Client Acceptance and Continuance: Good Practice Guidance
Client Acceptance and Continuance: Good Practice Guidance
Client Acceptance and Continuance: Good Practice Guidance
October 2010
Forum of Firms
International Federation of Accountants
545 Fifth Avenue, 14th Floor
New York, New York 10017 USA
The mission of IFAC is to serve the public interest, strengthen the worldwide accountancy
profession and contribute to the development of strong international economies by establishing
and promoting adherence to high quality professional standards, furthering the international
convergence of such standards and speaking out on public interest issues where the professions
expertise is most relevant.
The objective of the Forum of Firms is to promote consistent and high quality standards of
financial reporting and auditing practices world-wide.
Members in the Forum1 have committed to adhere to and promote the consistent application of
high quality audit practices worldwide, including the use of International Standards on Auditing,
and the maintenance of appropriate quality control standards in accordance with International
Standards on Quality Control issued by the International Auditing and Assurance Standards
Board. Through their organizations, members also conduct globally coordinated internal quality
assurance reviews on a regular basis and have policies and methodologies which conform to the
International Ethics Standards Board for Accountants Code of Ethics for Professional
Accountants (IESBA Code).
The Transnational Auditors Committee is the executive committee of the Forum of Firms.
Further information about both can be located at http://ifac.org/Forum_of_Firms/.
This publication may be downloaded free of charge from the IFAC website: http://www.ifac.org.
The approved text is published in the English language.
Copyright October 2010 by the International Federation of Accountants (IFAC). All rights
reserved. Permission is granted to make copies of this work provided that such copies are for use
in academic classrooms or for personal use and are not sold or disseminated and provided that
each copy bears the following credit line: Copyright October 2010 by the International
Federation of Accountants (IFAC). All rights reserved. Used with permission of IFAC. Contact
[email protected] for permission to reproduce, store or transmit this document. Otherwise,
written permission from IFAC is required to reproduce, store or transmit, or to make other
similar uses of, this document, except as permitted by law. Contact [email protected].
ISBN: 978-1-60815-070-0
1
Background
Delivery of high quality services is the driver of success for all professional services firms.
Quality service is important to maintaining client satisfaction, delivering value for money and
establishing professional reputation. For professional accountancy firms2 (and audit firms in
particular), delivering quality service is at the core of the business strategy, and is essential to
satisfy the public interest responsibilities of professional accountants.
As part of its ongoing work program, the Transnational Auditors Committee (TAC) regularly
reviews the inspection reports published by external audit oversight boards and regulators. The
objective of this review is to identify findings common across jurisdictions and to evaluate
whether additional guidance would benefit the members of the Forum of Firms.
One of the issues highlighted in recent reviews of these reports (two reviews were performed in
2008 and 2009)3 related to audit firms and their performance of client acceptance and
continuance procedures. The reviews findings with respect to client acceptance and
continuance included, among other things, matters related to the completeness of documentation,
timeliness of performance of acceptance and continuance considerations and audit team
competency.
Both in response to this and the key role well-developed client acceptance or continuance
procedures play in the overall quality of an audit, the TAC has undertaken to explore current
practice among members of the Forum of Firms. This good practice paper has been prepared
based on the input of 14 Forum members, representing international networks of varying sizes.
Where necessary, Forum members granted interviews and supplied background materials which
have been summarized in this paper on a non-attributed basis.
The TAC believes this paper will be a valuable tool for audit firms of all sizes, in developing and
evolving their policies on client acceptance and continuance, thereby demonstrating their
ongoing commitment to enhancing audit quality.
Due to the variety of sources used to compile this paper, a number of different terms are used to describe the
relevant organization. There is no intent to be either consistent or prescriptive in the usage of terms such as
Firms, members, networks, organizations, etc. Such terms should be interpreted in their customary meaning and
in the particular context.
Introduction
Why are client acceptance and continuance policies and procedures so important and
relevant to audit firms?
As discussed in a publication issued by the TAC entitled Tone at the Top and Audit Quality,
Firms note that quality is viewed as a requirement in everything that they do. Notably, quality is
identified as being an essential component of a firms reputation and a prerequisite for a firms survival
and growth.4
From an audit engagement perspective, the absence of a genuine joint commitment to optimal
quality can lead to difficult auditor-client relationships, severe damage to the firms professional
reputation and the profession generally and ultimately to a loss of public confidence. Possessing
as much information as necessary to make an informed assessment about the acceptability of the
potential client and the ability of the audit firm to perform a quality audit helps ensure the
relationship is as beneficial as can befor both the auditor and the client. Bottom line, its just
makes good sense.
As noted in a publication from the American Institute of Certified Public Accountants:
Prudent risk management requires that a firm know as much as possible about what will be involved
with a new client relationship or engagement before the agreement is in place. Not having made a
diligent risk assessment by performing timely client and engagement acceptance procedures almost
guarantees that surprises will follow. And, the result may not only involve an unplanned relationship
termination but could also include significant professional liability issues and concerns. 6
Transnational Auditors Committee, Tone at the Top and Audit Quality, December 2007, Page 10
Ibid, page 12
McFadden, John E, Client and Engagement Acceptance: Only a Public Company Audit Service Concern? The
Practicing CPA, July-August 2003, Volume 27, Number 6
5
Approach
There are several standards published by the International Auditing and Assurance Standards
Board (IAASB) which address client acceptance and continuance. These are:
International Standard on Quality Control (ISQC) 1, Quality Control for Firms that Perform
Audits and Reviews of Financial Statements, and Other Assurance, and Related Services
Engagements;7 and
International Standard on Auditing 220, Quality Control for an Audit of Financial Statements
Further, with respect to the audits of group financial statements, the IAASB has issued:
International Standard on Auditing 600: Special ConsiderationsAudits of Group Financial
Statements (Including the Work of Component Auditors).
Members of the Forum of Firms have committed8 to maintaining appropriate quality control
standards in accordance with ISQC 1 and, through their commitment to having policies that comply
with the ISAs, in accordance with ISA 220 and 600. The latter standards address acceptance and
continuance requirements at the engagement level rather than the firm level, but of course those
requirements fit within the firms overall quality control processes. As such, for convenience, the
requirements particularly of ISQC 19 provide much of the structure in this paper. ISQC 1 states:
26.
27.
The firm shall establish policies and procedures for the acceptance and continuance of client relationships
and specific engagements, designed to provide the firm with reasonable assurance that it will only undertake
or continue relationships and engagements where the firm:
(a)
Is competent to perform the engagement and has the capabilities, including time and resources,
to do so; (Ref: Para. A18, A23)
(b)
(c)
Has considered the integrity of the client, and does not have information that would lead it to
conclude that the client lacks integrity. (Ref: Para. A19-A20, A23)
The firm to obtain such information as it considers necessary in the circumstances before accepting an
engagement with a new client, when deciding whether to continue an existing engagement, and when
considering acceptance of a new engagement with an existing client. (Ref: Para. A21, A23)
(b)
(c)
If issues have been identified, and the firm decides to accept or continue the client relationship or
a specific engagement, the firm to document how the issues were resolved.
ISQC 1, effective December 15, 2009 (clarified ISQC 1) will be referred to throughout this document, given
that upon publication of this paper this will be the version to be complied with. At the time this paper was
developed participating networks were at differing stages of implementing clarified ISQC 1 into their
methodologies. However, given that the client acceptance and continuance dispositions of the clarified ISQC 1
are identical to those in the extant version, other than for the adoption of the clarity conventions, it is felt that
this has no impact on the appropriateness of the material presented in this paper (see appendix 3 for a
comparison). For the purposes of this paper, clarified ISQC 1 has been used as the basis for this papers format,
references and consideration of materials provided by participating networks.
28.
The firm shall establish policies and procedures on continuing an engagement and the client relationship,
addressing the circumstances where the firm obtains information that would have caused it to decline the
engagement had that information been available earlier. Such policies and procedures shall include
consideration of:
(a)
The professional and legal responsibilities that apply to the circumstances, including whether
there is a requirement for the firm to report to the person or persons who made the appointment
or, in some cases, to regulatory authorities; and
(b)
The possibility of withdrawing from the engagement or from both the engagement and the client
relationship. (Ref: Para. A22-23)
1.
Client Acceptance
A.
ISQC 1s paragraph 26(c) notes the need for considering the integrity of the client, and that the firm
does not have information that would lead it to conclude that the client lacks integrity. While
considering client integrity was not noted as a general issue in the TACs review of inspection
reports, one oversight body (Canada) did raise some specific recommendations about the need for the
performance and documentation of an assessment of management and board integrity and reputation.
Further, another recommendation was the need to develop policies for communicating with
predecessor auditors to ascertain whether there are circumstances the firm should take into account in
deciding whether to accept the engagement.
In reviewing the practices and procedures of participating networks for this paper, it was highlighted
in one networks policies that The personal characteristics, philosophy and operating style of the
individuals who comprise an entitys management have a significant influence on the entity as a
whole. The integrity of management and principal owners of an entity is fundamental to the Member
Firms ability to provide professional services and is a key consideration in the assessment of client
risk and, thus, Engagement Risk.
Further, If the Member Firm has reason to question the integrity of the management or principal
owners of a prospective or existing Client and they do not meet an acceptable standard of integrity,
the Member Firm would ordinarily not accept or continue to be associated with the entity, because
the Engagement Risk would be increased beyond an acceptable limit.
These sentiments are representative of the theme throughout all the policies considered in relation to
client integrity. As such, of the 14 networks reviewed, policies and procedures relating to client
integrity (and related to this, the clients industry and operating environment) receive the greatest
degree of focus in forming a conclusion on whether or not to accept or continue with a client.
However, the volume of emphasis and extent of the policies and procedures associated with
establishing client integrity varies considerably across the networks reviewed principally as a
function of size.
It is worth noting that ISQC 1 paragraphs A19-A20 and A23 (A23 focuses on the public sector10)
discusses guidance in support of 26(c) of ISQC 1providing further potentially useful material
10
A23 states: In the public sector, auditors may be appointed in accordance with statutory procedures. Accordingly,
certain of the requirements and considerations regarding the acceptance and continuance of client relationships and
specific engagements as set out paragraphs 26-28 and A18-A22 may not be relevant. Nonetheless, establishing
7
for networks when considering their related policies and procedures. To varying degrees, the
networks reviewed do pick up on the themes listed within A1911 (A20 discussed later).
The illustrative checklist below presents an overall aggregation of questions and matters considered
by the networks12 reviewed to assist them in their determination of client integrity.13 While
mentioned in the checklist below, it should be noted that firms in some jurisdictions are required to
implement extensive procedures to deal with regulations relating to e.g. money laundering, which is
also relevant in the context of knowing the client and client acceptance and continuance.
11
12
13
policies and procedures as described may provide valuable information to public sector auditors in performing risk
assessments and in carrying out reporting responsibilities.
See Appendix 6 for the contents of A19.
In the case of small and medium size practices and clients a reduced checklist could be used to ensure a cost effective
approach that covers all the requirements of the ISAs and ISQC 1.
As can be seen, certain questions and matters in the checklist relate to general risk management concerns (possibility
of a public offering, reliance on other auditors, financial and going concern considerations, etc.) rather than being
specifically related to client integrity. We have chosen to include these questions since, although they may not
respond to specific requirements of ISQC 1 or ISAs, they are clearly matters which Firms need to address in deciding
whether to accept an engagement and, if present, they would certainly have an impact on audit planning activities.
However, it is not the purpose of this paper to address risk management policies and procedures in other respects.
General Information
Response
CEO
CFO
Other
Lawyers
Bankers
Previous Auditor
Entity Financial Information
X1
X0
Total Assets
Current Liabilities
Long Term Liabilities
Working Capital
Equity
Cash Flows from Operations
Revenue
Net Income
What accounting standards are to be applied
to the engagement (international, domestic,
other)?
What auditing standards are to be applied to
the engagement (international, domestic,
other)?
Yes/
No
Are there any planned transactions within the next
year in which the engagement results may be used:
Any Initial Public Offering of any form of
securities in any markets?
Private offering of any form of securities in
cross-border markets?
Other private transaction where a duty-of-care
is expected to be established?
Sale or merger of the entity/net assets?
Will there be reliance on the work of other auditors
for a substantial portion of the engagement?
Will the other auditor be a non-Network Firm?
Will the other Firm be registered with a regulatory body?
Identity and Business Reputation of the Clients
Principal Owners, Key Management, and Those
Charged with its Governance
Do we have any concerns identifying ownership, key
management or those charged with governance?
Is there domination of key management by one/few
individuals?
Do we have concerns regarding managements
competence? Matters to consider include:
Experience
Skill (e.g.: effective budget preparation and
monitoring)
Depth
Background (e.g.: criminal convictions)
10
11
12
13
14
Overall Assessment
Does the integrity of the entity, its principal owners,
key management, or those charged with its
governance create an unacceptable risk?
Please rate the client risk?
(Where applicable) Does the Firms Risk Specialist
agree with plans to reduce risks to an acceptable
level? (document in the working file)
Having access to sufficient sources of information or most appropriate persons within the entity
to enable a thorough assessment
Full and open access to key personnel and information within the prospective client is desirable to
enable gaining necessary client knowledge and aiding an assessment of the clients/management
integrity. To assist in this respect, the Networks provided some practical insights, as follows:
Access to all the relevant resources within a potential client to enable a thorough assessment
can never be guaranteed for every engagement being considered. However, the onus is on the
Firm to maximize their contact with the prospective client in order to obtain as much
information as possible.
The critical nature of these assessments in the context of overall risk management should be
emphasized. Getting to know and better understand the client is a key component of the
assessment and one that generally also enables the provision of a higher quality service by
the Network. As such, it is mutually beneficial for the entity to be as open and transparent as
possible about itself and its operations.
One Network highlighted that an indication that the client is not willingly providing
information to assist with the assessment could be viewed as an indicator of higher risk.
Dependent upon the nature of the entitys actions, this may justify engaging the advice and
guidance of the Firms risk management specialists.
Many of the Networks highlighted that there are numerous avenues open to the auditor
beyond direct client contact to enable the assessment to be made and that these could be
pursued in support of (and to verify) representations made by the entity. Discussions with the
prior auditor, lawyers, and other service providers as well as researching publicly available
information are all avenues that could be pursued (further discussion provided below).
Related to this is the use of in-house or third party research and investigation services to
assist in performing background checks and seeking credible evidence to corroborate other
aspects of an informed assessment.
Sources of information to assist in determining client integrity
Paragraph A20 of ISQC 1 provides the following guidance on sources of information that could
be used to assist the Firm in performing an assessment as to client integrity.
15
Communications with existing or previous providers of professional accountancy services to the client
in accordance with relevant ethical requirements, and discussions with other third parties.
Inquiry of other Firm personnel or third parties such as bankers, legal counsel and industry peers.
Background searches of relevant databases.
These suggested sources are, not surprisingly, referenced by most of the Networks reviewed.
One Network notes however that, in relation to the performance of background checks, this may
be of a sensitive nature in some jurisdictions. As such each Firm should establish policies and
guidance for (1) the collection and confidentiality of background information obtained in
performing the checks and (2) the documentation and retention of such information. Each Firm
should establish that the policies and procedures comply with local laws.
Networks note that background checks may be performed using both publicly available information
sources and non-publicly available information sources, as appropriate. The extent of the procedures
performed and data obtained will depend on the specific circumstances of the entity (e.g., public
interest entities versus nonpublic interest entities) and the regulatory and legal environment in which
the check is to be performed but could also include one or more of the following:
Information obtained from sources inside the Firm:
o
Audit partner knowledge of the entity and its Principal Officers/Owners based on
prior professional or personal relationships
Discussions with Partners within the Firm who have had professional or personal
experiences with the entity and its Principal Officers/Owners
Inquiries of third parties who may have knowledge of the individuals and/or entities.
Third parties could include individuals in the business community, lawyers, bankers,
industry leaders, or others.
Public databases
Regulatory filings
Newspapers
Published articles
We will see later that such knowledge is consequently a key element in the context of client
continuance decisions.
16
B.
While paragraph 26(c) focuses on determining client integrity, paragraph 26(a) of ISQC 1
focuses on the need for the Firm to ensure it is in fact competent to perform the engagement in
the first place and has the capabilities, including time and resources, to do so. The need to have
the necessary competence under paragraph 26(a) is supported by paragraph A1814 providing
further guidance which Networks could find useful in considering their policies and procedures
as they relate to competence.
The TACs review of external inspection reports did note a couple of issues specifically related
to determining competency. One finding (more in relation to continuance) was that a few Firms
were not assessing whether they have the language capability to perform an audit when key
evidence is in a foreign language. A further recommendation was to require an assessment of
whether the Firm/engagement team has the necessary linguistic skills and that additional training
be provided on the need to consider and document whether the engagement team has the
requisite skills to conduct the engagement.
Key to enabling a meaningful determination of the Networks competency is a thorough
understanding of the entity and its industry. As such, a necessary component of competency
considerations are questions associated with knowledge of the client, which can be noted in
several of the questions used in the illustrative checklist to assist in determining client integrity.
Indicators that extra consideration needs to be given to the competencies within the Network to
perform the engagement to the necessary quality are as follows:
Complexity of the entitys structure
Complexity of the entitys transactions, or transactions for which the related accounting is
complex, emerging or subject to significant professional judgment/interpretation
Entity involvement with off-shore transactions
Complex tax arrangements
Entities operating within specialized industries such as banking/finance/insurance, real
estate/construction, gaming/gambling, government/public sector enterprises, leasing,
agriculture, etc.
An entity which is (or is a significant component of) a public interest entity
Armed with a solid foundation of client knowledge, the Networks reviewed asked questions in the
following areas to further determine their competency to undertake the engagementagain, as with
client integrity, presented as an illustrative checklist.
14
Response
Yes/
No
Does the entity have operations in any of the following
high risk industries or portfolios?
Banks, financial institutions
Insurance providers
Mutual funds
Gambling/gaming
Brokers/dealers
Real estate/construction
Leasing
Public sector not-for-profit
High litigation industries
Software development
Sport franchises
Businesses with going concern issues
Does the entity recognize revenue applying complex
or evolving accounting conventions?
Does the entity have significant activities related to
any of the following areas:
Acquisition accounting
18
Response
Reorganization
Restructuring charges
Self-insurance
Use of derivatives
Debt covenants
Other
Will the engagement require the use of work of
experts?
Are there any concerns regarding the availability of
professional staff to enable completion of the
engagement to a both a quality standard and in a
timely manner?
Are there any concerns regarding the partner and staff
having sufficient knowledge and experience for the
engagement?
Are there any matters related to staffing the
engagement which would indicate that the engagement
should not be accepted or why such acceptance needs
to be considered by a second partner or head of
specialization?
Are any special licenses or permits or approvals
required for our staff to carry-out the engagement in
the jurisdiction where the work will be performed?
Overall Assessment
Does the engagement team, including appropriate
industry and specialty experts who will be part of the
team, have the relevant experience and competence
and sufficient available time to:
Address the primary and other industries noted
above?
Address any risks or issues noted in the above?
Reduce any competency risks associated with the
engagement to an acceptable level?
19
Paragraph 26(b) of ISQC 1 requires that the Firm have policies and procedures to ensure
compliance with relevant ethical requirements. This is supported by further extensive discussion
within ISQC 1, notably paragraphs 2025 which is further supported by explanatory paragraphs
A7A17. The explanatory paragraphs outline the key principles and tenets of the International
Ethics Standards Board for Accountants Code of Ethics (IESBA Code):15
Integrity
Objectivity
Professional Competence and Due Care
Confidentiality
Professional Behavior
Ethical requirements, and more specifically, independence, was an issue noted in the TACs
review of inspection reports. One comment noted the general lack of rigor in some of the Firms
which included failing to consult personnel prior to accepting engagements to determine if there
were any independence concerns.
15
20
At the time this paper was developed, the IESBA Code (revised July 2000the revised Code) was not yet
effective (effective from January 1, 2011). As such, material provided by Networks participating in the
development of this paper would not have necessarily reflected all revisions to the Code. IESBA staff have
prepared materials to support implementation of the revised Code including comparative analysis between the
current code and the revised code. See http://www.ifac.org/Ethics/Resources.php#implementation-and-adoption
The Networks reviewed for this paper place significant focus on identifying issues associated
with independence and conflict of interest. The checklist below illustrates the types of enquiries
made by the Networks in this respect.
Yes/
No
Give detail
21
Yes/
No
Yes/
No
implementation
Executive recruiting
Contingent fee arrangements
Limitation of liability arrangements
Does the entitys audit committee have any issue
regarding this engagement?
Does the Firm have any issues with respect to meeting
the independence rules of other regulatory bodies?
Is the Firm aware of any other possible issues which
require the need for further research about our
independence or the need for further consultation
with an Independence Specialist?
Is the entity subject to SEC or regulatory rules?
Is there actual or threatened significant
disputes/litigation involving the entity and the Firm?
Does this engagement involve a limitation of liability?
Is the Firm providing litigation support or dispute
analysis services to another client that might be
considered to be in conflict with the interests of this
entity?
Overall Assessment
Will acceptance of this engagement create an
independence violation?
Will acceptance of this engagement create a conflict of
interest?
Please rate the independence risk?
23
24
(a)
(b)
Accept other prospective engagements where they could not do so in the absence of such
safeguards. These safeguards would ordinarily include but are not limited to the following:
(i)
subject to entity and other confidentiality obligations, disclosing the facts and
circumstances of the conflict to the entities concerned (understanding any entityimposed confidentiality requirements and obtain consent, as appropriate);
(ii)
After obtaining consents from the parties concerned, the Network highlights that the following
safeguards would ordinarily be considered:
Using entirely separate engagement teams to serve each respective client;
Establishing effective ethical walls and confidentiality safeguards, such as information and
physical barriers separating engagement teams designed to prevent the sharing of confidential
information;
Information technology safeguards such as passwords, limited network access, and separate
printers and fax machines; and
Instructing individuals on the engagement team, including administrative personnel who assist
the engagement team on the importance of maintaining confidentiality, including custody of
client documents and communication protocols, such as restricting discussion to those who
need-to-know.
However, the Network further notes that not all conflicts can be waived by a client and/or
managed by implementing safeguards. As such, if they are unable to implement appropriate
safeguards to manage a conflict, the prospective engagement should be declined.
D.
25
All client acceptance assessments must include Partner level involvement as a minimum
(involvement of the Audit Manager is also noted by some Networks). While the need for
Partner level involvement was consistent across Networks, the nature of who the Partner
could be varied from the Recommending Partner to the prospective Engagement Partner;
The need for second/additional Partner involvement (and concurrence) was also commonly
noted with the need for their participation required across a range of risk thresholds varying
from when engagement risk was assessed from normal to high;
Where the assessment is being made within an industry for which an industry/sector
specialist exists, then the input of the specialist should be sought in particular in instances
involving a risk assessment beyond normal;
Should the engagement risk be above normal, then there is a need to involve and gain the
concurrence of more specialized Firm personnel. The title of those to be consulted varied, but
could be characterized as the local Firms audit risk specialist (or person of equivalent
role)/specialist for quality control; and
If the risk is considered extremely high, then involvement of the Firms country level audit
risk specialist/head of risk management should be sought. The existence of a National
Committee was also noted to assist in reviewing potentially higher risk clients.
Documentation
ISQC 1 contains requirements specifically with respect to documentation. Paragraph 27 (c) notes:
If issues have been identified, and the Firm decides to accept or continue the client relationship or a
specific engagement, the Firm (shall) document how the issues were resolved.
Documentation in general with respect to client acceptance and continuance was an area for which
the TACs review of external quality assurance reports indicated was a notable issuean absence of
recording within the audit file corresponding to a lack of documented evidence.
As noted in the South African review report:
While quality audit work was evident throughout our reviews, we continue to identify a number of
instances where engagement files do not adequately comply with the professional standards in relation to
documentation. The requirement for the auditor to document matters providing evidence to support the
audit opinion has existed for many years and the lack of such documentation remains unacceptable.
Further, reviews performed by the PCAOB in the US noted several instances where the broader more
general issue of adequacy of documentation associated with several review findings was also evident.
In developing this paper, one of the Networks highlighted, more with respect to client continuance
considerations, that the thorough documentation of thought processes can be a challenge. While all
the necessary considerations may have taken place and rationale determined in deciding on the future
relationship with a client, ensuring all those thought-processes are actually documented in the audit
file can be an issue.
26
To assist ensuring that all aspects of the Networks client acceptance and continuance policies are
addressed and documented, all Networks employ checklists. The use of software applications to
assist in the completion of such checklists can be an added feature.
Where the use of electronic checklists is available, this can not only enhance documentation but also
be a useful tool for risk assessment purposes. As noted in some Networks, each individual question
can be linked to a related numeric risk indicator and assist in forming the overall risk assessment for
that particular client the general idea being the client achieves a risk score, different scores
contributing to (but not determining) the final assessment of risk associated with that client. The
score can then be subsequently reduced by the nature of any risk mitigating solutions implemented.
Timing of Procedures Associated With Client Acceptance
As with documentation, the timing of completion of acceptance and continuance procedures was
also a key finding in the TACs review of external inspection reports. Some comments were:
In some situations, the detailed consideration of the factors affecting a decision to continue
an existing client audit relationship normally occurs after the Firm has been appointed as
auditor at the clients Annual General Meeting (AGM), but before detailed audit planning
commences. In some cases, the continuance procedures may not be documented until well
after the completion of the planning phase (Canada).
Across most Firms, we continue to note deficiencies in thetiming of issuance of engagement
letters, for both new clients and new services to existing clients, before completing the relevant
continuance or acceptance processes. (Australia).
Networks emphasized that it was important for client acceptance evaluations to be completed before
proposing or committing to accept the engagement. Further, they highlighted that in situations where
all necessary procedures have not been completed, consideration should be given to disclosing that
the Firms proposal or commitment to perform the engagement is subject to satisfactory completion
of engagement acceptance procedures.
Once acceptance procedures have been completed, the general requirement amongst the Networks is
that only continuance procedures need be subsequently used, though it was noted that at least one
Network does require that once a client has been accepted, re-performance of the complete client
acceptance process be carried out at least once every five years over and above the usual annual
client continuance assessment.
One Network acknowledged that client acceptance requirements not being completed before starting
an engagement may have been an issue some years ago but was seemingly not a significant problem
area today. To help reach this level of compliance the Network had implemented, as a key part of
their corporate climate, a strong element of training to emphasize the risks associated with not
completing required procedures within the appropriate timeframe and the accountability of staff for
not doing so.
Despite this it was acknowledged by some Networks that timely performance of acceptance
procedures can still pose difficulties in practice. As such, some Networks have adopted tools to
assist in ensuring that such departures from policy are minimized. Practical steps that Networks
could consider to reduce the likelihood of timing issues include:
27
In those parts of the business where these types of issues arise, ensuring that a dedicated
resource is available to assist in the quick completion of the acceptance process; and
Ensuring there is frequent communication between the Quality Assurance function and the
engagement partners to ensure at least an established minimum threshold of procedures is
completed on time. If not fully completed within 30 days after a job coding has been created,
a policy requirement that the engagement must be suspended.
Generic, Sector-Specific and SME Policies and Procedures
While many of the Networks reviewed have more of a one size fits all approach to their acceptance
and continuance policies and related questionnaires, some Networks have invested in the
development of industry specific client acceptance toolsfocusing in on the key risk areas
associated with that particular sector which should be given special consideration in determining
client acceptance.
An approach used by one Network is the development of global template assessment forms which
differ by industry and can be tailored by each territory for local purposes. At this Network, there are
several assessment forms ranging from industry specific forms for bank and capital market clients to
generic forms (intended for consumer & industrial products, manufacturing, and technology industry
clients). In providing these sector-specific forms, the Network emphasizes that the underlying client
acceptance and continuance policies are the same across all industries.
A further approach to tailoring policies and procedures at one Network is the issuance of specific
guidance documents in response to industries experiencing heightened risk. This Network has
issued, for example, acceptance/re-acceptance guidance specifically for the financial industry,
given recent developments in that industry.
Tailored policies and procedures for smaller lower risk clients is an area of growing interest for
several Networks reviewed. A couple of Networks do provide for a simplified process for
assessing acceptance although, as with the industry specific templates discussed above, the
underlying acceptance policies in relation to that assessment are no different to the regular
generic acceptance assessments. One Network noted that their procedures are currently designed
to address all acceptances but theoretically, in an SME context, would be quicker to complete
with less elevated sign-off where the business is simpler in nature.
2.
Client Continuance
Common across the Networks reviewed is that the general themes underlying considerations for
determining client continuance are essentially the same as those applied in determining client
acceptance. Central to the continuance assessment is an evaluation of new or changed potential risks
of association with the client.
As noted by one Network, the Partners on the engagement should be alert to and monitor changes in
factors and conditions occurring during the engagement that could negatively impact the initial
assessment of engagement risk. Of the Networks reviewed this would particularly include monitoring
of changes associated with:
Principal decision makers, directors and officers, or owners;
Financial condition;
28
Industry and business environment issues that increase risk (e.g. economic trends, inflation or
deflation, industry consolidation, litigation, regulatory environment, expansion into new areas
of business);
Auditor-client relationship; and
Business and reputation of the client.
Where changes are considered significant, then consideration is given as to whether the significance
of the change justifies a complete reassessment of the client using a Networks more detailed
acceptance questionnaire. One Network highlights that this is an approach required in those
circumstances where an existing private audit client is considering going public, or where an existing
audit client is acquiring, or is being acquired by an entity that is public.
In reviewing the checklists of the participating Networks, the following were noted as areas of
enquiry focused more specifically on continuance, presented below as an illustrative checklist:
Client Continuance
Yes/
No
29
Client Continuance
Yes/
No
30
The professional and legal responsibilities that apply to the circumstances, including
whether there is a requirement to report to those who made the appointment or, in some
cases, to regulatory authorities; and
(b)
The possibility of withdrawing from the engagement or from both the engagement and the
client relationship.
This is supported by paragraphs A22A2316 which highlight that those policies and procedures
address issues that include the following:
Discussing with the appropriate level of the clients management and those charged with its
governance the appropriate action that the Firm might take based on the relevant facts and
circumstances.
If the Firm determines that it is appropriate to withdraw, discussing with the appropriate level
of the clients management and those charged with its governance withdrawal from the
engagement or from both the engagement and the client relationship, and the reasons for the
withdrawal.
Considering whether there is a professional, legal or regulatory requirement for the Firm to
remain in place, or for the Firm to report the withdrawal from the engagement, or from both the
engagement and the client relationship, together with the reasons for the withdrawal, to
regulatory authorities.
Documenting significant matters, consultations, conclusions and the basis for the conclusions.
Some additional requirements noted in reviewing the Networks were the need to give consideration
to:
Seeking legal counsel where warranted by the circumstances; and
At a minimum, seeking the concurrence of the Risk Specialist/Partner. In addition, concurrence
of the Firms Assurance Leader can also be required.
With particular respect to international engagements, it was noted:
communicate, if permissible, with the participating Firms as to the implications of
withdrawing; and
where applicable, consulting with the referring member Firm before reaching a final decision.
If the termination is being driven by the discovery of a conflict, an option noted was that subject
to local laws, giving consideration to obtaining an engagement letter with terms that provide the
right to terminate an engagement in the event that a conflict arises that cannot be resolved.
However, it was noted that in some circumstances, it may be possible to continue with the
engagement by disclosing the conflict to the client and obtaining the clients waiver or consent to
continuance of the engagement by adopting other safeguards as appropriate.
16
Country
Name of Report
Australia
Canada
Hong Kong
Japan
Singapore
South Africa
United Kingdom
32
United States
33
ISQC 1
(a)
(b)
(c)
(c)
28
(a)
(b)
(c)
28
34
(a)
Clarified ISQC 1
Effective December 15, 2009
ISQC 1
(a)
(a)
(b)
Clarified ISQC 1
Effective December 15, 2009
ISQC 1
Clarified ISQC 1
Effective December 15, 2009
ISQC 1
Considerations Specific to
Organizations (Ref: Para. 26-28)
Public
Sector
Audit
37
2.
Have policies and methodologies for the conduct of such audits that are based, to the extent
practicable, on ISAs
3.
Have policies and methodologies which conform to the IESBA Code of Ethics for
Professional Accountants and national codes of ethics.
38
The engagement partner shall be satisfied that appropriate procedures regarding the acceptance
and continuance of client relationships and audit engagements have been followed, and shall
determine that conclusions reached in this regard are appropriate. (Ref: Para. A8-A9)
13.
If the engagement partner obtains information that would have caused the Firm to decline the
audit engagement had that information been available earlier, the engagement partner shall
communicate that information promptly to the Firm, so that the Firm and the engagement partner
can take the necessary action. (Ref: Para. A9)
ISA 600:
With respect to client acceptance and continuance, ISA 600 states:
12.
In applying ISA 220, the group engagement partner shall determine whether sufficient
appropriate audit evidence can reasonably be expected to be obtained in relation to the
consolidation process and the financial information of the components on which to base the group
audit opinion. For this purpose, the group engagement team shall obtain an understanding of the
group, its components, and their environments that is sufficient to identify components that are
likely to be significant components. Where component auditors will perform work on the
financial information of such components, the group engagement partner shall evaluate whether
the group engagement team will be able to be involved in the work of those component auditors
to the extent necessary to obtain sufficient appropriate audit evidence. (Ref: Para. A10A12)
13.
it will not be possible for the group engagement team to obtain sufficient appropriate audit
evidence due to restrictions imposed by group management; and
(b)
the possible effect of this inability will result in a disclaimer of opinion on the group financial
statements,17
the group engagement partner shall either:
(a)
in the case of a new engagement, not accept the engagement, or, in the case of a continuing
engagement, withdraw from the engagement, where withdrawal is possible under applicable law
or regulation; or
(b)
where law or regulation prohibits an auditor from declining an engagement or where withdrawal
from an engagement is not otherwise possible, having performed the audit of the group financial
statements to the extent possible, disclaim an opinion on the group financial statements. (Ref:
Para. A13A19)
Terms of Engagement
14.
The group engagement partner shall agree on the terms of the group audit engagement in
accordance with ISA 210.18 (Ref: Para. A20A21)
17
18
40
41