It is not uncommon for clients to offer gifts and/or hospitality to professional accountants (including auditors).
Professional Accountants should ensure that accepting such gifts and hospitality does not violate the essential principles before doing so.
The client’s offer of gifts and hospitality, its type and value, and the client’s overarching purpose all play a role in determining whether or not this situation justifies the use of a threat.
For instance, if a client were to buy a professional accountant lunch after completing a lengthy and challenging job, the professional accountant could consider this gesture meaningless and unimportant.
However, the offering of a holiday by the client after a lengthy and challenging assignment would not be viewed as insignificant and immaterial. The professional accountant needs to deny such offers if they are made.
Suppose the professional accountant concludes that risks to basic principles cannot be eliminated completely or reduced to an acceptable level. In that case, the professional accountant is not permitted to accept any gifts or hospitality extended to them.
Accepting gifts and hospitality from an audit client might create a self-interest, familiarity or intimidation threat.
Firms must comply with the fundamental principles, be independent and apply the conceptual framework set out in Section 210 of Part 2 of the By-Laws (on Professional Ethics, Conduct and Practice) of the Malaysian Institute of Accountants to identify, evaluate and address threats to independence.
A firm or an assurance team member shall not accept gifts and hospitality from an assurance client unless the value is trivial and inconsequential.
Determining whether there is actual or perceived intent to influence behaviour requires the exercise of professional judgment improperly. Relevant factors to consider might include the following:
The nature, frequency, value and cumulative effect of the gift.
Timing of when the gift is offered relative to any action or decision it might influence.
Whether the gift is a customary or cultural practice, for example, offering a gift on the occasion of a religious holiday or wedding.
Whether the gift is an ancillary part of a professional service, for example, offering or accepting lunch in connection with a business meeting.
Whether the offer of the gift is limited to an individual recipient or available to a broader group. The broader group might be internal or external to the firm, such as other suppliers to the client.
The roles and positions of the individuals at the firm or the client offering or being offered the gift.
Whether the professional accountant knows or has reason to believe that accepting the gift would breach the policies and procedures of the client.
The degree of transparency with which the gift is offered.
Whether the gift was required or requested by the recipient.
The known previous behaviour or reputation of the offeror.
Examples of actions that might be safeguards to address such threats created by offering or accepting such a gift include:
Being transparent with senior management of the firm or the client about offering or accepting a gift.
Registering the gift in a log monitored by senior management or another individual responsible for the firm’s ethics compliance or maintained by the client.
Having an appropriate reviewer, who is not otherwise involved in providing the professional service, review any work performed or decisions made by the professional accountant concerning the client from which the accountant accepted the gift.
Donating the gift to charity after receipt and appropriately disclosing the donation, for example, to a member of senior management of the firm or the individual who offered the gift.
Reimbursing the cost of the gift, such as hospitality, received.
As soon as possible, return the gift, such as a gift, after it was initially accepted.
Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
Where family or close relationship ties between an auditor and their client, three different sorts of conflicts might arise that threaten the auditor’s independence and objectivity.
These threats are as follows:
Self-Review Threat;
Familiarity Threat; or
Intimidation Threat.
Example: Self-Review Threat
An accountant suggested a new strategy to an organisation she prepared the accounts for.
She has since been asked to examine the strategy to see if it has succeeded. She, therefore, faces major self-review threats to her professional ethics.
Example: Familiarity Threat
An accountant has been asked to work on the accounts for an organisation currently managed by his wife, exposing him to a Familiarity threat.
Example: Intimidation Threat
Susan is an external auditor, and she has been threatened by her client, ABC Ltd., to provide different recommendations for its financial statement. Susan faces intimidation threats that hurt her professionally.
When an immediate family member or a member of the audit team is:
A director or officer of the audit client; or
An employee that can exert influence over the preparation of the client’s accounting records or the financial statements on which the firm will express an opinion,
then the individual in question must be removed from the audit team.
If the individual in question is not removed from the audit team, no other safeguards can be established since the closeness of such a connection will not reduce the threat to an acceptable level.
Also, a former audit team members may have accepted a job with the audit client.
This possibility exists in addition to the possibility that a member of the audit client’s family or close circle of friends may be involved.
Under these conditions, there is a good chance that one’s independence will be jeopardised to the point where it will be difficult, if not impossible, to bring the threat down to a level that may be considered acceptable.
也有一种可能性是，审计小组的前成员可能已经接受了审计客户的工作。
除了这种可能性之外，还存在审计客户的家庭成员或亲密朋友圈可能参与其中的可能性。
在这些情况下，一个人的独立性很有可能会受到损害，以至于很难，甚至不可能将威胁降低到可以接受的水平。
Therefore, independence would be considered to have been compromised if a former member of the audit team or the audit partner joined the audit client as a director or officer; or as an employee with the ability to exert influence over the accounting records and financial statements to which the audit firm will express an opinion.
However, there are a few exceptions to the rules governing this threat. For instance, the individual is not eligible for any benefits or payments from the firm unless such benefits or payments are made under certain pre-determined procedures and when any sum owing to the individual is not significant to the firm.
One such illustration would be the scenario in which the person in question does not participate in the firm’s business or professional activities.
Section 521.7 A1 of the By-Laws (on Professional Ethics, Conduct and Practice) of the Malaysian Institute of Accountants set out factors that are relevant in evaluating the level of self-interest, familiarity or intimidation threat created by such a relationship, including:-
The nature of the relationship between the individual and the audit team member.
The position the individual holds with the client.
The role of the audit team member.
An example of an action that might be a safeguard to address such a self-interest, familiarity or intimidation threat is structuring the responsibilities of the audit team so that the audit team member does not deal with matters that are within the responsibility of the individual with whom the audit team member has a close relationship.
Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
The general objective of an audit is discussed in ISA 200 Overall Objective of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing.
According to ISA 200, the following objectives must be met for an audit of financial statements to be considered successful:
“To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and to report on the financial statements, and communicate as required by the ISAs, in accordance with the auditor’s findings.”
Every single ISA has what is known as an “objective,” which can also be translated as “what the ISA aims to accomplish.”
When the auditor carries out the audit following the ISAs and succeeds in achieving the objectives outlined in each ISA, the overall objective of the audit (which was outlined earlier) is considered to have been accomplished.
However, for the auditor to accomplish the objectives outlined in ISA 200, they need to comprehensively understand the requirements outlined in each ISA and ensure they comply with those requirements.
Since each audit is unique in various ways, it is important to note that the ISAs may sometimes suggest different procedures to achieve their objectives.
As a consequence, the auditor is required to go beyond the requirements of the ISA if they consider it necessary to achieve the objective of the ISA.
Achieving the overall objectives of the ISAs
To ensure that the general objectives of the ISAs are met, the auditors are required to design and carry out the audit using some level of professional scepticism and to use professional judgement in all aspects of the process.
According to ISA 200.13(l), the following is an acceptable definition of the phrase “Professional Scepticism”:
Professional scepticism is an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence.
The term ‘Professional Judgement’ is defined in ISA 200.13(k) as:
‘…the application of relevant training, knowledge and experience in making informed decisions about the appropriate courses of action in the circumstances of the audit engagement.’
The purpose of the audit is to improve the credibility of the financial statements, which in turn ensures that the user of those financial statements can make decisions that are reasonable and based on accurate information regarding a specific entity.
The conclusion that the auditor draws is whether or not the information included in the financial statements is presented as a truthful and fair picture fairly (or gives a true and fair view).
In addition, the auditor will also form an opinion about whether or not the financial statements have been correctly produced in compliance with the applicable financial reporting framework (for example, IFRS, MFRS. MPERS).
For the auditor to be able to provide reasonable assurance that the financial statements are free from material misstatement, they have to have a solid understanding of where and how such misstatements are likely to arise.
During the audit, the auditor will conduct a risk assessment under the ISAs, and as part of that assessment, they will take into account how likely these misstatements will occur.
This is being done to ensure that the areas where the auditor has found the risks of material misstatements will likely receive the appropriate attention.
These risk assessments do not necessarily only focus on the parts of the financial statements that are likely to contain material misstatements.
Instead, the risk assessment is also intended to identify the parts of the financial statements in which the risk of material misstatement is low.
This will enable the auditor to reduce the amount of testing performed in those parts of the financial statements, preventing resources and time from being wasted on parts of the financial statements that pose a low risk.
Inherent limitations
It is common knowledge that an external audit has inherent restrictions, which causes the opinion expressed by the auditor to be persuasive as opposed to conclusive.
The auditor is required under the ISAs to gain reasonable certainty (note that this is not the same thing as “absolute assurance”) that the financial statements are free from material misstatement, regardless of whether the misstatement was the result of fraud or an error.
The auditor can attain this degree of reasonable certainty when they have gathered sufficient and appropriate audit evidence to bring the audit risk down to a level that is considered to be acceptable (audit risk is the risk that the auditor will express an inappropriate audit opinion when the financial statements are materially misstated).
Some of the inherent limitations of an audit are as follows:
Audits require a significant amount of judgement on the auditor’s part (for example, what items to test).
Only some items within the financial statements are tested (this is because it would be impractical for the auditor to test 100% of every transaction throughout the year).
Audit reports are generally issued long after detailed audit work has been carried out.
Audit evidence is persuasive, not conclusive (for example, accounting estimates and use of judgements).
There are limitations in accounting and control systems (for example, the possibility of fraud, human error and the potential for management override of internal controls).
Although inherent limitations exist (and as a result, a material misstatement may go unnoticed), auditors will typically plan their work in such a way that they have a reasonable chance of detecting a material misstatement within the financial statements.
This is because inherent limitations prevent auditors from obtaining all relevant information.
If the objectives of each ISA are achieved, then the risk of an audit should be lowered to a level that is acceptable to a reasonable person.
Main features
An audit will, in basic terms, comprise the inspection of a company’s financial statements and the disclosures contained within those statements.
As a rule, the auditor is not responsible for preparing the financial statements (although, in some SME cases, the auditors may be involved, provided adequate safeguards have been implemented to maintain independence).
The final product of the audit is the auditor’s conclusion about whether or not the financial statements provide a true and fair view of the company’s financial situation.
A risk-based audit consists of the following:
To conclude ( to arrive at their opinion), the auditor must be perceived as independent of the entity being audited.
A person is considered “independent” for auditing purposes if they do not have significant personal interests in the entity being audited.
To accomplish the objective of the audit in the most efficient manner, ensuring that the auditor in question is independent of the entity being audited is essential.
This allows the auditor to provide an opinion that is both professional and unbiased.
Audit assignments must be carried out logically and structured since it is highly improbable that any two audit tasks will be the same.
The objective of the audit is to ensure that the financial statements of an entity present a true and fair view of the state of the company’s affairs as of its reporting date.
In light of this, it would be irresponsible for the auditor to carry out the audit in a haphazard manner and not pre-planned.
Before beginning any detailed audit work, the auditor must carry out a comprehensive planning procedure.
The procedure of the Clarity Project will have a substantial influence on several areas, including planning. The auditor can only show that they have developed a sufficient understanding of the entity to enable an efficient audit if adequate planning exists.
This prevents an efficient audit from taking place. The planning will take many different forms and will contain the following documentation schedule:
The entity’s background and history;
The entity’s policies and procedures;
Key management and staff;
Significant accounting policies;
The environment in which the entity operates;
Accounting systems;
Any problems encountered in previous audits;
A timetable for key events;
The audit budget;
The audit strategy;
The audit plan;
Meetings held with the client before the audit; and
Meetings of the audit team before the detailed audit work.
A full risk assessment is also required at the planning stage and the audit strategy is then developed as a result of this risk assessment to ensure that the audit procedures adopted during the course of the audit are responsive to the risks identified at the planning stage.
The following table provides a concise analysis of the complete auditing process for your perusal.
As can be seen in the chart below, the first phase in the auditing process is audit planning.
In this regard, compliance with the following two fundamental standards is required:
ISA 300, “Planning an Audit of Financial Statements,”; and
ISA 315, “Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment,”
New Audit
Recurring Audit
Legal and ethical matters
Consider
Review
Acceptance and letter of engagement
Prepare and issue
Review and update where necessary
Obtain an understanding of the entity and its environment
Obtain and prepare
Review and update where necessary
The auditor is responsible for documenting their degree of knowledge of the accounting and internal control procedures utilised by the audit client.
To do this, the auditor will have to conduct a risk assessment. This is done so that the auditor can ensure that the procedures they use when performing the detailed audit work are appropriate for the risks they identify.
The next thing for the auditor to do is to think about how they might develop enough audit evidence that is both suitable and adequate.
Evidence for audits can be gathered through various methods, but in most cases, it comes from either test of control or Substantive Procedures, or often a combination of the two.
Tests of Control are often referred to as ‘Compliance Tests’.
To determine whether the evidence can be gathered from tests of controls (and, as a result, reduce detailed substantive procedures), the auditor is required to evaluate the effectiveness of the internal controls; in other words, the auditor must ensure that the controls will prevent, detect, and correct a material misstatement within the accounting system promptly.
This is necessary to determine whether the evidence can be gathered from tests of controls.
In compliance with the provisions included in ISA 265 Communicating Deficiencies to those Charged with Governance and Management, any significant deficiencies in internal controls will be reported to those charged with governance.
The key purpose of the external audit is highlighted above.
The objective of the audit looks at the primary needs of external stakeholders of an entity, as opposed to the requirements of the entity’s management.
Typically, an entity’s bankers, trade payables and receivables, workers, possible investors, and tax authorities are considered to be external stakeholders.
As a result, the objective of the audit is to verify that the general-purpose financial statements are objective, free from bias and manipulation, and pertinent to the requirements of the individuals who will be using those financial statements.
The following graphic illustrates how key stakeholders may be identified:
Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
Yes. Both of these have their own unique qualities that set them apart.
Auditing may primarily be broken down into two categories: internal and external.
An internal audit department is staffed by employees of that entity who will provide internal audit functions that benefit the entity as a whole. However, it is common for businesses to contract out their internal audit function.
This is typically done when the expenses of having an in-house audit function do not outweigh the benefits of having one.
Internal audit departments will conform to their own auditing standards, generally independent of the International Standards on Auditing (ISAs). They will have their tasks outlined by the organisation’s management.
Internal auditing serves its purpose by, among other things, examining, evaluating and reporting to management with reports on the adequateness and efficiency of various accounting and internal control systems.
To put it another way, the purpose of an internal audit is to provide value to and enhance an organisation’s operations.
On the other hand, an external audit is almost always a requirement that must be fulfilled (either by legislation or other rules and regulations, such as listing rules or because financiers require an audit of the financial statements to be undertaken).
The Companies Act 2016 mandates that all entities established under the Act must have their financial statements audited by a certified auditor, except for those companies exempt from this requirement.
The entity’s financial statements will constitute the exclusive and primary focus of the aim of the independent audit (in contrast to the internal audit, which is focused on the operations of the entire business).
The following is a table that compares and contrasts internal auditing with external auditing:
以下是内部审计与外部审计的对比表:
Internal Audit
External Audit
Objective
It is developed to enhance the performance of an entity’s activities.
To provide an opinion about whether or not the financial statements are presented fairly (or to give a true and fair view)
Reporting
Those responsible for governance (such as the audit committee) or management (the board of directors) are the ones who receive reports from this department. Internal audit reports are not made public and are kept strictly confidential.
Contains information that is communicated to the entity’s shareholders or members on the truth and fairness of the financial statements. Reports are given to shareholders and anyone else who might be interested in the reporting company. They are also available to the general public.
Scope
The work of internal audit relates to the operations of the organisation
The work of the external auditors relates to the financial statements
Relationship
Employees of the organisation frequently fill positions in the organization’s internal audit departments (where the role of internal audit is not outsourced)
Auditors appointed by the company’s shareholders are considered external auditors because of their independence from the corporate entity.
Planning and evidence collection
Long-term planning will take place, emphasising the business’s overall strategy and the goals it aims to accomplish. There will be no materiality level established, and the evidence gathered by the internal audit will often be internal.
Its purpose is to have external audits done to see if the financial statements are true and fair in how they show the business. The importance of the financial statements and the company’s performance will be figured out, and evidence will be gathered in several ways that will be sufficient and appropriate.
There are no legal requirements to become an internal auditor. As a result, internal auditors are not required to be members of a professional body.
This is because business policy, as opposed to external rules or standards, is more likely to be responsible for defining the function of internal audits.
On the other hand, a significant number of internal auditors hold accounting degrees, and there is a recognised institution for internal auditors known as the Institute of Internal Auditors, [the Institute of Internal Auditors Malaysia (IIA Malaysia)], which internal auditors can join as members.
Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
“An engagement in which a practitioner expresses a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the outcome of the evaluation or measurement of a subject matter against criteria.”
In other words, it is an engagement to express an opinion giving assurance to a set of people on information which is the responsibility of others. It can include some or all of the following aspects:
Environmental due diligence (evaluating whether the entity has achieved certain targets, for example).
Financial due diligence (reviewing a target company’s financial statements to identify matters such as contingent liabilities and loan covenants).
IT due diligence (evaluating the risks inherent in a company’s IT systems and the quality of those systems).
Operational due diligence (evaluating the operational risks associated with the company).
People due diligence (evaluating key staff positions, termination costs following a restructuring and integration costs).
Regulatory due diligence (a review of a company’s compliance with regulation).
Review of grant claims.
The following characteristics differentiate an external audit from other types of assurance engagements, which include:
Audit Engagement
An audit is the objective examination and evaluation of an entity’s financial statements.
The purpose is to ensure that the financial records are a true and fair representation of the transactions they claim to represent.
The processes used and the examinations performed are known as “auditing”.
The auditor’s conclusions are based on the evidence obtained during the audit process and are communicated in an assurance report.
During an audit engagement, the auditor will give a high level of assurance, but not an absolute one, that the information being audited is free from material misstatement. The audit report notes this well, referring to it as reasonable assurance.
Assurance vs Audit
Audit refers to the techniques and procedures used to obtain evidence.
Assurance is what is obtained as a result of the audit procedures performed.
Review Engagement
ISRE (International Standard on Review Engagements) 2400 Engagements to Review Financial Statements is the standard to govern review engagements.
ISRE 2400 (Revised) addresses:
The practitioner’s responsibilities when engaged to review historical financial statements (when the practitioner is not the auditor of the entity); and
The form and content of the practitioner’s report on the financial statements.
A review engagement is also known as a limited assurance or negative engagement.
It gives users limited assurance of the accuracy or correctness of financial statements.
A review engagement takes less time than an audit engagement since less effort is involved.
During the engagement, the auditor performs inquiry and analytical review procedures to provide a moderate level of assurance required to give a Negative Assurance report.
In other words, since a review engagement consists primarily of inquiry and analytical procedures, there is a greater risk that material misstatements will not be detected compared to an audit.
Negative assurance is where a professional accountant gives an assurance that nothing has come to their attention which indicates that the subject matter has not been prepared under the framework it is being measured against.
To develop a judgement to express negative assurance, the practitioner is required by Paragraph 7 of ISRE 2400 to gather sufficient acceptable evidence, generally through inquiry and analytical techniques.
The procedures that the practitioner followed to arrive at this conclusion will be deciphered by the practitioner, who will consider the pertinent content of the ISRE in addition to guidance issued by relevant professional bodies, legislation, and regulation.
In addition, the conditions of the engagement between the practitioner and the client could include agreed-upon procedures.
Planning
Whilst a review engagement is not an external audit, the characteristics of a review engagement are similar.
The practitioner should undertake planning before carrying out the detailed work, which would include (among other things):
Obtaining an understanding of the entity and the environment in which it operates.
Determining materiality levels.
Using the work of others.
Obtaining sufficient appropriate evidence
To conclude, the practitioner must obtain evidence to support the assertions made in the financial statements (or other documents on which the practitioner is forming a conclusion) and in this respect, the practitioner should:
Ensure they documents all important matters about the review engagement.
Apply professional judgement in determining the nature, timing and extent of procedures.
Perform work on events after the reporting period (subsequent events).
The practitioner should ensure they extend procedures in these areas where material misstatements are suspected.
Reporting
In a review engagement, the practitioner will provide the interested parties with a review report which should contain a clear written expression of negative assurance.
As is the case in an audit, the practitioner should review and assess the conclusions drawn from the evidence obtained and use this as the basis for the expression of negative assurance and consider whether any of this evidence indicates that the financial statements do not give a true and fair view (or do not present fairly in all material respects) under the applicable financial reporting framework.
Where matters have come to the attention of the practitioner, they should describe those matters which may have the following effects:
Impact of finding(s)
Effect on the assurance report
Material
Practitioner will express a qualified opinion of negative assurance
Pervasive
Practitioner will express an adverse opinion that the financial statements do not give a true and fair view (or do not present fairly in all material respects)
Limitation in scope which is material to a single area
The practitioner should express a qualified opinion of negative assurance relating to amendments which may be required if the limitation did not exist
Our website's articles, templates, and material are solely for you to look over. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.
Keep in touch with us so that you can receive timely updates |
