Independence: long association, outsourced internal audit and fee dependency
Meridian & Co. audits Trelawney Holdings, a listed group. The audit fee is $1.2m and the firm's total revenue is $18m. Ravi, the engagement partner, has served Trelawney for nine consecutive years; the jurisdiction applies a seven-year rotation requirement with a two-year cooling-off period for listed entities. Meridian also provides tax compliance ($250k) and outsources Trelawney's treasury internal audit function ($350k); the audit team plans to rely on the treasury controls that Meridian's internal audit team tests and reports on. Trelawney's CFO was a senior manager at Meridian and worked on the Trelawney audit until four years ago. A Meridian partner holds units in a discretionary managed fund that owns 0.4% of Trelawney's shares; the partner cannot direct the fund's investments and the holding is not material to the partner. Meridian is bidding for a $2m systems consulting project at Trelawney. The group audit committee has asked the firm to confirm its independence in writing.
1. Identify and evaluate the threats to independence and conclude whether the firm can continue as auditor, with or without safeguards.
Read the worked answer
Several threats arise, and some cannot be safeguarded.
Self-review: Meridian provides the internal audit service over treasury controls and the audit team plans to rely on those same controls. The firm would be evaluating its own work. For a listed entity this is a significant self-review threat; under IESBA the firm should not provide internal audit services relating to a significant part of the internal controls over financial reporting.
Self-interest: total fees of $1.8m against firm revenue of $18m is 10%, below the 15% disclosure threshold but still significant, and the $2m consulting bid increases dependency.
Familiarity: Ravi has served nine years, exceeding the seven-year rotation requirement for listed entities; the CFO was a Meridian senior manager on the audit until four years ago.
Financial interest: the partner's indirect holding through a discretionary fund may be acceptable if the partner cannot direct investments and the interest is immaterial, but it must be confirmed and documented; a direct interest would be prohibited.
Conclusion: the firm cannot continue as auditor on the current arrangements. It must either resign the internal audit engagement or resign the audit, rotate Ravi immediately, and decline the consulting bid. If the rotation requirement has already been breached, the firm must consider the effect on prior-year reports and notify the regulator. Safeguards cannot reduce a self-review threat of this kind to an acceptable level.
2. Assess the implications of the outsourced internal audit work and the planned reliance on the treasury controls that Meridian tests.
Read the worked answer
The internal audit outsourcing is the most serious issue. The audit team plans to rely on treasury controls that Meridian itself tests and reports on. The auditor would be auditing its own conclusions, and the work would not provide the independent evidence the audit needs.
ISA 610 allows the external auditor to use the work of an internal audit function, but only where that function is objective and competent and the work is relevant. An outsourced function performed by the audit firm fails the objectivity test for this purpose, and the firm's own independence is impaired. The audit committee should be told that reliance on this work is not possible.
If the firm were to continue as auditor, it would have to perform its own testing of treasury controls and not use the internal audit work. But that does not cure the independence problem: the firm would still be providing an internal audit service over a significant part of the controls over financial reporting. The correct remedy is to terminate the outsourcing arrangement, with the audit committee's agreement, or to resign from the audit.
The audit committee should also consider whether the internal audit function has been appropriately directed and whether its reporting lines are independent of management. Document the assessment and the resolution, and consider whether the firm can continue to provide the service while the audit relationship lasts.
3. What should the firm do before signing the independence confirmation, and what are the consequences of signing while impaired?
Read the worked answer
Before signing the independence confirmation, the firm should convene an independence review involving the ethics partner and the audit committee. The review should document each threat, evaluate whether it can be eliminated or reduced to an acceptable level, and record the safeguards or the decision to resign.
Specific steps: (i) confirm the status of the rotation requirement and whether it has already been breached; (ii) obtain written confirmation from all partners and staff of their financial interests in Trelawney, including indirect holdings through funds; (iii) decide on the internal audit outsourcing, terminate it or resign the audit; (iv) withdraw from the consulting bid; (v) rotate the engagement partner and brief the replacement; (vi) assess whether prior-year reports were affected.
If the firm signs the confirmation while the self-review threat and the rotation breach remain, the confirmation is false or misleading. That exposes the firm to disciplinary action, possible loss of registration, and challenge to the validity of the audit report. The audit committee and, where required, the regulator should be informed promptly. The firm should also consider whether its quality management system failed to identify the issue earlier. The confirmation should be signed only after the remedies are implemented, not on the basis of intended future action.