What makes a good audit?by
The FRC has set out a blueprint for how firms can deliver a high-quality audit. Julia Penny reviews the six key attributes and considers the big question – what makes a good audit?
Have you ever had that sinking feeling when a regulator raises points after a review that you weren’t expecting, and you ask the question, “How was I supposed to know that’s what you wanted to see?” Or, “What can I do to improve quality?”
Well, clearly the FRC was getting fed up with this type of question and has issued a document called What Makes a Good Audit to spell out its expectations.
This is a surprise in itself. In the past the response has often been that firms must interpret the auditing standards themselves and it isn’t the job of the regulator to provide guidance. However, in the face of continuing levels of audit quality below that required (just 71% met the expected standards in the last FRC inspection round) a concerted effort is clearly required from all concerned, including the FRC. Hence this document.
But does it help, and should you read the whole thing? In brief, I would answer yes, and yes, but let’s have a look at some of the key points to help you make up your own mind.
An audit is only as good as the practice
Firstly, the report highlights a fundamental issue – an individual audit is only likely to work well if the audit practice as a whole is well run. The three main elements of an individual audit which are considered are not a surprise: risk assessment and planning; execution of the audit; and completion and reporting.
In many ways, the areas highlighted by the FRC are not much of a surprise. For instance, planning should be timely (and not just at the start of fieldwork!).
Audit teams should understand the client and their business model, including developing expectations about what they might see in the financial statements, based on appropriate external and internal sources of information. Sufficient resources should be available at the right time and the audit work done should execute the plan (not just revert back to what was done last year).
And of course there must be sufficient professional scepticism and challenge of management, which perhaps has more to do with the culture and behaviours of audit teams than anything else.
Problems at the completion stage
Problems arising at the completion stage of an audit are mostly paper notes, relating to an over-running audit, where issues identified by the audit team are resolved at a very late stage.
This situation can be avoided by good project management and live audit quality indicators. However, if problems still develop, good practice is for the audit firm to delay signing the audit report where there simply is not enough resource to resolve the issues by the original deadline.
On reporting, the FRC notes that it supports graduated findings when communicating with those charged with governance. This means the auditor comments on estimates describing them, for example, as conservative, balanced or aggressive and allows for fuller discussions with the audit committee and potentially investors if included in the key audit matters.
Six elements of a high-performing audit
In terms of a high performing audit practice as a whole, the FRC considers there are six elements:
- Assessing firm quality risks
- Mindset, culture, governance and leadership
- Performance monitoring and remediation
- Quality monitoring
- Resources (including recruitment and training); and
- Information and communications.
For those of you already familiar with the new quality management standard ISQM 1, which takes effect from 15 December 2022, I am sure you will recognise many of the elements of the system of quality management from the list above.
In both ISQM 1 and the guidance given in this paper it is recognised that judgment and behaviour are key (both words are mentioned 25 times in the paper). Ticking boxes will not ensure (or arguably even help to ensure) that there is a good audit.
Instead an audit team must approach an engagement with the right behaviours and mindset. There is much in ISQM 1, 2 and revised ISA 220, which should improve quality within firms and the paper reiterates the FRC’s desire that firms adopt the suite of new standards early.
Behavioural change techniques
The paper notes that behavioural change techniques may be needed in order to develop an appropriate culture of scepticism and challenge.
Audit firms must clearly communicate the expected behaviours to staff, aligning incentives with desired behaviours, using cultural assessment techniques to judge whether everything is working as planned. This may seem like a whole new world to some audit firms, but if we look at why things go wrong it is mostly that someone behaves inappropriately, rather than they didn’t understand an ISA or IFRS correctly.
Let’s face it, if you don’t understand a technical requirement, the correct behaviour would be to seek advice, so a shortfall in knowledge doesn’t have to impact overall audit quality if dealt with appropriately.
However, if the actual behaviour is an attempt to cover up the lack of knowledge, this will lead to an audit quality issue. Interestingly the paper notes favourably that it has seen firms engage more in training related to skills and behaviour and exercises aimed at ensuring an appropriate culture, rather than purely technical training.
What is missing from the document
The report sets out examples of good practice, but these are summaries of what was seen – for example, “The audit team’s engagement with the technical panel was of a high standard and demonstrated robust two-way challenge”.
What the document doesn’t do is to show examples of what was in the working papers that caused the reviewers to so conclude. Whilst this is understandable, as such content would be confidential and lengthy, it could nonetheless leave some in doubt as to what is actually required.
In my view this issue can be solved by the careful review of files as part of the monitoring procedures, considering whether such positive conclusions could be reached based on the information documented. If not, there are learning points to take forward, or if the work and documentation are of a high standard then the firm can use it internally to demonstrate to others what is required.
The role of senior leadership
The paper also highlights that senior leadership must live and drive the right values, ethics and behaviours to support high audit quality throughout the firm. This seems obvious, but we can perhaps all see the risk of senior partners (or other team members) being drawn into a focus on firm profitability, rather than quality, a tendency to be too busy to undertake necessary training or even to be sufficiently involved in the audits for which they are responsible.
Culture must flow from the top, right down to the bottom of the firm and the FRC noted an example of good practice where the INEs (Independent Non-Executives) at one firm held a series of culture meetings with people at all levels, identifying a misaligned culture in a small number of teams.
This is a hugely powerful exercise and even smaller firms can do work to understand what beliefs their staff and partners truly have about the firm’s culture. What is the answer you would hear if you asked staff and partners anonymously whether it is quality that will get you that promotion, or being able to sell more services to an audit client or stick to budget?
Audit quality indicators
For larger firms, the active management of quality, by setting audit quality indicators (AQIs) or audit quality milestones (AQMs) has perhaps become routine. But for many firms the use of AQIs, particularly ones that can be tracked live, may be new tools that can be applied to help avoid issues getting out of hand.
For instance if certain planning stages must be dealt with by a date sufficiently in advance of the fieldwork to allow proper time for full development of the plan, this will help to avoid a last-minute surprise where appropriate resources might not have been made available. It may be possible to embed such an indicator into audit software, or manually monitor it if not.
It’s down to culture
Ultimately for me, this quote from the paper (12.3) sums up the most important message: “The culture of the firm needs to embrace improvements, foster quality and generate ideas from across the audit practice: avoiding the status-quo or group-think. It is important to create a culture of trust, whereby people are encouraged to openly talk about mistakes and learn from them.”
It seems that ultimately it is the cultures and behaviours which must be the right ones for quality audit to result.
It’s time for auditors to look at developing our understanding of behavioural psychology, as well as ensuring that we meet the more detailed technical requirements of an audit.
But there is much more to the paper than we have been able to cover here, so if you have a role in audit quality make sure you know What Makes a Good Audit.
Julia Penny will be speaking at AccountingWEB Live Expo on 1-2 December, where she’ll be looking at the financial reporting highlights with Steve Collins, putting the spotlight on AML with David Winch and exploring accountancy’s role in sustainability. Register now to get your FREE tickets.
You might also be interested in
Julia Penny is the principal of JS Penny Ltd which provides technical and training consulting on anti-money laundering procedures, auditing and financial reporting. Julia is a member of ICAEW Board and Council, chair of the ICAEW Ethics Advisory Committee and past chair of the ICAEW...