7040 Audit Conclusion
Jul-2020

Overview

This section presents the requirements pertaining to the audit conclusion. It provides guidance on the four types of conclusion that are possible to reach as well as guidance on what to consider when forming a conclusion. There is also a specific reference to how to form a special examination opinion, including the concept of significant deficiency.

Financial Administration Act Requirements for Special Examinations

Section 139(1) An examiner shall, on completion of the special examination, submit a report on his findings to the board of directors of the corporation examined.

(2) The report of an examiner under subsection (1) shall include

(a) a statement whether in the examiner’s opinion, with respect to the criteria established pursuant to subsection 138(3), there is reasonable assurance that there are no significant deficiencies in the systems and practices examined; and

(b) a statement of the extent to which the examiner relied on internal audits.

OAG Policy

Audits shall have a clear conclusion against the audit objective. [Nov-2016]

OAG Guidance

What the CSAE 3001 means for the audit conclusion

The standard requires that the audit concludes against the audit objective and that the conclusion is clearly indicated in the audit report.

The standard also requires that the engagement leader supports the audit conclusion with sufficient appropriate evidence, and that he/she forms a conclusion about whether the subject matter is free from significant deviation (see OAG Audit 2020 Significance).

If the evidence shows that one or more of the audit criteria have not been met, then the engagement leader must use professional judgment to decide whether to express a “reservation” in the form of a qualified or an adverse conclusion, and explain the reason for the reservation in the audit report.

If the team has been unable to obtain sufficient appropriate evidence regarding an entity’s conformity with any of the audit criteria, we have a scope limitation. The standards require that the engagement leader expresses a qualified conclusion, disclaims a conclusion, or withdraws from the audit. A disclaimer of conclusion rarely occurs in the OAG’s performance audits and could not occur in special examinations.

The following diagram illustrate the steps set out in CSAE 3001 in forming the conclusion, with relevant paragraph numbers referenced.

How to form a conclusion

In forming conclusions, using their professional judgment, the auditors evaluate the sufficiency and appropriateness of the evidence obtained (see OAG Audit 7021 Evaluate sufficiency and appropriateness of audit evidence, and OAG Audit 1051 Sufficient appropriate audit evidence). They also assess the significance (see OAG Audit 2020 Significance) of the findings in relation to the audit objective. The conclusion should not be a summary of findings, but rather be a clear conclusion against the audit objective.

The conclusion has to be expressed using a positive form; for example, “The entity has complied, in all significant respects, with xyz . . .”

There are essentially four different types of conclusions that can be used in direct engagements:

  • unmodified (clean) conclusion (“yes”);
  • qualified conclusion (“yes, but” or “no, but”);
  • adverse conclusion (“no”); and
  • disclaimer of conclusion (when the audit team is unable to conclude due to lack of sufficient appropriate evidence).

Audit team members need to clearly communicate the type of conclusion in the audit report. They also need to use professional judgment in forming a conclusion (OAG Audit 1042 Applying professional judgment). For example, the team may decide to qualify the conclusion when some parts of an entity’s performance are satisfactory while others are unsatisfactory. The conclusion can then contain an "except for" statement to disclose the deviations from satisfactory performance.

If it is an unmodified (clean) conclusion (“yes”) or an adverse conclusion (“no”), the audit team should echo the words of the audit objective(s) in the conclusion. In an adverse conclusion, the audit team should also ensure to have a very clear “no.” An adverse conclusion is used when the significance and extent of the deviations from satisfactory performance are pervasive. When performance is fully satisfactory or highly unsatisfactory, concluding against the overall objective may be straightforward and the audit report will reflect a completely positive or adverse conclusion, as appropriate.

A qualified conclusion (“yes, but” / “no, but”) should contain the following essential elements: (1) clear announcement of the conclusion with specific reference to the audit objective, (2) clear “placement” (“yes, but / no, but”), and (3) reason for the (“yes, but / no, but”). For example:

(1) We conclude that the Department of Widget Affairs administered its Widget program in accordance with the Widgets Act, (2) with some improvement required in communications. (3) In particular, Widget status reports need to be communicated from headquarters to regional offices sooner so that Widget officers in the field have up-to-date lists of fees to be charged.

The core of a clear overall audit report conclusion is a single key paragraph with a clear overall conclusion. In straightforward cases, the entire conclusion may only be one paragraph. In more complex cases (multiple auditees, not a clean conclusion, etc.), further explanatory paragraphs can be added if the conclusion is not self-evident. The conclusion should be in a separate section of the written audit report in order to make it clear to the readers that this is the conclusion of the audit, not a finding on a specific aspect of the audit or a recommendation (see OAG Audit 7030 Drafting the audit report).

If, despite best efforts, an audit team is unable to obtain sufficient appropriate evidence, it may report the available evidence and its limitations, but it cannot draw findings and conclusions from the evidence. If the OAG decides to report the matter, it would state it as a qualification to the conclusion—that the auditors could not evaluate part of the subject matter because of lack of evidence (i.e. scope limitation). When the lack of evidence is significant, the audit report will express a “disclaimer of conclusion” due to incapacity to obtain sufficient appropriate audit evidence.

If the audit team determines there is a scope limitation (which occurs when the team is unable to obtain sufficient appropriate evidence), it would either explain it in the conclusion using a qualified conclusion or a disclaimer of conclusion (as explained above).

Special examinations

Special examination opinion statement and conclusion. Consistent with sub-paragraph 139(2)(a) of the Financial Administration Act (FAA), each special examination report must include a statement on whether in the examiner’s opinion and based on the established criteria, reasonable assurance exists that there are no significant deficiencies in the Crown corporation’s systems and practices examined.

The special examination opinion statement serves as a basis for the conclusion against the audit objective and is included in the conclusion paragraph in the audit report.

The special examination conclusion can take one of the following forms:

  • Unmodified (clean) conclusion. In our opinion, based on the criteria established, there was reasonable assurance there were no significant deficiencies in the Corporation’s systems and practices that we examined. We concluded that the Corporation maintained its systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.

  • Qualified conclusion (one significant deficiency). In our opinion, based on the criteria established, there was a significant deficiency in the Corporation’s [identify specific systems and practices named in report], but there was reasonable assurance there were no significant deficiencies in the other systems and practices that we examined. We concluded that, except for this significant deficiency, the Corporation maintained its systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.

  • Qualified conclusion (two significant deficiencies). In our opinion, based on the criteria established, there were significant deficiencies in the Corporation’s [identify the two systems and practices named in report], but there was reasonable assurance there were no significant deficiencies in the other systems and practices that we examined. We concluded that, except for these significant deficiencies, the Corporation maintained its systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.

  • Adverse conclusion. In our opinion, based on the criteria established, there were significant deficiencies in the Corporation’s systems and practices that we examined for corporate management and management of operations. As a result of the pervasiveness of these significant deficiencies, we concluded that the Corporation had not maintained its systems and practices during the period covered by the audit in a manner that provided the reasonable assurance required under section 138 of the Financial Administration Act.

Because the FAA prescribes the need to provide a statement of opinion on the systems and practices selected for examination, a disclaimer of conclusion is not an option for special examinations. In the special examination practice, the ability to report on a significant deficiency replaces the need to disclaim a conclusion. If, for example, there was an inability to obtain sufficient appropriate evidence related to one of the areas selected for examination, the engagement team would either opine that there is a significant deficiency in the specific area (i.e. it would issue a qualified conclusion) or, where the inability affects multiple areas, that there is no reasonable assurance that the corporation’s systems and practices selected for examination achieved the statutory control objectives (i.e. the team would issue an adverse conclusion).

The special examination report template prescribes where the opinion should be located in the audit report as well as the exact wording of the statement/conclusion to be used in the possible scenarios (unmodified, qualified, or adverse) (see OAG Audit 7030 Drafting the audit report).

What is a significant deficiency? The FAA prescribes the use of the words “significant deficiency” to be used in the opinion, but does not define what it is. The OAG considers a significant deficiency to have occurred when there is a significant deviation from criteria. A significant deficiency is reported when the systems and practices examined did not meet the criteria established, resulting in a finding that the Corporation could be prevented from having reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.

Significance is judged in relation to the reasonable prospect of a matter influencing the judgments or decisions of a user of a special examination report. For example, factors that may influence the engagement team’s judgment on what is significant in a particular circumstance might include the potential public, legislative, economic, or environmental impact.

Clearly, the definition of “significant” is a matter of judgment and depends on the circumstances. Ultimately, one of the major deciding factors is the identified or potential impact of a deficiency.

Factors considered to determine if a significant deficiency exists. The engagement team may take the following factors into account when determining whether a finding constitutes a significant deficiency:

  • Extent of deviation from criteria. A finding should be clearly linked to criteria and, for it to be significant, there should be substantial deviation from criteria. Where there are deviations, the engagement team needs to establish whether there are compensating systems or practices to help achieve the desired result.

  • Impact of the deficiency. To be significant, the deficiency’s impact on achieving the corporation’s statutory control objectives should be clear, serious, and consequential. When selecting key systems and practices and developing criteria, considering the corporation’s exposure to risk will help trace the impact of any deficiencies subsequently identified. The impact may be potential; that is, the consequences may not have materialized yet.

  • Relevance to the board, the Minister, Parliament, or other users of the report. The engagement team should consider what is of interest and relevance to report users. If a finding is of little or no consequence to users, it may not be significant. What is relevant to report users are a finding’s impact (what it will mean to them) and cause (why it happened). Of course, there may be a difference of opinion between what the engagement team believes is relevant to users and the corporation’s views on the issue, in which case the examiner would report the deficiency as significant if convinced of its consequence to users.

  • Practicality of the solution. If the likely cost of correcting the deficiency is greater than the benefit to be derived, the deficiency’s significance may be questionable.

  • Number of reported deficiencies. Minor deviations from several criteria may signal minor problems, or may be symptoms of a problem (or theme) of greater significance that should be reported as a significant deficiency.

  • Planned corrective actions. If the corporation has action plans in place or even in process to correct deficiencies that have been classified as significant, these deficiencies should still be included in the report as significant because they existed during the examination period and because there is no assurance that the planned actions will correct the problem or that the actions will continue after the report date.

How is a significant deficiency formulated? A significant deficiency must have a clear evidentiary link to a criterion. Problems often occur when the wording used to describe the deficiency is too general; for example, if the significant deficiency does not discuss the impact(s).

In order to be clear and meaningful, a significant deficiency should identify the problem, its cause, and its effect.

All reasoning behind the decision on the significance of a given deficiency must be documented in the examination file.