Advice for auditors from the experts

Although the effective challenge of management is crucial to high-quality audit, inspection and other regulatory reports from ICAEW’s Quality Assurance (QAD) and the UK Financial Reporting Council (FRC) repeatedly find that auditors are not challenging management sufficiently. The areas where weaknesses are found range widely, but focusing on some of the most significant and those most commonly highlighted can offer opportunities for auditors to enhance their challenge of management, and how this is evidenced and demonstrated in audit files.

When ICAEW published its Audit Monitoring Report 2020/21, Trevor Smith, QAD Director, noted that the underlying issues behind many audits that require ‘improvement’ or ‘significant improvement’ are related to professional scepticism and challenge of management: “Audit documentation that tells the story of audit work in complex areas, demonstrating the application of scepticism and nature of challenges made by the auditor will always be more successful than over-reliance on tick-boxes and checklists.”

The audit monitoring report notes that ‘telling the story’ of the audit, or a particular aspect of it, might typically involve the auditor explaining:

• the identified audit risks;
• how and why they approached the audit issue as they did;
• what they discussed with management;
• what alternative circumstances they challenged management with;
• the evidence that they identified and evaluated to support or contradict the position; and
• their reasoning behind the final conclusion.

This kind of best practice documentation seldom fits into a standard audit checklist and requires some separate record on the audit file. If it is done well, however, the audit partner and manager – and any later external audit file reviewer – should have no need to ask questions about the work completed, assessment of evidence or challenge of management.

This most recent monitoring report also points auditors back to the Audit Monitoring Report 2020, which highlights three key areas of judgement where scepticism and robust challenge of management are essential: property valuations; long-term construction contracts; and going concern (and it outlines concerns and examples of good practices in all three areas).

All of these remain risks for some businesses. Given uncertainties stemming from Brexit, the coronavirus pandemic and the Ukraine crisis, going concern has become and remains a significant risk for many more businesses. “The greater the risk, the stronger the evidence needs to be and the more robust the auditor’s approach should be,” says Smith.

The 2020 QAD report offers some examples of good practice that can assist auditors to challenge management in relation to going concern, including:

• consideration of worst-case scenarios when assessing forecasts;
• use of a restructuring specialist who planned various scenarios and stress-tested assumptions;
• use of a flowchart to work through various going concern scenarios to identify the appropriate form of audit opinion; and
• thorough documentation of thought processes supporting conclusions and demonstrating scepticism and challenge of management.

Auditors are reminded of resources that the faculty and other parts of ICAEW have created and updated over recent months, which can be found by visiting the ‘Ukraine crisis: central resource hub’.

Learning from firms

QAD has been encouraging auditors to use root cause analysis (RCA) to dig down into what’s behind some of its findings and it analysed some of the results in its 2020/21 monitoring report. One of the RCA case studies it includes shares an example where a weakness in challenge of management relates to flawed design of audit tests. A QAD review of work in progress (WIP) in an audit by a firm with one audit partner identified that there had been detailed discussions with the client’s quantity surveyor about amounts recognised as WIP. However, this was not reflected in the audit file.

The level of detail on the file regarding the audit team’s challenge of the stage of completion of contracts and expected costs and margins did not show enough audit evidence to conclude on the balance in the statutory accounts. Although the firm had identified appropriate risks to address for the WIP balance and had completed some more detailed work on costs and margins, this was not documented coherently. The firm committed to carrying out additional work at the next audit to review the outcome of previous completed projects, to assess the accuracy of management estimations.

FRC findings

Over a number of years, the FRC has noted that some firms seem to struggle to challenge the management of audited entities effectively in more judgemental areas, such as long-term contracts, as well as goodwill impairment or the valuation of financial instruments. When it published Developments in Audit 2021 in November of that year, lack of professional scepticism by auditors, including failures to sufficiently challenge management’s assumptions, as well as evidence of poor application of professional judgement, were highlighted as persistent deficiencies.

This publication offers some examples of good practice from recent audit inspections. They include:

• effective use of internal/external specialists to review/challenge management’s methodology/assumptions;
• delaying audit opinion sign off to ensure that sufficient time is available to deliver quality output
• rigorous assessment of the risks related to the carrying value of assets that could be impaired; and
• use of corporate finance/modelling specialists to challenge assumptions/modelling techniques used in going concern assessments.

Auditors will also find valuable insight and support from the FRC in its November 2021 publication What Makes a Good Audit? It notes, for example, the importance of auditors:

• consulting appropriately when carrying out the audit of complex areas;
• performing audit procedures in a manner that is not biased towards obtaining audit evidence that may be corroborative or towards excluding audit evidence that may be contradictory;
• persisting in challenging management if management does not address the auditor’s concerns; and
• challenging management where the auditor considers that management should be using its own experts to support specific disclosures in the accounts.

In What Makes a Good Audit, examples of good practices that support and demonstrate effective/robust challenge of management span various stages and aspects of the audit and include:

• audit team planning, audit procedures and basis for conclusions that are clearly corroborated and commensurate with the audited entity’s risks – allowing the audit team to demonstrate considerable challenge of management, including the assessment of judgemental audit differences identified;
• audit teams obtaining direct confirmations from customers to verify that revenue for major contracts has been appropriately recognised;
• involvement of auditor’s valuation experts, with good evidence of their and the audit team’s discussions with and challenges of management’s experts;
• audit teams that structure audit working papers to identify significant judgements by management, showing how they were challenged and how that challenge was concluded; and
• instances where audit partners delay signing of the audit opinion until all outstanding items are cleared and audit adjustments are finalised.

Although some of the insights in this FRC document reflect the larger firms and audits that are typical of AQR inspections, there is information that is potentially helpful for all audit firms.

Challenge of management – done well and done not so well – was also the subject of a letter the FRC sent to heads of audit in December 2020. It merits reading – or even re-reading. After aggregating and analysing its own research with RCA that it requested firms to undertake, the FRC identified some processes and attributes as key features of effective challenge of management. They include:

• timely and informed planning;
• effective project management;
• clearly defined, relevant expectations;
• significant involvement of partner and other senior team members;
• good use of specialists;
• strong risk assessment, including an understanding of the risk of management bias;
• consultation on complex areas;
• understanding the audited entity’s system of internal control;
• training and mentoring; and
• robust quality control procedures.

A culture of challenge

Analysis by the FRC also highlights the critical role in effective challenge of management played by behaviour, mindset and culture within an audit firm. A strong audit culture of scepticism and challenge is, it explains, one where:

• auditors feel they have the support of the firm’s senior management when challenging the audited entity’s management – even if this might lead to a relationship breakdown between the audit firm and audited entity, or result in extreme delays or modifications of audit reports;
• audit team members are encouraged to ask questions and to raise concerns; and
• audit team members are open to new information and challenge from other team members, peers and from specialists.

In short, states the FRC: “Through effective continuous professional training (technical and qualitative) and mentoring, firms will have empowered audit teams with the right people with the right knowledge doing the right procedures at the right time.”

When it comes to professional scepticism and effective challenge of management, the importance of culture should not be underestimated.

Audit firm culture was the focus of the FRC’s international conference during 2021 on the themes of challenge, trust and transformation and Audit & Beyond shared some of its helpful ideas on shaping and strengthening organisational culture.

The FRC website offers access to recordings (each around an hour long) on sessions covering, for example:

• ‘Developing a mindset of professional scepticism and challenge’;
• ‘Building an audit firm culture that supports high quality audit’; and
• ‘Embedding and measuring organisational culture’.

A lot can be gained by listening to the voices of the regulators and learning from good practices at other firms. There are many actions and initiatives that auditors can take to encourage and enhance the development and application of professional scepticism and strengthen and support a culture of challenge.