Meeting Audit Standards in Practice Audit Evidence and Managed Platform Investments November 2016 Sharlene Anderson Director Veritas Corp PH: 1300 189 963 Email: info@veritascorp.com.au
Disclaimer This paper represents the opinion of the author(s) and not necessarily those of CaseWare Australia and New Zealand. The contents are for general information only. They are not intended as professional advice. Veritas Corp expressly disclaims all liability for any loss or damage arising from reliance upon any information in this paper. Veritas Corp, November 2016 2
Contents INTRODUCTION... Error! Bookmark not defined. AUDITING STANDARDS COMPLIANCE... Error! Bookmark not defined. AUTHORITY FOR APPLICATION OF AUDIT STANDARDS FOR SMSF AUDITS... Error! Bookmark not defined. CLIENT ENGAGEMENT ASA 210, 220, ASAE 3000 & 3100 Error! Bookmark not defined. INDEPENDENCE... Error! Bookmark not defined. CHINESE WALLS... Error! Bookmark not defined. REFERRALS AND INDEPENDENCE... Error! Bookmark not defined. VALUATION ADVICE BY AUDITOR AND INDEPENDENCE... Error! Bookmark not defined. AUDIT PLANNING ASA 300, ASAE 3000 & 3100... Error! Bookmark not defined. RISK ASSESSMENT ASA 315 & ASAE 3100. Error! Bookmark not defined. PERFORMING THE AUDIT AUDIT EVIDENCE... 4 EXTERNAL CONFIRMATIONS ASA 505... 6 MANAGED PLATFORMS ASA 402... 7 References... 12 3
PERFORMING THE AUDIT AUDIT EVIDENCE During the performance of the audit the auditor obtains sufficient appropriate audit evidence on which to base the opinion for both Parts A and B of the audit report. Sufficiency is the measure of the quantity of evidence, which is affected by the risk of misstatement, the higher the risk the more evidence is likely to be required. Appropriateness is the measure of the quality of evidence, that is, its relevance and its reliability, the higher the quality the less evidence may be required. The auditor considers the relationship between the cost of obtained evidence and the usefulness of the information obtained. ASA 230 Audit Documentation, ASAE 3000 and ASAE 3100 all require the auditor to document the evidence obtained for the basis of the auditor s report. Insufficient Audit Evidence: Examples The following are examples of an audit file that contains insufficient audit evidence to support an unqualified audit opinion. Example 1 Signed Trustee Declaration has not been obtained S35B of SISA requires the fund accounts to be signed by the sole director of a corporate trustee or at least two directors / trustees as applicable. This section is part of the relevant criteria in the standard ATO audit report. The Auditor can not confirm compliance with S35B without evidencing an appropriately signed Trustee Declaration. Example 2 No company search for corporate trustee Where a fund has a corporate trustee and the auditor has not sighted a company search or company statement confirming registered directors we would consider the auditor has insufficient evidence to support a conclusion on compliance with section 17A of SISA. Whilst we accept there is legal basis for a person to be a company director without ASIC registration when that person holds themselves out as a director, it is the company search that would be the most appropriate evidence. A company search is also the only way to determine that 4
there are no non-member directors (breach of section 17A other than in single member funds or legal personal representative exceptions). Example 3 Audit file includes only the last bank statement for the year audited This represents insufficient evidence to base an opinion on completeness and occurrence of transactions at Part A of the audit report or to base an opinion on Part B compliance including sections 65 (financial assistance to members), 67 (borrowing), 109 (arm s length transactions) and regulations 1.06 (pension limits), 4.09A (separation of assets), 6.17 (access to benefits) and 7.04 (acceptance of contributions). At minimum an adequate sample of the bank statements should be on the file. We would suggest that due to the compliance nature of the audit that all bank statements should be evidenced. The evidence must be documented in the audit file and therefore cannot merely be sighted and then destroyed or returned to the client. Example 4 No title search for fund investment in real property Without a title search dated post 30 June of the year of audit the auditor can not confirm existence and ownership at 30 June for Part A of the audit report or confirm compliance at Part B of the audit report with for example section 65 (financial assistance to members) and regulation 4.09A (separation of assets). The file may have historical evidence that the property was acquired correctly in the name of the fund but without the title search continued ownership is not evidenced. Whilst it is unlikely that a property would be sold without being accounted for and the proceeds either retained by the trustees or reinvested in alternate assets evidence that this has not occurred must be obtained. Property will normally represent a material or substantial asset in the fund. The title search will also evidence that a mortgage has not been given over the fund to enable the auditor to base the opinion for compliance with regulation 13.14 (charges over assets). Example 5 Material term deposit supported by renewal notice dated during the year of audit A fund may have a term deposit which, for example, is renewed in the month of May during the audit year. The auditor has documented this renewal notice confirming that the deposit was renewed for a term of 6 months to mature in November subsequent to the audit year. Such a notice does not of itself confirm existence and ownership at 30 June as it is possible, however unlikely, that the deposit has been prematurely terminated and the monies retained 5
by the trustees or perhaps even invested in alternative investments for the fund. Accordingly, the file does not have sufficient evidence to confirm existence an ownership at 30 June for Part A of the audit report or compliance at Part B including for example sections 65 (financial assistance to members), section 67 (borrowings, potentially more funds could have been added to the deposit) and regulation 4.09A (separation of assets). The additional evidence required by the auditor would be at minimum evidence of existence and ownership at 30 June such as the subsequent November maturity notice. However, given the risk associated with cash investments and the materiality of the investment an external confirmation in the form of a Bank Audit Certificate would be considered most appropriate. External confirmations are discussed below. Example 6 Bank audit Certificate not obtained for a material bank account Sufficient appropriate evidence is a matter of judgment by the auditor. The auditor may decide that copies of bank statements received from the trustees are adequate evidence. However, if called upon to defend your audit file, would you feel comfortable explaining an external Bank Audit Certificate was not obtained because it s too hard, takes too long or trustees object to bank fees? The discussion on external confirmations is continued below. EXTERNAL CONFIRMATIONS ASA 505 To obtain sufficient appropriate audit evidence, the auditor may be required to communicate with a number of external third parties, typically banks and solicitors. The timing of this communication should be coordinated so that all information can be assessed before forming an audit opinion on the financial statements. The need to obtain external confirmations is not prescribed and as such in practice there is considerable debate over when they should be obtained. However, guidance can be drawn from other audit standards. ASA 500 Audit Evidence indicates that the reliability of audit evidence is influenced by its source and nature. The standard generalizes that evidence will be more reliable when obtained from an independent source and when it is obtained directly by the auditor. 6
ASA 330 The Auditor s response to assessed risks requires the auditor to consider whether external confirmations are to be performed and to perform substantive procedures (such as external confirmations) that are specifically responsive to significant risks of misstatement. ASAE 3100 also expressly reminds auditors that difficulty or expense involved is not a valid basis for omitting an evidence gathering procedure for which there is no alternative. It may be considered that obtaining a copy of the bank statement is an alternative to obtaining a direct bank confirmation. However, it must be understood that all the fund members are users of the audit report and information asymmetry may well exist between them. Examples have been seen where one of the member trustees is unaware of the actions of another. Given the inherent risk associated with cash investments by the fund being easily accessed by members and potentially subject to fraud by other parties the auditor must seriously consider directly obtaining a Bank Audit Certificate for material accounts as the most reliable audit evidence. If completed fully, a Bank Audit Certificate will also confirm whether the investment is encumbered (used as security by another party) and also include all other accounts held by the fund that may not be disclosed in the financials (we have seen instances where trustees forgot to tell the accountant about contributions made directly to a new term deposit or bank account). MANAGED PLATFORMS ASA 402 It is common practice for SMSF s to invest with a managed platform provider. The provider will typically provide quarterly and annual reports to the trustees disclosing transactions and the period end balances. For the purpose of the audit standards the provider is a service organization and ASA 402 Auditing Considerations Relating to an Entity Using a Service Organization is the relevant standard. ASA 402 deals with the auditor s responsibility to obtain sufficient appropriate audit evidence. It expands on how the auditor applies ASA 315 and ASA 330 in obtaining an understanding of the fund including internal control. It does not apply to services provided that are limited to processing transactions authorised by trustees such as cheque account transactions by a bank or security transactions by a broker. 7
Essentially, the auditor must determine whether the report provided to the trustees by the service provider is free from material misstatement as the figures from the report will be included in the fund financial statements. The auditor must first gain an understanding of the service the fund uses, including: a) Nature of the services b) Nature and materiality of transactions processed c) Degree of interaction between the fund and the service provider The process to then establish whether the report provided by the service provider can be accepted as free from material misstatement is: Step 1 - Establish whether the fund has adequate internal controls relevant to the services provided as a basis for the identification and assessment of risk of misstatement. It is unlikely that adequate controls exist at the fund level as such controls would have to be thorough and well maintained and could not be a single simple procedure such as checking the correct market value for investments is presented in the report. Step 2 - In the absence of adequate internal controls at the fund level the auditor must gain an understanding of the controls of the service provider. This can be done by one or more of the following: Obtaining type 1 report (Service auditors report on the description and design of controls) Obtaining type 2 report (Service auditors report on the description and design of controls AND operating effectiveness) Contacting the service provider for specific information Visiting and performing procedures Using another auditor to perform procedures It is unlikely that a managed platform provider will welcome you in to identify their internal controls. The most likely source of the understanding will either be from a type 1 or type 2 report. 8
ASA 402 does not allow such a report to be relied upon automatically but requires auditors to satisfy themselves as to: a) The service auditor s professional competence and independence from the service organization; and b) The adequacy of the standards under which the type 1 or type 2 report was issued The auditor must then evaluate: a) Whether the description and design of the controls is at a date or for a period appropriate to the auditor s purposes (e.g. a 2011 report would be unsuitable for a 2013 SMSF audit) b) The sufficiency and appropriateness of the evidence provided by the report for an understanding of the internal control c) And determine whether their should be complementary controls at the SMSF level and if so obtain understanding of whether the fund has designed and implemented such controls. If there is any assessed risk of material misstatement at this stage the auditor must perform further procedures. Step 3 Test the controls. When the auditor expects that controls at the service organization are operating effectively evidence must be obtained of the operating effectiveness by one or more of the following: a) Obtain a type 2 report b) Perform appropriate tests of controls at the service organization; or c) Use another auditor to perform those tests Again it is unlikely that the managed platform provider will welcome you in to test their internal controls. The most likely source of confirmation will be the type 2 report. If a type 2 report is to be used as evidence the auditor must determine whether the report provides sufficient appropriate audit evidence. This includes ensuring the report is for an approproiate date or time period, whether the fund is required to have complimentary controls, whether the controls and the results of the testing described in the report are relevant. 9
Step 4 - The auditor must enquire with the management (trustees) of the SMSF whether the managed platform provider has communicated any fraud, non compliance with laws or uncorrected material misstatements. In practice, to cover the standard s requirements the audtor should have on file: Understanding of the nature of the service rovided Enquiry of trustees regarding whether the fund has internal controls or any knowledge of actual or suspected fraud or material misstatement. The auditor ultimately will need to obtain a type 2 report from the managed platform provider and review the same for matters including date relevance, the auditor s competence and independence, the sufficiency and appropriateness of the evidence provided from the report and whether a requirement for the fund to have compliemntary controls is disclosed. Having properly evidenced that the managed platform provider has adequate controls that operate effectively, the auditor must then decide whether to accept the copy of the annual report provided by the trustees as sufficient appropriate audit evidence or to obtain an external confirmation. This is a matter of professional judgement and the previous discussion regarding external confirmations is relevant. Where the managed platform investment represents a material fund asset we would suggest that an external confirmation would be appropriate. The most suitable confirmation would be obtained directly from the service provider that holds the assets, also being the most independent source of the confirmation. Alternatively, we would accept confirmation from the financial advisor (signed by authorized AFSL holder or representative) but would be mindful of the closeness of the relationship with the trustee and risk of fraud. Here is an audit tip as a final note. Often SMSF accountants record managed platform investments as a single ledger account in the fund financials and account for the investment with a single net entry at 30 June. In such cases, extra care should be taken to review the cash account statements of the investment to test whether all external deposits and withdrwawals have been correctly taken up by the fund. 10
We have seen instances where withdrawals and / or deposits have not been recorded and are only represented in the change in market value at year end resulting in material misstatement of the fund financials. 11
References Commonwealth Legislation: Superannuation Industry (Supervision) Act 1993 Superannuation Industry (Supervision) Regulations 1994 ATO Publications: Approved Auditors of Self- Managed super funds role and responsibilities Other Publications: Joint Accounting Bodies Independence Guide, Fourth Edition February 2013 https://www.ato.gov.au/super/super-professionals/in-detail/smsf-auditors/smsfaudits/approved-auditors-and-self-managed-super-funds---role-and-responsibilities-ofapproved-auditors/ http://www.charteredaccountants.com.au/industry-topics/ethical-and-professionalstandards/independence-guide Audit and Assurance Standards Board: GS009 Auditing Self-Managed Superannuation Funds ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements ASA 210 Agreeing the Terms of Audit Engagements ASA 220 Quality Control for an Audit of a Financial Report and Other Historical Financial Information ASA 230 Audit Documentation ASA 240 The Auditor s Responsibilities Relating to Fraud in an Audit of a Financial Report ASA 300 Planning an Audit of a Financial Report ASA 315 Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment ASA 320 Materiality in Planning and Performing an Audit ASA 330 The Auditor s Responses to Assessed Risks ASA 402 Audit Considerations Relating to an Entity Using a Service Organization ASA 500 Audit Evidence ASA 505 External Confirmations 12
ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information ASAE 3100 Compliance Engagements Accounting Professional & Ethical Standards Board: APES 110 Code of Ethics for Professional Accountants APES 210 Conformity with Auditing and Assurance Standards 13