The Big 4 audit firms, and audit in general really, have been through a lot over the past number of years. There have been numerous calls for the improvement in audit quality. Followed by very high profile reviews such as the Brydon Review in the UK, and the aptly named Audit Inquiry in Australia. With each of these reviews, pressure also fell on regulators to become tougher on audit firms and ensure there is an overall improvement in the audit quality. Now whilst each of these reviews, and this blog post, focus on external / financial statement audit, the underlying issues and message can be applied to internal audit. You may have recently read about the KPMG Partner who was recently fined by the FRC. Granted, whilst the fine does relate to an audit performed in 2016, part of the issues identified can exist in internal audits also. As mentioned by Accountancy Daily, the breaches by KPMG “concerned KPMG’s failure to apply sufficient professional scepticism, or to obtain and document sufficient appropriate audit evidence”. Only both fronts, the exact same issues can exist in an internal audit. The ultimate way to ensure there has been a good level of professional scepticism and there is sufficient and appropriate audit evidence, is to ensure there is a good audit review process during the audit. A failure point for any audit function is that too often, audit reviews are performed at the end of the audit, which is too late to identify any issues. Whilst audit functions vary greatly, in either they are a flat structure with the team reporting directly to the head of audit, or they are hierarchical, there is still a need to have an active review process, and this is exactly what could have assisted KPMG in avoiding yet another fine. Throughout an audit, there are a number of things which can be done to help ensure a good quality review is performed. Many of the below items actually form part of the Irish Auditing & Accounting Supervisory Authority (IAASA) audit quality assessment. Tips for ensuring good audit quality include:
Setting the tone at the top. Making it clear that audit quality should be a the forefront of everything we do and regularly reminding team members of this.
Setting the standard for audit quality. At its simplest, checklists can be developed for teams to help ensure they have done everything. We have developed a range of checklists which focus on each area of the audit; planning, fieldwork, reporting. Using these checklists provides the audit team with the opportunity to assess their own audit quality first. They also allow senior team members to review the file and educate more junior members where they have not met expectations.
Perform live reviews. Don’t leave the review of the file until the end. By this point, fieldwork is likely all finished up and the report is close to being finalised. Performing reviews of the file regularly and ensuring frequent updates / meetings helps ensure the quality of the audit file, but also educate and assist more junior team members.
Regular feedback and training. You don’t know what you can improve on if you are never told. By establishing a good feedback process (which isn’t too late), and providing regular training, we can help increase the level of audit quality.
Whilst some of these points above may have helped KPMG avoid another fine, ultimately, auditors need to use an appropriate level of scepticism, challenge what we are doing, and ensure all of our work is documented. If it’s not documented, its not done. But KPMG is not alone. Only recently did the Irish Auditing & Accounting Supervisory Authority (IAASA) release a series of reports on audit quality from Ireland which further highlighted the importance of audit quality. In two of the four audits selected for review by the IAASA, it was found that EY did not have sufficient evidence of the audit quality review. So whilst we need to ensure that our audit work is documented properly, we also need to ensure our review of the audits are documented properly. There is always going to be an opportunity to improve our audit quality, however we need to ensure that we have created the right environment within our audit functions, provided the right tools, regular training and frequent feedback. Once we have developed and embedded the fundamentals, we should be able to see the quality of our audits improve exponentially.