Reporting on Compliance
Author:
Shelagh McAlpine
The summer saw the release of draft guidance on how company directors and auditors might fulfil the new obligations under the Companies (Auditing and Accounting) Act 2003 (the 2003 Act) to make and report on statements relating to compliance with law. So what can we expect auditors to be doing in future?
Draft guidance to answer that question was issued by the Auditing Practices Board during July. As we move into the autumn, its draft Bulletin, Directors’ compliance statements: reports by auditors under company law in the Republic of Ireland, will be reviewed in the light of commentators’ views - as will the draft guidance for directors, issued by the Director of Corporate Enforcement.
Neither guidance was straightforward to develop. The directors’ obligations involve preparation of two differently focussed but inter-related statements dealing with the existence and operation of controls over a wide range of legal obligations during each year (Table 1).
For auditors, fulfilling their new obligation involves considering how best to approach statements involving specific legal issues that overlap with, but extend beyond, the scope of a financial statement audit without unnecessary duplication of effort already undertaken in the financial statement audit in the context of an environment in which we are moving towards implementation of global standards for auditors’ work.
The APB has been working closely with the International Audit and Assurance Standards Board (IAASB) on new International Standards for financial statement audits and as well as issuing the draft Bulletin for comment, it has recently issued for comment a suite of documents applying the International Standards to financial statement audits in Ireland and the UK.
The 2003 Act’s provisions relating to the auditors’ obligations have four elements: auditors are to
• undertake a review of the directors’ statements
• form an opinion as to whether the statements are ‘fair and reasonable’
• have regard to information from other work undertaken for the company - auditing its financial statements and any audit-related or non-audit services
• report the conclusions of their review to shareholders.
In response, the APB consultation draft canvasses 3 possible levels of work effort to meet this specification: an “audit” level, which would be equivalent to a financial statement audit, focussed on provision of reasonable assurance; a limited assurance level of work; and no extra work, basing any conclusion solely only the work already done as part of the financial statement audit.
The first option - “audit” - would involve a considerable and unpredictable cost - as is illustrated in the effort and related cost involved in meeting the new standards issued by the Public Company Accounting Oversight Board (PCAOB) in the US for reporting on internal controls over financial reporting.
The PCAOB’s standards require auditors to express two opinions: one on the adequacy of statements by the directors and the other on whether or not the company’s internal controls are effective.
A survey by The Financial Times and reported over the summer indicated that related costs were climbing by over 60% of estimates in the early part of 2004. Thus the implications of this option do not sit easily with the stated intention of those sponsoring the legislation that there should not be undue cost to Irish business. Nor is such a level of work consistent with the implications of using the ‘review’ rather than ‘audit’.
The second option applies the concept of a ‘review’ rather than an audit. This option is the one developed by the text of the draft Bulletin and would provide some incremental assurance in addition to that already provided by the auditors as part of their report on the company’s financial statements. This appears a better fit with the policy line that appears to underlie the legislation and is consistent with the legislation’s use of the term 'review’ to describe the auditors’ additional responsibilities.
The third option is clearly the most cost efficient, but results in little or no assurance to shareholders over and above that already provided by the auditors’ statutory obligation to consider on the consistency of the directors’ report (in which the two new statements are to be published) with the company’s accounts.
Some of the challenges in drafting guidance can be seen by comparing the Act’s requirements with the International Framework for Assurance Engagements, issued by the IAASB.
(Bullet points excluded from web edition)
Issues of consistency with the IAASB framework for assurance are not, of course, the only ones that required consideration in developing a draft for comment.
Expectations of the extent of work undertaken by a professional in order to make a report also need consideration. In general terms, a court is likely to expect that a professional forming an opinion does so after appropriate ‘due diligence’. The draft guidance seeks to specify a number of steps in which auditors consider reports prepared by and for the directors, and the processes adopted by the directors, in order to reach an informed opinion in the light of knowledge from other work.
The draft guidance also indicates that the financial statement audit will provide a substantial body of information relevant to the new report. Auditing Standards already require auditors to undertake procedures relating to compliance with law and regulations. These are focused on the information needed to form an opinion on whether the financial statements are true and fair - including proper incorporation of the effects of non-compliance. However, the new directors’ statements must focus on the adequacy of procedures to prevent non-compliance with company and tax law more broadly - it appears that materiality may not apply - and to other laws that may have a material effect on the financial statements. It will be interesting to see commentator's reactions to the balance of the directors' guidance on this point as there is an inference that the directors' statements need to address potential risks of future non-compliance and assess the adequacy of controls over all such risks.
The draft guidance has also been informed by potential implications of the term ‘fair and reasonable’ and incorporates suggested commentary on the term taken from the directors’ guidance. The term’s implications include those of balance, fair reflection and a process sufficient to support an informed decision on the appropriateness of information and opinions given - though uncertainty inevitably exists in relation to a new piece of legislation and views on the usefulness and appropriateness of the commentary will be helpful.
Tables excluded from web edition.
Accountancy Ireland Vol 36 No 5 October 2004.