Auditor Independence, a Backdated Comfort Letter and Suspicious Deposits at QuickCash MFB
You are the engagement quality review partner at a mid-tier audit firm in Lagos. The firm audits a licensed microfinance bank, QuickCash MFB Plc, which is also applying to the Central Bank of Nigeria for a national banking licence. The engagement partner, Bola, has been the signed auditor for six years and is a close friend of QuickCash's CEO. Bola's spouse holds ₦8m of QuickCash shares. The bank's 2025 profit is ₦1.2bn; the audit fee is ₦45m and the firm also earned ₦90m in tax advisory fees from the bank. During fieldwork, a junior auditor found 14 cash deposits of ₦4.95m each, made on consecutive days by a customer whose stated business is 'general merchandise'. The relationship manager says the customer is a 'high-net-worth politician' and asks the team to 'leave it'. The CEO also asks Bola to sign a comfort letter to CBN dated 15 January 2026, although the audit report will be dated 28 February 2026; the letter would state that the bank has 'adequate controls'. Bola asks you to approve the letter so the licence application is not delayed.
1. Identify the ethical, independence and regulatory issues, and explain the threats they create.
Read the worked answer
Independence threats: (1) Financial interest: Bola's spouse owns ₦8m of QuickCash shares. A spouse is immediate family; a direct financial interest in an audit client is prohibited or creates a self-interest threat so significant that no safeguard is available. Bola should not be the engagement partner; the shares should be disposed of or the firm should resign. (2) Familiarity: close friendship with the CEO and six years as engagement partner; long association and familiarity threaten objectivity. (3) Self-interest and fee dependence: ₦90m tax advisory vs ₦45m audit; total fees and non-audit services may impair independence. (4) Self-review: tax advisory can affect tax provisions and disclosures. (5) Intimidation: the CEO is pressing for a comfort letter and the licence application creates pressure.
Other issues: the comfort letter dated 15 January 2026, before the audit report date of 28 February 2026, would be misleading if it states 'adequate controls' before the audit is complete. Signing it would breach integrity and objectivity and could mislead CBN. The 14 deposits of ₦4.95m are just below the ₦5m cash reporting threshold; that is a classic structuring red flag. The customer is a PEP; the relationship manager's request to 'leave it' is improper.
Conclusion: the firm cannot accept the engagement as constituted. Bola must be removed and the shareholding resolved; the firm should assess whether it can continue the audit at all. The comfort letter should not be signed.
2. Decide what you would do about the comfort letter and the suspicious deposits, including reporting, confidentiality and client communication.
Read the worked answer
Comfort letter: refuse to sign. Any comfort letter must be factual, limited to matters the firm has actually reviewed, dated the same as or after the audit report, and approved by the audit committee and the firm's legal counsel. A letter dated 15 January 2026 asserting 'adequate controls' before completion is false or at least misleading. Explain to the CEO and audit committee that the firm cannot backdate or pre-sign; if CBN needs comfort, provide a factual status letter after the audit, with appropriate caveats. If management insists, escalate to the firm's ethics partner and consider withdrawing.
Suspicious deposits: do not ignore. The pattern, 14 deposits of ₦4.95m on consecutive days, suggests structuring to avoid the ₦5m threshold. As auditor, escalate to the bank's MLRO and ensure a suspicious transaction report is filed with the NFIU; the bank is the reporting entity. Do not tip off the customer. The auditor's confidentiality obligation does not prevent a report to the authorities; take legal advice on the firm's own reporting obligation. Assess whether the bank's AML controls, customer due diligence and PEP screening are adequate; this may be a material control deficiency and a contingent liability. Consider whether the financial statements or licence application contain misstatements. Communicate with those charged with governance. If management obstructs, document and consider a qualified opinion, resignation and regulatory notification.
3. Recommend firm-level safeguards and documentation to prevent a recurrence.
Read the worked answer
Firm-level safeguards: (1) Independence: maintain a partner and shareholding register; require annual confirmations; prohibit immediate-family financial interests in audit clients; rotate the engagement partner and EQCR after the permitted period. (2) Non-audit services: establish a pre-approval policy with the audit committee; prohibit services that create self-review; separate teams and report fees. (3) Ethics: escalate to the ethics partner; use an independent quality review; document threats, safeguards and conclusions. (4) AML: train staff on structuring, PEPs and tipping-off; require escalation to the MLRO; keep records. (5) Comfort letters: central register, legal review, no backdating, sign only after the report date. (6) Whistleblowing: protect the junior auditor who raised the deposits. (7) Regulatory: consider whether the firm has a duty to report the bank's conduct to CBN or the NFIU; take legal advice. Documentation: record the decision to refuse the comfort letter, the removal of Bola, the STR and the communications with the audit committee. The firm should be prepared to resign if the client or partner persists.