Although the effective challenge of management is crucial to high-quality audit, inspection and other regulatory reports from ICAEW’s Quality Assurance (QAD) and the UK Financial Reporting Council (FRC) repeatedly find that auditors are not challenging management sufficiently. The areas where weaknesses are found range widely, but focusing on some of the most significant and those most commonly highlighted can offer opportunities for auditors to enhance their challenge of management, and how this is evidenced and demonstrated in audit files.
When ICAEW published its Audit Monitoring Report 2020/21, Trevor Smith, QAD Director, noted that the underlying issues behind many audits that require ‘improvement’ or ‘significant improvement’ are related to professional scepticism and challenge of management: “Audit documentation that tells the story of audit work in complex areas, demonstrating the application of scepticism and nature of challenges made by the auditor will always be more successful than over-reliance on tick-boxes and checklists.”
The audit monitoring report notes that ‘telling the story’ of the audit, or a particular aspect of it, might typically involve the auditor explaining:
This kind of best practice documentation seldom fits into a standard audit checklist and requires some separate record on the audit file. If it is done well, however, the audit partner and manager – and any later external audit file reviewer – should have no need to ask questions about the work completed, assessment of evidence or challenge of management.
This most recent monitoring report also points auditors back to the Audit Monitoring Report 2020, which highlights three key areas of judgement where scepticism and robust challenge of management are essential: property valuations; long-term construction contracts; and going concern (and it outlines concerns and examples of good practices in all three areas).
All of these remain risks for some businesses. Given uncertainties stemming from Brexit, the coronavirus pandemic and the Ukraine crisis, going concern has become and remains a significant risk for many more businesses. “The greater the risk, the stronger the evidence needs to be and the more robust the auditor’s approach should be,” says Smith.
The 2020 QAD report offers some examples of good practice that can assist auditors to challenge management in relation to going concern, including:
Auditors are reminded of resources that the faculty and other parts of ICAEW have created and updated over recent months, which can be found by visiting the ‘Ukraine crisis: central resource hub’.
Learning from firms
QAD has been encouraging auditors to use root cause analysis (RCA) to dig down into what’s behind some of its findings and it analysed some of the results in its 2020/21 monitoring report. One of the RCA case studies it includes shares an example where a weakness in challenge of management relates to flawed design of audit tests. A QAD review of work in progress (WIP) in an audit by a firm with one audit partner identified that there had been detailed discussions with the client’s quantity surveyor about amounts recognised as WIP. However, this was not reflected in the audit file.
The level of detail on the file regarding the audit team’s challenge of the stage of completion of contracts and expected costs and margins did not show enough audit evidence to conclude on the balance in the statutory accounts. Although the firm had identified appropriate risks to address for the WIP balance and had completed some more detailed work on costs and margins, this was not documented coherently. The firm committed to carrying out additional work at the next audit to review the outcome of previous completed projects, to assess the accuracy of management estimations.
Over a number of years, the FRC has noted that some firms seem to struggle to challenge the management of audited entities effectively in more judgemental areas, such as long-term contracts, as well as goodwill impairment or the valuation of financial instruments. When it published Developments in Audit 2021 in November of that year, lack of professional scepticism by auditors, including failures to sufficiently challenge management’s assumptions, as well as evidence of poor application of professional judgement, were highlighted as persistent deficiencies.
This publication offers some examples of good practice from recent audit inspections. They include:
Auditors will also find valuable insight and support from the FRC in its November 2021 publication What Makes a Good Audit? It notes, for example, the importance of auditors:
In What Makes a Good Audit, examples of good practices that support and demonstrate effective/robust challenge of management span various stages and aspects of the audit and include:
Although some of the insights in this FRC document reflect the larger firms and audits that are typical of AQR inspections, there is information that is potentially helpful for all audit firms.
Challenge of management – done well and done not so well – was also the subject of a letter the FRC sent to heads of audit in December 2020. It merits reading – or even re-reading. After aggregating and analysing its own research with RCA that it requested firms to undertake, the FRC identified some processes and attributes as key features of effective challenge of management. They include:
A culture of challenge
Analysis by the FRC also highlights the critical role in effective challenge of management played by behaviour, mindset and culture within an audit firm. A strong audit culture of scepticism and challenge is, it explains, one where:
In short, states the FRC: “Through effective continuous professional training (technical and qualitative) and mentoring, firms will have empowered audit teams with the right people with the right knowledge doing the right procedures at the right time.”
When it comes to professional scepticism and effective challenge of management, the importance of culture should not be underestimated.
Audit firm culture was the focus of the FRC’s international conference during 2021 on the themes of challenge, trust and transformation and Audit & Beyond shared some of its helpful ideas on shaping and strengthening organisational culture.
The FRC website offers access to recordings (each around an hour long) on sessions covering, for example:
A lot can be gained by listening to the voices of the regulators and learning from good practices at other firms. There are many actions and initiatives that auditors can take to encourage and enhance the development and application of professional scepticism and strengthen and support a culture of challenge.