can often be tested in conjunction with
tests of accounting-related controls. For example, in establishing controls over the
processing of sales invoices, a business may include controls over unit sales
recording. The auditors could therefore test the controls over the recording of unit
sales in conjunction with tests of controls over the processing of sales invoices; and
(d) Determine the amount of any difference of recorded amounts from expected values that is
acceptable without further investigation. This is influenced by:
(i) materiality and consistency with the desired level of assurance
(ii) the possibility a misstatement may cause the financial statement to be materially
misstated
(iii) the persuasiveness of audit evidence
According to HKSA 330 (Clarified) when information produced by the entity is used by the auditor
in audit procedures, the auditor should obtain audit evidence about the accuracy and completeness
of the information.
338
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
HKSAs often refer to a combined assessment of the “risks of material misstatement” rather than
referring to inherent risk and control risk separately. However, the auditor may make separate or
combined assessments of inherent and control risk depending on preferred audit techniques or
methodologies and practical considerations.
339
Business Assurance
Some comparisons and ratios, measuring liquidity and longer-term capital structure, will assist in
evaluating whether the entity is a going concern, in addition to contributing to the overall view of the
financial statements. Declining ratios may indicate going concern problems.
The working papers must contain the completed results of analytical procedures. They should
include:
the outline programme of the work;
the summary of significant figures and relationships for the period;
a summary of comparisons made with budgets and with previous years;
details of all significant fluctuations or unexpected relationships considered; and
details of the results of investigations into such fluctuations/relationships.
Self-test question 1
Green Life Limited (“Green”) sells garden furniture from five retail stores. All sales are made either
in cash or by credit cards, mainly from customers living in New Territories who have properties with
gardens.
All items purchased are delivered to the customer using Green’s own delivery trucks as most
customers could not transport these goods in their own motor vehicles. The directors of Green
indicate that the company has had a difficult year, but are optimistic to present some acceptable
results to the shareholders.
The statements of profit or loss for the last two financial years are shown below:
STATEMENT OF PROFIT OR LOSS
31 March 20Y0 31 March 20X9
HK$'000 HK$'000
Revenue 7,482 6,364
Cost of sales (3,520) (4,253)
Gross profit 3,962 2,111
Operating expenses
Administration (1,235) (1,320)
Selling and distribution (981) (689)
Interest payable (101) (105)
Investment income 145 -
Profit/(loss) before tax 1,790 (3)
340
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
Topic recap
AUDIT PROCEDURES
Substantive
Test of controls procedures at the Includes external
assertion level confirmation
See Chapter II
Extent depends on
results of tests of
Normally combined
controls and
with test of details
analytical procedures
341
Business Assurance
Answer 1
Types of analytical procedures
Under HKSA 520 (Clarified), analytical procedures can be used as:
Comparison of comparable information to prior periods to identify unusual changes or
fluctuations in amounts.
Comparison of actual or anticipated results of the entity with budgets and/or forecasts, or the
expectations of the auditor in order to determine the potential accuracy of those results.
Comparison to industry information either for the industry as a whole or by comparison to
entities of similar size to the client to determine whether receivable days, for example, are
reasonable.
Net profit
Overall, Green’s result has changed from a net loss to a net profit. Given that sales have only
increased by 17% and that expenses, and in particular administration expenses, appear low, then
there is the possibility that expenditure may be understated.
Sales – increase 17%
According to the directors, Green has had a “difficult year”. Reasons for the increase in sales
income must be ascertained as the change does not appear to agree with the directors’ comments.
It is possible that the industry as a whole has been growing allowing Green to produce this good
result.
Cost of sales – fall 17%
A fall in cost of sales is unusual given that sales have increased significantly. This may have been
caused by an incorrect inventory valuation and the use of different (cheaper) suppliers. If quality
has been compromised this may cause problems with poor customer satisfaction or faulty goods in
the next year.
Gross profit (GP) – increase 88%
This is a significant increase with the GP% changing from 33% last year to 53% in 20Y0.
Identifying reasons for this change will need to focus on the change in sales and cost of sales.
Administration – fall 6%
A fall is unusual given that sales are increasing and so an increase in administration to support
those sales would be expected.
Expenditure may be understated, or there may have been a decrease in the number of
administration staff.
Selling and distribution – increase 42%
This increase does not appear to be in line with the increase in sales – selling and distribution
would be expected to increase in line with sales. There may be a mis-allocation of expenses from
administration. Alternatively if the age of Green’s delivery trucks is increasing this may have
resulted in additional service costs.
342
12: Substantive procedures, including analytical procedures | Part D Assurance engagements
343
Business Assurance
Exam practice
Source A Source B
Required
(a) For each of the four situations, state the most important financial statement assertion(s)
which are being tested by the described audit procedures. (4 marks)
(b) For each of the four situations, identify which of the two sources gives more persuasive
evidence, and briefly explain your reasoning. (8 marks)
(Total = 12 marks)
HKICPA February 2006 (amended)
344
chapter 13
Learning focus
In this chapter you will study the audit procedures you would perform to confirm specific
assertions in an entity's financial statements. You should understand why a specific procedure
is performed. We will examine the substantive audit of trade payables and accruals, long-term
liabilities and impairment losses and end with a brief look at capital. Sales are considered in
conjunction with trade receivables and purchases are considered in conjunction with the audit
of trade payables.
345
Business Assurance
Learning outcomes
Competency
level
2.09 Audit procedures 3
2.09.09 Explain the appropriate audit tests for:
2.09.09.01 Tangible non-current assets
2.09.09.02 Intangible non-current assets
2.09.09.03 Inventory
2.09.09.04 Receivables
2.09.09.05 Bank and cash
2.09.09.06 Trade payables and accruals
2.09.09.07 Non-current liabilities
2.09.09.08 Provisions and contingencies
2.09.09.09 Capital and other issues
2.09.09.10 Long-term investments
2.09.09.11 Segment information
2.09.09.12 Revenue
2.09.09.13 Purchases
2.09.09.14 Wages and salaries
2.09.09.15 Financial instruments
346
13: Specific audit procedures | Part D Assurance engagements
Topic highlights
These are key areas when testing tangible non-current assets:
Confirmation of ownership
Inspection of non-current assets
Valuation by third parties
Adequacy of depreciation rates
347
Business Assurance
Confirm whether valuations of all assets that have been revalued have
been updated regularly by inquiries of the Chief Financial Officer and
inspection of previous financial statements.
Inspect draft financial statements to check that entity has recognised
in the statement of profit or loss and other comprehensive income
revaluation losses unless there is a credit balance in respect of that
asset in equity, in which case it should be debited to equity to cancel the
credit. All revaluation gains should be credited to equity.
348
13: Specific audit procedures | Part D Assurance engagements
For revalued assets, ensure that the charge for depreciation is based
on the revalued amount by recalculating it for a sample of revalued
assets.
Reperform calculation of depreciation rates to ensure it is correct.
349
Business Assurance
If the asset was used as security, ensure release from security has
been correctly made.
Classification and Agree opening balances with prior years.
understandability
Review non-current asset disclosures in the financial statements to
ensure they meet HKAS 16 Property, Plant and Equipment criteria.
For a sample of fully depreciated assets, inspect the register to
ensure no further depreciation is charged.
Inspect draft financial statements to ensure that depreciation policies
and rates are correctly disclosed.
350
13: Specific audit procedures | Part D Assurance engagements
Self-test question 1
You are the external auditor of Convenient Motor Limited (“CML”), a Hong Kong listed entity which
has a year end 31 March. You have been the auditor since CML's listing. CML has purchased over
70 trucks for hiring to CML's customers for transporting goods. Normally, the hiring time ranges
from one week to three months.
In the main, all the vehicles are running anywhere in Hong Kong except when some of them have
broken down the vehicles will be returned to CML's car park for repairs. Full details of all vehicles
are maintained in a non-current assets register.
CML will receive telephone orders or e-mail orders where the booked truck would be ready for
collection the next day. Standard hiring amounts are allocated to each booking depending on the
amount of time for which the vehicle is being hired.
The net book value of the trucks is $37.5 million as at the year end and it represents 35 % of CML's
total assets.
Required
Describe the audit procedures the auditor should perform on the net book value of CML's trucks at
the year end.
(The answer is at the end of the chapter)
Note that inspection of a building's title deeds does not give audit evidence about existence and if
there is doubt that a building actually exists, the auditors should physically inspect it.
Topic highlights
Key assertions for intangible non-current assets are existence and valuation.
The key assertions relating to intangibles are existence (not so much “do they exist?”, but “are
they genuinely assets?”) and valuation. They will therefore be audited with reference to criteria laid
down in the financial reporting standards. As only purchased goodwill or intangibles with a readily
ascertainable market value can be capitalised, audit evidence should be available (purchase
invoices or specialist valuations). The audit of amortisation will be similar to the audit of
depreciation.
351
Business Assurance
352
13: Specific audit procedures | Part D Assurance engagements
Self-test question 2
You are the auditor of CC Limited (“CC”). CC acquired DD Limited during the year and recorded
goodwill of HK$300 million and intangible assets such as trade mark, patent and customer
relationships of HK$500 million. Management of CC engaged X Limited to value the intangible
assets and advise on the business valuation of the transaction. Based on the business valuation
performed by X Limited, CC developed its goodwill impairment assessment and concluded that no
goodwill impairment is necessary.
353
Business Assurance
Required
(a) Evaluate and explain the risk of material misstatement relating to the valuation assertion of
CC Limited’s goodwill and intangible assets.
(b) Suggest and discuss the audit procedures you would perform on goodwill and intangible
assets respectively in response to the assessed risk of material misstatement in part (a).
(The answer is at the end of the chapter)
3 Inventory
Topic highlights
There are five key assertions relating to inventory:
Existence
Completeness
Rights and obligations
Valuation
Cut-off
Inventory is often a major area of importance for the auditor and, historically, has been the
component of the statement of financial position that creates more problems than any other. There
are a number of reasons for this including the reasons stated below:
Inventory is usually a significant balance in the calculation of profit and a material component
of the statement of financial position;
The determination of year-end quantities can be problematic;
There are different approaches to its valuation and estimation and subjective assessment is
usually required; and
There is an increased risk of manipulation and fraud by management and relevant parties.
354
13: Specific audit procedures | Part D Assurance engagements
355
Business Assurance
Cut-off Note the numbers of the last Goods Despatched Notes (GDNs)
and Goods Received Notes (GRNs) before the year-end and the
first GDN and GRN after the year-end and check that these have
been included in the correct financial year.
356
13: Specific audit procedures | Part D Assurance engagements
Topic highlights
Physical inventory count procedures are vital as they provide evidence which cannot be obtained
elsewhere or at any other time about the quantities and conditions of inventories and work-in-
progress.
HKSA 501.4 HKSA 501 (Clarified) Audit Evidence – Specific Considerations for Selected Items provides
guidance to auditors on attending the physical inventory count. It states that where inventory is
material, auditors must obtain sufficient appropriate audit evidence regarding its existence and
condition by attending the physical inventory count, unless this is impracticable and perform audit
procedures over the entity's final inventory records to determine whether they accurately reflect
actual inventory count results.
Procedures performed during attendance at physical inventory counting may serve as tests of
control or substantive procedures depending on the auditor's risk assessment, audit approach
and the specific procedures carried out.
It is always management's responsibility to ensure inventory figures in the accounts both
represent inventory that exists and that is actually owned by the entity.
357
Business Assurance
358
13: Specific audit procedures | Part D Assurance engagements
359
Business Assurance
Observe whether the entity's staff are following instructions as this will help to ensure the
count is complete and accurate.
Perform test counts to ensure procedures and internal controls are working properly, ie the
application of appropriate control activities.
Ensure that the procedures for identifying damaged, obsolete and slow-moving inventory
operate properly; the auditors should obtain information about the inventory's condition, age,
usage and in the case of work-in-progress, its stage of completion to ensure that it is later
valued appropriately.
Confirm that inventory held on behalf of third parties is separately identified and accounted
for so that inventory is not overstated.
Conclude whether the count has been properly carried out and is sufficiently reliable as a
basis for determining the existence of inventories.
Consider whether any amendment is necessary to subsequent audit procedures.
Gain an overall impression of the levels and values of inventories held so that the auditors
may, in due course, judge whether the figure for inventory appearing in the financial statements
is reasonable.
When carrying out test counts the auditors should select items from the management's count
records and from the physical inventory and check one to the other, to confirm the accuracy of the
count records. These two-way tests provide evidence for completeness and existence. The
auditors should concentrate on high value inventory. If the results of the test counts are not
satisfactory, the auditors may request that inventory is recounted.
The auditors' working papers should include:
details of their observations and tests
the manner in which points that are relevant and material to the inventory being counted or
measured have been dealt with by the entity
instances where the entity's procedures have not been satisfactorily carried out
items for subsequent testing, such as photocopies of (or extracts from) rough inventory
sheets
details of the sequence of inventory sheets
the auditors' conclusions
360
13: Specific audit procedures | Part D Assurance engagements
Ensure that continuous inventory records have been adjusted to the amounts physically
counted or measured, and that the reasons for the differences have been identified.
Confirm there is a consistent cut-off by checking sales invoices and supplier invoices are
recorded in the proper period.
Review replies from third parties about inventory held by or for them and check all
consignment inventory is included in the final valuation and against the detailed records held by
the entity.
Confirm the entity's final valuation of inventory has been calculated correctly.
Follow up queries and notify any problems to management.
Existence
Inventories at multi-locations
Inventories of small size but high value
Manufactured goods require identification of raw materials, work-in-progress
Inventories with similar appearance
Inventories requiring special storage
Inventories are highly desirable and movable, ie the susceptibility of assets to loss or
misappropriation is high. For example, fraudulent schemes may be used to disguise the
unaccounted for portion of inventories
Valuation
Inventories with similar appearance
Inventories requiring special knowledge to value
Inventories purchased in bulk – difficult to allocate costs
Inventories of high value – wrong identification is material error
Inventories requiring special storage – increased chance of obsolescence
Inventories with fluctuating net realisable value
Manufactured goods – allocation of costs
361
Business Assurance
Topic highlights
The valuation and disclosure rules for inventory are laid down in HKAS 2 Inventories. Inventory
should be valued at the lower of cost and net realisable value.
362
13: Specific audit procedures | Part D Assurance engagements
363
Business Assurance
364
13: Specific audit procedures | Part D Assurance engagements
Self-test question 3
Gourmet Limited (“Gourmet”) manufactures and distributes canned food for supermarkets and
groceries. It operates a perpetual inventory system where accurate records of quantities and costs
can be retrieved at any point of time. The sales and purchases transactions are interrelated with
this inventory system. No year-end inventory count takes place and production will continue even
when there is an inventory count in progress. All the inventories are stored in large warehouses in
Hong Kong.
Your firm has been the external auditor for Gourmet for three years. You are now performing the
audit of inventories which comprise mainly raw materials and finished goods. Your firm wishes to
rely on Gourmet's perpetual inventory system to provide the basis of the figure to be included in the
financial statements for inventories.
Your firm does not wish to ask the entity to conduct a year-end inventory count.
Required
Describe the audit tests that you would perform on the perpetual inventory system during the year
in order to determine whether to rely on it as a basis for the raw materials and finished goods
figures to be included in the financial statements. No work has to be performed on work-in-progress.
4 Receivables
Topic highlights
Existence, completeness and valuation are key assertions relating to the audit of receivables.
Audit procedures for receivables are set out in the table below. This covers the audit of sales and
prepayments as well as trade receivables. Receivables are often tested in conjunction with sales.
The key assertions for sales are occurrence, completeness and accuracy.
365
Business Assurance
366
13: Specific audit procedures | Part D Assurance engagements
Topic highlights
A confirmation of receivables is a major procedure, usually achieved by direct contact with
customers. There are two methods of confirmation: positive and negative.
367
Business Assurance
From an independent source (external parties), it is reliable audit evidence. It would satisfy the
criteria of “appropriate” for evidence. Therefore, when it is reasonable to expect customers to
respond, the auditors should ordinarily plan to obtain direct confirmation of receivables to individual
entries in an account balance.
The confirmation of receivables on a test basis should not be regarded as replacing other audit
procedures, such as the testing in-depth of sales transactions, but the results may influence the
scope of such tests.
368
13: Specific audit procedures | Part D Assurance engagements
369
Business Assurance
HKSA
505.10, 12, 14
4.5 Follow-up procedures
4.5.1 Doubts about the reliability of responses to confirmation requests
There is always some risk regardless of the form of the response. Factors that indicate doubts
about the reliability of a response include that it:
was received by the auditor indirectly
appeared not to come from the originally intended confirming party ie responses received
electronically as it is difficult to identify the sender of information
If the auditor identifies factors that give rise to doubts about the reliability of the response to a
confirmation request, the auditor shall obtain further audit evidence to resolve those doubts. The
auditor may request to contact the confirming party and in addition, the auditor shall evaluate the
implications on the assessment of the relevant risks of material misstatement, including the risk of
fraud.
4.5.2 Non-responses
Topic highlights
Non-response is a:
failure of the confirming party to respond or fully respond, to a positive confirmation request
confirmation request returned undelivered
HKSA 505 requires the auditor shall perform alternative audit procedures to obtain relevant and
reliable audit evidence. Though oral response to a confirmation request does not meet the
definition of external confirmation, the auditor may request the confirming party to respond in
writing directly to the auditor. If the auditor is unable to obtain sufficient and appropriate audit
evidence, the auditor shall determine the implications for the audit and consider qualification of
auditor's opinion.
In certain situations, the auditor may consider a positive confirmation request is necessary to obtain
sufficient appropriate audit evidence especially when:
the information available to corroborate is only available outside the entity
specific fraud risk factors prevent the auditor from relying on evidence from the entity
A non-response to a confirmation request may indicate a previously unidentified risk of material
misstatement.
The auditor may need to revise the assessed risk of material misstatement at the assertion level,
and modify planned audit procedures.
370
13: Specific audit procedures | Part D Assurance engagements
4.5.3 Exceptions
Key term
Exceptions are responses that indicate a difference between information requested to be
HKSA 505.6e confirmed, or contained in the entity's records, and information provided by the confirming party.
The auditor shall investigate exceptions to determine whether or not they are indicative of
misstatement or indicative of fraud. Finally, exceptions also may indicate a deficiency or
deficiencies in the entity's internal control over financial reporting.
Auditors may use the following table to consider the reasons for exceptions:
371
Business Assurance
Self-test question 4
DEF Trading Limited (“DEF”) is principally engaged in purchasing different types of goods from
overseas manufacturers and reselling them to retailers in Hong Kong. Since trade receivables is a
material item in the statement of financial position of DEF, Wong & Co. (Wong), DEF’s auditor, is
planning to use external confirmation to verify the account balance of trade receivables as at
31 March 20X0.
Wong sent out trade receivables confirmation requests to all its major debtors and has received the
following replies from four major debtors:
(i) Debtor A replied, “Sorry, we can’t answer your request for confirmation of our account unless
you provide details of all outstanding invoices”.
(ii) Debtor B replied, “Yes, the outstanding balance of HK$488,000 agreed to our accounting
record”. However, Debtor B did not sign the response.
(iii) Debtor C replied, “The balance of HK$580,000 was paid on 15 March 20X0.”
(iv) Debtor D replied, “The amount should be HK$400,000 because the remaining HK$300,000
was for goods we received after 31 March 20X0.”
Required
(a) Evaluate the effectiveness of using external confirmation to obtain relevant and reliable audit
evidence at the existence, valuation and completeness assertion level of trade receivables.
(5 marks)
372
13: Specific audit procedures | Part D Assurance engagements
(b) Design additional audit procedures Wong should perform based on the replies from the
following four debtors:
(i) Debtor A (2 marks)
(ii) Debtor B (2 marks)
(iii) Debtor C (5 marks)
(iv) Debtor D (3 marks)
(Total = 17 marks)
HKICPA December 2010 (amended)
(The answer is at the end of the chapter)
Topic highlights
Bank balances are usually confirmed directly with the bank in question.
Topic highlights
The bank confirmation letter can be used to ask a variety of questions, including queries about
outstanding interests, contingent liabilities and guarantees.
The auditors should decide from which bank or banks to request confirmation, having regard to
such matters as size of balance, volume of activity, degree of reliance on internal controls,
and materiality within the context of the financial statements.
The auditors should determine which of the following approaches is the most appropriate in
seeking confirmation of balances or other information from the bank:
Listing balances and other information, and requesting confirmation of their accuracy and
completeness
Requesting details of balances and other information, which can then be compared with
the entity's records
373
Business Assurance
In determining which of the above approaches is the most appropriate, the auditors should weigh
the quality of audit evidence they require in the particular circumstances against the practicality
of obtaining a reply from the confirming bank.
Difficulty may be encountered in obtaining a satisfactory response even where the entity submits
information for confirmation to the confirming bank. It is important that a response is sought for all
confirmation requests. Auditors should not usually request a response only if the information
submitted is incorrect or incomplete.
374
13: Specific audit procedures | Part D Assurance engagements
375
Business Assurance
Topic highlights
Cash balances should be verified if they are material or irregularities are suspected.
Auditors will be concerned that the cash exists, is complete, and belongs to the entity (rights and
obligations) and is stated at the correct value.
Where the auditors determine that cash balances are potentially material they may conduct a cash
count, ideally at the period-end. Rather like attendance at an inventory count, the conduct of the
count falls into three phases: planning, the count itself, and follow-up procedures.
Some of the common procedures are as follows:
Count cash balances held and agree to petty cash book or other record:
– Count all balances simultaneously
– All counting to be done in the presence of the individuals responsible
– Inquire into any IOUs or cashed cheques outstanding for a long period of time
Obtain certificates of cash-in-hand from responsible officials.
Confirm that bank and cash balances as reconciled above are correctly stated in the
financial statements.
376
13: Specific audit procedures | Part D Assurance engagements
The following table sets out audit procedures to test trade payables and accruals:
377
Business Assurance
Valuation and allocation Vouch selected samples from the trade payables listing and
accruals listing to the supporting documentation (purchase orders,
minutes authorising expenditure and suppliers' invoices etc).
Select suppliers' statements and reconcile these to the relevant
suppliers' accounts.
For accruals, recalculate the amount of the certain accrual to
ensure the calculation is correct.
Perform the following comparisons:
the current period balances for trade payables and accruals to
the previous period.
the amounts owed to a sample of individual suppliers in the
trade payables listing to amounts owed to these suppliers in the
previous year.
the payables' turnover and payables' days to the previous year
and industry data.
Cut-off For a sample, compare the actual dates with the dates they
were recorded in the ledger to check cut-off has been applied
correctly.
Test transactions either side of the period end to determine
whether amounts have been correctly recognised.
Perform analytical procedures on purchase returns, by
comparing the purchase returns as a percentage of sales or
cost of sales to the previous year.
Accuracy Recalculate the sample of suppliers' invoices to confirm the
amounts due are correct.
Occurrence For a sample of vouchers, inspect supporting documentation
such as authorised purchase orders.
Classification and Review the trade payables listing to identify any large debits
understandability (which should be reclassified as receivables or deposits) or
long-term liabilities which should be disclosed separately.
Review the disclosure notes on liabilities in the draft financial
statements: understandability is important.
Accuracy and valuation Read the disclosure notes to ensure the information is accurate
and properly presented at the appropriate amounts.
378
13: Specific audit procedures | Part D Assurance engagements
(b) Where the auditor suspects there may be unrecorded liabilities, regular suppliers who
have small or zero balances on their accounts and a sample of other accounts will be
confirmed in addition to any large balances.
Auditors use a positive confirmation (referred to as a blank or zero-balance confirmation). This
means the confirmation does not state the amount owed but requires the supplier to provide a
detailed statement of the account, including the balance owed at the period end. When the
confirmation is received back, the amount must be reconciled with the entity's records.
7 Non-current liabilities
Topic highlight
Non-current liabilities are usually authorised by the board and should be clearly documented.
In this section we focus on non-current liabilities such as debentures, loan stock and other loans
repayable at a date more than one year after the year-end.
Auditors will primarily try to determine the following:
(a) Completeness: whether all non-current liabilities have been adequately recognised
(b) Accuracy: whether interest payable has been calculated correctly and included in the
correct accounting period
(c) Classification and understandability: whether long-term loans and interest have been
correctly disclosed in the financial statements. The risk of material misstatement in
classification of bank loans is usually low, since the terms of bank loans are clearly set out in
the loan agreements.
The main issue for the auditors is that debenture and loan agreements often stipulate conditions
with which the entity must comply, which may mean restrictions on the entity's total borrowings or
adherence to specific borrowing ratios.
A minimal level of substantive procedures usually suffices unless there are new loans raised during
the reporting period, and tests will consist of substantive analytical procedures and obtaining
confirmation from the banks.
Either obtain or prepare a schedule of loans outstanding at the reporting date. For each
loan information should be given about the name of the lender, the date of the loan, the
maturity date, the interest date, the interest rate, the balance at the end of the period and
what the terms are regarding security.
Compare opening balances to previous year's records.
Test the clerical accuracy of the analysis.
Compare balances to the general ledger.
Agree name of lender etc, to register of debenture holders or equivalent (if kept).
Trace additions and repayments to entries in the cash book.
Confirm repayments are in accordance with loan agreement.
Examine cancelled cheques and memoranda of satisfaction for loans repaid.
Ascertain that borrowing restrictions imposed by agreements are not exceeded.
Read signed board minutes relating to new borrowings/repayments.
379
Business Assurance
Obtain direct confirmation from lenders of the amounts outstanding, accrued interest
and what security they hold.
Verify interest charged for the period and the adequacy of accrued interest.
Confirm assets charged have been entered in the register of charges and notified to
the Registrar.
Review any restrictive covenants in loan agreements and impairment losses relating to
default:
– Review any correspondence relating to the loan
– Review confirmation replies for non-compliance
– In the event of a default, determine its effect, and record findings
Review minutes and cash book to confirm that all loans have been recorded.
Review draft financial statements to ensure that disclosures for non-current liabilities
are correct and in accordance with relevant accounting standards. Elements repayable
within one year should be classified under current liabilities.
Topic highlight
The accounting treatments for impairment loss and contingencies are complex and involve
judgment and this can make them difficult to audit.
380
13: Specific audit procedures | Part D Assurance engagements
381
Business Assurance
382
13: Specific audit procedures | Part D Assurance engagements
9 Audit of provisions
Topic highlight
The key issues in the audit of provisions are existence and valuation.
The approach to auditing provisions is similar to that for the audit of contingencies.
383
Business Assurance
The auditor must agree the issued share capital as stated in the financial statements to the total
recorded in the share register.
Where an entity handles its own registration work an examination of share transfers on a test basis
should be performed. Where independent registrars carry out the work on behalf of an entity, the
auditors will normally examine the reports submitted by them to the entity, and obtain from them a
certificate of the share capital in issue at the period end.
Auditors should carry out careful checks as to whether entities have complied with local legislation
regarding the issue or purchase of their own shares. Auditors should take particular care if there
are any movements in reserves that cannot be distributed, and should confirm that these
movements are valid.
384
13: Specific audit procedures | Part D Assurance engagements
11 Segment information
Topic highlights
The entity may be required or permitted to disclose segment information in the financial statements
according to the applicable financial reporting framework.
HKSA 501.13 The auditor is not required to perform audit procedures that would be necessary to express an
opinion on the segment information presented on a stand alone basis but rather the auditor has
responsibility regarding the presentation and disclosure of segment information in relation to the
financial statements taken as whole.
According to HKSA 501 (Clarified) Audit Evidence – Specific Considerations for Selected Items,
when segment information is material to the financial statements, the auditor should obtain
sufficient appropriate audit evidence regarding its presentation and disclosure of segment
information in accordance with the applicable financial reporting framework (ie HKAS) by:
(a) performing analytical procedures or other appropriate audit procedures appropriate in the
circumstances;
(b) obtaining an understanding of the methods used by management in determining segment
information; such as:
(i) evaluating whether such methods are likely to result in disclosure in accordance with
the applicable financial reporting framework; and
(ii) where appropriate, testing the application of such methods.
Requirement of disclosure of segment information
The entity may be required or permitted to disclose segment information in the financial
statements, depending on the applicable financial reporting framework.
The auditor's responsibility regarding the presentation and disclosure of segment information is in
relation to the financial statements taken as a whole.
Non-requirement of expression of opinion
Accordingly, the auditor is not required to perform audit procedures that would be necessary to
express an opinion on the segment information presented on a standalone basis.
385
Business Assurance
12 Sales
Topic highlights
For verification of sales, auditors have to be aware of special sales and consignment sales.
Sales is a material figure in the financial statements where the auditor devotes special attention.
In most cases, an auditor would perform analytical review at the beginning in order to predict the
relationship of sales in relation with other figures in the financial statements.
The auditor wants to ensure the sales are completely and accurately recorded.
For financial statement assertions that are relevant to sales, the auditor would concentrate on:
completeness, accuracy and cut-off.
The audit procedures are listed below:
386
13: Specific audit procedures | Part D Assurance engagements
387
Business Assurance
(b) Evaluate compliance in accordance with HKAS 18 to determine whether they had applied
HKAS 18 appropriately in accounting for the special sales
(c) Inspect, or reperform the procedures to obtain a list of special sales made during the year
(d) Perform substantive analytical procedures on the list of special sales to determine the
completeness and accuracy of the information
(e) Inspect, or reperform, the calculations of the amounts of (a) special sales made during the
year, (b) returned during the year and (c) goods delivered under special sales
388
13: Specific audit procedures | Part D Assurance engagements
13 Purchases
Topic highlights
For verification of purchases, auditors may consider trade payables from the point of directional
testing.
389
Business Assurance
390
13: Specific audit procedures | Part D Assurance engagements
Topic highlights
Controls testing will normally be a key part of the audit of wages and salaries.
Payroll is an area where misappropriation through fraud is a risk.
391
Business Assurance
Self-test question 5
The following are independent situations. All items involved are material.
(a) The impairment loss for warranty account has a balance of HK$800,000 which is the same
as that of last year.
(b) A subsidiary engaged in importing has been audited by the Customs and Excise Department
which alleges that the entity has been avoiding customs duty on products it is importing.
Management has indicated that it disagrees with this contention and will strenuously defend
the subsidiary's position. The entity has instructed its external legal counsel to handle the
dispute.
(c) You have sent confirmation requests to four major customers and the responses received
are as follows:
(i) 'Sorry, can't answer request unless you supply details of all invoices outstanding.'
(ii) 'Our balance of amount due to you at 31 December 20Y0 was HK$170,000. We have
paid your invoice dated 15 December 20Y0 of HK$160,000 last week on 23 February
20Y1. The remaining HK$10,000 is for your invoice dated 24 December 20Y0. We
don't know where your extra HK$20,000 came from'. (In your client's receivables
ledger, the balance at 31 December 20Y0 was HK$190,000.)
(iii) 'Balance agreed to our record' (However, the response was not signed).
(iv) 'Our balance due to you at 31 December 20Y0 was HK$310,000' (In your client's
receivables ledger, the balance at 31 December 20Y0 was HK$200,000.)
Your staff have not performed any other work in this area to date.
Required
In each of the above situations (a) to (c), describe the additional audit procedures you would
perform in order to obtain sufficient appropriate audit evidence.
(The answer is at the end of the chapter)
392
13: Specific audit procedures | Part D Assurance engagements
15 Financial Instruments
Topic highlights
“Hong Kong Auditing Practice Guidance” (HKAPG) - HKAPG 1000 conforms with IAPN 1000 and
it provides important practical assistance to auditors when addressing valuation and other
considerations pertaining to financial instruments.
Financial instruments may be used by financial and non-financial entities of all sizes for a variety of
purposes. Some entities have large holdings and transaction volumes while other entities may only
engage in a few financial instrument transactions. Some entities may take positions in financial
instruments to assume and benefit from risk while other entities may use financial instruments to
reduce certain risks by hedging or managing exposures. This Hong Kong Auditing Practice
Guidance (HKAPG) is relevant to all of these situations.
393
Business Assurance
(b) Established a risk management process relative to the size of the entity and the complexity
of its financial instruments
(c) Established information systems that provide those charged with governance with an
understanding of the nature of the financial instrument activities and the associated risks,
including adequate documentation of transactions
(d) Designed, implemented and documented a system of internal control
(e) Established appropriate accounting policies, including valuation policies, in accordance
with the applicable financial reporting framework.
An expectation that controls are operating effectively may be more common when dealing with a
financial institution with well-established controls, and therefore controls testing may be an effective
means of obtaining audit evidence.
Entities with a high volume of trading and use of financial instruments may have more sophisticated
controls, and an effective risk management function, and therefore the auditor may be more likely
to test controls in obtaining evidence.
When an entity has relatively few transactions involving financial instruments, it may be relatively
easy for the auditor to obtain an understanding of the entity’s objectives for using the financial
instruments and the characteristics of the instruments.
394
13: Specific audit procedures | Part D Assurance engagements
395
Business Assurance
In testing how management values the financial instrument and in responding to the
assessed risks of material misstatement in accordance with HKSA 540 (Clarified), the
auditor should:
Test how management made the accounting estimate and the data on which it is
based (including valuation techniques used by the entity in its valuations)
Evaluate whether the assumptions used by management are reasonable
Test the operating effectiveness of the controls over how management made the
accounting estimate, together with appropriate substantive procedures.
Develop a point estimate or a range to evaluate management’s point estimate
Determine whether events occurring up to the date of the auditor’s report provide audit
evidence regarding the accounting estimate
Evaluate the appropriateness of management’s expert’s work. This assists the auditor
in assessing whether the prices or valuations supplied by a management’s expert
provide sufficient appropriate audit evidence to support the valuations
(c) Procedures that may provide audit evidence to support the presentation and
disclosure assertion
The auditor’s focus may need to be on the disclosures relating to risks and sensitivity
analysis. Information obtained during the auditor’s risk assessment procedures and testing
of control activities may provide evidence in order for the auditor to conclude whether or not
the disclosures in the financial statements are in accordance with the requirements of the
applicable financial reporting framework.
Consideration of the appropriateness of presentation, for example on short-term and long-
term classification, in substantive testing of financial instruments is relevant to the auditor’s
evaluation of the presentation and disclosure.
396
AUDIT PROCEDURES
Topic recap
Non-current Inventory Receivables Cash Trade payables Provisions Sales and Wages and
assets purchases salaries
– Physical Planning External – Bank confirmation Supplier statement – Discussion with Analytical – Controls testing
inspection attendance and confirmation – Review of bank reconciliations management procedures – Analytical
– Recalculation review reconciliations – Review of legal procedures
management correspondence
inventory count
procedures
Positive Positive
Attendance at
inventory count
Test count
procedures
13: Specific audit procedures | Part D Assurance engagements
397
Business Assurance
Answer 1
Audit work on the trucks
For a sample of new additions in the non-current asset register:
Existence assertion
Agree to the physical asset to confirm existence of the trucks. For trucks out on hire during the
audit visit, obtain alternative evidence of existence such as payment from customer near year end
for hire or send confirmations.
Check the physical condition of the vehicle to ensure that repairs and renewal expenditure is not
being understated (Existence of repair expenditure).
Completeness assertion
For a sample of vehicle purchases during the year, trace details to the non-current assets register.
For a sample of sold/scrapped vehicles during the year, ensure asset has been removed from the
non-current assets register.
Valuation assertion
Obtain non-current asset register from entity and cast the cost, depreciation and net book value
columns of the register and agree to final figures appearing on the statement of financial position.
Recalculate depreciation in the non-current asset register, ensuring that the rates used are those
disclosed in the financial statements.
Review profits and losses generated on sale of vehicles and ensure these are not excessive.
Check the accuracy of the depreciation rates used as this may indicate over or under charge of
depreciation.
Rights and obligations assertion
Agree details to purchase invoice or similar document for evidence of ownership ie annual licence.
Occurrence assertion
Examine board minutes or similar documentation for evidence of authority to purchase vehicles.
Compare sales income to sale of similar vehicles with similar mileage and ensure comparable for a
sample of disposals during the year.
Check calculation of profit or loss on disposal of trucks.
Agree receipt on sale to the cash book.
Presentation and classification assertion
Agree totals in non-current asset register to the financial statements, ensuring vehicles are
disclosed separately in the non-current assets note (material item).
Ensure that the accounting policy for depreciation is clearly stated in the financial statements and is
the same as last year.
398
13: Specific audit procedures | Part D Assurance engagements
Answer 2
(a) The valuation of goodwill and intangible assets may be materially misstated if:
improper business and intangible asset valuation prepared by X Limited due to wrong
assumptions, business data and valuation methodology used;
certain intangible assets are not identified from the acquisition;
useful lives of the intangible assets are over-estimated; and
goodwill impairment assessment was not properly prepared by management with
reference to inappropriate business data and assumptions.
(b) CC Limited’s auditor should consider the below audit procedures on goodwill:
Inspect the selling and purchase agreement and agree the consideration to the selling
and purchase agreement;
Assess the reasonableness of the business valuation performed by X Limited by
reviewing the valuation methodology, data and assumptions used;
Assess the competence, objectivity and independence of X Limited to ensure X
Limited has the expertise on advising the business valuation and intangible assets;
Recalculate the purchase price allocation among assets acquired and liabilities
assumed, intangible assets identified and goodwill allocated;
Check purchased goodwill is calculated correctly. It should reflect the difference
between the fair value of the consideration given and the aggregate of the fair values
of the separable net assets acquired; and
Review the goodwill impairment assessment performed by CC Limited. Discuss with
management the reasonableness of assumptions and data used and appropriateness
of the assessment model.
CC Limited’s auditor should consider the below audit procedures on purchased intangible
assets:
Inspect the selling and purchase agreement and agree purchased intangibles as to
the selling and purchase agreement;
Inspect the valuation report prepared by X Limited to ensure the valuations of the
intangibles are reasonable;
Assess the reasonableness of the useful lives of the intangible assets estimated by
X Limited and management; and
Recalculate the amortisation calculations of the intangibles prepared by management.
Answer 3
In order to rely on the system as a basis for the figure in the financial statements, the auditor would
need to ensure that management had an accurate and up-to date system for ensuring that each
item of inventory was counted at least once a year.
Auditors would therefore visit the warehouses during the year, possibly on a rotational basis, to
ensure that the system was being operated in a normal manner.
Auditors would ask management about the procedures for inventory counting and review the
related documentation, including inventory counting instructions, and form a view as to whether the
system was adequate.
Auditors would test check records of goods received and goods despatched and trace them
through the inventory system to ensure that records were accurate and input on a timely basis.
399
Business Assurance
Analytical procedures would be performed to establish which warehouses to visit for testing.
Warehouses likely to be visited include warehouses where large volumes of inventories were held,
warehouses that were experiencing problems or had experienced problems in the past, or
warehouses that were considered high risk for other reasons.
Auditors would perform own test checks of inventory and compare with Gourmet's test count
results. Using CAATs (computer-assisted audit techniques), including test data and audit software
may be necessary.
All exception reports produced by the system should be reviewed to see if there were any recurring
or old items and to ensure that all errors and exceptions were being dealt with on a timely basis.
Answer 4
(a) The auditor uses assertions in assessing risks and designing and performing audit
procedures in response to the assessed risks. HKSA 315 (Revised) categorises assertions
into those relating to classes of transactions, account balances, and disclosures.
While external confirmations may provide audit evidence regarding these assertions, the
ability of an external confirmation to provide audit evidence relevant to a particular assertion
varies.
External confirmation of trade receivable provides reliable and relevant audit evidence
regarding the existence of the account and customer as at a certain date, eg, 31 March 20X0
for DEF.
However, external confirmation of trade receivable does not ordinarily provide all the
necessary audit evidence relating to the valuation assertion because it is not practicable to
ask the debtor to confirm detailed information relating to its ability to pay the account.
External confirmation of trade receivable also does not ordinarily provide all the necessary
audit evidence relating to unrecorded trade receivable balances (the completeness
assertion).
(b) Wong should perform the following additional audit procedures:
(i) Wong should ask DEF to follow up Debtor A’s response by providing the outstanding
statement with all necessary details to Debtor A after checking. It is unlikely that this
additional audit procedure is impractical.
(ii) Wong should verify the source and contents of the response in a telephone call to the
purported sender of Debtor B, and document oral confirmations in the audit
documentation file. Where practicable, Wong should return this response to Debtor B
for signature after asking DEF to communicate the issue with Debtor B.
(iii) Wong should check with DEF if the balance was actually received. Wong should verify
it with the bank statement. Wong has to obtain DEF’s explanation on the reply of
Debtor C’s confirmation.
If the HK$580,000 was received and credited to the wrong customer account, Wong
should investigate whether this is a clerical error. To assure both accounts have been
properly stated, the account originally credited should be reconfirmed unless the
customer has already questioned the propriety of the credit.
If there is no receipt evidence in DEF, Wong has to ask DEF to obtain the payment
evidence and sort out the issue with Debtor C. Wong needs to verify evidence once
the issue is sorted out. Wong should be alert if there is an unreasonable time lag
between the cheque receipt date and the bank-in date, it may be a teeming and lading
fraud and Wong should re-assess the audit risk and take necessary action.
(iv) Debtor D has effectively confirmed a balance of HK$400,000. The remaining
HK$300,000 goods in transit should be analysed to determine whether there is any
cut-off error. Wong should check when the goods were sent to and received by Debtor
400
13: Specific audit procedures | Part D Assurance engagements
Answer 5
(a) Given that the impairment loss for warranty account balance is material, audit steps in
accordance with HKSA 540 (Clarified) Audit of Accounting Estimates should be undertaken
to obtain sufficient appropriate audit evidence to conclude whether the accounting estimates
for warranty impairment loss made by the management is reasonable in the circumstances
and whether the impairment loss is appropriately disclosed.
In this case, it is appropriate for the auditor to review and test the process used by
management to develop the estimate. Given that impairment losses for warranty claims
usually take time to realise, it is unlikely that review of subsequent transactions may provide
the auditor with further audit evidence regarding an accounting estimate made by
management. (However, this does not mean that the auditors need not perform normal
procedures on subsequent events, for example, inquire of management whether the claim
levels have changed unexpectedly after the year-end.) It is also unlikely that an independent
estimate for comparison with that prepared by management is necessary.
In reviewing and testing the process used by management, the auditor would ordinarily
perform the following steps:
(i) Ensure the impairment loss satisfies the recognition criteria under the relevant HKASs
(ii) Evaluate the data and consider the assumptions on which the impairment loss
warranty is based
(iii) Review and/or reperform the calculations involved in the estimate
(iv) Compare last year's estimates with the actual warranty costs incurred to determine
whether last year's estimate was accurate
(v) Consider management's approval procedures and obtain management
representations
(b) HKSA 501 (Clarified) states that when the auditor believes a risk of material misstatement
regarding litigation or claims may exist, the auditor should seek direct communication with
the entity's legal counsel. Normally, the communication would be in the form of a letter to the
external legal counsel that specifies:
(i) a list of litigation and claims
(ii) management's assessment of the outcome of the litigation or claim and its estimate of
the financial implications, including costs involved
(iii) a request for the solicitors to confirm the reasonableness of management's
assessment of the outcome of the claim and its estimate of the financial implications,
including costs involved
The letter, which should be prepared by management and sent by the auditor, should
request the entity's legal counsel to communicate directly with the auditor.
Where necessary, the auditor would meet with the entity's legal counsel to discuss the likely
outcome of litigation and claims.
(c) (i) Where time allows, send to the customers details of the outstanding invoices for
confirmation. Where this is not practicable, perform appropriate alternative
procedures. For example, trace balance to any subsequent cash receipt and agree
unpaid amounts to invoices and proof of delivery.
401
Business Assurance
(ii) The debtor has effectively confirmed a balance of HK$170,000. The auditor should
trace the remaining HK$20,000 to subsequent payment or, invoices and proof of
delivery.
The exception may indicate a misstatement in the entity's records. In such a case, the
auditor determines the reasons for the misstatement and assesses whether it has a
material effect on the financial statements. If an exception indicates a misstatement,
the auditor reconsiders the nature, timing and extent of audit procedures necessary to
provide the audit evidence required.
(iii) Verify the source and contents of a response in a telephone call to the purported
sender, and document oral confirmations in the working papers. Where practicable
this response should be returned to the debtor for signing.
(iv) The balance of HK$310,000 should be reconciled to the entity's record of HK$200,000
by verifying any differences in recording payments, invoices and delivery of goods.
The exception may indicate a misstatement in the entity's records. In such a case, the
auditor determines the reasons for the misstatement and assesses whether it has a
material effect on the financial statements. If an exception indicates a misstatement,
the auditor reconsiders the nature, timing and extent of audit procedures necessary to
provide the audit evidence required.
402
13: Specific audit procedures | Part D Assurance engagements
Exam practice
X Limited 21 minutes
C Limited is a customer of X Limited. In X Limited’s accounting records, HK$2,589,000 is shown
as an outstanding balance receivable from C Limited as at 30 June 20Y0. C Limited and X Limited
have recently been disputing over the quality of some products delivered from X Limited to
C Limited.
Required
You are the auditor of X Limited. Explain how you would evaluate the valuation and allocation
assertion of the overall trade receivables balance, in which HK$2,589,000 due from C Limited is
under dispute, in X Limited’s accounting records.
(12 marks)
HKICPA June 2011
Z Construction 27 minutes
A CPA (Practising), Benny, and his team are carrying out the audit of the financial statements for a
mid-size construction company called Z Construction. Today, Benny receives the bank
reconciliation at the financial year-end date from Z Construction’s Financial Controller and the bank
confirmation reply from Z Construction’s banker. Benny has also asked the financial controller to
arrange to send a confirmation letter to Z Construction’s lawyer.
Required
(a) List out the audit procedures that Benny and his team should conduct in respect of the bank
reconciliation.
(7 marks)
(b) In addition to the balances of current and deposit accounts, explain two more particular items
for the construction industry that Benny and his team should seek to ascertain or confirm
from the bank confirmation reply.
(4 marks)
(c) Explain what Benny and his team should seek to ascertain or confirm from the lawyer’s
confirmation letter.
(4 marks)
(Total = 15 marks)
HKICPA June 2012
Inventory 27 minutes
You are working on an audit engagement for a client who owns over 150 chain shoe stores in Hong
Kong. Your client owns five different shoe brands and each of the brands specialises in a different
style of shoe product. During the course of the audit, you look into the inventory ledger and find
that the inventory balance as at year end increased three-fold to HK$200 million compared to last
year, representing 20% of the total assets of the company as at year end, and the inventory aging
has been deteriorating significantly compared to last year.
403
Business Assurance
You therefore discuss with the management their assessment on the appropriateness of the
inventory provision. The managing director explains to you that he is very optimistic about their
future development. According to the managing director, they have just acquired three more shoe
brands and will open another 50 shoe stores in Hong Kong in the coming year and therefore the
inventory balance as at year end had tripled compared to last year. In addition, he is confident that
there will be no inventory provision required against their shoe products given that their shoe
products are always well-received by their customers in the market.
Required
(a) Assess and explain the risk of material misstatement relating to the accounting estimate over
the inventory valuation as at year end.
(5 marks)
(b) After talking to the managing director, you are not satisfied with the explanation from the
managing director on the inventory. What audit procedures would you further perform in
response to the risk of material misstatement discussed in (a)?
(10 marks)
(Total = 15 marks)
HKICPA December 2012
404
chapter 14
Topic list
1 Experts
1.1 Using the work of an auditor's expert
1.2 Determining the need to use the work of an auditor's expert
1.3 Effect of management's expert on the use of auditor's expert
1.4 Audit procedures on the work of an auditor's expert
1.5 Evaluating the adequacy of the auditor's expert's work
1.6 Management's expert
2 Service organisations
2.1 Considerations of the entity auditor
2.2 Obtaining audit evidence
2.3 Service organisation auditor's reports
2.4 Reporting
Learning focus
When using the work of third parties, the auditor should consider the scope, the function and
the reports involved. You should link the study of this chapter with your knowledge from the
previous chapters and should consider the involvement with third parties' work.
405
Business Assurance
Learning outcomes
Competency
level
2.10 Audit evidence 3
2.10.05 Discuss why auditors may rely on the work of others, including 2
internal audit, experts and service organisations
2.11 Internal audit 2
2.11.02 Discuss why auditors may rely on the work of others, including
internal audit, experts and service organisations
406
14: Using the work of others | Part D Assurance engagements
1 Experts
Topic highlights
External auditors may make use of the work of both the auditor's expert or management's expert
when carrying out audit procedures to obtain sufficient appropriate audit evidence.
Key terms
An auditor's expert is an individual or organisation possessing expertise in a field other than
HKSA 620.6 accounting or auditing, whose work in that field is used by the auditor to assist the auditor in
obtaining sufficient appropriate audit evidence. They may be either an auditor's internal expert or
an auditor's external expert.
Management's expert is an individual or organisation possessing expertise in a field other than
accounting or auditing, whose work in that field is used by the entity to assist the entity in
preparing the financial statements.
HKSA In accordance with HKSA 620 (Clarified) Using the Work of an Auditor’s Expert an auditor’s expert
620.7, A4 may be needed to assist the auditor in one or more of the following:
Obtaining an understanding of the entity and its environment, including its internal control
Identifying and assessing the risks of material misstatement
Determining and implementing overall responses to assessed risks at the financial
statement level
Designing and performing further audit procedures to respond to assessed risks at the
assertion level, comprising tests of controls or substantive procedures
Evaluating the sufficiency and appropriateness of audit evidence obtained in forming an
opinion on the financial statements
The following list gives examples of the audit evidence which might be obtained from the use of an
auditor's expert:
(a) Valuing certain types of assets, e.g. land and buildings, plant and machinery, complex
financial instruments and so on
(b) Performing the actuarial calculation of liabilities associated with insurance contracts or
employee benefit plans
(c) Estimating oil and gas reserves
(d) Valuing environmental liabilities and site clean-up costs
(e) Interpreting contracts, laws and regulations
(f) Measuring work completed and work-in-progress on contracts-in-progress
(g) Analysing complex or unusual tax compliance issues
The objectives of the auditors are to determine whether:
to use the work of an auditor's expert
that work is adequate for the auditor's purposes if using the work of an auditor's expert
407
Business Assurance
408
14: Using the work of others | Part D Assurance engagements
409
Business Assurance
(c) any unexpected events, changes in considerations, or the audit evidence obtained from the
results of audit procedures
Factors Details
The relevance and Auditor can use specific procedures such as:
reasonableness of
inquire of auditor's expert
auditor's expert's
findings or conclusions review working papers and reports of auditor's expert
discuss with another expert with that relevant expertise
discuss with management the report of the auditor's expert
other procedures such as observation of expert's work or
confirming with third parties
The factors that the auditor should consider for evaluation are
whether:
the conclusions are presented consistently and clearly in
accordance with standards of the auditor's expert's profession
the conclusions are based on an appropriate period and have
taken into account any subsequent event
the conclusions are subject to any limitations and restrictions
the conclusions are based on appropriate considerations of errors
or deviations
The relevance and The auditor shall consider whether the auditor's expert has adequately
reasonableness of reviewed the assumptions and methods and in addition consider
significant assumptions any models used, whether they are accepted in the auditor's expert's
and methods used by field.
the auditor's expert
410
14: Using the work of others | Part D Assurance engagements
411
Business Assurance
Self-test question 1
You are an audit manager of ABC & Co and you are engaged in the audit of EX3's financial
statements for the year ended 31 December 20X0. On 1 July 20X0, EX3 acquired a 70 per cent
equity interest in Subsidiary Three Limited (“Sub-3”) for a cash consideration of HK$400,000,000.
A firm of professional surveyors, Very Professional Surveying Limited (“VPS”), was appointed by
EX3 to value the buildings of Sub-3. The fair values of the buildings of Sub-3 were, in total,
HK$50,000,000 above their carrying amounts at 1 July 20X0 after taking into account depreciation
up to 30 June 20X0. These valuation surpluses had not been adjusted in the books of Sub-3.
According to the relevant accounting standard, the buildings should be initially carried in EX3's
consolidated financial statements at fair value at the date of acquisition. The buildings have a
useful life of 50 years.
Required
(a) Explain why your firm may decide to rely on the work of VPS.
(b) Determine how your team would satisfy yourselves that VPS is a suitable candidate to rely
on.
(The answer is at the end of the chapter)
Self-test question 2
Metropolitan Group is a company listed on the Hong Kong Stock Exchange. It is one of the large
retailing companies in the Asia-Pacific region with around 130 locations. In 20X9, Metropolitan
generated sales of HK$3,888 million and inventories of HK$420 million. Its sales brands “Metro
Boy” and “Junior Star” command leading market positions in their respective segments.
Simon, senior audit manager of Law & Co. (Law), is responsible for the financial statement audit of
the Metropolitan Group for the year ended 30 June 20X0. In accordance with the valuation report
prepared by XYZ Valuation and Professional Services Limited (XYZ), a firm of business valuers
engaged by Law, the fair value of the brand name of “Junior Star” at 30 April 20Y0 was
HK$100 million. Metropolitan Group would like to disclose this information in the notes to the
financial statements. The brand name is carried at cost of registration of HK$200,000.
Required
Assuming Law is going to rely on the valuation report prepared by XYZ, describe the audit
procedures to accept XYZ’s work as audit evidence and as consideration to express the auditors’
opinion on disclosure requirement.
(10 marks)
HKICPA December 2010 (amended)
(The answer is at the end of the chapter)
2 Service organisations
Topic highlights
A service organisation provides outsourced services to another entity. This raises particular
concerns for the auditor.
412
14: Using the work of others | Part D Assurance engagements
Key terms
A service organisation is a third party organisation that provides services to user entities that are
part of those entities’ information systems relevant to financial reporting.
HKSA
402.8e, i A user entity is an entity that uses a service organisation and whose financial statements are
being audited.
A type 1 report is a report on the description and design of a service organisation’s controls.
A type 2 report is a report on the description and design of a service organisation’s controls and
their operating effectiveness.
For auditors whose client uses a service organisation to outsource its non-core activities HKSA 402
(Clarified) Audit Considerations Relating to an Entity using a Service Organisation provides
guidance as to how to audit this relationship. It states that the objectives of the auditor are to:
(a) obtain an understanding of the nature and significance of the services provided by the
service organisation and their effect on the user entity’s internal control relevant to the audit,
sufficient to identify and assess the risks of material misstatement; and
(b) design and perform audit procedures responsive to those risks.
The HKSA identifies a number of directly relevant activities which are often performed in this way
(by no means, an exhaustive list):
maintenance of accounting records
management of assets
initiating, recording or processing transactions as agents of the user entity
Who determines the processes and operational controls over the service activity depends on the
nature of the contract between the two parties:
(a) When the services provided by the service organisation are limited to recording and
processing entity transactions and the entity retains authorisation and maintenance of
accountability, the entity may be able to implement effective policies and procedures within
its own control environment.
(b) When the service organisation executes the entity's transactions and maintains
accountability, the entity may deem it necessary to rely on policies and procedures at the
service organisation.
413
Business Assurance
(a) the nature of the services provided by the service organisation and the significance of
those services to the user entity
(b) the nature and materiality of the transactions processed or accounts or financial reporting
processes affected by the service organisation
(c) the degree of interaction between the activities of the service organisation and those of the
user entity
(d) the nature of the relationship between the user entity and the service organisation, including
the relevant contractual terms for the activities undertaken by the service organisation
When obtaining an understanding of internal control the user auditor must evaluate the design and
implementation of relevant controls at the user entity that relate to the services provided by the
service organisation, including those that are applied to the transactions processed by the service
organisation. Where the user entity has established controls over the service organisation’s
services the auditor may be able to rely on these regardless of the controls in place at the service
organisation. The auditor would need to perform tests of controls in this situation and the extent of
reliance would depend on the results of these tests.
If the user auditor is unable to obtain a sufficient understanding from the user entity, the user
auditor shall obtain audit evidence from one or more of the following procedures:
(a) obtaining a Type 1 report or Type 2 report (see Section 2.3 below);
(b) contacting the service organisation via the user entity in order to obtain specific information;
(c) requesting that another auditor be engaged to perform procedures that will provide the
necessary information; or
(d) visiting the service organisation and performing such procedures.
In responding to assessed risks in accordance with HKSA 330 (Clarified), the user auditor shall:
(a) determine whether sufficient appropriate audit evidence concerning the relevant financial
statement assertions is available from records held at the user entity; and if not
(b) perform further audit procedures to obtain sufficient appropriate audit evidence or use
another auditor to perform those procedures at the service organisation on the user auditor’s
behalf.
Where the auditor has an expectation that controls at the service organisation are operating
effectively and the auditor wishes to rely on these audit evidence must be obtained from one or
more of the following procedures:
(a) obtaining a Type 2 report, if available
(b) performing appropriate tests of controls at the service organisation
(c) using another auditor to perform tests of controls at the service organisation on behalf of the
user auditor
414
14: Using the work of others | Part D Assurance engagements
2.4 Reporting
HKSA The auditor is always solely responsible for the audit opinion. He must be assured that he has
402.20-22 gained sufficient appropriate audit evidence to form an opinion on the financial statements and he
must then express his opinion in the audit report.
It would therefore be inappropriate to refer to the work of others in the audit report. His
conclusions on the work of others should, however, be adequately documented in the audit file.
If reference to the service organisation is relevant to an understanding of a modified audit opinion
the audit report must indicate that this reference does not diminish the auditor’s responsibility for
that opinion.
415
Business Assurance
Topic recap
Experts Service
organisation
Auditor assesses
Management’s Auditor’s control risk and designs
expert expert audit procedures
accordingly
Auditor evaluates
competence, and
capabilities and
objectivity
416
14: Using the work of others | Part D Assurance engagements
Answer 1
(a) The auditor's education and experience enable the auditor to be knowledgeable about
business matters in general, but the auditor is not expected to have the expertise of a person
trained for or qualified to engage in the practice of another profession or occupation, such as
an actuary or engineer. The valuation of the building of EX3 in this case requires expert's
knowledge that ABC & Co does not have. Therefore, ABC & Co needs to rely on the work of
VPS.
(b) In accordance with HKSA 620 (Clarified) Using the Work of an Auditor’s Expert, when ABC &
Co plans to use the work of VPS, ABC & Co should evaluate (1) the professional
competence of VPS; and (2) the objectivity of VPS.
ABC & Co assesses VPS's professional competence by considering the following:
(i) VPS's professional certification or licensing by, or membership in, an appropriate
professional body. For example, the legal and professional status of the professional
body that licenses VPS to perform property valuation.
(ii) Experience and reputation in the field in which ABC & Co is seeking audit evidence,
that is, experience in the type and location of building that EX3 acquired through
Sub-3.
The risk that VPS's objectivity will be impaired increases when VPS is (1) employed by
EX3 (which is not likely in this case); or (2) related in some other manner to EX3, for
example, by being financially dependent upon or having an investment in EX3.
If ABC & Co is concerned about the competence or objectivity of VPS, ABC & Co
needs to discuss any reservations with management and consider whether sufficient
appropriate audit evidence can be obtained concerning the work of VPS. ABC & Co
may need to undertake additional audit procedures or seek audit evidence from
another property valuer when it is necessary.
Answer 2
If Law is going to rely on XYZ's valuation report for the purpose of disclosing the fair value of brand
name in the notes to the financial statement, Law should ensure its audit procedures fully comply
with HKSA 620 (Clarified) Using the Work of an Auditor’s Expert.
Law should make an assessment on the competence, capabilities and objectivity of XYZ.
Law should determine the nature, scope and objectives of XYZ’s work for Law’s purposes and
evaluate the adequacy of that work for Law’s purposes.
This involves assessing whether the substance of XYZ's findings have been properly reflected in
the notes disclosure of the brand name. Particularly, Law should consider whether:
the source data used by XYZ is appropriate in the circumstances. For example, reviewing or
testing the data used by XYZ.
the assumptions and methods used by XYZ are reasonable and appropriate, and whether
they are consistently applied in prior periods.
the results of XYZ’s work are reasonable based on Law’s knowledge of Metropolitan Group’s
business and the results of other audit procedures.
417
Business Assurance
the effective date of XYZ’s findings (30 April 20Y0) is acceptable when comparing with Law’s
report date.
If the results of XYZ’s work do not provide sufficient appropriate audit evidence, or if the results are
not consistent with other audit evidence, Law should resolve the matter.
Law may discuss the issue with Metropolitan Group and XYZ, and apply additional procedures,
including possibly engaging another expert or modify the auditor's report.
Law should not refer to the work of XYZ when issuing an unmodified auditor’s report for
Metropolitan Group’s audit because such a reference might be misunderstood to be an audit
qualification or a division of responsibility between Law and XYZ.
If Law decides to add an emphasis of matter paragraph to their report or to issue a qualified opinion
as a result of XYZ’s work, Law may in the auditor’s report make a reference to the identification of
XYZ as the expert and the extent of XYZ’s involvement. Such a reference will facilitate an
understanding of the modification. Law should indicate in the auditor’s report that such reference
does not reduce its responsibility for that opinion.
When Law decides to make a reference to XYZ in the auditor’s report, Law would first obtain
permission from XYZ. If permission is refused and Law believes that such a reference is
necessary, Law may consider obtaining legal advice.
418
14: Using the work of others | Part D Assurance engagements
Exam practice
419
Business Assurance
420
chapter 15
Accounting estimates,
opening balances and
comparatives
Topic list
Learning focus
When an estimate is involved, the use of judgment means the level of risk is higher. Be alert
for assertions that are likely to be estimates or subjective valuations.
When auditing fair values, auditors should consider whether there is an active open market,
if not valuation models should be used.
An incoming auditor should perform appropriate audit procedures to verify the opening
balances.
421
Business Assurance
Learning outcomes
Competency
level
2.09 Audit procedures 3
2.09.10 Discuss the audit problems and identify procedures for the audit
of:
2.09.10.01 Accounting estimates
2.09.10.02 Fair values
2.09.10.03 Opening balances
2.09.10.04 Comparatives
422
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
1 Accounting estimates
Topic highlights
When auditing accounting estimates auditors should:
test the management process
use an independent estimate
review subsequent events
in order to assess whether the estimates are reasonable.
Key term
An accounting estimate is an approximation of a monetary amount in the absence of a precise
HKSA 540.7a means of measurement.
The responsibility for making estimates lies with management or those charged with governance.
Some estimates are routine and some are one-off. Many estimates are capable of reasonable
estimation but some complex estimates may involve special knowledge and judgment.
423
Business Assurance
Key term
Estimation uncertainty refers to the susceptibility of an accounting estimate and related
HKSA 540.7c disclosures to an inherent lack of precision in its measurement.
Relate to entities that are not engaged in Accounting estimates relating to the outcome
complex business activities of litigation
Accounting estimates are frequently updated Fair values accounting estimates for:
due to routine transactions
– derivative financial instruments not
The method of measurement of the fair value publicly traded
accounting estimates based on applicable
– highly specialised entity-developed
financial reporting framework is simple and
model is used for which assumptions or
can be applied easily
inputs cannot be observed in the
The model used to measure the fair value marketplace
accounting estimates is well-known or
generally accepted
The auditor shall obtain understanding of whether and if so, how management has assessed the
effect of estimation uncertainty. For example:
(a) how management has considered alternative assumptions or outcomes
(b) how management determines the accounting estimate when analysis indicates a number of
outcome scenarios
(c) whether management monitors the outcome of accounting estimates and has responded
appropriately.
424
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
(c) whether there are existing recognised measurement techniques to mitigate the estimation
uncertainty
(d) the consideration of the length of the forecast period
(e) the availability of reliable data from external sources
(f) the inputs contributed to the accounting estimate
425
Business Assurance
426
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
(b) Test how management made the accounting estimate and the data used.
The auditor shall evaluate whether the method of measurement used is appropriate and the
assumptions used by management are reasonable. Some of the tests are described below.
(i) Test the extent to which data on which the accounting estimate is based is accurate,
complete and relevant, and whether the accounting estimate has been properly
determined using such data and management assumptions
(ii) Consider the source, relevance and reliability of external data or information
(iii) Recalculate the accounting estimate
(iv) Consider whether the accounting estimate is internally consistent
(v) Consider management's review and approval processes
(c) Test the operating effectiveness of controls over how management made the accounting
estimate when management's process has been well-designed, implemented and
maintained. For example:
(i) Controls exist for the review and approval of the accounting estimates by appropriate
levels of management and those charged with governance
(ii) The accounting estimate is derived from the routine processing of data by the entity's
accounting system
(d) Develop a point estimate or a range (see key term below) to evaluate whether
management's point estimate may be an appropriate treatment. This may be appropriate in
the following circumstances:
(i) An accounting estimate is not derived from the entity's routine processing of data
(ii) Previous experience suggests that management's current period process is unlikely to
be effective
(iii) The entity's controls for determining accounting estimates are not well designed and
implemented
(iv) Subsequent events contradict management's point estimate
(v) Alternative sources of relevant data are available to use in making a point estimate or
a range
HKSA 540 (Clarified) requires that, when developing a point estimate or a range to evaluate
management's point estimate if the auditor uses different assumptions or methods
compared to management and concludes that it is inappropriate to use a range, then the
auditor shall narrow the range.
When the auditor concludes that it is appropriate to use a range to evaluate the
reasonableness of management’s point estimate the auditor shall narrow the range based on
audit evidence available, until all outcomes within the range are considered reasonable.
(e) Disclosure relating to accounting estimates – the auditor shall obtain sufficient
appropriate the audit evidence about whether the disclosures in the financial statements
related to accounting estimates are in accordance with the requirements of the applicable
financial reporting framework.
Key terms
An auditor's point estimate or auditor's range is the amount, or range of amounts respectively,
HKSA derived from audit evidence for use in evaluating management's point estimate.
540.7b, e
A management’s point estimate is the amount selected by management for recognition or
disclosure in the financial statements as an accounting estimate.
427
Business Assurance
Key term
Management bias is a lack of neutrality by management in the preparation and presentation of
HKSA 540.7d information.
HKSA During the process of making an accounting estimate, there is inherent subjectivity involved and
540.21-22
the susceptibility of an accounting estimate to management bias increases with the level of
subjectivity.
428
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Management bias can be described as unintentional management bias or the potential for
intentional management bias and can be difficult to detect at an account level. It may only be
identified when considered in the aggregate of groups of accounting estimates or all accounting
estimates when observed over a number of periods.
For continuing audits, indicators of possible management bias identified in preceding periods
may influence the planning and risk identification and assessment activities of the auditor in the
current period.
Topic highlights
Indicators of possible management bias do not necessarily conclude that there are misstatements
on the accounting estimates as there may be no intention by management to mislead users of
financial statements.
HKSA 540 (Clarified) requires that the auditor shall identify whether there are indicators of
possible management bias when reviewing the judgment and decisions made by management in
the making of accounting estimates during the audit.
However, if there is an intention to mislead, management bias is fraudulent, meaning fraud has
occurred.
429
Business Assurance
Self-test question 1
Metropolitan Group is a company listed on the Hong Kong Stock Exchange. It is one of the large
retailing companies in the Asia-Pacific region with around 130 locations. In 20X9, Metropolitan
generated sales of HK$3,888 million and inventories of HK$420 million. Its sales brands “Metro
Boy” and “Junior Star” command leading market positions in their respective segments.
Simon, senior audit manager of Law & Co. (Law), is responsible for the financial statement audit of
the Metropolitan Group for the year ended 30 June 20Y0. In accordance with the valuation report
prepared by XYZ Valuation and Professional Services Limited (XYZ), a firm of business valuers
engaged by Law, the fair value of the brand name of “Junior Star” at 30 April 20Y0 was HK$100
million. Metropolitan Group would like to disclose this information in the notes to the financial
statements. The brand name is carried at cost of registration of HK$200,000.
Required:
What audit procedures, other than those relating to using the work of XYZ, would Law perform, in
accordance with relevant Hong Kong auditing standards, on the proposed fair value disclosure of
the brand name “Junior Star” in the notes to the financial statements for the year ended 30 June
20Y0?
(6 marks)
HKICPA December 2010 (amended)
(The answer is at the end of the chapter)
2 Opening balances
Topic highlights
HKSA 510 (Clarified) Initial Audit Engagements – Opening Balances provides guidance on opening
balances:
when the financial statements for the prior period were not audited
when the financial statements for the prior period were audited by a predecessor auditor,
meaning the incoming auditor should obtain sufficient and appropriate audit evidence
regarding the opening balances.
Key terms
Opening balances are those account balances that exist at the beginning of the period. Opening
HKSA balances are based upon the closing balances of the prior period and reflect the effects of
510.4b, c
transactions and events of prior periods and accounting policies applied in the prior period.
Opening balances include matters requiring disclosure that existed at the beginning of the period,
such as contingencies and commitments.
Predecessor auditor is an auditor from a different audit firm who audited the financial statements
of an entity in the prior period and who has been replaced by the current auditor.
430
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
431
Business Assurance
432
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
The possible effects of the inability to obtain sufficient appropriate audit evidence regarding
opening balances of inventory are deemed to be material but not pervasive to the entity's
financial performance and cash flows.
The financial position at year end is fairly presented.
Illustration 2
Circumstances described in the following paragraph include the following:
The auditor did not observe the counting of the physical inventory at the beginning of the
current period and was unable to obtain sufficient appropriate audit evidence regarding the
opening balances of inventory.
The possible effects of the inability to obtain sufficient appropriate audit evidence regarding
opening balances of inventory are deemed to be material but not pervasive to the entity's
financial performance and cash flows.
The financial position at year end is fairly presented.
An opinion that is qualified regarding the financial performance and cash flows and
unmodified regarding financial position is considered appropriate in the circumstances.
433
Business Assurance
3 Comparatives
Topic highlight
The auditor's responsibilities for comparatives vary depending on whether they are corresponding
figures or comparative financial statements.
434
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Key terms
Comparative information is the amounts and disclosures included in the financial statements in
HKSA 710.6 respect of one or more prior periods in accordance with the applicable financial reporting
framework.
Corresponding figures are amounts and other disclosures for the prior period included as part
of the current period financial statements, which are intended to be read in relation to the
amounts and other disclosures relating to the current period (referred to as “current period
figures”). The level of detail presented in the corresponding amounts and disclosures is dictated
primarily by its relevance to the current period figures.
Comparative financial statements are amounts and other disclosures of the prior period included
for comparison with the financial statements of the current period, but, if audited, are referred to in
the auditor’s opinion. The level of information included in those comparative financial statements is
comparable with that of the financial statements of the current period.
Comparatives are presented in compliance with the relevant financial reporting framework. The
essential audit reporting differences are that:
for corresponding figures, the auditors' report only refers to the financial statements of the
current period
for comparative financial statements, the auditors' report refers to each period that
financial statements are presented
435
Business Assurance
The auditor shall determine that the comparative information agrees with the amended financial
statements if the prior period financial statements are amended.
3.2.5 Reporting
Topic highlights
The auditor's opinion is on the current period financial statements as a whole, including the
corresponding figures.
Resolved and properly accounted for or The auditor's opinion on the current period need not
disclosed in the financial statements in refer the previous modification.
accordance with the applicable financial
reporting framework
Unresolved The auditor shall consider whether the modification
is relevant to the current period's figures and shall
modify the auditor's opinion on the current period's
financial statements (see illustrations below).
Illustration 1
Circumstances described in the following paragraph include the following:
The auditor's report on the prior period, as previously issued, included a qualified opinion.
The matter giving rise to the modification is unresolved.
The effects or possible effects of the matter on the current period's figures are material and
require a modification to the auditor's opinion regarding the current period figures.
436
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Qualified opinion
In our opinion, except for the effects of the matter described in the Basis for Qualified Opinion
paragraph, the financial statements give a true and fair view of the state of the Company's affairs
as at 31 December 20Y0, and of its profit and cash flows for the year then ended in accordance
with Hong Kong Financial Reporting Standards and have been properly prepared in accordance
with the Hong Kong Companies Ordinance.
Illustration 2
Circumstances described in the following paragraph include the following:
The auditor's report on the prior period, as previously issued, included a qualified opinion.
The matter giving rise to the modification is unresolved.
The effects or possible effects of the matter on the current period's figures are immaterial but
require a modification to the auditor's opinion because of the effects or possible effects of the
unresolved matter on the comparability of the current period's figures and the corresponding
figures.
437
Business Assurance
In situations where the incoming auditor identifies that the prior year unaudited figures are
materially misstated, the auditor should request management to revise the prior year's figures or if
management refuses to do so, appropriately modify the report.
Self-test question 2
You are the audit manager of a CPA firm. You are responsible for the audits of the financial
statements of two new clients, XYZ and KLM, for the year ended 31 December 20X3.
Since the auditors' report of XYZ's financial statements for the year ended 31 December 20X2 has
not been modified, your assistant has suggested to you that no specific procedures are
needed in respect of the opening balances and comparatives relevant to XYZ's financial
statements for the current year.
Required
Do you concur with your audit assistant's view about the opening balances and comparatives?
Explain your views. (6 marks)
HKICPA February 2004
(The answer is at the end of the chapter)
438
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Topic recap
Consider
management bias
Review subsequent
events
439
Business Assurance
Answer 1
HKSA 540 (Clarified) Auditing Accounting Estimates, Including Fair Value Accounting Estimates
and Related Disclosures establishes standards and provides guidance on auditing fair value
measurements and disclosures contained in financial statements.
Law should obtain sufficient appropriate audit evidence that fair value measurements and
disclosures of the HK$100 million brand name of “Junior Star” are in accordance with the Hong
Kong Financial Reporting Standards (“HKFRS”).
To this end, Law should obtain an understanding of:
Metropolitan Group’s process for determining fair value measurements and disclosures; and
the relevant control activities sufficient to identify and assess the risks of material
misstatement at the assertion level and to design and perform further audit procedures.
Law should evaluate whether the fair value measurements and disclosures in the financial
statements comply with HKFRS.
Law should test the fair value measurements and disclosure, including the assumptions, valuation
method and the data used. Reference to and review of past history of similar intangible assets or
accounting treatment should be made.
Law should obtain written representations from Metropolitan Group’s management whether they
believe significant assumptions used by the company in making the fair value measurements and
disclosures are reasonable.
Law should evaluate the results of the audit procedures performed and conclude whether the fair
value measurements and disclosures of the HK$100 million brand name “Junior Star” are
reasonable.
440
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Answer 2
Responsibilities regarding opening balances and comparatives
HKSA 510 (Clarified) requires auditors to obtain sufficient appropriate evidence that:
(a) opening balances do not contain misstatements which materially affect the current period's
financial statements;
(b) the preceding period's closing balances have been correctly brought forward as opening
balances, or when appropriate, have been restated;
(c) appropriate accounting policies are consistently applied or changes in accounting policies
have been properly accounted for and adequately disclosed;
(d) the accounting policies used for the comparatives are consistent with those of the current
period or appropriate adjustments and disclosures have been made where this is not the
case; and
(e) the comparatives agree with the amounts and other disclosures presented in the
preceding period's financial statements or appropriate adjustments and/or disclosure have
been made where this is not the case.
Procedures in general cases
Even if we audited XYZ's financial statements for the year ended 31 December 20X2 and issued
an unqualified opinion, we would still need procedures to ensure that opening balances have
been appropriately brought forward and that current accounting policies have been consistently
applied.
These would normally include a review of the accounting polices adopted in the previous year and
an examination of opening balances and comparatives against the previous year's audited
financial statements.
Additional procedures as incoming auditors
However, since we have not audited XYZ's previous financial statements, we may need to perform
some or all of the following additional procedures to ensure that requirements of HKSA 510
(Clarified) are complied with:
(a) Hold consultations with management of XYZ;
(b) Review records, working papers and accounting and control procedures for the preceding
period;
(c) Perform substantive tests on opening balances and comparatives in respect of which the
results of other procedures are considered unsatisfactory; and
(d) Hold consultations with the auditors, if any, who were previously the auditors of the entity.
441
Business Assurance
Exam practice
442
15: Accounting estimates, opening balances and comparatives | Part D Assurance engagements
Cod CPA has recently been appointed as the auditor of Ling Limited’s financial statements for the
year ended 30 June 20X1. The client and engagement acceptance procedures have been
satisfactorily completed. Cod CPA has also reviewed the situation in respect of the system
deficiency of the accounts receivable sub-ledger and has considered that the system now appears
to function correctly.
Required
443
Business Assurance
444
chapter 16
445
Business Assurance
Learning focus
The review stage of the audit is very important. It is very important that you understand the
difference between the review stage of the audit and the earlier testing stage.
These topics are related to the final stage of the audit process. At the end of the audit before
issuing any auditor’s report, the auditor is required to cover these areas.
Learning outcomes
Competency
level
2.09 Audit procedures 3
2.09.10 Discuss the audit procedures and identify procedures for the
audit of:
2.09.10.05 Related party transactions
2.12 Completion procedures 3
2.12.01 Explain the purpose of, and the procedures to be used in:
2.12.01.01 A subsequent events review
2.12.01.02 A going concern review
2.12.01.03 Obtaining written representations from management
2.12.01.05 Overall review of the financial statements
2.12.01.06 Review of other published information
2.12.02 Explain the procedures required to identify and audit related
party transactions
2.12.03 Explain the need to evaluate misstatements identified during the
audit
2.12.04 Explain the follow up on illegal acts or fraud found while
performing an audit especially in the case of money laundering
or corruption
2.13 Reporting 3
2.13.02 Explain the requirement for an auditor to report to management
or those charged with governance
446
16: Overall audit review and finalisation | Part D Assurance engagements
1 Subsequent events
Topic highlights
Subsequent events are events occurring between the date of the financial statements and the
date of the auditor's report and also include facts discovered after the auditor's report has been
issued. Auditors shall consider the effect of such events on the financial statements and on their
audit opinion.
Key term
Subsequent events are events occurring between the date of the financial statements and the
HKSA 560.5e date of the auditor's report, and facts that become known to the auditor after the date of the
auditor's report.
1.1.1 Dates
Key terms
Date of the financial statements is the date of the end of the latest period covered by the
HKSA financial statements.
560.5a, 5c
Date of the auditor's report is the date the auditor dates the report on the financial statements in
accordance with HKSA 700 (Clarified) Forming an Opinion and Reporting on Financial Statements.
This date cannot be earlier than the date on which the auditor has obtained sufficient appropriate
audit evidence for forming the audit opinion and the date of approval of the financial statements.
Date the financial statements are issued is the date that the auditor’s report and audited
financial statements are made available to third parties.
The date of approval of the financial statements is the date on which all the statements that
comprise the financial statements have been prepared and responsible parties have asserted that
they have taken this responsibility.
The date the financial statements are issued is the date that the auditor's report and audited
financial statements are made available to third parties. This date must not only be at, or later than,
the date of the auditor's report but must also be at, or later than, the date the auditor's report is
provided to the entity.
447
Business Assurance
Topic highlights
Auditors have a responsibility to identify subsequent events before they sign their auditor's
report. Action may need to be taken if they become aware of subsequent events occurring between
the date they sign their auditor's report and the date the financial statements are issued.
HKSA 560.6- The audit procedures to identify subsequent events should be timed to occur as near as
17 practicable to the date of the auditor's report. HKSA 560 (Clarified) gives guidance on the
additional procedures the auditor should perform if aware of a subsequent event which materially
affects the financial statements. The auditor should review whether the events are properly
accounted for and adequately disclosed but need not repeat or perform further procedures on
matters on which he is already satisfied.
448
16: Overall audit review and finalisation | Part D Assurance engagements
The timeline along with the commentary given below may clarify the responsibilities of an auditor
with regard to subsequent events:
Situation 1 – Subsequent period Situation 2 Situation 3
449
Business Assurance
1.2.2 Situation 2: Facts discovered after the date of the auditor's report but
before the financial statements are issued
As you should now be aware, the preparation of the financial statements in accordance with the
appropriate accounting framework is management's responsibility. Therefore, management
should inform the auditors of any material subsequent events between the date of the auditors'
report and the date the financial statements are issued. The auditors do not have any obligation to
perform procedures, or make inquiries regarding the financial statements, after the date of their
auditor's report.
However, if a matter comes to the auditor’s attention that had it been known to the auditor earlier
may have led to a different opinion, the auditor shall:
(a) discuss the matter with management and those charged with governance
(b) determine whether the financial statements require amendment
(c) if amendment is needed, inquire as to how management intends to address this. The
auditors will then consider performing and extending procedures up to the date of the new
auditor's report based on amended financial statements. The new auditor's report should not
be dated earlier than the date of approval of the amended financial statements.
However, if management does not amend the financial statements the auditor has to take action
to either modify or prevent reliance on the report:
(a) If the auditor's report has not yet been provided to the entity, the auditor shall modify the
opinion and issue its report based on that opinion emphasising the reason for qualification.
(b) If the auditor's report has already been provided to the entity, the auditor shall advise
management and those charged with governance not to issue the financial statements
before the amendments are made. If the entity refuses, the auditor shall take action to seek
to prevent reliance on the auditor's report. The precise action taken will depend on the
auditor's legal rights and obligations and the advice of the auditor's legal counsel.
1.2.3 Situation 3: Facts discovered after the financial statements have been
issued
Auditors have no obligations to perform procedures or make inquiries regarding the financial
statements after they have been issued.
However, if the auditor becomes aware of a fact that had it been known to the auditor at the date of
the auditor's report, may have led to a different outcome, the auditor shall follow the steps outlined
in Situation 2, that is discussion with management, assessing whether the statements need
amendment and how that might be addressed.
If management amends the financial statements, the auditor shall carry out and extend procedures
necessary up to the date of the new auditor's report. The auditor will also review the steps taken by
management to ensure that anyone in receipt of the previously issued financial statements is
informed that an amended set of financial statements has been issued and that the reasons why
are adequately disclosed.
450
16: Overall audit review and finalisation | Part D Assurance engagements
The auditor shall also issue a new or amended auditor's report which will include an
explanatory paragraph (known as an emphasis of matter paragraph or other matter
paragraph) that refers to a note in the financial statements that discusses the reason for the
amendment.
In our opinion, the revised financial statements give a true and fair view, as at the date the original
financial statements were approved, of the financial position of the company as of 31 December
20X0, and of its profits and its cash flows for the year then ended in accordance with Hong Kong
Financial Reporting Standards.
In our opinion the original financial statements for the year to 31 December 20X0, failed to comply
with the Hong Kong Companies Ordinance.
Date AUDITOR
Address
If the auditors feel management has failed to adequately communicate the fact that the financial
statements have been amended to users, the auditor shall notify management and those charged
with governance that the auditor will seek to prevent future reliance on the report through legal
recourse.
In the public sector, when management does not amend the financial statements, auditors may
also include reporting separately to the legislature, or other relevant body in the reporting hierarchy,
on the implications of the subsequent event for the financial statements and the auditor’s report.
Self-test question 1
As at 31 December 20X9, Slow Moving Company Limited (“SMC”) has trade receivables of
HK$30,000,000 overdue for more than one year. After some rounds of tough negotiation with the
auditor, SMC finally agreed to write-off the whole amount in its draft financial statements for the
year ended 31 December 20X9, since it failed to convince the auditor that the debts are
recoverable. However, one of the debtors settled an amount of HK$8,000,000 a few days before
SMC’s directors are due to approve the financial statements. The directors of SMC prefer not to
amend the financial statements to reflect the settlement of the overdue amount of HK$8,000,000,
and account for the impairment reversal in the year ending 31 December 20Y0. You are the
engagement manager for the audit of SMC’s financial statements for the year ended 31 December
20X9.
Required
(a) Determine your team’s responsibility to identify the settlement of the overdue amount of
HK$8,000,000; and
(9 marks)
(b) Determine your team’s response if your team becomes aware of the settlement before your
firm issues the auditor’s report.
(3 marks)
(Total = 12 marks)
HKICPA February 2010 (amended)
(The answer is at the end of the chapter)
451
Business Assurance
2 Going concern
Topic highlights
If the entity has inappropriately used the going concern assumption or a material uncertainty exists,
this may impact on the auditor's report.
Key term
Under the going concern assumption, an entity is viewed as continuing in business for the
HKSA 570.2 foreseeable future with neither the intention to liquidate or cease trading. When the use of the
going concern assumption is appropriate, assets and liabilities are recorded on the basis that the
entity will be able to realise its assets and discharge its liabilities in the normal course of business.
452
16: Overall audit review and finalisation | Part D Assurance engagements
Events or conditions that may cast doubt about the going concern assumption
Financial Net liability or net current liability position
Fixed-term borrowings approaching maturity without realistic prospects of
renewal or repayment
Excessive reliance on short-term borrowings to finance long-term assets
Withdrawal of financial support by creditors, holding entity and shareholders
Negative operating cash flows
Adverse key financial ratios
Substantial operating losses or significant deterioration in the value of assets
used to generate cash flows
Arrears or discontinuance of dividends
Inability to pay creditors on due dates
Inability to comply with terms of loan agreements
Change from credit to cash-on-delivery transactions with suppliers
Inability to obtain financing for essential new product development or other
essential investments
Operating Management intentions to liquidate or cease operations
Loss of key management without replacement
Loss of a major market, key customers, licence, or principal suppliers
Labour difficulties
Shortages of important supplies
Emergence of a highly successful competitor
Other Non-compliance with capital or other statutory requirements
Pending legal or regulatory proceedings against the entity
Changes in law or regulations that may adversely affect the entity
Uninsured or under-insured catastrophes when they occur
The significance of the above events or conditions can be mitigated by other factors, for example:
(a) An inability to make normal debt repayments may be counter-balanced by management’s
plans to sell assets, rescheduling loan repayments, or obtaining additional capital.
(b) The loss of a principal supplier may be counter-balanced by the availability of a suitable
alternative source of supply.
453
Business Assurance
The auditor shall also inquire of management their knowledge of events or conditions beyond the
period of the assessment that may cast significant doubt on the entity's ability to continue as a
going concern.
When management makes the assessment, it will consider the following:
The uncertainty involved about the events and conditions being assessed
Judgment made based in the available information at that time and the future (eg
subsequent events can contradict a judgement which was reasonable at the time it was
made)
The size and complexity of the entity, the nature and condition of the business.
HKSA 570.10 These risk assessment procedures assist the auditor to determine whether management's use of
the going concern assumption is likely to be an important issue and has major impact in the audit
planning. Auditors may discuss with management its plans and resolution of any identified going
concern issues.
The auditor shall remain alert throughout the audit for evidence of events or conditions that may
cast significant doubt on the entity's ability to continue as a going concern.
454
16: Overall audit review and finalisation | Part D Assurance engagements
455
Business Assurance
Emphasis of matter
Without qualifying our opinion, we draw attention to Note 5 in the financial statements which
indicates that the Company incurred a net loss of HK$10,000,000 during the year ended
31 December 20X0 and, as of that date, the Company's current liabilities exceeded its total assets
by HK$15,000,000. These conditions, along with other matters as set forth in Note 3, indicate the
existence of a material uncertainty that may cast significant doubt about the Company's ability to
continue as a going concern.
For multiple material uncertainties that are significant to the financial statements as a whole, the
auditor may consider it appropriate to express a disclaimer of opinion instead.
If the auditor concludes that the use of the going concern assumption is appropriate but a material
uncertainty exists and there is inadequate disclosure in the financial statements, the auditor shall
express a qualified opinion or adverse opinion in accordance with HKSA 705 (Clarified)
Modifications to the Opinion in the Independent Auditor's Report.
456
16: Overall audit review and finalisation | Part D Assurance engagements
The following is an illustration of the relevant paragraphs when a qualified opinion is to be expressed:
If the financial statements have been prepared on a going concern basis, but in the auditor's
judgment this is inappropriate, the auditor must express an adverse opinion. This applies
regardless of whether the financial statements include disclosure of the inappropriateness of
management's use of the going concern assumption.
The following is an illustration of the relevant paragraphs when an adverse opinion is to be expressed:
457
Business Assurance
The auditor can still issue an unmodified opinion on those financial statements if adequate
disclosure has been made and an emphasis of matter paragraph may be added to draw reader's
attention to that alternative basis and the reasons for its use.
2.7.6 Summary of reporting on going concern
The following table summarises the possible scenarios that could arise following the auditor's
review of going concern:
The auditor shall communicate with those charged with governance events or conditions that may
cast doubt on the entity's ability to continue as a going concern. This will include:
(a) whether the events or conditions constitute a material uncertainty
(b) whether the use of the going concern assumption is appropriate in the preparation and
presentation of the financial statements
(c) the adequacy of related disclosures
Self-test question 2
Elegant Ella Limited (“EE”) is a garment manufacturer with major overseas customers residing in
the US. Its annual turnover exceeds US$500 million.
You are the auditor of EE. In March 20X2, you have substantially completed your audit work of the
financial statements for the year ended 31 December 20X1 and are satisfied that there are no
material misstatements. You intend to conclude the audit by 15 April 20X2. On 2 April 20X2, the
Wall Street Journal has reported on the serious financial difficulty of EE’s largest customer,
Y Limited. According to the report, the customer may declare bankruptcy any time.
Required
(a) In view of the facts and the news report, what is your revised assessment of the risk of
material misstatement of EE’s financial statements as a whole? (4 marks)
(b) In response to the circumstances, what are the further audit procedures, with reasoning, you
would design to complete your audit and to give an audit opinion on EE’s financial
statements for the year ended 31 December 20X1? (9 marks)
(Total = 13 marks)
HKICPA December 2011
(The answer is at the end of the chapter)
458
16: Overall audit review and finalisation | Part D Assurance engagements
3 Written representations
Topic highlights
The auditor obtains written representations from management and, where appropriate those
charged with governance, concerning their responsibilities and to support other audit evidence
where necessary.
Key term
Written representations are written statements by management provided to the auditor to confirm
HKSA 580.7 certain matters or to support other audit evidence. They do not include the financial statements,
assertions or supporting books and records.
HKSA 580.6 HKSA 580 (Clarified) Written Representations provides guidance to auditors in this area. The
objectives of the auditor are described below:
(a) To obtain written representations from management that they believe that they have fulfilled
their responsibility for the preparation of the financial statements and for the completeness of
the information provided to the auditor
(b) To support other audit evidence relevant to the financial statements if determined necessary
by the auditor or required by other HKSAs
(c) To respond appropriately to written representations or if management does not provide
written representations requested by the auditor
459
Business Assurance
HKSA 240 (Clarified) The Requires that the auditor shall obtain written representations
Auditor's Responsibilities from management and, where appropriate, those charged with
Relating to Fraud in an Audit governance to evidence the following:
of Financial Statements (a) acknowledgement of their responsibilities for the design,
implementation and maintenance of internal control to
prevent and detect fraud
(b) disclosure to the auditor of the results of management's
assessment of the risk that the financial statements may
be materially misstated due to fraud
(c) disclosure to the auditor of their knowledge of fraud or
suspected fraud affecting the entity or knowledge of an
allegation of fraud.
HKSA 250 (Clarified) Requires that the auditor shall obtain written representations
Consideration of Laws and from management and, where appropriate, those charged with
Regulations in an Audit of governance of their disclosure of known instances of non-
Financial Statements compliance or suspected non-compliance with laws and
regulations whose effects should be considered when preparing
financial statements.
HKSA 450 (Clarified) Requires that the auditor shall obtain written representations
Evaluation of Misstatements from management and, where appropriate, those charged with
Identified During the Audit governance of their belief that the effects of uncorrected
misstatements are immaterial, individually and in aggregate, to
the financial statements as a whole.
HKSA 501 (Clarified) Audit Requires that the auditor shall obtain written representations
Evidence – Specific from management and, where appropriate, those charged with
Considerations for Selected governance that disclosure has been made to the auditor of their
Items knowledge of actual or possible litigation and claims whose
effects should be considered when preparing the financial
statements.
HKSA 540 (Clarified) Requires that the auditor shall obtain written representations
Auditing Accounting from management and, where appropriate, those charged with
Estimates, including Fair governance of their belief that significant assumptions used in
Value Accounting Estimates, making accounting estimates are reasonable.
and Related Disclosures
HKSA 550 (Clarified) Related Requires that the auditor shall obtain written representations
Parties from management and, where appropriate, those charged with
governance of their:
(a) disclosure to the auditor of the identity of the entity's
related parties and all the related party relationships and
transactions of which they are aware
(b) actions of having appropriately accounted for and
disclosed such relationships and transactions in
accordance with the requirements of the framework
460
16: Overall audit review and finalisation | Part D Assurance engagements
HKSA 560 (Clarified) Requires that the auditor shall obtain written representations
Subsequent Events from management and, where appropriate, those charged with
governance of their belief that all events occurring subsequent to
the date of the financial statements, for which the applicable
financial reporting framework requires adjustment or disclosure,
have been adjusted or disclosed.
HKSA 570 (Clarified) Going Requires that the auditor shall obtain written representations
Concern from management and, where appropriate, those charged with
governance of their plans for future action and the feasibility of
these plans.
HKSA 710 (Clarified) Requires that the auditor shall:
Comparative Information – (a) request written representations for all periods referred to
Corresponding Figures and in the auditor's opinion
Comparative Financial
(b) obtain specific written representations regarding any
Statements
restatement made to correct a material misstatement in
prior period financial statements that affect the
comparative information.
461
Business Assurance
If written representations are inconsistent with other internal and external corroborative audit
evidence, the auditor shall perform audit procedures to try to resolve the matter or investigate the
circumstances. If the matter cannot be resolved, the auditor shall reconsider the assessment of the
competence, integrity and ethical values of management, and the effect this may have on the
reliability of representations and audit evidence in general.
If the auditor concludes that written representations are not reliable, the auditor shall take
appropriate actions, including determining the impact on the auditor's report or withdrawing from
the engagement.
HKSA 580 (Clarified) requires that the auditor shall disclaim an opinion on the financial statements
if the auditor concludes that there is sufficient doubt about the integrity of management.
Self-test question 3
Towards the end of an audit, it is common for the external auditor to seek a letter of representation
from the management of the client company.
Required
(a) List the matters commonly included in the letter of representation.
(b) Explain why it is important to discuss the content of the letter of representation at an early
stage during the audit.
(The answer is at the end of the chapter)
4 Related parties
Topic highlights
It can be difficult to gain audit evidence about related party transactions.
462
16: Overall audit review and finalisation | Part D Assurance engagements
4.1 Introduction
HKSA 550 (Clarified) Related Parties deals with the auditor's responsibilities with regards to related
party relationships and transactions in an audit of financial statements. It is management's
responsibility to identify related party transactions, to make proper disclosure and to approve the
transactions. It is not the auditor's responsibility to do so.
Key term
Related party. A party that is either:
HKSA 550.10
(a) a related party as defined in the applicable financial reporting framework (eg HKAS 24
(Revised)).
(b) where the applicable financial reporting framework establishes minimal or no related party
requirements:
(i) A person or other entity that has control or significant influence, directly or indirectly
through one or more intermediaries, over the reporting entity.
(ii) Another entity over which the reporting entity has control or significant influence,
directly or indirectly through one or more intermediaries.
(iii) Another entity that is under common control with the reporting entity through having:
– common controlling ownership (ie parent, subsidiary or fellow subsidiary related)
– owners who are close family members
– common key management
HKSA 550.2 During the audit process, auditors often encounter difficulties in identifying related party
transactions.
The nature of related party relationships and transactions may give rise to increased risk due to
the following reasons:
(a) Related parties may operate through a wide and complex range of relationships and
structures ie complex group structures. Management may be unaware of the existence of all
related party relationships and transactions
(b) Information systems may be ineffective at identifying or summarising transactions and
outstanding balances between an entity and its related parties
(c) Related party transactions may not be conducted under normal market terms and
conditions
(d) Related party relationships provide a greater opportunity for collusion, concealment or
manipulation by management
(e) Identifying related party transactions means extra work for management as often
accounting systems are not designed to identify the related party transactions
(f) Often there is a lack of audit trail for related party transactions
Planning and performing the audit with professional scepticism is therefore particularly important
where there are related parties.
463
Business Assurance
464
16: Overall audit review and finalisation | Part D Assurance engagements
465
Business Assurance
466
16: Overall audit review and finalisation | Part D Assurance engagements
(iii) Evaluate whether the terms of the transactions are consistent with management's
explanations
(iv) Evaluate whether the transactions have been appropriately accounted for and
disclosed in accordance with the applicable financial reporting framework
(v) Obtain audit evidence that the significant related party transactions have been
appropriately authorised and approved
The auditor shall consider the consistency between management's explanations and the business
rationale of the related party transactions. Any inconsistencies with the nature of its business may
indicate a fraud risk.
The auditor shall consider and be alert as to whether there are rational explanations for
significant related party transactions that have not been authorised and approved by appropriate
level of management. Even where the transactions have been authorised and approved, the
auditor shall consider whether there is collusion between the related parties or by related parties
with dominant influence.
The auditor shall identify and assess the risks of material misstatement associated with related
party relationships and transactions and determine whether any of those risks are significant
risks.
Topic highlights
A related party with dominant influence can exert control or dominant influence over the entity or
its management.
467
Business Assurance
The auditor should be aware of any significant risks of material misstatement due to fraud such as:
(a) high turnover of senior management indicating unethical or fraudulent business practices
(b) use of intermediaries for significant related party transactions that have no clear business
justification
(c) excessive participation by related parties, especially in making significant estimates
468
16: Overall audit review and finalisation | Part D Assurance engagements
The auditor must communicate all significant matters arising during the audit in connection to the
entity's related parties to those charged with governance.
Self-test question 4
You are the audit manager responsible for a recurring audit engagement. As a result of the
planning procedures recently completed for the upcoming year’s audit assignment, you became
aware that the company purchased goods from a supplier that may be related to a director of the
company.
Required
(a) What factors may cause you to believe that the purchases were made from a related party?
(b) What would you do if you concluded that the purchases were made from a related party?
(c) What would you do to ensure the completeness of related party transactions?
(The answer is at the end of the chapter)
Topic highlights
The auditors must perform and document an overall review of the financial statements by
undertaking analytical procedures before they can reach an opinion.
Once most of the substantive audit procedures have been carried out, the auditors will have a draft
set of financial statements which should be supported by appropriate and sufficient audit evidence.
Towards the end of the audit process, it is usual for the auditors to undertake an overall review of
the financial statements.
This review of the financial statements, in conjunction with the conclusions drawn from the other
audit evidence obtained, gives the auditors a reasonable basis for their opinion on the financial
statements. It should be carried out by a senior member of the audit team, with appropriate skills
and experience.
469
Business Assurance
(a) the information presented in the financial statements is in accordance with local statutory
requirements that is, the Hong Kong Companies Ordinance
(b) the accounting policies employed are in accordance with accounting standards HKASs and
HKFRSs, properly disclosed, consistently applied and appropriate to the entity
When examining the accounting policies, auditors should consider the following:
(a) Policies commonly adopted in particular industries
(b) Policies for which there is substantial authoritative support
(c) Whether any departures from applicable accounting standards are necessary for the
financial statements to give a true and fair view
(d) Whether the financial statements reflect the substance of the underlying transactions and
not merely their form
(e) Whether sufficient evidence has been collected
(f) Whether the evidence supports the auditor's opinion
(g) Review of working papers
470
16: Overall audit review and finalisation | Part D Assurance engagements
6 Other information
Topic highlights
Auditors should always seek to resolve inconsistencies or misstatements of fact between
financial statements and other published information.
471
Business Assurance
Key terms
Other information is financial and non-financial information other than the financial statements
HKSA and the auditor's report, which is included, either by law, regulation or custom, in a document
720.5a, 5b
containing audited financial statements and the auditor's report thereon.
An inconsistency exists when other information contradicts information contained in the audited
financial statements.
A material inconsistency may raise doubt about the audit conclusions drawn from audit evidence
previously obtained and, possibly, about the basis for the auditor's opinion on the financial
statements.
472
16: Overall audit review and finalisation | Part D Assurance engagements
Topic highlights
Auditors shall communicate specific matters to those charged with governance and HKSA 260
(Clarified) provides guidance to auditors in this area.
Key terms
'Those charged with governance' are the person(s) or organisation(s) with responsibility for
HKSA 260.10 overseeing the strategic direction of the entity and obligations related to the accountability of the
entity.
Management are persons with executive responsibility for the conduct of the entity’s operations.
The auditor must determine the appropriate person(s) within the entity’s governance structure with
whom to communicate. Communication with those charged with governance is important for the
following reasons:
(a) It assists the auditor and those charged with governance to understand audit-related
matters in context and allows them to develop a constructive working relationship
(b) It allows the auditor to obtain information relevant to the audit
473
Business Assurance
(c) It assists those charged with governance to fulfil their responsibility to oversee the financial
reporting process, thus reducing the risks of material misstatement in the financial
statements
474
16: Overall audit review and finalisation | Part D Assurance engagements
Auditor The auditor shall communicate the following for listed entities:
independence A statement that the engagement team and others in the firm, the
firm, and network firms have complied with relevant ethical
requirements regarding independence.
All relationships between the firm and entity that may reasonably be
thought to bear on independence.
Related safeguards that have been applied to eliminate identified
threats to independence or reduce them to an acceptable level.
Topic highlights
The auditor is required to evaluate the effect of identified misstatements on the audit and the effect
of uncorrected misstatements on the financial statements.
Key terms
Misstatement is a difference between the amount, classification, presentation, or disclosure of a
HKSA 450.4 reported financial statement item and the amount, classification, presentation, or disclosure that is
required for the item to be in accordance with the applicable financial reporting framework.
Misstatements can arise from error or fraud.
Uncorrected misstatements are misstatements that the auditor has accumulated during the audit
and that have not been corrected.
475
Business Assurance
476
16: Overall audit review and finalisation | Part D Assurance engagements
477
Business Assurance
Topic highlights
In most instances the auditor will discuss findings with those charged with governance. The auditor
may also consider the need to report to a proper authority in the public interest.
478
16: Overall audit review and finalisation | Part D Assurance engagements
The auditor may discuss the findings with those charged with governance where they may be able
to provide additional audit evidence.
The auditor may consider it appropriate to consult with the entity’s in-house legal counsel or
external legal counsel about the application of the laws and regulations.
The auditor shall evaluate the implications of non-compliance in relation to other aspects of the
audit, including the auditor’s risk assessment and the reliability of written representations.
The auditor may consider withdrawal from the engagement, where withdrawal is possible under
applicable law or regulation.
In some jurisdictions, the auditor of a financial institution has a statutory duty to report the
occurrence, or suspected occurrence, of non-compliance with laws and regulations to supervisory
authorities.
479
Business Assurance
Topic recap
Audit completion
Responsibilities
– Up to date of audit report
Subsequent event – After date of audit report but
before financial statements issued
– After financial statements issued
Reporting implications
Auditor’s responsibilities
About management’s
responsibilities
Other
Identification
Related parties
Disclosure
Assess materiality of
Material inconsistency accumulated misstatement
Other information
Reports to those
charged with Relevant audit matters Including major
governance control deficiencies
Identified misstatement
Misstatements Evaluate
identified
Uncorrected misstatements
480
16: Overall audit review and finalisation | Part D Assurance engagements
Answer 1
(a) The settlement of HK$8,000,000 was a subsequent event, and to be more specific, it was an
event occurring between the date of financial statements and the date of the auditor’s report.
In accordance with HKSA 560 (Clarified), the engagement team should perform procedures
designed to obtain sufficient appropriate audit evidence that all events up to the date of the
auditor’s report that may require adjustment of, or disclosure in, the financial statements
have been identified.
Such procedures ordinarily include the following:
– Reviewing procedures the management has established to ensure that subsequent
events are identified.
For example, the engagement may consider whether the directors/management of
SMC would be alerted of significant cash receipts subsequent to the financial year end.
If SMC has such procedures properly in place, it is likely that the management could
identify the settlement on a timely basis.
– Reading minutes of the meetings of shareholders, the board of directors and audit and
executive committees held after the date of the financial statements and inquiring
about matters discussed at meetings for which minutes are not yet available.
– Given that such meetings would not be frequent, it is unlikely that these procedures
would identify the settlement.
– Reading SMC’s latest available interim financial statements and, as considered
necessary and appropriate, budgets, cash flow forecasts and other related
management reports.
– Given that the preparation of such statements and reports would not be frequent, it is
unlikely that these procedures would identify the settlement.
– Inquiring, or extending previous oral or written inquiries, of SMC’s lawyers concerning
litigation and claims.
Unless the lawyers of SMC have been involved in dealing with the customer for
settlement, such an inquiry or extended confirmation is unlikely to identify the
settlement.
– Inquiring of management of SMC whether any subsequent events have occurred
which might affect the financial statements.
– Provided that SMC has an effective and efficient internal system in identifying and
reporting significant/major cash movements, it is very likely that the engagement
team’s inquiry of management would identify the settlement.
(b) When the engagement team became aware of the settlement before the issue of the
auditor’s report, the engagement team should determine whether SMC’s financial statements
should be amended.
Given that the settlement of HK$8,000,000 subsequent to the financial period provides
evidence as to the recoverability of the receivable as at 31 December 20X9, the engagement
team should normally request SMC to amend the financial statements such that the amount
of impairment of receivables for the year ended 31 December 20X9 would be reduced by
HK$8,000,000.
481
Business Assurance
If the management of SMC refuse to amend the financial statements, the engagement team
should consider whether it is appropriate to issue a qualified opinion in accordance with
HKSA 705 (Clarified).
Answer 2
(a) EE Limited’s auditor should consider the below in assessing the risk of material
misstatement relating to EE Limited’s financial statements as a whole in response to the
rumour:
Whether the valuation of the accounts receivable due from Y Limited will be impaired
since Y Limited is reported to be in serious financial difficulty; and
Assess whether Y Limited is the single largest customer of EE Limited and whether
the loss of business from Y Limited would seriously impact the going concern of
EE Limited.
(b) EE Limited’s auditor should consider the audit procedures below in response to the rumour:
Discuss the rumour with management and management’s assessment of the rumour;
Perform independent checks on Y Limited’s financial stability;
Review the year end outstanding accounts receivable balance due from Y Limited and
assess any potential recoverability issues since Y Limited was reported to be in
serious financial difficulty;
Understand and evaluate management’s business and settlement plan with Y Limited,
if any;
Review EE Limited’s current financial position, budget and projected cash flow
forecast and assess whether EE Limited is able to continue the operation as a going
concern even if Y Limited is proven to be in financial difficulty; and
Reassess whether management has adopted an appropriate basis of preparation for
the financial statements and consider whether sufficient financial statements
disclosure has been made about going concern.
EE Limited’s auditor should consider the below audit procedures on performing the
subsequent event review:
Ask the management whether there is any significant subsequent event to their
knowledge that should be brought to the auditor’s attention;
Review management’s procedures for identifying subsequent events to ensure that
management are aware of the risks;
Review meeting minutes and written resolutions of the board of directors and
significant committees up to the date of the signed auditor’s report;
Review EE Limited’s announcements and publications relating to EE Limited up to the
date of the signed auditor’s report;
Review EE Limited’s latest available management accounts, budget, cash flow
forecast and management reports.
The above procedures collectively aim to investigate whether there have been any:
New commitments, borrowings or guarantees;
Sales or destruction of non-current assets;
Changes of business structure;
Issues of shares/debentures;
482
16: Overall audit review and finalisation | Part D Assurance engagements
Answer 3
(a) Common categories of matters included in the letter of representation:
(i) Confirmation of responsibility for, and approval of, the financial statements.
(ii) Confirmation that all of the accounting records, and all related documentation (such as
minutes of management and shareholder meetings) have been made available, and
that company transactions have been properly reflected therein.
(iii) Confirmation of the expected outcome of legal claims.
(iv) Confirmation of company plans in relation to certain tax provisions.
(v) Confirmation of completeness of disclosures of related party transactions.
(vi) Confirmation that there have been no events after the balance sheet requiring
revisions to the financial statements.
(b) In order to emphasise its importance to management, and to explain that it forms a key part
of audit evidence.
Answer 4
(a) Factors that need to be considered to determine whether the purchases were made from a
related party:
(1) Were the transactions entered into between the parties with normal terms of trade
such as pricing and credit terms, compared to transactions made with other parties?
(2) Were the transactions entered into between the parties without apparent business/
commercial reasons?
(3) Were the transactions made in a structure that places significant emphasis on legal
form rather than actual substance?
(4) Were the transactions carried out in a different manner compared to similar
transactions made with other parties?
(5) Was there an unexpectedly high volume or significant number of transactions made
with the identified supplier?
(6) Were the transactions handled by management/staff who normally are not responsible
for this work?
(b) If the purchases were made with a related party, I will do the following:
(1) Discuss the reasons for the purchases with directors and senior management of the
company.
(2) Send a positive confirmations request in connection with the terms of trade and
amount of the purchases to the party concerned.
(3) Discuss the issue directly with the party concerned and inspect documents in its
possession.
(4) Confirm the nature of the transactions or discuss the matter with other parties involved
in/associated with the transactions.
(5) Include specific representations covering the relationship between the company and
the party, terms of trade and the amount in the letter of representation.
483