2. COMMON DEFICIENCIES FOUND AT AUDIT MONITORING VISITS

3. AGENDA Common deficiencies in compliance with auditing standards
Independence issues
Communication with those charged with governance
Identification requirements per the AML Directive

4. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
PLANNING .
Inadequate planning or planning activities carried out but not effectively applied.
Documenting the understanding of business
No risk assessment - Identifying risks from:
- understanding of the business
- compliance with laws and regulations
- consideration of fraud and error
- preliminary analytical review
Key audit areas based on risk assessment / audit approach
Overall and/or performance materiality not calculated

5. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
Design of audit procedures - audit programme not used or suitably tailored
DOCUMENTATION .
We only recognize work recorded on file 
No audit work recorded
Basis of sample size and selection not recorded
Insufficient record of nature and extent of audit work – source of audit evidence and samples tested not recorded
No summary and evaluation of the results of audit tests to support the conclusion

6. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
CONTROL AND REVIEW .
None or inadequate evidence of engagement partner supervision and review
Principal not ensuring that sufficient appropriate audit evidence is obtained to support the conclusions reached.
No or not adequate second partner review

7. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
DEFICIENCIES IN AUDIT EVIDENCE .
Existence of plant and equipment not verified
Ownership of property and motor vehicles not verified (especially those brought forward from prior years)
Valuation of property not assessed
Ownership and valuation of investments, including group companies.
Inventory
-Physical count not attended
-No tests on cost and net realisable value
-No consideration of stock obsolescence

8. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
Deficiencies in audit evidence (continued)
Recoverability of receivables not tested
No bank letter
Completeness of payables not tested
Validity of related party balances not tested. Recoverability of debit balances of related parties (including directors and shareholders) not tested
Completeness of income for understatement not tested
Validity of expenses, including payroll
Where firm does relevant work by checking after date payments either in bank section or in subsequent events testing, work not properly referenced to ensure that completeness of payables is also addressed

9. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
Deficiencies in audit evidence (continued)
No analytical review on completion
No subsequent events review or no documented extent of review
No going concern review no documented extent of review
No review of financial statements for adequate disclosures
No management representation letter
No evidence of communication with client (either pre-audit communication – ISA 260 or communication of deficiencies – ISA 265)

10. COMMON DEFICIENCIES IN COMPLIANCE WITH AUDIT STANDARDS
GOING CONCERN REVIEW .
Firm needs to document its assessment of the going concern assumption
If it disagrees, then it must issue a qualified audit opinion/ consider disclaimer depending on circumstances
If it agrees but there are uncertainties, firm needs to consider the adequacy of audit evidence obtained to support the assessment and ensure that the uncertainties are properly disclosed in the financial statements in the notes.

12. INDEPENDENCE ISSUES
IFAC Code of Ethics for Professional Accountants (IFAC Code of Ethics) (2014)
and
the breach of Law 42(I)/2009.

13. Provision of Non-assurance Services to Audit Clients.
Self Review (paragraph of the IFAC Code of Ethics)
For example from bookkeeping and VAT services to audit clients (paragraph )
Client money.
Separate bank account not used (paragraphs and of the IFAC Code of Ethics)

14. Long Association of Senior Personnel.
Familiarity and self-interest threats are created by using the same senior personnel on an audit engagement over a long period of time.
(Paragraphs of IFAC Code of Ethics)
Key audit partner

15. Undue dependence. On fees from one client or group of clients
On clients referred to the firm from one source.
(Paragraph of IFAC Code of Ethics)

16. Serving as director or officer in the audit client.
(Paragraphs – and paragraphs to of the IFAC Code)
The principal and/or employees of the firm
Immediate family members
Close family members
Other relationships
Paragraph 43 (3) of Law 42(I)/2009

17. Network firms.

18. Network firms.
Paragraph of the IFAC Code of Ethics states the term “Firm” in section 290 includes network firm, except where otherwise stated.
Paragraph 28 (2) of Law 42(I)/2009 states that a statutory auditor or a statutory audit firm shall not carry out a statutory audit if there is any direct or indirect financial or business or employment or other relationship between the statutory auditor, the statutory audit firm or network and the audited entity.

19. Network firms. (Paragraphs 290.14 – 290.24 of IFAC Code of Ethics)
Although two entities are legally separate entities, there may be facts and circumstances that would suggest that they are associated in such a way that a network exists.

20. Network firms.
The judgment as to whether the larger structure is a network shall be made in light of whether a reasonable and informed third party would be likely to conclude,
weighing all the specific facts and circumstances, that the entities are associated in such a way that a network exists.

21. Network firms. Main weakness /characteristics identified:
Common ownership (or immediate and close family relationships)
Ownerships hidden behind friends or employees
The fiduciary services company does not service other audit firms (or very few other audit firms) as a result appears as an extension of the audit firm or as a separate department of the audit firm.
The firm’s website promotes the services of the separate entity as their own or as offered through associates or collaborators.
Presentations and promotional material carried out jointly offering the client the impression of one entity and a one stop shop. …

22. Network firms. Main weakness /characteristics identified :
Invoices for services are issued by one of the two.
Invoices show the same contact details for both entities.
Joint statement of account to clients showing the transactions and balances relating to both entities.
A current account  is maintained between the two entities and a number of financial transfers are made between them for financial support.
The practitioner acts a signatory on bank accounts, and/or has viewing rights on bank accounts …

23. Network firms. Main weakness /characteristics identified :
The firm relies on the due diligence work performed by the fiduciary services company without due diligence work of its own.
The fiduciary services company communicates with clients on audit matters on behalf of the firm which may create the impression that they are one firm.
Both entities share the same data and file server or other resources.

24. COMMUNICATION

25. COMMUNICATION WITH THOSE CHARGED WITH GOVERNANCE
ISA 260, Communication with Those Charged with Governance
ISA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

26. Communication with those charged with governance.
ISA 260, Communication with Those Charged with Governance
Those charged with governance can be defined as the persons with responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity
Management are defined as the persons with executive responsibility for the conduct of the entity’s operations.

27. Communication with those charged with governance.
ISA 260, Communication with Those Charged with Governance
Communicate :
responsibilities as auditors in relation to the financial statements,
overview of the planned scope and timing of the audit,
significant findings from the audit, for instance the auditor’s views about significant qualitative aspects of the entity’s accounting practices
matters of auditor independence.

28. Communication with those charged with governance.
ISA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management
Communicate the significant deficiencies in the entity’s internal control found during the course of its audit

29. Communication with those charged with governance.
Means of communication
The auditor should communicate the form, timing and expected general content of communications with those charged with governance
Communications should be given on a timely basis

30. Communication with those charged with governance.
Means of communication (cont’d)
Communication may involve many methods such as presentations, discussions and written reports
The typical form on communication in relation to weaknesses is the management letter
The management letter or any other form of communication is not a substitute for modifying the audit report if the circumstances demand it

31. Control of audits & access to clients.
Audit clients that were international business companies
Issues:
direct contact with the beneficial owners.
The information and explanations provided by the firms of legal advisors (or any other service provider) which refers the clients to the firm.

32. Control of audits & access to clients.
Issues:
No written correspondence between the audit principals and the beneficial owners of the audit clients who manage the businesses of these companies in accordance with ISA 260.

33. Control of audits & access to clients.
Issues:
No direct communication on :
understanding the business and associated risks,
planning and evidential matters including on representations, analytical review, going concern and subsequent events.
In addition the firm does not obtain formal approval of the financial statements from the beneficial owners.

34. Control of audits & access to clients.
As a result the firm was not in a position to properly control the audits of these companies, in serious breach of the ISAs.

36. IDENTIFICATION REQUIREMENTS PER THE AML DIRECTIVE
The primary purpose of an audit monitoring visit is to monitor a firm’s compliance with International Standard on Quality Control 1 (ISQC 1) and International Standards on Auditing (ISAs) in the conduct of audit work.
Currently the visit also includes checking the firm’s awareness of the regulations on money laundering (ML).

37. Directive to the Members.
The Directive is issued by the ICPAC to its members.
The Directive deals with the statutory and professional requirements in relation to the avoidance, recognition and reporting of money laundering and combating the financing of terrorism.

38. Identification and client due diligence procedures.
The auditor, external accountant, tax advisor or trust and company service provider will need to obtain a good working knowledge of a client’s business and financial background as well as information on the purpose and intended nature of the business relationship in order to provide an effective service.
(5.02)

39. Identification and client due diligence procedures.
The identification and verification of identity of clients are requirements which must be completed regardless of the risk-based approach.
The extent of client due diligence will depend on the client’s risk assessment.
(4.24)

40. Identification and client due diligence procedures.
Identification and client due diligence measure in the following cases:
When they establish a business relationship
For transactions amounting to Euro 15k or more
Where there is a suspicion of money laundering
Where there is doubt about the validity of documents collected in the past.
( 5.16)

41. Identification and client due diligence procedures.
An on-going client due diligence on the client business should be done, including scrutiny of transactions undertaken throughout the course of the relationship
to ensure that the transactions being conducted are consistent with the firm’s knowledge of the client, their business and risk profile, and where necessary the source of funds.
Records must be reviewed and updated.
( 5.09)

42. Identification and client due diligence procedures.
Reliance on third parties
Reliance for client identification and due diligence purposes may only be placed on a credit institution, a financial institution, an auditor…… from a country which is a member of the European Economic Area or a third country that the Advisory Authority has determined to be applying procedures and measures for the prevention of money laundering and terrorist financing equivalent to the EU Directive.
The firm must verify that the third party is subject to professional registration …….. as well as supervision …
(5.28)

43. Identification and client due diligence procedures.
The firm should obtain immediately from the third party all relevant information and documentation in order that they may satisfy themselves that the information is sufficient.
A third party consenting to be relied upon must…. Make available to the person relying on it as soon as its reasonably practicable:
Any information obtained from the client
Copies of any identification and verification date and other documents on the identity of the client.
(5.29)

44. Identification and client due diligence procedures.
Before accepting the client identification data verified by the third party the firm should:
Assess and evaluate the systems and procedures applied by the third party for the prevention of money laundering and terrorist financing
Satisfy itself…. That the third party implements client identification and due diligence systems and procedures in ling with the Directive
Maintain a separate file for every such third party where it stores the assessment report regarding point (a) and other relevant information
Take steps to ensure that the third party will provide the required information
The commencement of the cooperation …… is subject to approval by the Compliance officer.
(5.30)

45. Identification and client due diligence procedures.
The firm may rely on third parties only at the outset
(5.31)

46. Identification and client due diligence procedures.
For the occasions where the client is introduced by one of the firm’s overseas branch offices or associated firms, the firm could obtain the introducer’s written confirmation that it has verified the client’s identity and that relevant information data is retained by the overseas office branch or firm,
provided that the group applies common client due diligence and record-keeping procedures and measures against money laundering and terrorist financing and the effective application of such measures as and procedures is supervised at group level by a competent authority.
(5.32)

47. THANK YOU