3 Audit Deficiencies to Fix Today
In this article, we will share with you 3 audit deficiencies that we guarantee will become problematic for you in your next Inspection, if you do not take immediate action.
We have provided inspection consultancy and monitoring reviews to many SMP’s and sole practitioners, and we have familiarized ourselves with dozens of potentially significant audit deficiencies that are prevalent in over half of the reports we have reviewed.
With our EQC Methodology, we can help your practice to identify audit deficiencies and correct your audit methodology, quality control policies and most importantly, change your employees’ mindset and audit practices, so that audit effectiveness and efficiency can be achieved.
Deficiency #1: Completeness of Journal Entries
Background
What are your typical audit procedures on journal entries? What is the purpose of journal entry testing? As part of your audit planning procedures, your team should understand the process of how the management closes its financial books. If the entity has no controls to ensure that its general ledger is complete, potential material misstatements may exist in the trial balance provided.
Many engagement teams would perform substantive or control tests on journal entries. Engagement team members may be confused of their objectives. Your engagement team may select material journal entries and specify in working papers that certain non-standard journal entries including those that are outside the entity’s ordinary course of business should be selected. This type of audit procedure does not properly address management override of controls, nor does it address completeness of entries.
What should be done
Your team should understand that a test of completeness of journal entries is mandatory in understanding the entity’s financial reporting closing process. As the auditor, we are required to test the accuracy and completeness of all information provided by the management that are relevant to the audit.
As such, you should perform sequential tests on specific ranges of journal entry numbers, and also recalculate selected accounts’ closing balances by adding the opening balance to the entire movement of journal entries to ensure that the management accounts are accurate and complete. Similar procedures should be performed on the accuracy and completeness of other management reports provided by the client, such as trade receivable and payable aging analyses.
Deficiency #2: Testing the design and implementation of internal controls
Background
Is it not necessary to understand the entity’s internal controls, nor is it necessary to document audit procedures performed on them if the team relies on substantive audit procedures? Some practices would try to justify not understanding the internal controls by stating that they are non-existent as the directors are the only ones managing the company.
As a part of our audit planning process, an audit team should always understand the internal controls that help to prevent, detect and correct material misstatements in account balances or classes of transactions that we have identified with significant audit risks.
What should be done
In documenting their understanding, the team should name the person responsible for carrying out the control, and his / her title or position name, and the frequency and under what circumstances the controls would take place. For each of these identified controls, the team should decide whether they are relevant to the audit. For example, controls would likely be relevant if they can help to address significant audit risks.
In addition to inquiry, the team should test the effectiveness of design and implementation of controls by obtaining, observing and inspection of source documents that are evidence of the controls having taken place. Obtaining and inspecting a set of walkthrough documents of a sequence of control activities and drawing a flow chart may help to identify the effectiveness of controls.
Deficiency #3: AML Sanction Checks
Background
Complying with the Anti-Money Laundering (“AML”) and Counter-Terrorist Financing guidelines requires the Practice to perform a name check of a client and its beneficial owners against the latest UN sanction lists. This is required as one of your practice’s client / engagement acceptance procedures.
Many practices only perform the sanction checks when a new client is accepted and often have not checked the ultimate beneficial owners or the entity itself. Most of the times, practices have not detained evidence of when the sanction checks are performed and how they were performed. Simply documenting that it has been performed does not meet the prevailing requirements.
What should be done
Before accepting a new client or continuing a relationship with an existing client, for example, prior to the commencement of a recurring audit engagement, a sanction check should be performed on the name of directors, shareholder, ultimate beneficial owners and the entity itself. You may choose to pay for external suppliers, which may charge up to tens of thousands of dollars per annum, or adopt the EQC methodology, which is free of charge.
For ongoing sanction screening, the Practice is required to document monthly the results of the sanction check of its complete audit client base, against the latest sanction lists maintained by the UN Security Council. The practice is required to document in their AML procedures manual of the step-by-step procedures of performing sanction checks on audit clients and affiliated stakeholders, the results of the procedures; and it is essential that the Practice documents clearly the exact date of the sanction check to show that the procedures have been conducted on a continuing basis for AML/CTF compliance.
How EQC can help you
EQC helps to elevate quality assurance with easy-to-implement and practical solutions. We have identified dozens of potentially significant inspection findings and developed consultancy services and training program to help your practice correct them efficiently. We help with implementation of new controls, and perform completed file reviews and ongoing policy monitors, as a part of compliance with HKSQC 1, to see through that solutions have been effectively implemented.
We are also aware of the shortcomings of the audit training courses available on the market. We understand that your employees may be tired of attending audit training that are impractical and no different from a typical QP Module C exam preparation course. We also understand that if we only add new regulatory procedures, then your practice would probably never reach your profitability goals.
EQC Advisory provides business consultations, and create custom-made working paper templates, that help your practice, in its entirety, in completing daily tasks and in providing practice protection – in essence, we combine audit effectiveness with audit efficiency. Our consultancy services are not just a mandatory exercise to fulfill HKSQC 1, nor are our training services simply CPD hours. Schedule a consultation session with us now to start developing a sustainable CPA practice.