7513 Actions on discovery of possible non-compliance with laws and regulations

Jun-2020

CAS Guidance

The auditor may become aware of information concerning an instance of non‑compliance with laws and regulations other than as a result of performing the procedures in paragraphs 13‑17 (e.g., when the auditor is alerted to non‑compliance by a whistle blower) (CAS 250.A17).

The following matters may be an indication of non‑compliance with laws and regulations (CAS 250. A18):

• Investigations by regulatory organizations and government departments or payment of fines or penalties;

• Payments for unspecified services or loans to consultants, related parties, employees or government employees;

• Sales commissions or agent’s fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or to the services actually received;

• Purchasing at prices significantly above or below market price;

• Unusual payments in cash, purchases in the form of cashiers’ cheques payable to bearer or transfers to numbered bank accounts;

• Unusual transactions with companies registered in tax havens;

• Payments for goods or services made other than to the country from which the goods or services originated;

• Payments without proper exchange control documentation;

• Existence of an information system which fails, whether by design or by accident, to provide an adequate audit trail or sufficient evidence;

• Unauthorized transactions or improperly recorded transactions;

• Adverse media comment.

Matters relevant to the auditor’s evaluation of the possible effect on the financial statements include (CAS 250.A19):

• The potential financial consequences of identified or suspected non‑compliance with laws and regulations on the financial statements including, for example, the imposition of fines, penalties, damages, threat of expropriation of assets, enforced discontinuation of operations, and litigation;

• Whether the potential financial consequences require disclosure;

• Whether the potential financial consequences are so serious as to call into question the fair presentation of the financial statements, or otherwise make the financial statements misleading.

CAS Guidance

The auditor is required to discuss the suspected non‑compliance with the appropriate level of management and, where appropriate, those charged with governance, as they may be able to provide additional audit evidence. For example, the auditor may confirm that management and, where appropriate, those charged with governance have the same understanding of the facts and circumstances relevant to transactions or events that have led to the suspected non‑compliance with laws and regulations (CAS 250.A20).

However, in some jurisdictions, law or regulation may restrict the auditor’s communication of certain matters with management and those charged with governance. Law or regulation may specifically prohibit a communication, or other action, that might prejudice an investigation by an appropriate authority into an actual, or suspected, illegal act, including alerting the entity, for example, when the auditor is required to report the identified or suspected non‑compliance to an appropriate authority pursuant to anti-money laundering legislation. In these circumstances, the issues considered by the auditor may be complex and the auditor may consider it appropriate to obtain legal advice (CAS 250.A21).

If management or, as appropriate, those charged with governance do not provide sufficient information to the auditor that the entity is in fact in compliance with laws and regulations, the auditor may consider it appropriate to consult with the entity’s in-house or external legal counsel about the application of the laws and regulations to the circumstances, including the possibility of fraud, and the possible effects on the financial statements. If it is not considered appropriate to consult with the entity’s legal counsel or if the auditor is not satisfied with the legal counsel’s opinion, the auditor may consider it appropriate to consult on a confidential basis with others within the firm, a network firm, a professional body, or with the auditor’s legal counsel as to whether a contravention of a law or regulation is involved, including the possibility of fraud, the possible legal consequences, and what further action, if any, the auditor would take (CAS 250.A22).

See OAG Audit 2200 for guidance on communications.

CAS Guidance

The auditor’s documentation of findings regarding identified or suspected non‑compliance with laws and regulations may include, for example (CAS 250. A35):

• Copies of records or documents.
• Minutes of discussions held with management, those charged with governance or parties outside the entity.

Law, regulation or relevant ethical requirements may also set out additional documentation requirements regarding identified or suspected non‑compliance with laws and regulations (CAS 250. A36).

CAS Guidance

As required by paragraph 22, the auditor evaluates the implications of identified or suspected non‑compliance in relation to other aspects of the audit, including the auditor’s risk assessment and the reliability of written representations. The implications of particular identified or suspected non‑compliance will depend on the relationship of the perpetration and concealment, if any, of the act to specific controls and the level of management or individuals working for, or under the direction of, the entity involved, especially implications arising from the involvement of the highest authority within the entity. As noted in paragraph 9, the auditor’s compliance with law, regulation or relevant ethical requirements may provide further information that is relevant to the auditor’s responsibilities in accordance with paragraph 22 (CAS 250. A23).

Examples of circumstances that may cause the auditor to evaluate the implications of identified or suspected non‑compliance on the reliability of written representations received from management and, where applicable, those charged with governance include when (CAS 250.A24):

• The auditor suspects or has evidence of the involvement or intended involvement of management and, where applicable, those charged with governance in any identified or suspected non‑compliance.

• The auditor is aware that management and, where applicable, those charged with governance have knowledge of such non‑compliance and, contrary to legal or regulatory requirements, have not reported, or authorized reporting of, the matter to an appropriate authority within a reasonable period.

In certain circumstances, the auditor may consider withdrawing from the engagement, where permitted by law or regulation, for example when management or those charged with governance do not take the remedial action that the auditor considers appropriate in the circumstances, or the identified or suspected non‑compliance raises questions regarding the integrity of management or those charged with governance, even when the non‑compliance is not material to the financial statements. The auditor may consider it appropriate to obtain legal advice to determine whether withdrawal from the engagement is appropriate. When the auditor determines that withdrawing from the engagement would be appropriate, doing so would not be a substitute for complying with other responsibilities under law, regulation or relevant ethical requirements to respond to identified or suspected non‑compliance. Furthermore, paragraph A9 of CAS 220 indicates that some ethical requirements may require the predecessor auditor, upon request by the proposed successor auditor, to provide information regarding non‑compliance with laws and regulations to the successor auditor (CAS 250.A25).