Core Principles for Independent Audit Regulators
16.05.2011
Introduction
IFIAR is an organization of independent audit regulators (hereinafter ‘audit regulators’). The organization’s primary aim is to enable its Members to share information regarding the audit market environment and practical experiences of independent audit regulatory activity, with a focus on inspections of auditors and audit firms.
Consistent with the IFIAR Charter, the Core Principles (hereinafter, ‘Principles’) seek to promote effective independent audit oversight globally, there by contributing to Members’ overriding objective of serving the pu blic interest and enhancing investor protection by improving audit quality.
An audit regulator’s membership in IFIAR is not dependent on its status in implementing the Principles. However, Members are encouraged to work towards implementing them where appropriate in their own jurisdictions, taking account of the risk profile, size and complexity of audit firms in their market. It is recognized that legislative change or other measures by national authorities not in control of the audit regulator may be required to achieve adherence to the Principles.
The Principles are intended to:
- Assist Members in developing their own national arrangements through being able to draw on and hence benefit from the experience of other members;
- Advance widespread adoption of high quality audit oversight practice aimed at fostering high quality audits and promoting public trust in the financial reporting process; and
- Support cooperation between regulators and promote greater consistency of audit oversight.
The Principles are presented in bold lettering followed by an explanatory tex t that provides further explanation.
A system of a udit oversight and audi t re gulation can only be effective subject to cer tain precondi tion s; that is if it exists within an appropriate external environment. Such pre condi tions, although often outside the control of th e national audit oversight system, in pr actice have a direct impact on th e effectiveness of that system. The main precon dition is th e e xistence of a well ‐ developed le gal and corpo r ate governa nce fra mewo r k as to provide necessary support for hi gh quality a uditi ng. Elements of this framework will cover the following:
- Comprehensi v e and well defined accou nting and au diting pri ncip l es and standards that are generally accepted;
- Legal requirements for the preparation and publication of financial statements according to those prin cipl es and standards;
- An enforcement system fo r preparers of financial statements to ensure co mpli ance with accoun ting standards (e .g. fines, shareholder redress or penalties on responsible managers for non-compliance);
- Corporate governance arrangeme nts and pra cti ces that support high‐ quali ty corporate reporting and auditi ng practice; and
- Effective e ducational and training arrangements for accoun tants and audi tors.
Where shortcomings exist, audit r egulators should make the gover nmen t or other relevant decision makers aware of such ma tters and th eir potential impact on audi t quality or the operation of an effective audi t oversight system. Audi t r egulators sho uld also act, as part of their normal activities, with the aim of mitiga ting the effects of such shortco mings on th e effectiveness of their overs ight, regulation and inspe ction.
Part A. Structure
Principle 1: The responsi bi lities and powers of audit regulators should serve the public interest and be clearly and objectively stated in legislation.
Audit regula t ors should ha ve a man date to work in th e pu blic inter est and prote ct investors by seeking to improve audit quality. The re sponsibilities and powers of audit regulators should, at a minimum, require i nde pe nden t oversight of the audi ts of pu blic interest enti tie s .
The legal fra mework for a udit oversight should set forth th e audit regulator’s mandate and responsibiliti es, and provi de the re gula tor with adequate powers and authority that ena ble the regulator to perform its audit oversight du ties, including powers to address, th rough inspection and enforceme nt, compl i ance with the requirements for the authorization/registration of audi tors/audit firms and co mpliance with appli cable auditin g, professional and i ndepe nde nce standards.
Principle 2: Audit regulators should be operati onally independent.
Indep e nde nce means th e ability to undertake re gula tory activity and to take and enforce decisions without exter nal interference by those r e gulate d. The audit regulator should be operationally indepe nde nt from external politi cal inte rference and from com me r cial, or other sectoral interests, in the exer cise of its functio ns and power s , including not being controlled in its governance by audit practitioners. The audi t re gulator should have a stable source of f undin g, which is secure and free from influe nce by a uditors and audi t fir ms and s ufficient to execute its powers and responsi bilities.
Principle 3: Audit regulators should be transparent and accountable.
The audit regulator should have p ubli c a ccoun tabili ty in the use of its powers and resources to ensure that the audit re gulator maintai ns its integri t y and credi bil ity. Further, the decisions and actions of the audit regulator should be subject to appropriate scrutiny and review, incl udin g appeal to a hig her authority. Tra nsparency should include the p ubli catio n of annual work plans and activity reports, incl uding the outcome of inspe ctions ei ther in th e aggrega te or on a fir m by firm basis.
Part B. Operations
Principl e 4: A udit reg ulators shoul d have comprehensive enf orce m ent powers whic h incl ude the capabi lity to ensur e th at their inspecti on fi ndi ngs or recom m endati ons are appropri ately addr esse d; these enf orce m ent powers should include the ability to im pos e a range of sanctions including, for example , fines and th e removal of an audi t license and/ or r egistrati on.
Audit regula t ors should at a mini mum be responsible for the system and conduct of r ecurring inspection of audit fir ms u ndertaki ng a udits of publi c interest entities. A udit re gulators should have the a uthority and abili ty to enforce inspection fi ndin gs and re com m endations. Th e audi t regulator should have comprehensiv e enforcement arrange me nts such as fines, suspensions and the removal of an audi tor’s or audit firm’s lice nse or registration.
Audit regula t ors should ha ve adequa te and appropri ate mechanisms for enabli ng informa tion to be brought to th eir atte ntion by third parti es and for th en dealing with such information, such as through complaints pro ce dures or through w histle blowing arrangements. These me chanis m s should act in a timel y and effective man ner and th eir results followed up throug h an a ppropriate system of investigations and penalti es in rela tion to cases of in adequate or noncomplia n t execution of an audi t.
Principl e 5: A udit reg ulators shoul d ensure th at their staff is ind e p e nde nt from the pr ofessi on and shoul d have sufficient staff of ap pro p ri ate competence.
Audit regula t ors should ha ve arrangem ents in pla ce to ensure tha t inspe ction staff me mbers are indepe nde nt of the profession. These a rrangements will, as a mi ni mum, i n cl ude ensuring that staff memb ers should no t be pr actici ng a uditors or employed by or affiliated with an audit fir m, and tha t the arrangements are not controlled in any form by a professional body.
In order for a udit regula tors to be effective, it is a pr erequisite that th ere is suf ficient staff of appropriate competence . The persons carrying out the reviews of quality assurance systems of audit firms should have appropr iate professional traini ng and relevant experien ce in auditin g and financial reporting, and traini ng in r egulatory quality assurance reviews.
This also mea ns that adequate arrange ments for co nsultation and discussion amongst ins p ectors are in pla ce. New inspe ctors should be subje ct to proper supervision and appropriate trainin g.
Principl e 6: A udit reg ulators shoul d be objective , free from conflicts of interes t, an d m aintain appr op riate confidenti ality arr angem e nts.
Audit regula t ors should maintain the hi ghest sta ndar ds of ethical conduct to provide the publi c with confiden ce in the objectivi ty of their decisions. Audit regulators should have in place prohibi tions against confli cts of interest by its governing body and staff and ensure tha t appropriate arrangements are in place to prote ct co nfiden tial inf o rmation from p ubli c diss emination.
Principl e 7: A udit reg ulators shoul d make appr opri ate arr angem ents for cooperation with oth e r audi t regulators an d, wh e r e rel evant, other third parties.
Taking into accoun t the gl obal nature of the financial marke ts, where necessary and relevant, cooperation and informati o n sharing with other audit regulators and other thir d parti es, incl uding financial mar ket r egulator s, is helpful to improve audit quality.
Audit regula t ors should pr ovide tim e ly assistance to each other within reasonable li mits. Arrangeme nts should be in place for sha r ing informa ti o n betw een audit regula tors and other regulators (o r betw een par ts of th e audit oversight system if it involves more than one body), and for protecting th e confi dentiality of such information.
Par t C. Pri nci ples for i nspections
Principl e 8: A udit reg ulators shoul d as a minimum, conduc t r ecurring i n spec ti ons of au dit firms unde rtaking audi ts of public interes t e n ti ties in ord e r to ass ess compliance wi th ap plicabl e professional standards, in depe nde nce requir emen t s an d ot her laws, rules an d reg ulations .
The recurring inspe ctions should be con ducted pursu ant to a process comprisin g th e sele ctio n of the audit fir ms to inspe ct, appointment of an inspe ction teams with appropriate e xpertise and compe ten ce, notification to the audit fir m, advance documentation request, no tification of s election of audit enga gemen ts for review, mee ti ngs with ma n a gemen t, and on‐ site inspection arrangements. The inspection process sho uld be subj ect to a ppropri ate internal quality control within the audit regulator to ensure hi gh quality and cons istency.
Principl e 9: A udit reg ulators shoul d ensure th at a ris k ‐ based i nspections program is in plac e.
Audit regula t ors should ha ve a process for assessing risks in the audit environm ent and audit risks in individual regulated firms and their audit en gage men ts. Audit regulators should have a proce s s for taking into account th eir risk assessment in allocating their inspe cti on resources and in th e inspection approaches they adopt. These processes should be comme nsurate with the size and co mpl e xity of the a udit fir ms and the i r clients. Audit regulators should have an established minim um cy c l e regarding th e freque ncy of inspections.
Principl e 10: Audit reg ulators should en sure th at ins pecti ons i ncl ude effective pr ocedur es for both firm wi de an d file revie ws .
The risk‐ base d inspe ction approach sho uld also be reflected in both firm wide and audit file inspection pr ocedures. Th e firm wide p r ocedures should address the a udit fir m’s quality control system as reflected in the firm’s organization, policie s and proced ures. IS QC 1 or similar standards should be us ed as a benchmark in perfo r ming firm wide procedure s . The inspe ction process should also include a dequate testing of selected audi t files in order both to determine the effectiveness of the fir m’s quality con trol system and to assess compliance with applicable laws, rules and professional standards.
Principl e 11: Audi t regulators shoul d have a mechanism for reporting inspec tions fi ndings to the audi t firm an d en suri ng re mediation of findings wi th th e audi t fi rm.
Audit regula t ors should ha ve a process that ensures that criticisms or potential defects in an audit firm’s quality control systems and issues related to an audi t fir m’s performan ce of audits tha t are identifi ed dur ing an inspe c tion are reported to the a udit firm. Audit re gulators ’ reporting processes should include th e preparation and issuance of a draf t inspe ction report, a process for the audit fir m to respond, and the prepa r ation and issuance of a final inspection report. In addition, audit regulators should have a process for ensuring that a udit firms satisfactorily address inspection findings that were reported to the audi t firm by the a udit regula tor.