2 Threats and safeguards Section overview • Examples of threats to independence and potential safeguards are given here, categorised by the main type of threat they represent. You should note that some matters can present several types of threat. • Hard and fast rules are shown in bold. This section is based on the ICAEW Code of Ethics and the FRC Ethical Standard. It examines a number of specific threats to independence on assurance engagements. They are outlined here, categorised by type of risk and appropriate safeguards. You should, however, note that certain issues fall into several types of threat, not simply one. Where this is the case, issues have been listed under the dominant threat but other threats are noted. Where relevant, rules relating to each threat are set out. We shall also look at how these risks might apply to particular situations, such as when considering whether to accept a new client. 2.1 Self-interest threat The Code of Ethics highlights a great number of areas in which a self-interest threat might arise. Employment with assurance client Close business relationships Financial interests Partner on client board Family and personal relationships Gifts and hospitality Lowballing Percentage or High percentage contingent fees of fees Loans and guarantees Overdue fees Figure 15.1: Self-interest threat 2.1.1 Financial interests Definitions Financial interest: An interest in equity or other security, debenture, loan or other debt instrument of an entity, including rights and obligations to acquire such an interest and derivatives directly related to such interest. Direct financial interest: A financial interest: • Owned directly by and under the control of an individual or entity (including those managed on a discretionary basis by others); or • Beneficially owned through a collective investment vehicle, estate, trust or other intermediary over which the individual or entity has control, or the ability to influence investment decisions. Assurance Indirect financial interest- A fin vehicle, estate, trust or other inte ^'h-1"1"6" beneficial|y owned through a collective investment influence investment decisions °VCr which tne individual or entity has no control or ability to Immediate family A mnn« r- V. A spouse (or equivalent) or a dependent. Assurance team: not allowed to own a dl °nstltutes a substantial sell-interest threat. The parties listed below are rect financial Interest or an Indirect material financial Interest In a client: The assurance firm ' AnV P^ner in the assurance firm m7mPb\?oH^ J° inj,uence lhe conduct and outcome ol the engagement (eg, a • An ,mmedl*e ^mlly member of such a person The following safeguards will therefore be relevant: • Disposing of the interest . Removing the individual from the team if required Keeping the client's audit committee informed of the situation Using an engagement quality control reviewer to review work carried out if necessary Assurance firms should have quality control procedures requiring staff to disclose relevant financial interests for themselves and immediate family members. They should also foster a culture of voluntary disclosure on an ongoing basis so that any potential problems are identified on a timely basis. 2.1.2 Close business relationships A close business relationship will involve a common commercial interest, which in addition to a self-interest threat, could cause advocacy or intimidation threats and a perceived loss of independence. Examples of when an assurance firm and an assurance client have an inappropriately close business relationship include: • Operating a joint venture between the firm and the client, or between the firm and a director or other senior manager of the client • Arrangements to combine one or more services or products of the firm with one or more services or products of the assurance client and to market the package with reference to both parties • Distribution or marketing arrangements under which the firm acts as distributor or marketer of the assurance client's products or services or vice versa • Other commercial transactions, such as the audit firm leasing its office space from the assurance client Again, it will be necessary for the partners to judge the materiality of the interest and therefore its significance. However, unless the financial interest Is clearly immaterial and the relationship to the firm and its client clearly insignificant, an assurance provider should not participate In such a venture with an assurance client. Appropriate safeguards are therefore to end the assurance provision or to terminate the (other) business relationship. If an individual member of an assurance team had such an interest, he should be removed from the assurance team. Generally speaking, purchasing goods and services from an assurance client In the ordinary course of business on anam's length basis does not constitute a threat to independence. However, If there fa substantial number of such transactions, there may be a threat to independence and safeguards may be necessary. Integrity, objectivity ,»nd independence The FRC Ethical Standard (section 2) states that for audit clients and firms, there should be no business relationships except for the purchase of goods and services in the ordinary course of business and on an arm's length basis, and which are not material or clearly inconsequential to either party. 2.1.3 Employment with assurance client Dual employment (the same person being employed by both an assurance firm and a client) is not permitted. It is also possible that staff might transfer between an assurance firm and a client, or that negotiations or interviews to facilitate such movement might take place. Both situations are a threat to independence: • An assurance team member might be motivated by a desire to impress a future possible employer (objectivity is therefore affected) • A former partner turned Finance Director has too much knowledge of the firm's systems and procedures These sorts of situations can also present self-review, intimidation and familiarity threats. The extent of the threat to independence depends on various factors, such as the role the individual has taken up at the client, the extent of his influence on the assurance service previously, and the length of time that has passed between the individual's connection with the assurance service and the new role at the client. Various safeguards may be considered: • Modifying the assurance strategy • Ensuring the assurance engagement is assigned to someone of sufficient experience as compared with the individual who has left • Involving an additional professional accountant not involved with the engagement to review the work done • Carrying out a quality control review of the engagement There is a significant threat to objectivity if a partner of an audit firm accepts a key management position at a client of the firm. The FRC Ethical Standard (section 2) states that when a partner leaves the firm and is appointed as a director or to a key management position with an audit client, having acted as audit engagement or independent/key partner in relation to that audit at any time in the previous two years, the firm should resign as auditors. The auditors should not reaccept appointment until two years have elapsed since that partner's involvement in the audit or the former partner leaves the audit client, if earlier. When any other former member of an engagement team joins an audit client as director/key management within two years of being involved with the audit, the firm should consider whether the composition of the audit team is appropriate. An individual who has moved from the firm to a client should not be entitled to any benefits or payments from the firm unless these are made in accordance with pre-determined arrangements. The individual should not continue to participate (or appear to) in the firm's business or professional activities. If money is owed to the individual, it should not be so much as to compromise the independence of the assurance engagement. A firm should have quality control procedures setting out that an individual involved in serious employment negotiations with an audit client should notify the firm and that this person would then be removed from the engagement. In addition, the FRC Ethical Standard (section 2) states that a review of the employee's work on the current and, where appropriate, most recent audit should take place. 2.1.4 Partner on client board A partner or employee of an assurance firm should not serve on the board of an assurance client. This can also cause a self-review and/or a management threat. It may be acceptable for a partner or an employee of an assurance firm to perform the role of company secretary for an assurance client, if the role is essentially administrative. 258 Assurance Family and personal relationships pefinition Close family: A parenUhildonsibling who is not an immediate family member. Family or close personal relationships between assurance firm and client staff could seriously threaten independence. Each situation has to be evaluated individually. Factors to consider are: ' ™e ir;dividual's resP°nsibilities on the assurance engagement . The closeness of the relationship . The role of the other party at the assurance client When an immediate family member of a member of the assurance team is a director, an officer or an employee of the assurance client in a position to exert significant influence over the subject matter information of the assurance engagement, the individual should be removed from the assurance team. The firm should also consider whether there is any threat to independence if an employee who is not a member of the assurance team has a close family or personal relationship with a director, an officer or an employee of an assurance client. A firm may wish to establish quality control policies and procedures under which staff should disclose if a close family member employed by the client is promoted within the client. If a firm inadvertently violates the rules concerning family and personal relationships they should consider applying additional safeguards, such as undertaking a quality control review of the assurance engagement and discussing the matter with the audit committee of the client, if there is one. Gifts and hospitality Unless the value of gifts or hospitality are such that a reasonable and informed third party, weighing all the specific facts and circumstances, would consider them trivial and inconsequential, a firm or a member of an assurance team should not accept them. Worked example: Receiving a benefit Katie, a trainee at West and Co, chartered accountants, is attending the inventory count at Designs Limited, a company that manufactures fashion lines for a number of famous high street stores. During the course of the count, the stores manager tells Katie that after the inventory count, staff are entitled to purchase goods at cost to the value of £30 each. He invites her to take part in this company perk. In this case, Katie has not been offered a gift, she has been invited to spend £30. However, the benefit that this would confer on her could be substantial. Given the customary mark ups in the fashion industry, cost price could be as low as 25% of ultimate selling price, so in effect, Katie would be receiving a benefit of £90. While this is likely to be immaterial and insignificant to the financial statements of Designs Limited, it could be significant to a trainee in an audit firm. Katie should certainly not accept any such offer without confirming with her engagement partner that it is appropriate to do so. She may be able to determine herself that the best course of action is not to accept the benefit. In this case, a benefit of £90 is not clearly insignificant, and therefore Katie should decline the offer. In addition, you should note that this practice could represent an audit risk, as it means that there will be inventory movements after the inventory count but before the end of the year, and unless there are strong controls over recording these sales, both inventory and sales could be misstated. Such a benefit to employees is unlikely to cause a material misstatement, but Katie should probably observe the controls over the sales and make a note of the practice for the audit file. The FRC Ethical Standard (section 4) extends this prohibition to immediate family members or persons able to influence the audit and states that hospitality should not be accepted from an audit client unless it is reasonable in terms of its frequency, nature and cost. Integrity, objectivity and independence 2.1.7 Loans and guarantees The advice on loans and guarantees falls into two categories: The client is a bank or other similar institution • Other situations If a loan or a guarantee of a loan is made by an audit client which Is a bank (or other similar institution), then this is not acceptable if the loan is not made under normal lending procedures (ie in the normal course of business). If the loan is made under normal lending procedures, then this is acceptable provided that appropriate safeguards are applied. An example of a safeguard would be having the work reviewed by a professional accountant from a network firm that is neither involved with the audit nor received the loan. If a loan is made by a bank client to a member of the audit team under normal lending procedures, then this is acceptable and no safeguards are necessary. An example of this would be if a member of the team had a home mortgage, bank overdraft, car loan or credit card with a bank client. If a loan is made or guaranteed by a client that is not a bank or other similar institution to either the firm or to a member of the audit team, then the self-interest threat created would be so significant that no safeguards could reduce the threat to an acceptable level, unless the loan or guarantee is immaterial to both (a) the firm or the member of the audit team and the immediate family member, and (b) the client. Finally, if the firm, a member of the audit team or an immediate family member, makes or guarantees a loan to a client, then the self-interest threat created would be so significant that no safeguards could reduce the threat to an acceptable level, unless the loan or guarantee is immaterial to both (a) the firm or the member of the audit team or the immediate family member, and (b) the client. 2.1.8 Overdue fees In a situation where there are overdue fees, the assurance provider runs the risk of, in effect, making a loan to a client, whereupon the guidance above becomes relevant. The ICAEW Code states that, generally, the payment of overdue fees should be required before the assurance report for the following year can be issued. Firms should guard against fees building up and being significant by discussing the issues with those charged with governance (more specifically, the audit committee), and, if necessary, the possibility of resigning if overdue fees are not paid. 2.1.9 Percentage or contingent fees Definition Contingent fee: A fee calculated on a predetermined basis relating to the outcome of a transaction or the result of the services performed by the firm. A fee that is established by a court or other public authority is not a contingent fee. A firm shall not enter into any fee arrangement for an assurance engagement under which the amount of the fee is contingent on the result of the assurance work or on items that are the subject matter of the assurance engagement. 260 Assurance 1 jo High percentage of fees 0 Definition Public interest entity: • A listed entity; and iTifr^quVtdCquISn tj°: °! I*9"131100 " 9 PUb'k "** " (b) *t independence le9'?latio" t0 bh . Discussing the issue with th individual's work on the assignment ne audjt committee , 2 Preparing accounting records anH ft* • ■ s and financial statements There is clearly a significant risk of a * if statements and then audits or tp ■ r"review tnreat if a firm prepares accounting records and financial reviews them. On the other hand auditors routinpiv and give advice about arm.,,,,- a"'Sl mana9ement with the preparation of financial statements hunting treatments and journal entries. Therefore, assurance firms mint .».1 risk is at an acceptable level sl„ ? *b arising and pul safe9uards in Place to ensure that the r cyci. ^areguards include: • Using staff members othpr th*,, omer than assurance team members to carry out work 2nn tnv^f01'065 fnd Procedur« to prohibit the individual providing such services from making any managerial decisions on behalf of the assurance client . Requiring the source data for the accounting entries to be originated by the assurance client . Requiring the underlying assumptions to be originated and approved by the assurance client The rules are more stringent when the client is listed. The FRC Ethical Standard (section 5) states that firms should not prepare accounts or financial statements for listed clients, unless an emergency arises. The EU Audit Regulation (June 2016) reiterated this guidance by prohibiting auditors from bookkeeping, preparing accounting records or preparing financial statements for public interest entities. 2.2.3 Valuation services is Definition Valuation comprises the making of assumptions with regard to future developments, the application of appropriate methodologies and techniques, and the combination of both to compute a certain value, or range of values, for an asset, a liability or for a business as a whole. If an audit firm performs a valuation that will be included in financial statements audited by the firm, a self-review threat arises and also a management threat might arise. The FRC Ethical Standard (section 5) states that audit firms shall not carry out valuations which either: • Have a material effect on a listed company's financial statements, either separately or in aggregate with other valuations provided • Involve a significant degree of subjective judgement and have a material effect on the financial statements either separately or in aggregate with other valuations provided to any other audited entity If the valuation is for an immaterial matter, the audit firm should apply safeguards to ensure that the risk is reduced to an acceptable level. Matters to consider when applying safeguards are the extent of the audit client's knowledge of the relevant matters in making the valuation and the degree of judgement involved, how much use is made of established methodologies and the degree of uncertainty in the valuation. Safeguards might include: • Second partner review • Confirming that the client understands the valuation and the assumptions used . Ensuring the client acknowledges responsibility for the valuation . Using separate personnel for the valuation and the audit 1 Integrity, objectivity and independence " contíoľ1 aCkn0Vvled9es its responsibility for establishing and monitoring a system of internal ' Ind 2ľí a"ÍgnS the resP°nsibility to make all management decisions with respect to the design and mplementation of the hardware or software system to a competent employee, preferably within senior management . The client makes all management decisions with respect to the design and implementation process . The client evaluates the adequacy and results of the design and implementation of the system The ľnerľteseSPOnSlble ^ °peratin9 the sVstem (hardware or software) and for the data it uses or genera es Further safeguards would include using only personnel who are not on the audit team to provide the IT services, and having the audit or non-assurance work reviewed by a professional accountant. .8 Litigation support services An example of a litigation support service is acting as an expert witness. Such services can cause self-review threats if they involve estimating damages or other amounts that affect the financial statements. In addition, management and/or advocacy threats may arise. Hence the FRC Ethical Standard (section 5) forbids acceptance of litigation support services for listed audited entities that are listed or significant affiliates when the situation above exists. Litigation support services for non-listed entities that do not involve such subjective estimations are not prohibited, provided that appropriate safeguards have been implemented. 3 Advocacy threat Legal services Contingent fees ADVOCACY THREAT finance Figure 15.3: Advocacy threat An advocacy threat arises in certain situations where the assurance firm is in a position of taking the client's part in a dispute or somehow acting as their advocate. The most obvious instances of this would be when a firm offered legal services to a client and, say, defended them in a legal case. The FRC Ethical Standard (section 5) forbids the provision of legal services to an audited entity where it would involve acting as the solicitor formally nominated to represent the audited entity in resolution of a dispute or litigation which is material to the financial statements. An advocacy threat might also arise if the firm carried out corporate finance work for the client; for example, if the audit firm were involved in advice on debt restructuring and negotiated with the bank on the client's behalf. As with the other threats above, the firm has to appraise the risk and apply safeguards as necessary. Relevant safeguards might be using different departments in the firm to carry out the work and making disclosures to the audit committee. Remember, the ultimate option is always to withdraw from an engagement if the risk to independence is too high. Integrity, objectivity and independence 2.4 Familiarity threat A familiarity threat is where independence is jeopardised by the audit lirm and its staff becoming over familiar with the client and its staff. There is a substantial risk of loss of professional scepticism in such circumstances. We have already discussed some examples of when this risk arises, because very often a familiarity threat arises in conjunction with a self-interest threat. Where there are family and personal relationships between clientyfirm Recruitment FAMILIARITY THREAT Employment with assurance client Long association with assurance clients Recent service with assurance client Figure 15.4: Familiarity threat 2.4.1 Long association of senior personnel with assurance clients It can be a significant threat to independence if senior members of staff at an audit firm have a long association with a client. All firms should therefore monitor the relationship between staff and established clients and use safeguards to independence such as rotating senior staff off the assurance team and involving engagement quality control reviews. Where appropriate safeguards cannot be applied, the firm should resign. The requirements of the FRC's Ethical Standard are stricter in this area that those of the Code of Ethics. Worked example: Long association Peter has been the audit engagement partner for Santa Ltd for a number of years. During that time, he has formed a friendly relationship with the finance director, to the point that on occasion, usually at client hospitality days organised by the firm, but sometimes not, he might play a round of golf with the FD or attend a dinner function with him and his wife. There is a risk of a familiarity threat here, particularly if the relationship is growing closer and more personal as time evolves. Peter should monitor this situation and request a review of the audit file by an engagement quality control reviewer to ensure that the risk is not too significant for the audit firm. Alternatively, the audit firm might decide that it would be better to 'rest' Peter from this engagement for a period of time to ensure that independence was not affected, if the firm were confident that this would not affect the professional relationship between the firm and Santa Ltd. The Code of Ethics sets out general provisions for all audit engagements. These state that when an audit engagement partner has held that role for a continuous period of ten years in relation to a non-public interest client, careful consideration must be given as to whether a reasonable and informed third party would consider the firm's objectivity and independence to be impaired. If that individual is still not rotated, alternative safeguards should be put in place, the reason for lack of rotation should be documented, and the facts should be communicated with those charged with governance. For public interest entities, the Code of Ethics has more stringent rules. The FRC Ethical Standard (section 3) states these as follows. • No one shall act as the audit engagement partner for more than five years. 268 Assurance • Any°ne Wno has acted « audit engagement partner for a period of five years, shall not elaps'ed ent'y partidpate ln the audit engagement until a further period of five years has However, there may be circumstances in which it is necessary to be flexible about rotation of the audit engagement partner or audit quality control reviewer in relation to the audit of a public interest entity. If the audit committee of the audited entity decides that flexibility is necessary to safeguard the quality of the audit (and the audit firm agrees), then the audit engagement partner may continue in the role for two more years. This might happen for example where: . Substantial change has recently been made or will soon be made to the nature or structure of the audited entity's business • There are unexpected changes in the senior management of the audited entity In such situations, alternative safeguards should be applied such as an expanded review of the work by an engagement quality control reviewer. The FRC Ethical Standard (section 3) then goes on to specify the following rules for engagement quality control reviewers: • No one should act as the engagement quality control reviewer for a continuous period longer than seven years. . Where the engagement quality control reviewer becomes the audit engagement partner the combined service in these two positions should not exceed seven years. • People who have held these positions for seven years (continuously or in aggregate) should not return to them for at least five years. Staff in senior positions and other partners who have been responsible for significant affiliates should be reviewed by the audit engagement partner where they have been involved in the audit of a public interest entity for a continuous period exceeding seven years. Safeguards should be applied such as the removal of members of staff from, or the rotation of roles within, the engagement team. When an audited entity becomes a listed company, the length of time the audit engagement partner has been involved should be taken into consideration. The engagement partner should only continue in the position for another two years where four or more years have already been served by that individual. 2.4.2 Recruitment Recruiting senior management for an assurance client, particularly those able to affect the subject matter of an assurance engagement creates management, familiarity, self-interest and intimidation threats. Assurance providers must not make management decisions for the client. Their involvement could be limited to drawing up a shortlist of candidates, providing that the client has drawn up the criteria by which they are to be selected, and makes the final decision in respect of who to hire. The FRC Ethical Standard (section 5) states that an audit firm should not undertake an engagement to provide recruitment services in relation to a key management position of the audited entity (or significant affiliate of such) for a listed entity. Integrity, objectivity jnci independence 269 2.5 Intimidation threat » ...... . . „ k,.,. rpasnn to be intimidated by An intimidation threat arises when members of the assurance team have reason client staff. Close business relationships Litigation INTIMIDATION THREAT Family and personal relationships Assurance staff members move to employment with client Figure 15.5: Intimidation threat These are also examples of self-interest threats discussed in section 2.1, largely because intimidation may only arise significantly when the assurance firm has something to lose. 2.5.1 Actual and threatened litigation The most obvious example of an intimidation threat is when the client threatens to sue, or indeed sues, the assurance firm for work that has been done previously. The firm is then faced with the risk of losing the client, bad publicity and the possibility that they will be found to have been negligent, which will lead to further problems. This could lead to the firm being under pressure to produce an unqualified audit report when they have been qualified in the past, for example. Generally, assurance firms should seek to avoid such situations arising. If they do arise, factors to consider are: • The materiality of the litigation • The nature of the assurance engagement • Whether the litigation relates to a prior assurance engagement The following safeguards could be considered: • Disclosing to the audit committee the nature and extent of the litigation • Removing specific affected individuals from the engagement team • Involving an additional professional accountant on the team to review work However, if the litigation is at all serious, it may be necessary to resign from the engagement, as the threat to independence is so great. The FRC Ethical Standard (section 4) requires a firm to not continue with/accept an engagement where the threat of litigation is anything other than insignificant, however it is not required to resign immediately in circumstances where a reasonable and informed third party would not regard it in the interests of the shareholders for it to do so. The EU Audit Regulation (June 2016) states that legal services are prohibited in the case of audits of public interest entities. 2.6 Management threat The management threat is identified in the FRC Ethical Standard rather than in ICAEW Code. A management threat arises when the audit firm undertakes work involving making judgements and taking decisions that are the responsibility of management. There is a significant cross-over with self-review threat here, and, as we have already seen, assurance providers are forbidden to take decisions on behalf of management, therefore this risk should be removed by avoiding situations or not accepting engagements where the client is asking the assurance firm to take management decisions. 270 Aisurance