WEBVTT
00:00:00.160 --> 00:00:03.919
Welcome to Financial Reporting Conversations brought to you by Bas for Consulting.
00:00:04.000 --> 00:00:13.199
We're here to make the unknowns and knowledge of accounting, auditing and climate standards known so you can avoid the blindfredding mistakes and do financial reporting better.
00:00:13.519 --> 00:00:18.239
Each episode will unpack what the standards really say, what they mean in practice.
00:00:18.480 --> 00:00:24.000
Whether you're a preparer, auditor, director, or litigator, our aim is to help you get it right.
00:00:24.559 --> 00:00:31.600
When the company collapses shortly after receiving a clean audit opinion, the same question almost always appears.
00:00:31.839 --> 00:00:33.359
Where were the auditors?
00:00:33.600 --> 00:00:35.759
It's the questions investors ask.
00:00:35.920 --> 00:00:38.159
It's the questions regulators ask.
00:00:38.320 --> 00:00:41.039
And it's the question that dominates the headlines.
00:00:41.200 --> 00:00:44.960
But that question assumes audit failures happen in a single moment.
00:00:45.280 --> 00:00:52.320
Today, Wayne and I are going to talk about that order failure rarely happens at the end of the audit.
00:00:52.560 --> 00:00:57.439
Instead, it develops gradually through a sequence of decisions made throughout the engagement.
00:00:57.679 --> 00:01:00.159
Welcome to Financial Reporting Conversations.
00:01:00.320 --> 00:01:08.480
In this series, Why Audits Go Wrong, we explore the conditions that shape order quality and the situations in which audits can fail.
00:01:08.719 --> 00:01:14.079
In today's episode, we're looking at what we might call the timeline of audit failure.
00:01:14.319 --> 00:01:29.120
We discuss how audit failures can begin before the audit even starts, how misunderstandings about the business can shape the direction of the audit, and why decisions made throughout the engagement ultimately determine the audit opinion.
00:01:29.439 --> 00:01:31.680
As usual, I'm joined by Wayne Bassford.
00:01:31.920 --> 00:01:40.000
Wayne, most people think audit failures occur when the auditor signs the wrong opinion, but you argue that the failure often begins much earlier.
00:01:40.159 --> 00:01:41.120
Why is that?
00:01:41.519 --> 00:01:45.519
I'm trying to frame it as the cascade of audit failure.
00:01:45.760 --> 00:01:52.319
It's just a build-up as we get down each step and then suddenly we issue the wrong audit opinion.
00:01:52.560 --> 00:01:55.599
A lot of lawyers ask me questions.
00:01:55.840 --> 00:02:00.959
The question they asked me, was the financial report prepared in accordance with accounting standards?
00:02:01.120 --> 00:02:04.480
And if your answer to that is no, why not?
00:02:04.959 --> 00:02:11.039
And then the next question is: was the audit performed in accordance with auditing standards?
00:02:11.120 --> 00:02:14.960
And did the auditor issue the correct audit opinion?
00:02:15.120 --> 00:02:18.800
If the answer to that is no, why not?
00:02:19.199 --> 00:02:22.400
And then the answer to that is not they want these.
00:02:22.560 --> 00:02:26.719
My lawyers want it, it's that it was that process there.
00:02:27.520 --> 00:02:58.960
And I typically then take it right the way back to ultimately they accepted the client when they hadn't got the resource to perform the audit, they did not understand the client, they did not understand the client's business, they did not understand its governance, its internal control, its competitors, and because they didn't understand it, they didn't identify the risk of material misstatement, and then this horrible cascade.
00:02:59.199 --> 00:03:10.800
If you don't understand, identify the risk of material misstatement, you just don't do the work, you don't get the evidence, and then at the end you issue the wrong audit opinion.
00:03:10.960 --> 00:03:13.280
But where did that failure start?
00:03:13.599 --> 00:03:18.240
Go right upstream and say you shouldn't have accepted the audit.
00:03:18.560 --> 00:03:20.000
Okay, so let's start there.
00:03:20.159 --> 00:03:22.960
Let's start at that beginning of that audit timeline.
00:03:23.120 --> 00:03:25.759
That why is that stage so important?
00:03:26.159 --> 00:03:27.439
Client acceptance.
00:03:27.840 --> 00:03:34.000
Because you must have the resource to be able to provide reasonable assurance.
00:03:34.400 --> 00:03:36.800
And that's not as easy as it sounds.
00:03:36.960 --> 00:03:40.319
So have you got your sufficient audit teams?
00:03:40.479 --> 00:03:51.840
Very likely have, very likely can get outsourced staff, so you can get numbers, but can you get the right resource that has the experience of that industry?
00:03:52.080 --> 00:03:58.719
Have you got the aspect of dealing with components in foreign countries?
00:03:59.199 --> 00:04:21.600
And remember, if if a company has got weak internal control, if a company has got poor governance, if a company is risky, if a company is expanding, going into new products in an area of great competition, that increases inherent risk.
00:04:22.000 --> 00:04:35.759
And the principle of audit: the more the riskier a client is, the more evidence you need, the more resources you need to provide to that audit to get sufficient appropriate audit evidence.
00:04:35.920 --> 00:04:44.480
And when you look at the number of audit failures, you go, that audit firm should not have accepted that client.
00:04:44.639 --> 00:04:48.560
That audit firm should not have retained that client.
00:04:48.720 --> 00:04:54.560
The audit firm could not put sufficient resources onto that newly acquired business.
00:04:54.800 --> 00:05:02.879
That audit firm really didn't understand that industry to be able to design procedures.
00:05:03.199 --> 00:05:05.839
Let's move on to the next step of the timeline.
00:05:05.920 --> 00:05:10.240
Once the engagement begins, the next step is understanding the business.
00:05:10.399 --> 00:05:13.040
Why does that stage carry so much weight?
00:05:13.439 --> 00:05:15.040
Foundation of all audit.
00:05:15.360 --> 00:05:20.240
I understand the business in order to identify the risk of material misstatement.
00:05:20.480 --> 00:05:26.959
I understand the business in order to determine the significant risks of material misstatement.
00:05:27.360 --> 00:05:40.240
I have to understand its funding, I have to understand its internal control, I have to understand its governance, I have to understand the environment in which the entity is operating in.
00:05:40.480 --> 00:05:51.279
Because all of those increase the risk of material misstatement if I don't understand the business and understanding it an appropriate level of understanding.
00:05:51.839 --> 00:05:57.120
All businesses make widgets, sell widgets, provide services that clean widgets.
00:05:57.360 --> 00:06:00.000
What makes this company unique?
00:06:00.319 --> 00:06:03.839
What is the risks that make this company unique?
00:06:04.000 --> 00:06:09.839
And if you don't understand the business, you don't identify the risks, you don't respond to those risks.
00:06:10.160 --> 00:06:10.879
Thanks, Wayne.
00:06:11.040 --> 00:06:14.480
So by this point of the audit, two things have already happened.
00:06:14.639 --> 00:06:21.920
The firm has decided to accept the client, and the audit team has formed an understanding of the business.
00:06:22.079 --> 00:06:30.240
And Wayne had talked about those early judgments are incorrect, how it can affect and cascades down to the rest of the audit.
00:06:30.480 --> 00:06:33.600
Now let's talk about the next stage, risk assessment.
00:06:33.920 --> 00:06:43.040
You um I think previously you mentioned to me you uh that risk assessment is one of the most critical stages in the entire audit process.
00:06:43.279 --> 00:06:45.600
Why does it play such a central role?
00:06:45.920 --> 00:06:49.439
Well, two bits to going back to that understanding the business.
00:06:49.680 --> 00:07:01.839
Understanding the business is not randomly filing uh copies of ASX announcements or randomly copying uh sections from the director's report.
00:07:02.319 --> 00:07:16.160
Understanding the business is not doing a random uh Bloomberg high-level view of a certain industry, professional services in Australia, technical boutique uh accounting services in Australia.
00:07:16.480 --> 00:07:28.959
You need to understand the business, and then you're only after you've understood the business, what is the risks that could cause a material misstatement, including through fraud or error?
00:07:29.279 --> 00:07:32.319
So which areas are complex?
00:07:32.480 --> 00:07:36.800
You know you go into inherent risk, which areas are complex?
00:07:37.120 --> 00:07:43.680
That'd be revenue recognition, impairment, share based payments, derivative, etc.
00:07:44.319 --> 00:07:51.759
Which aspects are subjective estimates, share base payments, revenue, impairment, etc.
00:07:52.399 --> 00:07:55.279
Which areas are subject to bias?
00:07:55.439 --> 00:07:58.560
Well, what and what drives bias?
00:07:58.959 --> 00:08:02.560
Now that is risk identification, and you do that by assertion.
00:08:02.800 --> 00:08:14.800
The number of audit files I see because ISA 240 tells us to revenue recognition is a significant risk and material misstatement.
00:08:15.600 --> 00:08:17.439
I see that key audit matters.
00:08:17.600 --> 00:08:21.839
We have determined that revenue recognition is a significant risk and material misstatement.
00:08:22.319 --> 00:08:37.440
You live in a world of IFRS 15 five-step approach, the number of key audit matters that do not address which bit of the five-step approach could give a significant risk and material misstatement.
00:08:38.159 --> 00:08:39.440
Is that step one?
00:08:39.600 --> 00:08:41.600
Is it performance obligations?
00:08:41.840 --> 00:08:43.440
Is it step three?
00:08:44.080 --> 00:08:51.679
Consideration, is it step four, which is most likely allocating consideration to the distinct performance obligations?
00:08:51.919 --> 00:08:56.480
You can't just say revenue recognition is a risk material misstatement.
00:08:56.639 --> 00:09:01.759
You need to get underneath it and say, this is how it could go wrong.
00:09:02.000 --> 00:09:13.840
This is what could cause a material misstatement, and I am going to design this procedure to make sure they got step one right or stop step four right.
00:09:14.000 --> 00:09:16.320
I am doing construction contracts.
00:09:16.559 --> 00:09:29.279
There is a risk that that new contract that we won on a massively competitive tender building something that we've never built before in a jurisdiction that we've never built before.
00:09:29.600 --> 00:09:32.960
Maybe that's the one that could go wrong.
00:09:33.200 --> 00:09:39.360
Maybe that's the one where I might be underestimating my cost to complete.
00:09:39.679 --> 00:09:50.639
And because that I understand the business, I am going to focus all of my attention on the cost to complete estimates on contract C.
00:09:51.120 --> 00:09:55.440
You need to understand the risks at the appropriate level.
00:09:55.759 --> 00:10:00.879
If you're finding this discussion useful, please take a moment to click like, subscribe, and share.
00:10:01.120 --> 00:10:09.440
It helps others in the financial reporting community discover financial reporting conversations and keeps you up to date with every new episode.
00:10:09.679 --> 00:10:19.279
So once we identify the risk and understand the risk at the appropriate level, the audit teams are meant to design procedures to address them.
00:10:19.519 --> 00:10:21.759
Where can things go wrong at that stage?
00:10:22.080 --> 00:10:26.320
Copy and paste, use the standard work program, no tailoring.
00:10:26.879 --> 00:10:30.240
We will always test five contracts, ten contracts.
00:10:30.480 --> 00:10:42.159
We've not focused in on what a lot of auditors these days don't understand the assertion that the test is they don't understand the risk by assertion.
00:10:42.320 --> 00:10:48.159
They then don't understand what assertion an audit procedure is addressing.
00:10:48.399 --> 00:10:57.919
And again, this horrible phrase that we're using too much, it turns into a filing exercise, not an auditing exercise.
00:10:58.159 --> 00:11:05.759
My job is to collect randomly 10 tests from the library within caseware.
00:11:06.000 --> 00:11:08.960
I will then randomly file that information.
00:11:09.120 --> 00:11:20.879
Well, sorry, it won't, I'll file it in the correct section of the audit file, and I will not tie in anything to do with risks and evidence.
00:11:21.200 --> 00:11:30.720
This is just purely a filing exercise because I want this busy season over as quickly as I possibly can without thinking about risk.
00:11:31.039 --> 00:11:38.240
Yep, so once we have designed our procedures, what risk arise during the execution stage?
00:11:38.639 --> 00:11:39.519
Not thinking.
00:11:39.759 --> 00:11:51.679
We've designed the procedures, they're good procedures, they might actually be the appropriate procedure, but the person undertaking those procedures doesn't really understand why they're doing those procedures.
00:11:52.000 --> 00:12:10.159
The person really, again, doesn't want to think about why they're doing those procedures, just wants to get it finished, wants to file it, wants to go home, and ignores contradictory audit evidence, ignores that doesn't make sense.
00:12:10.399 --> 00:12:22.720
The one I classically like we do sampling, we do statistical sampling, and annoyingly with statistical sampling, you find an error, and then the oh god, I'll I'll pick another one.
00:12:23.440 --> 00:12:24.240
Oh, that's good.
00:12:24.320 --> 00:12:26.000
The second one I picked worked.
00:12:26.879 --> 00:12:30.879
Completely understanding the idea of statistics and statistical sampling.
00:12:31.120 --> 00:12:36.799
So people do not understand, they they trust the human nature.
00:12:36.960 --> 00:12:42.879
I don't going back to the commerciality or it or even human nature, I don't want to upset my client.
00:12:42.960 --> 00:12:50.720
I really if the more questions I ask, the more work I've got to do, and the chances are the more annoyed my client will be.
00:12:50.879 --> 00:12:52.559
Let's just not ask that question.
00:12:52.639 --> 00:12:55.279
You know, that's once you get into this execution phase.
00:12:55.600 --> 00:13:04.720
To the next step, when we've put all the procedures and we've got all the findings or evidence gathered, I think that's the technical term.
00:13:04.879 --> 00:13:06.720
What do you do at that stage?
00:13:06.879 --> 00:13:08.399
What's the next step?
00:13:08.799 --> 00:13:15.600
So when we get into ACE 330, when we get into ACE 700, you need to step back.
00:13:16.240 --> 00:13:22.000
Have I got sufficient appropriate audit evidence to issue reasonable assurance?
00:13:22.320 --> 00:13:32.399
Have I got enough work to say revenues recognized under in accordance with 15, the recoverable amount makes sense under 36?
00:13:33.200 --> 00:13:34.320
Step back.
00:13:34.960 --> 00:13:40.480
And then you go, and have I got any contradictory audit evidence?
00:13:40.720 --> 00:14:06.879
And that contradictory audit evidence can come through procedures, can come about through subsequent event testing, ISA 560 testing, and does my knowledge of this business all make sense, and I'm happy revenue makes sense, I'm happy that going concern it makes sense, I'm happy recoverable amount makes sense.
00:14:07.039 --> 00:14:10.960
I'm not stepping back in anything because I've not looked at it, it makes no sense.
00:14:11.200 --> 00:14:15.919
But all I'm doing is making sure each component is full.
00:14:16.240 --> 00:14:24.480
Everything's been filed, doesn't matter what it is, but I I've finished the audit because I put something in every box.
00:14:25.120 --> 00:14:29.279
That's not how an audit works, or that's not how an audit should work.
00:14:29.600 --> 00:14:37.360
After we evaluate the evidence, uh then we come to a point where we had to express an audit opinion.
00:14:37.519 --> 00:14:42.320
If weaknesses have occurred throughout the earlier stages, what happens at this point?
00:14:42.559 --> 00:14:49.360
You get the audit opinion wrong and you failed the objective of an audit as set out in ISA 200.
00:14:49.840 --> 00:14:57.600
You give an unmodified opinion on a set of financials that is materially misstated.
00:14:58.399 --> 00:15:01.840
And you know that is this cascade of audit failure.
00:15:02.080 --> 00:15:05.679
Why did I end up issuing that wrong opinion?
00:15:06.159 --> 00:15:09.039
Well, I never understood the business.
00:15:09.279 --> 00:15:15.840
I send a team out that would never have been able to spot a risk, even if it had hit them in the face.
00:15:16.399 --> 00:15:22.000
The team could not design procedures to respond to that risk.
00:15:22.159 --> 00:15:26.879
They just randomly collected procedures from the caseware library.
00:15:27.279 --> 00:15:37.360
They got the audit evidence and they didn't read it, they ignored contradictory audit evidence, but chances are it's a good client.
00:15:38.000 --> 00:15:45.919
Statistically, 99% of clients prepare their accounts correctly.
00:15:46.320 --> 00:15:54.480
Or maybe less than that, but statistically, nobody will ever find out that the client didn't prepare their accounts correctly.
00:15:54.799 --> 00:16:00.720
So sign an unmodified audit opinion incorrectly and fail the objective of an audit.
00:16:00.960 --> 00:16:08.960
Wrapping up with one final question: what is the lesson someone listening should take away from our discussion today?
00:16:09.279 --> 00:16:15.200
It is audit is a process, a quality audit is a process.
00:16:15.600 --> 00:16:19.519
It is not I can sign off at the end of it.
00:16:19.840 --> 00:16:27.840
I will just be able to look at an audit file in the last week of September and pull it out of the mess.
00:16:28.080 --> 00:16:32.240
It has got bedrock of the firm, the firm's quality management.
00:16:32.480 --> 00:16:38.080
Have you got processes for only accepting audits that you can properly staff?
00:16:38.320 --> 00:16:43.840
Have you got a process for allocating the appropriate staff, training the staff?
00:16:44.320 --> 00:17:03.360
So I sitting there as head of audit, I am happy my firm will only accept audits it can audit that he can actually have sufficient resources to get sufficient appropriate audit evidence to provide reasonable assurance.
00:17:03.600 --> 00:17:17.839
My team, I send my teams out to the client, they know the industry, they've given enough time to understand the industry, and they will take diligently, they will understand the business.
00:17:18.079 --> 00:17:34.720
And when they're understanding the business, they're not just copying pasting from the director's report or ASX announcements, they are understanding the business with start with the end in mind, they are understanding the business to identify the risk of material misstatement.
00:17:35.839 --> 00:17:55.519
And once they identify the risk and misstatement, and they actually understand how risk misstatement work by assertion, that team is skilled enough to design, pick the procedures from the caseware library to address those risks by assertion.
00:17:56.480 --> 00:18:05.359
The team, even though it's delegated down to lower levels grads, they perform those procedures diligently.
00:18:05.920 --> 00:18:13.440
And if they ever s see any contradictory audit evidence, they will consider the contradictory audit evidence.
00:18:13.599 --> 00:18:27.440
They are sceptical, they're questioning, they're not just filing, they're actually being auditors, and then we step back before we rushed oh we've got to sign off, it's it's uh deadlines in three days' time.
00:18:27.680 --> 00:18:34.160
The audit partner, the engagement partner, is in sufficient time, does stand back?
00:18:34.319 --> 00:18:35.440
What were the risks?
00:18:35.599 --> 00:18:46.000
Read his key audit matters, and I have I got sufficient audit evidence to give an opinion on those key audit matters.
00:18:46.319 --> 00:18:49.279
Is there any contradictory audit evidence?
00:18:50.000 --> 00:19:07.359
And this is auditing 101, but this stage of an audit, horribly when you look at audit failures, which one went wrong, it's it starts upstream and then just smashes down the rapids until the wrong audit opinion.
00:19:07.680 --> 00:19:14.559
Audit failure is not just a single event when the audit partner signs the wrong opinion.
00:19:14.720 --> 00:19:20.880
It's usually the result of a sequence of decisions, as Wayne have talked about, made throughout the engagement.
00:19:21.039 --> 00:19:30.640
And understanding that timeline helps explain why improving audit quality requires attention and thought at every stage of the audit process.
00:19:31.119 --> 00:19:39.920
And this is what our series talks about why audits go wrong and we explore different issues that contribute to audits going wrong.
00:19:40.160 --> 00:19:52.319
So thank you for joining us for this episode of Financial Reporting Conversations, and we hope you will join us next time when we continue to examine the risks and decisions that shape financial reporting and audit quality.
00:19:52.640 --> 00:19:55.440
Thanks for listening to Financial Reporting Conversations.
00:19:55.519 --> 00:20:03.279
For guidance on applying accounting and auditing standards or to access our online training programs, please visit basfordconsulting.com.
00:20:03.519 --> 00:20:07.920
Don't forget to like, subscribe, and share this episode with your colleagues and contacts.
00:20:08.000 --> 00:20:12.799
We'll see you next time where we make the unknowns in financial reporting known.
00:00:00.160 --> 00:00:03.919
Welcome to Financial Reporting Conversations brought to you by Bas for Consulting.
00:00:04.000 --> 00:00:13.199
We're here to make the unknowns and knowledge of accounting, auditing and climate standards known so you can avoid the blindfredding mistakes and do financial reporting better.
00:00:13.519 --> 00:00:18.239
Each episode will unpack what the standards really say, what they mean in practice.
00:00:18.480 --> 00:00:24.000
Whether you're a preparer, auditor, director, or litigator, our aim is to help you get it right.
00:00:24.559 --> 00:00:31.600
When the company collapses shortly after receiving a clean audit opinion, the same question almost always appears.
00:00:31.839 --> 00:00:33.359
Where were the auditors?
00:00:33.600 --> 00:00:35.759
It's the questions investors ask.
00:00:35.920 --> 00:00:38.159
It's the questions regulators ask.
00:00:38.320 --> 00:00:41.039
And it's the question that dominates the headlines.
00:00:41.200 --> 00:00:44.960
But that question assumes audit failures happen in a single moment.
00:00:45.280 --> 00:00:52.320
Today, Wayne and I are going to talk about that order failure rarely happens at the end of the audit.
00:00:52.560 --> 00:00:57.439
Instead, it develops gradually through a sequence of decisions made throughout the engagement.
00:00:57.679 --> 00:01:00.159
Welcome to Financial Reporting Conversations.
00:01:00.320 --> 00:01:08.480
In this series, Why Audits Go Wrong, we explore the conditions that shape order quality and the situations in which audits can fail.
00:01:08.719 --> 00:01:14.079
In today's episode, we're looking at what we might call the timeline of audit failure.
00:01:14.319 --> 00:01:29.120
We discuss how audit failures can begin before the audit even starts, how misunderstandings about the business can shape the direction of the audit, and why decisions made throughout the engagement ultimately determine the audit opinion.
00:01:29.439 --> 00:01:31.680
As usual, I'm joined by Wayne Bassford.
00:01:31.920 --> 00:01:40.000
Wayne, most people think audit failures occur when the auditor signs the wrong opinion, but you argue that the failure often begins much earlier.
00:01:40.159 --> 00:01:41.120
Why is that?
00:01:41.519 --> 00:01:45.519
I'm trying to frame it as the cascade of audit failure.
00:01:45.760 --> 00:01:52.319
It's just a build-up as we get down each step and then suddenly we issue the wrong audit opinion.
00:01:52.560 --> 00:01:55.599
A lot of lawyers ask me questions.
00:01:55.840 --> 00:02:00.959
The question they asked me, was the financial report prepared in accordance with accounting standards?
00:02:01.120 --> 00:02:04.480
And if your answer to that is no, why not?
00:02:04.959 --> 00:02:11.039
And then the next question is: was the audit performed in accordance with auditing standards?
00:02:11.120 --> 00:02:14.960
And did the auditor issue the correct audit opinion?
00:02:15.120 --> 00:02:18.800
If the answer to that is no, why not?
00:02:19.199 --> 00:02:22.400
And then the answer to that is not they want these.
00:02:22.560 --> 00:02:26.719
My lawyers want it, it's that it was that process there.
00:02:27.520 --> 00:02:58.960
And I typically then take it right the way back to ultimately they accepted the client when they hadn't got the resource to perform the audit, they did not understand the client, they did not understand the client's business, they did not understand its governance, its internal control, its competitors, and because they didn't understand it, they didn't identify the risk of material misstatement, and then this horrible cascade.
00:02:59.199 --> 00:03:10.800
If you don't understand, identify the risk of material misstatement, you just don't do the work, you don't get the evidence, and then at the end you issue the wrong audit opinion.
00:03:10.960 --> 00:03:13.280
But where did that failure start?
00:03:13.599 --> 00:03:18.240
Go right upstream and say you shouldn't have accepted the audit.
00:03:18.560 --> 00:03:20.000
Okay, so let's start there.
00:03:20.159 --> 00:03:22.960
Let's start at that beginning of that audit timeline.
00:03:23.120 --> 00:03:25.759
That why is that stage so important?
00:03:26.159 --> 00:03:27.439
Client acceptance.
00:03:27.840 --> 00:03:34.000
Because you must have the resource to be able to provide reasonable assurance.
00:03:34.400 --> 00:03:36.800
And that's not as easy as it sounds.
00:03:36.960 --> 00:03:40.319
So have you got your sufficient audit teams?
00:03:40.479 --> 00:03:51.840
Very likely have, very likely can get outsourced staff, so you can get numbers, but can you get the right resource that has the experience of that industry?
00:03:52.080 --> 00:03:58.719
Have you got the aspect of dealing with components in foreign countries?
00:03:59.199 --> 00:04:21.600
And remember, if if a company has got weak internal control, if a company has got poor governance, if a company is risky, if a company is expanding, going into new products in an area of great competition, that increases inherent risk.
00:04:22.000 --> 00:04:35.759
And the principle of audit: the more the riskier a client is, the more evidence you need, the more resources you need to provide to that audit to get sufficient appropriate audit evidence.
00:04:35.920 --> 00:04:44.480
And when you look at the number of audit failures, you go, that audit firm should not have accepted that client.
00:04:44.639 --> 00:04:48.560
That audit firm should not have retained that client.
00:04:48.720 --> 00:04:54.560
The audit firm could not put sufficient resources onto that newly acquired business.
00:04:54.800 --> 00:05:02.879
That audit firm really didn't understand that industry to be able to design procedures.
00:05:03.199 --> 00:05:05.839
Let's move on to the next step of the timeline.
00:05:05.920 --> 00:05:10.240
Once the engagement begins, the next step is understanding the business.
00:05:10.399 --> 00:05:13.040
Why does that stage carry so much weight?
00:05:13.439 --> 00:05:15.040
Foundation of all audit.
00:05:15.360 --> 00:05:20.240
I understand the business in order to identify the risk of material misstatement.
00:05:20.480 --> 00:05:26.959
I understand the business in order to determine the significant risks of material misstatement.
00:05:27.360 --> 00:05:40.240
I have to understand its funding, I have to understand its internal control, I have to understand its governance, I have to understand the environment in which the entity is operating in.
00:05:40.480 --> 00:05:51.279
Because all of those increase the risk of material misstatement if I don't understand the business and understanding it an appropriate level of understanding.
00:05:51.839 --> 00:05:57.120
All businesses make widgets, sell widgets, provide services that clean widgets.
00:05:57.360 --> 00:06:00.000
What makes this company unique?
00:06:00.319 --> 00:06:03.839
What is the risks that make this company unique?
00:06:04.000 --> 00:06:09.839
And if you don't understand the business, you don't identify the risks, you don't respond to those risks.
00:06:10.160 --> 00:06:10.879
Thanks, Wayne.
00:06:11.040 --> 00:06:14.480
So by this point of the audit, two things have already happened.
00:06:14.639 --> 00:06:21.920
The firm has decided to accept the client, and the audit team has formed an understanding of the business.
00:06:22.079 --> 00:06:30.240
And Wayne had talked about those early judgments are incorrect, how it can affect and cascades down to the rest of the audit.
00:06:30.480 --> 00:06:33.600
Now let's talk about the next stage, risk assessment.
00:06:33.920 --> 00:06:43.040
You um I think previously you mentioned to me you uh that risk assessment is one of the most critical stages in the entire audit process.
00:06:43.279 --> 00:06:45.600
Why does it play such a central role?
00:06:45.920 --> 00:06:49.439
Well, two bits to going back to that understanding the business.
00:06:49.680 --> 00:07:01.839
Understanding the business is not randomly filing uh copies of ASX announcements or randomly copying uh sections from the director's report.
00:07:02.319 --> 00:07:16.160
Understanding the business is not doing a random uh Bloomberg high-level view of a certain industry, professional services in Australia, technical boutique uh accounting services in Australia.
00:07:16.480 --> 00:07:28.959
You need to understand the business, and then you're only after you've understood the business, what is the risks that could cause a material misstatement, including through fraud or error?
00:07:29.279 --> 00:07:32.319
So which areas are complex?
00:07:32.480 --> 00:07:36.800
You know you go into inherent risk, which areas are complex?
00:07:37.120 --> 00:07:43.680
That'd be revenue recognition, impairment, share based payments, derivative, etc.
00:07:44.319 --> 00:07:51.759
Which aspects are subjective estimates, share base payments, revenue, impairment, etc.
00:07:52.399 --> 00:07:55.279
Which areas are subject to bias?
00:07:55.439 --> 00:07:58.560
Well, what and what drives bias?
00:07:58.959 --> 00:08:02.560
Now that is risk identification, and you do that by assertion.
00:08:02.800 --> 00:08:14.800
The number of audit files I see because ISA 240 tells us to revenue recognition is a significant risk and material misstatement.
00:08:15.600 --> 00:08:17.439
I see that key audit matters.
00:08:17.600 --> 00:08:21.839
We have determined that revenue recognition is a significant risk and material misstatement.
00:08:22.319 --> 00:08:37.440
You live in a world of IFRS 15 five-step approach, the number of key audit matters that do not address which bit of the five-step approach could give a significant risk and material misstatement.
00:08:38.159 --> 00:08:39.440
Is that step one?
00:08:39.600 --> 00:08:41.600
Is it performance obligations?
00:08:41.840 --> 00:08:43.440
Is it step three?
00:08:44.080 --> 00:08:51.679
Consideration, is it step four, which is most likely allocating consideration to the distinct performance obligations?
00:08:51.919 --> 00:08:56.480
You can't just say revenue recognition is a risk material misstatement.
00:08:56.639 --> 00:09:01.759
You need to get underneath it and say, this is how it could go wrong.
00:09:02.000 --> 00:09:13.840
This is what could cause a material misstatement, and I am going to design this procedure to make sure they got step one right or stop step four right.
00:09:14.000 --> 00:09:16.320
I am doing construction contracts.
00:09:16.559 --> 00:09:29.279
There is a risk that that new contract that we won on a massively competitive tender building something that we've never built before in a jurisdiction that we've never built before.
00:09:29.600 --> 00:09:32.960
Maybe that's the one that could go wrong.
00:09:33.200 --> 00:09:39.360
Maybe that's the one where I might be underestimating my cost to complete.
00:09:39.679 --> 00:09:50.639
And because that I understand the business, I am going to focus all of my attention on the cost to complete estimates on contract C.
00:09:51.120 --> 00:09:55.440
You need to understand the risks at the appropriate level.
00:09:55.759 --> 00:10:00.879
If you're finding this discussion useful, please take a moment to click like, subscribe, and share.
00:10:01.120 --> 00:10:09.440
It helps others in the financial reporting community discover financial reporting conversations and keeps you up to date with every new episode.
00:10:09.679 --> 00:10:19.279
So once we identify the risk and understand the risk at the appropriate level, the audit teams are meant to design procedures to address them.
00:10:19.519 --> 00:10:21.759
Where can things go wrong at that stage?
00:10:22.080 --> 00:10:26.320
Copy and paste, use the standard work program, no tailoring.
00:10:26.879 --> 00:10:30.240
We will always test five contracts, ten contracts.
00:10:30.480 --> 00:10:42.159
We've not focused in on what a lot of auditors these days don't understand the assertion that the test is they don't understand the risk by assertion.
00:10:42.320 --> 00:10:48.159
They then don't understand what assertion an audit procedure is addressing.
00:10:48.399 --> 00:10:57.919
And again, this horrible phrase that we're using too much, it turns into a filing exercise, not an auditing exercise.
00:10:58.159 --> 00:11:05.759
My job is to collect randomly 10 tests from the library within caseware.
00:11:06.000 --> 00:11:08.960
I will then randomly file that information.
00:11:09.120 --> 00:11:20.879
Well, sorry, it won't, I'll file it in the correct section of the audit file, and I will not tie in anything to do with risks and evidence.
00:11:21.200 --> 00:11:30.720
This is just purely a filing exercise because I want this busy season over as quickly as I possibly can without thinking about risk.
00:11:31.039 --> 00:11:38.240
Yep, so once we have designed our procedures, what risk arise during the execution stage?
00:11:38.639 --> 00:11:39.519
Not thinking.
00:11:39.759 --> 00:11:51.679
We've designed the procedures, they're good procedures, they might actually be the appropriate procedure, but the person undertaking those procedures doesn't really understand why they're doing those procedures.
00:11:52.000 --> 00:12:10.159
The person really, again, doesn't want to think about why they're doing those procedures, just wants to get it finished, wants to file it, wants to go home, and ignores contradictory audit evidence, ignores that doesn't make sense.
00:12:10.399 --> 00:12:22.720
The one I classically like we do sampling, we do statistical sampling, and annoyingly with statistical sampling, you find an error, and then the oh god, I'll I'll pick another one.
00:12:23.440 --> 00:12:24.240
Oh, that's good.
00:12:24.320 --> 00:12:26.000
The second one I picked worked.
00:12:26.879 --> 00:12:30.879
Completely understanding the idea of statistics and statistical sampling.
00:12:31.120 --> 00:12:36.799
So people do not understand, they they trust the human nature.
00:12:36.960 --> 00:12:42.879
I don't going back to the commerciality or it or even human nature, I don't want to upset my client.
00:12:42.960 --> 00:12:50.720
I really if the more questions I ask, the more work I've got to do, and the chances are the more annoyed my client will be.
00:12:50.879 --> 00:12:52.559
Let's just not ask that question.
00:12:52.639 --> 00:12:55.279
You know, that's once you get into this execution phase.
00:12:55.600 --> 00:13:04.720
To the next step, when we've put all the procedures and we've got all the findings or evidence gathered, I think that's the technical term.
00:13:04.879 --> 00:13:06.720
What do you do at that stage?
00:13:06.879 --> 00:13:08.399
What's the next step?
00:13:08.799 --> 00:13:15.600
So when we get into ACE 330, when we get into ACE 700, you need to step back.
00:13:16.240 --> 00:13:22.000
Have I got sufficient appropriate audit evidence to issue reasonable assurance?
00:13:22.320 --> 00:13:32.399
Have I got enough work to say revenues recognized under in accordance with 15, the recoverable amount makes sense under 36?
00:13:33.200 --> 00:13:34.320
Step back.
00:13:34.960 --> 00:13:40.480
And then you go, and have I got any contradictory audit evidence?
00:13:40.720 --> 00:14:06.879
And that contradictory audit evidence can come through procedures, can come about through subsequent event testing, ISA 560 testing, and does my knowledge of this business all make sense, and I'm happy revenue makes sense, I'm happy that going concern it makes sense, I'm happy recoverable amount makes sense.
00:14:07.039 --> 00:14:10.960
I'm not stepping back in anything because I've not looked at it, it makes no sense.
00:14:11.200 --> 00:14:15.919
But all I'm doing is making sure each component is full.
00:14:16.240 --> 00:14:24.480
Everything's been filed, doesn't matter what it is, but I I've finished the audit because I put something in every box.
00:14:25.120 --> 00:14:29.279
That's not how an audit works, or that's not how an audit should work.
00:14:29.600 --> 00:14:37.360
After we evaluate the evidence, uh then we come to a point where we had to express an audit opinion.
00:14:37.519 --> 00:14:42.320
If weaknesses have occurred throughout the earlier stages, what happens at this point?
00:14:42.559 --> 00:14:49.360
You get the audit opinion wrong and you failed the objective of an audit as set out in ISA 200.
00:14:49.840 --> 00:14:57.600
You give an unmodified opinion on a set of financials that is materially misstated.
00:14:58.399 --> 00:15:01.840
And you know that is this cascade of audit failure.
00:15:02.080 --> 00:15:05.679
Why did I end up issuing that wrong opinion?
00:15:06.159 --> 00:15:09.039
Well, I never understood the business.
00:15:09.279 --> 00:15:15.840
I send a team out that would never have been able to spot a risk, even if it had hit them in the face.
00:15:16.399 --> 00:15:22.000
The team could not design procedures to respond to that risk.
00:15:22.159 --> 00:15:26.879
They just randomly collected procedures from the caseware library.
00:15:27.279 --> 00:15:37.360
They got the audit evidence and they didn't read it, they ignored contradictory audit evidence, but chances are it's a good client.
00:15:38.000 --> 00:15:45.919
Statistically, 99% of clients prepare their accounts correctly.
00:15:46.320 --> 00:15:54.480
Or maybe less than that, but statistically, nobody will ever find out that the client didn't prepare their accounts correctly.
00:15:54.799 --> 00:16:00.720
So sign an unmodified audit opinion incorrectly and fail the objective of an audit.
00:16:00.960 --> 00:16:08.960
Wrapping up with one final question: what is the lesson someone listening should take away from our discussion today?
00:16:09.279 --> 00:16:15.200
It is audit is a process, a quality audit is a process.
00:16:15.600 --> 00:16:19.519
It is not I can sign off at the end of it.
00:16:19.840 --> 00:16:27.840
I will just be able to look at an audit file in the last week of September and pull it out of the mess.
00:16:28.080 --> 00:16:32.240
It has got bedrock of the firm, the firm's quality management.
00:16:32.480 --> 00:16:38.080
Have you got processes for only accepting audits that you can properly staff?
00:16:38.320 --> 00:16:43.840
Have you got a process for allocating the appropriate staff, training the staff?
00:16:44.320 --> 00:17:03.360
So I sitting there as head of audit, I am happy my firm will only accept audits it can audit that he can actually have sufficient resources to get sufficient appropriate audit evidence to provide reasonable assurance.
00:17:03.600 --> 00:17:17.839
My team, I send my teams out to the client, they know the industry, they've given enough time to understand the industry, and they will take diligently, they will understand the business.
00:17:18.079 --> 00:17:34.720
And when they're understanding the business, they're not just copying pasting from the director's report or ASX announcements, they are understanding the business with start with the end in mind, they are understanding the business to identify the risk of material misstatement.
00:17:35.839 --> 00:17:55.519
And once they identify the risk and misstatement, and they actually understand how risk misstatement work by assertion, that team is skilled enough to design, pick the procedures from the caseware library to address those risks by assertion.
00:17:56.480 --> 00:18:05.359
The team, even though it's delegated down to lower levels grads, they perform those procedures diligently.
00:18:05.920 --> 00:18:13.440
And if they ever s see any contradictory audit evidence, they will consider the contradictory audit evidence.
00:18:13.599 --> 00:18:27.440
They are sceptical, they're questioning, they're not just filing, they're actually being auditors, and then we step back before we rushed oh we've got to sign off, it's it's uh deadlines in three days' time.
00:18:27.680 --> 00:18:34.160
The audit partner, the engagement partner, is in sufficient time, does stand back?
00:18:34.319 --> 00:18:35.440
What were the risks?
00:18:35.599 --> 00:18:46.000
Read his key audit matters, and I have I got sufficient audit evidence to give an opinion on those key audit matters.
00:18:46.319 --> 00:18:49.279
Is there any contradictory audit evidence?
00:18:50.000 --> 00:19:07.359
And this is auditing 101, but this stage of an audit, horribly when you look at audit failures, which one went wrong, it's it starts upstream and then just smashes down the rapids until the wrong audit opinion.
00:19:07.680 --> 00:19:14.559
Audit failure is not just a single event when the audit partner signs the wrong opinion.
00:19:14.720 --> 00:19:20.880
It's usually the result of a sequence of decisions, as Wayne have talked about, made throughout the engagement.
00:19:21.039 --> 00:19:30.640
And understanding that timeline helps explain why improving audit quality requires attention and thought at every stage of the audit process.
00:19:31.119 --> 00:19:39.920
And this is what our series talks about why audits go wrong and we explore different issues that contribute to audits going wrong.
00:19:40.160 --> 00:19:52.319
So thank you for joining us for this episode of Financial Reporting Conversations, and we hope you will join us next time when we continue to examine the risks and decisions that shape financial reporting and audit quality.
00:19:52.640 --> 00:19:55.440
Thanks for listening to Financial Reporting Conversations.
00:19:55.519 --> 00:20:03.279
For guidance on applying accounting and auditing standards or to access our online training programs, please visit basfordconsulting.com.
00:20:03.519 --> 00:20:07.920
Don't forget to like, subscribe, and share this episode with your colleagues and contacts.
00:20:08.000 --> 00:20:12.799
We'll see you next time where we make the unknowns in financial reporting known.
