Chapter 2 - Responsibilities Flashcards
What are the responsibilities of management with regards to managing a company, including those outlined in the Companies Act 2006?
The directors’ job is to manage the business so
that its objectives are achieved. It also means assessing what business risks face the company and devising the necessary strategies to deal with them
The Companies Act also sets out further reponibilities of management:
* Safeguard the assets: Prevent and detect fraud and error and ensure compliance with laws and
regulations.
* Records: Maintain the books and records of the company.
* Financial Statements: Prepare the financial
statements on the correct basis with adequate
accounting policies, appropriate judgements and that comply with accounting standards.
* AGMs & Filing: Lay the financial statements
before the shareholders at the AGM and file the financial statements at Companies House on time.
* Sustainability: Duties in relation to sustainability (s172): production of a strategic report that shows the impact of company’s operations on the environment
Do assuarance providers take any responsibility for the managing of a company?
Assurance providers, such as auditors and internal auditors, should not take direct responsibility for managing a company (management/self review threat).
However, the auditor does need to understand the risks facing the business and to understand how it will impact on their approach to the audit or other assurance engagement
Define sustainability
Meeting the needs of the present without compromising the ability of future generations to meet their own needs.
Define Environmental, Social and Governance (ESG)
Environmental, social and governance (ESG) approaches sustainability related issues through a corporate lens and considers the effect of these issues on business and enterprise values (rather than on society more broadly).
What is meant by dependencies and impacts with regards to ESG? Give suitable examples of each and briefly explain who is of most interest on each being reported on
- Impacts: In sustainability terms, this relates to the way that an organisation and its operations can affect ESG issues (in other words, the impact of an organisation on ESG). Such impacts could be either positive or negative. Reporting on impacts is of interest to wider stakeholders, including consumers. Impacts can be material due to possible extensive impact to reputation
- Dependencies: By contrast, ESG issues can also have an effect on an organisation’s ability to create and maintain value (the impact that ESG has on an organisation). Such dependencies are essential to understand so organisations can take suitable action if required. Reporting on dependencies tends to be of interest to investors, who are concerned with how the company is managing its long-term exposure to such issues
What are the types of risks related to sustainability? Define each
- Physical risks: Risks which arise from the physical effects of climate change, such as storms, extreme temperatures, wildfires and flooding.
- Transition risks: Risks which relate to social and economic shifts to a low-carbon economy, such as changes to policy, regulation, technology and market.
What is scenario analysis and how can it be used by companies with regards to sustainability issues?
Scenario analysis is a process for identifying and assessing the potential implications of a range of plausible future states under conditions of uncertainty. Scenarios are hypothetical constructs and not designed to deliver precise outcomes or forecasts. Instead, scenarios provide a way for organisations to consider how the future might look if certain trends continue or certain conditions are met. In an ESG context, many organisations are using scenario analysis to consider the impact on their organisation of different increases in global temperatures.
What factors determine the responsibility of assurance providers?
The responsibility of the external provider of assurance services is determined by:
* Legislation and Regulation: The requirements of any legislation or regulation under which the engagement is conducted. This includes compliance with laws and regulatory frameworks that govern the assurance process.
* Terms of Engagement: The specific terms of engagement for the assignment, which outline the scope, objectives, and nature of the services to be provided. This agreement sets clear expectations and responsibilities for both the assurance provider and the client.
* Ethical Standards: Adherence to ethical standards, such as integrity, objectivity, professional competence, confidentiality, and professional behavior. These standards ensure that assurance providers conduct their work with honesty and impartiality.
* Quality Management Standards: Compliance with quality management standards, which ensure that the assurance services are performed consistently and meet the required level of quality. This includes internal quality control procedures and external reviews.
What are the responsibilities of assurance providers completing statutory audits?
In the case of an audit of annual accounts under the Companies Act 2006, it is the external auditor’s responsibility to:
- Form an independent opinion on the truth and fairness of the annual accounts.
- Confirm that the annual accounts have been properly prepared in accordance with the Companies Act 2006.
- State in their auditor’s report whether, in their opinion, the information given in the directors’ report is consistent with the annual accounts.
To ensure they meet their responsibilities, what must assurance providers completing statutory audits ensure?
- The audit is planned properly (see Chapters 7, 8, 9 and 10)
- Sufficient and appropriate audit evidence is gathered (we covered this in detail in Assurance)
- The evidence is properly reviewed and valid conclusions drawn (see Chapter 13)
What rights are granted to auditors to allow them to fulfil their responsibilities?
- The right of access at all times to the company’s books and accounts
- The right to obtain any information necessary for the audit from any employee of the company
- The right to attend any general meeting of the company.
What are auditors not responsible for with regards to the company they are auditing?
- The design and operation of the accounting systems.
- The maintenance of the accounting records.
- The preparation of the financial statements.
- The identification of every error and deficiency in the accounts and the accounting records.
- The prevention of fraud in a company.
- The detection of immaterial fraud in the company.
- Ensuring that the company has complied with relevant laws and regulations
What are the responsibilities of assurance firms providing non-assurance services ?
A firm engaged by management to provide additional non-statutory and non-assurance services is only responsible for the services specifically negotiated with management. Such engagements do not result in the firm taking responsibility for any aspects of the company’s operations or procedures. For example, a firm may be engaged to perform services additional to the audit such as:
- Assisting the company with the maintenance of its accounting records.
- Assisting the company with preparing management information.
- Preparing the financial statements of the company.
- Preparing the corporation tax return of the company.
The key point is that management retains overall responsibility for all of these matters; the firm is employed as a support to management, providing expert assistance.
What are the responsibilities of assurance firms providing sustainability assurance services ?
- Evaluate impact on financial reporting – Assess how sustainability issues (e.g. climate risks) affect financial statements and ensure proper disclosure.
- Review ‘other information’ – Check sustainability-related content in annual reports for consistency with audited financials.
- Provide assurance on sustainability disclosures – Offer limited or reasonable assurance using standards like ISAE 3000 (Revised) or, in future, ISSA 5000.
- Monitor evolving regulations and frameworks – Stay up to date with developments like the ISSA 5000 and UK or global regulatory expectations.
- Integrate climate considerations throughout audit – Apply professional judgment to identify and respond to sustainability risks at all audit stages.
- Maintain independence and objectivity – Avoid conflicts of interest, especially when also serving as the entity’s statutory auditor.
Define fraud and error
- Error: an unintentional misstatement in financial statements, including the omission of an amount or a disclosure.
- Fraud: the intentional act to deceive or obtain an unjust or illegal advantage.
For audit purposes, what are the two types of risk of misstatement which can arise from fraud?
- Misstatements arising from fraudulent financial reporting - intentional misstatements or omissions of amounts or disclosures in financial statements to deceive financial statement users.
- Misstatements arising from misappropriation of assets - theft of an entity’s assets, leading to financial statement misstatements
With regards to fraud, what are the responsibilities of management?
Those charged with governance have primary responsibility for the prevention and detection of fraud. This includes taking the following actions:
- Creating a Culture of Honesty and Ethical Behaviour: Establishing and promoting a culture where honesty and ethical behavior are valued and practiced by all employees.
- Establishing a Sound System of Internal Control : Implementing robust internal controls to prevent and detect fraud. This includes regular monitoring and reviewing of these controls to ensure their effectiveness.
- Implementing Policies and Procedures: Developing and enforcing policies and procedures that ensure the efficient and ethical conduct of the company’s business. This includes clear guidelines on reporting and addressing suspected fraud.
With regards to fraud, what are the responsibilities of assurance providers?
With regards to fraud, the responsibilities of assurance providers, specifically auditors, include:
* Obtaining Reasonable Assurance: Auditors must obtain reasonable assurance (not complete assurance) that the financial statements are free from material misstatement, whether caused by fraud or error.
* Assessing the Risk of Material Misstatement: Auditors need to assess the risk of material misstatement in the financial statements due to fraud. This involves understanding the entity and its environment, including internal controls, to identify and assess risks.
* Reporting Fraud or Error: When fraud or error is discovered, auditors are responsible for reporting it to the appropriate level of management or those charged with governance. In some cases, they may also need to report to regulatory authorities.
These responsibilities ensure that auditors play a crucial role in detecting and addressing fraud, thereby enhancing the reliability of financial statements.
When considering risk, what areas will auditors look at when considering the risk of fraud before accepting an audit?
Auditors should also carry out a discussion of the susceptibility of the entity’s financial statements to fraud. This will usually include a consideration of:
- The unique position of management to commit fraud: Management has access to sensitive financial information and the authority to override internal controls, making them uniquely positioned to manipulate financial statements or engage in fraudulent activities.
- The circumstances that could indicate earnings management: Situations where there is pressure to meet financial targets or expectations can lead to earnings management. This includes manipulating revenues, expenses, or other financial metrics to present a more favorable financial position.
- The known internal and external factors that could be an incentive to fraud being carried out: Factors such as financial difficulties, market competition, or personal financial pressures can incentivize individuals to commit fraud. External factors might include economic downturns or industry-specific challenges.
- Any unusual or unexplained changes in behaviour/lifestyle of management or employees: Significant changes in behavior or lifestyle, such as sudden wealth or erratic behavior, can be red flags indicating potential involvement in fraudulent activities.
- Any allegations of fraud that have been made: Previous allegations or suspicions of fraud, whether substantiated or not, can indicate a higher risk of fraud within the organization. These should be thoroughly investigated and considered in the audit process.
- Industry Risks: Identifying risks specific to the industry in which the company operates, such as common fraud schemes or regulatory challenges.
- Complexity of Transactions: Assessing the complexity of the company’s transactions, including operations in foreign countries, which can introduce additional risks such as currency fluctuations, regulatory compliance issues, and cultural differences.
If fraud is detected or suspected, who are auditors required to report it to and for what situations?
If fraud is detected or suspected, auditors are required to report it to various parties depending on the situation:
- Those Charged with Governance: Auditors must report fraud to those charged with governance, such as the board of directors or audit committee. This is appropriate in all cases to ensure that the entity’s leadership is aware of the issue and can take appropriate action. However, auditors must be cautious of “tipping off” issues, which involve disclosing information that could alert the subject of the investigation and potentially hinder the investigation.
- Shareholders: Auditors may need to disclose fraud to shareholders through their auditor’s report if the fraud has a significant impact on the financial statements. This is appropriate when the fraud affects the financial health or performance of the company. It would not be appropriate to report minor or immaterial frauds that do not impact the financial statements significantly - i.e. financial statements to not give a true and fair view.
- Third Parties: Auditors may be required to report fraud to regulatory authorities, law enforcement, or other relevant third parties, especially if the fraud involves illegal activities or breaches of regulatory requirements. This is appropriate when the fraud has legal implications or regulatory breaches. It would not be appropriate to report to third parties if the fraud is minor and does not breach any laws or regulations.
Where fraud is suspected, aside from making a report if necessary, what else must auditors consider regarding the integrity of the audit?
If the auditors identify misstatements which might indicate that fraud has taken place, they should consider the implications of this for other aspects of the audit, particularly management representations which may not be trustworthy if fraud is indicated. This may lead to a limitation in the scope of the audit
What types of laws and regulations are auditors concerned with regards to a company’s compliance? (2) Include examples of each
- Laws with a Direct Impact on Financial Statements: Laws and regulations that directly affect the preparation and presentation of financial statements. Auditors need to ensure that the entity complies with these laws to provide accurate and reliable financial information. Non-compliance can lead to material misstatements, impacting the truth and fairness of the financial statements. Examples: Companies Act, tax laws, accounting standards.
- Laws Providing a Legal Framework for Operations: laws that govern the overall operations of the company and ensure that it operates within legal boundaries. Auditors verify compliance to avoid legal penalties and preserve the company’s reputation. Non-compliance can result in significant legal and financial consequences. Examples: Employment laws, environmental regulations, health and safety standards, industry-specific regulations.
With regards to compliance with laws and regulations, what are the responsibilities of management?
Those charged with governance have primary responsibility to ensure compliance with laws and regulations. To fulfill this responsibility, they must:
* Monitor Legal Requirements: Management must stay informed about relevant laws and regulations that apply to the company. This involves regularly reviewing legal updates and ensuring that the company’s policies and procedures are aligned with current legal requirements.
* Operate Internal Control: Implementing and maintaining a robust system of internal controls is essential. These controls help prevent and detect non-compliance with laws and regulations, ensuring that the company operates within legal boundaries.
* Develop a Code of Conduct: Establishing a code of conduct sets the ethical standards and expectations for behavior within the company. This code should be communicated to all employees and integrated into the company’s culture.
* Monitor Compliance with the Code: Regularly monitoring and enforcing the code of conduct is crucial. This includes conducting audits, assessments, and investigations to ensure that employees adhere to the established ethical standards.
* Engage Legal Advisors: Consulting with legal advisors helps management navigate complex legal issues and ensures that the company’s operations comply with applicable laws and regulations. Legal advisors provide expert guidance on legal risks and compliance matters.
With regards to compliance with laws and regulations, what are the responsibilities of auditors?
- Make Inquiries of Management: Auditors should ask management about the company’s compliance with laws and regulations to identify any known or potential issues.
- Inspect Correspondence with Relevant Licensing or Regulatory Bodies: Auditors should review communications between the company and regulatory bodies to identify any compliance issues or concerns raised by these authorities.
- Obtain Written Representations: Auditors should obtain written representations from management confirming that all known instances of actual or possible non-compliance with laws and regulations have been disclosed.
- Report Issues of Non-Compliance: Auditors should report any identified issues of non-compliance to the appropriate level of management or those charged with governance. In some cases, they may also need to report to regulatory authorities.
If non-compliance with laws and regulations is detected or suspected, who are auditors required to report it to and for what situations?
If non-compliance with laws and regulations is detected or suspected, auditors are required to report it to various parties depending on the situation:
* Those Charged with Governance: Auditors must report non-compliance to those charged with governance, such as the board of directors or audit committee. This is appropriate in all cases to ensure that the entity’s leadership is aware of the issue and can take appropriate action. However, auditors must be cautious of “tipping off” issues, which involve disclosing information that could alert the subject of the investigation and potentially hinder the investigation.
* Shareholders: Auditors may need to disclose non-compliance to shareholders through their auditor’s report if the non-compliance has a significant impact on the financial statements. This is appropriate when the non-compliance affects the financial health or performance of the company. It would not be appropriate to report minor or immaterial non-compliance that does not impact the financial statements significantly - i.e. financial statements to not give a true and fair view.
* Third Parties: Auditors may be required to report non-compliance to regulatory authorities, law enforcement, or other relevant third parties, especially if the non-compliance involves illegal activities or breaches of regulatory requirements. This is appropriate when the non-compliance has legal implications or regulatory breaches. It would not be appropriate to report to third parties if the non-compliance is minor and does not breach any laws or regulations.
What is bribery?
Bribery is the act of offering, giving, or receiving something of value to influence someone to act improperly
What are the four main offences regarding bribery? Describe each
- Bribing another person - Where a person offers promises or gives financial or other advantage to another person to induce or reward them for improperly providing a relevant function or activity
- Being bribed - Where a person requests accepts or receives financial or other advantage as a reward for improper performance of a relevant function or activity.
- Bribing a foreign public official - Where a person offers promises or gives any financial or other advantage to the official or a third party with the officials consent or acquiescence and that official is not permitted by law to be influenced
- Corporate failure to prevent bribery - Any commercial organisation which fails to prevent an offence being committed by anyone who performs services for the company. Includes employees, agents, subsidiaries
Define ‘relevant function or activity’ and ‘improper’ with regards to bribery
- Relevant function or activity: Where the person performing the function is in a position of trust (need not have any connection with the UK), including: any activity of a public nature, any activity connected with business or in the course of employment.
- Improper: Does not meet the standard which a reasonable person in the UK would expect.
What is one of the legal tests used to determine whether something constitutes bribery in the UK?
What a reasonable person in the UK would expect of a person performing the relevant function or activity
What is the impact of the Bribery Act 2010 on an audit?
- Anti-Bribery Controls Assessment: Auditors must evaluate internal controls, anti-bribery policies, risk assessments, due diligence, and whistleblowing mechanisms.
- Fraud Risk & Material Misstatements: Bribery increases the risk of financial misstatements due to fraudulent transactions (e.g., disguised fees, off-the-books payments).
- Legal and Ethical Responsibilities: Auditors must comply with ISA 250 and may may have a duty to report suspicions of bribery to the National Crime Agency (NCA) under the Proceeds of Crime Act 2002 (POCA).
What is the impact of the Bribery Act 2010 on an audit firm?
Audit firms must implement effective anti-bribery policies, focusing on these six key principles:
* Proportionate Procedures – Develop tailored controls to prevent and mitigate bribery risks, based on the firm’s size and operations.
* Top-Level Commitment – Senior management must promote a culture where bribery is unacceptable.
* Risk Assessment – Conduct periodic, informed, and documented reviews of bribery risks.
* Due Diligence – Apply proportionate, risk-based checks on clients, suppliers, and third parties.
* Communication & Training – Ensure staff understand and follow anti-bribery policies through clear communication and regular training.
* Monitoring & Review – Regularly review and improve bribery prevention procedures to address new risks or weaknesses.
Define a related party
A related party is an individual or entity that has a close relationship with a company, which could influence or be influenced by the company’s decisions. Related parties may have the ability to control, exert significant influence over, or be subject to control by the reporting entity.
What is a related party transaction and why is it important that auditors consider these?
A related party transaction is any transfer of resources, services, or obligations between a company and a related party (e.g., directors, subsidiaries, or close family members). Transactions with related parties may be carried out on terms which may not be the same as in an arm’s length transaction with an independent third party
Auditors must carefully assess related party transactions because under FRS you must disclose the relevant amounts and relationships so that the readers of the financial statements can decide for themselves whether such transactions have led to a manipulation of the financial statements.
In each of the follwoing stages of the audit, detail what work must be carried out regarding the auditing of related party transactions:
* the planning stage
* the detailed testing stage
* the review stage
At the planning stage, auditors must consider and evaluate the risk of material misstatements related to related party transactions (RPTs), particularly focusing on fraud risks or improper disclosures.
During the detailed testing stage, auditors must:
* Enquire to the directors of the existence of related parties
* Reviewing minutes of board meetings
* Reviewing records for large or unusual transactions or balances
* Reviewing investments in other companies
At the review stage, auditors must request written representation from directors, who are in the best position to know the identities of related parties. The auditor then reviews the accounts, together with the audit evidence available, in order to reach a conclusion on the appropriate audit opinion.
What is money laundering?
Money laundering is the crime which is the process by which the proceeds of crime are converted into assets which appear to have a legitimate source.
Proceeds of crime is widely defined and includes any assets resulting from a criminal act, e.g. smuggling, drugs, tax evasion, and bribery.
What are the responsibilities of the audit firm regarding safeguarding against money laundering?
Appointing a Money Laundering Nominated Officer (MLNO): The audit firm must designate an MLNO (also called a Money Laundering Reporting Officer – MLRO) who is responsible for:
* receiving and evaluating internal reports of suspicious activities,
* reporting genuine concerns to the National Crime Agency (NCA) via a Suspicious Activity Report (SAR)
* ensuring the firm complies with anti-money laundering (AML) regulations and monitors the effectiveness of AML controls.
Conducting Client Due Diligence (CDD):
* For New Clients: Before accepting new clients, auditors must perform CDD to verify the client’s identity, assess their risk profile, and ensure they are not involved in illegal activities. This includes checking official identification documents (e.g., passports, company registration documents), performing enhanced due diligence for high-risk clients (e.g., politically exposed persons – PEPs or clients from high-risk jurisdictions).
* For Existing Clients: CDD should be periodically updated to reflect any changes in the client’s risk profile or circumstances (e.g., expansion into high-risk industries).
Training: Audit firms must provide regular training to all staff, including auditors, administrative personnel, and partners, to help them:
* understand money laundering risks and how they may arise during audits,
* recognize potential signs of money laundering, such as unusual transactions, discrepancies in client records, or high-risk client behavior
* Follow proper procedures for reporting suspicious activities internally to the MLNO.
Effective training ensures that all employees are aware of their legal obligations and can contribute to the firm’s AML efforts.
Record-Keeping Requirements:
Audit firms are required to maintain comprehensive records related to AML compliance, including:
* Client Due Diligence Records: Documents collected during the CDD process (e.g., client identification checks).
* Suspicious Activity Reports (SARs): Copies of SARs filed with the NCA and related correspondence.
These records must be securely retained for at least five years after the end of the client relationship or engagement, as required by AML regulations. Proper record-keeping ensures that the firm can demonstrate compliance with AML obligations during regulatory inspections or audits.
What are the responsibilities of the auditor regarding safeguarding against money laundering?
- Auditors are legally required to comply with the Proceeds of Crime Act 2002 (POCA), which imposes obligations on professionals, including accountants, to detect and report money laundering activities. Failure to report suspicions of money laundering is a criminal offense. If an auditor suspects that a client is involved in money laundering, the auditor must report it to the Money Laundering Nominated Officer (MLNO) or Money Laundering Reporting Officer (MLRO). The obligation to report overrides the duty of confidentiality that auditors have towards their clients, meaning they must disclose suspicions even if doing so breaches client confidentiality. This ensures that the wider public interest, including preventing financial crimes, is prioritized over client confidentiality.
- Auditors must however avoid tipping-off the entity or person suspected of money laundering as this is also an offence. By tipping off, auditors would prejudicially affect legal proceedings, obstruct law enforcement efforts, and potentially allow criminals to evade capture. Therefore, auditors must take care not to reveal any information about a money laundering report or investigation to the client, ensuring confidentiality and the integrity of the investigation proce
Define tipping-off with regards to money laundering
Tipping off refers to the act of informing a client or third party that an investigation into possible money laundering is underway.
