DFSA’S AUDIT MONITORING PROGRAMME 2013/Audit... · 2017-08-10 · The DFSA’s audit monitoring...

DFSA’S AUDIT MONITORINGPROGRAMME

Public Report 2008 - 2012

Issued April 2013

1. Foreword

2.AboutthisReport

3. DubaiFinancialServicesAuthority

4. Keyfindings

4.1 Professionalscepticism

4.2 Goingconcern

4.3 Independenceofemployees

4.4 Externalconfirmations

4.5 ImplementationofClarityISAs

4.6 Preparationoffinancialstatementsforauditclients-self-reviewthreat

4.7 Insufficientevidenceofreviewduetotheauditworkbeingconductedbyanotherofficeofthesamefirm

4.8 Qualityofauditwork

4.9 InvolvementofAuditPrincipal

4.10 Insufficientauditwork

4.11 Disclosureofanassetplacedwitharelatedentityasacashequivalent

5. Otherfindings

Appendix1-TheDFSA’sauditmonitoringprogramme

Appendix2-Otherfindings

Appendix3-AuditorsregisteredforthePeriod

Appendix4-AuditorswithdrawnduringthePeriod

Contents

3

6

7

8

8

8

8

9

9

9

10

11

11

11

12

13

14

18

23

24

3DFSA’S AUDIT MONITORING PROGRAMME

1. Foreword

Thisisthefirstpublicreport(Report)ontheDubaiFinancialServicesAuthority(DFSA)’sauditmonitoringprogramme.

ThisReportcoversauditinspectionsconductedbytheDFSAintheperiod1January2008to31December2012(Period).

TheDFSA’sauditmonitoringprogrammeaimstopromotehigh-qualityexternalauditsoffinancialreportsissuedinaccordancewithChapter8oftheGENModule(DFSARulebook).

ThepurposeofourauditmonitoringprogrammeistoassesswhetherRegisteredAuditors(RAs)intheDubaiInternationalFinancialCentre(DIFC)meettheappropriateinternationalstandards.The DFSA Rulebook sets out these standards which include: the International Standards onAuditing(ISAs),theInternationalStandardonQualityControl(ISQC1)andtheCodeofEthicsforProfessionalAccountants(CodeofEthics)issuedbyInternationalFederationofAccountants(IFAC).Whererelevant,theIslamicAccountingandAuditingStandardsandtheCodeofEthicsforAccountantsandAuditFirmsofIslamicFinancialInstitutionsasissuedbyAccountingandAuditingOrganisationforIslamicFinancialInstitutions(AAOIFI)areapplied.

TheDFSA’ssupervisoryregimeforRAs involvesoff-siteandon-sitesupervision.Weemployarisk-basedapproach,incorporatingbothplannedandeventdrivenactivities.OurauditmonitoringprogrammeisdiscussedinmoredetailinAppendix1.

TheDFSA’sauditmonitoringteamcomprisesmembersofstaffwhoareexperiencedinstatutoryauditandfinancialreporting.StaffmembersaretrainedintheDFSAauditmonitoringmethodology.

Duringtheperiodcoveredbythisreport,theDFSAconductedthirtythree(33)on-siteassessments,assessedfiftysix(56)AuditPrincipalsandreviewedonehundredandsix(106)auditengagement

Chart 1: Summarised results of audit monitoring for the Period.

4

filesfocusingonthesubstanceofaRA’sworkandassessingwhethersufficientandappropriateevidencewasobtainedanddocumentedtosupporttheconclusionsreached inrelationtokeyauditjudgements.

TheInstituteofCharteredAccountantsinEnglandandWalesand/ortheAssociationofCharteredCertifiedAccountantsprovidedtechnicalassistanceonthirteen(13)on-siteassessments.However,atalltimes,DFSAstaffmembersdirectedandretainedtheresponsibilityforallassessments.

Key issuesTheDFSAhasidentifiedthree(3)keyissuesrequiringimprovementbyRAsintheareaofauditevidencenamely:

(1) RAs should exercise greater professional scepticism, particularly when reviewingmanagement’sjudgments;

(2) RAsshouldnotonlyseektoobtainevidencethatcorroboratesbalancesandmanagementjudgements,butalsoseekevidencethatmaychallengethosebalancesandjudgments;and

(3) RAsshouldimprovethesufficiencyandappropriatenessofevidenceobtainedtosupporttheirconclusionsonsignificantareasoftheaudit.

There are some other important areas where RAs need to focus their attention and makeimprovementstoensureauditquality.

TheDFSAcommunicatesitsfindingswithRAsonanindividualbasisandalsothroughitsannualoutreachsessions,detailingaggregatefindingsfromthepreviousyear’sinspectionsandraisingareasofinterestforthecomingyear’sinspectionprogramme.

DuringtheperiodcoveredbythisReport,theDFSAhastakenanumberofactionsincludinggiving written observations to RAs with a requirement that they implement recommendedaction, placingAudit Principals under close supervision and enforcement action in themoreseriouscases.

TheDFSAhasorganisedtwo(2)RegionalAuditConferencestoprovideaplatformtodiscussmatterspertainingtoauditintheregion.Theseconferenceswereattendedbyahighnumberofaudit professionals from across the region.We alsoorganised various “Breakfast Briefings”ontopicsofinteresttotheauditcommunityatlarge.

TheDFSAiscurrentlyundertakingafullreviewofitslegislativeframeworkrelatingtoRAsintheDIFC.Itisexpectedthatthisreviewwillbecompletedin2014.

In2012,theRegulatoryLaw2004wasamendedtoprovidetheDFSAregulatoryoversightofRAsofPublicListedCompanies(PLCs).TheDFSAwill initiate inspectionsoftheseRAsfrom2013onwards.


For2013,theDFSAwillcontinuetoinspectRAsofAuthorisedFirms(AFs)andAuthorisedMarketInstitutions(AMIs).Areasoffuturefocuswillinclude:

1) Auditevidenceandprofessionalscepticism;

2) InvolvementofAuditPrincipals;and

3) Independence.

IamconfidentthatyouwillfindreadingtheobservationsinthisReportuseful.

Ian JohnstonChiefExecutive

6

2. About this Report

ThisReportsummarisestheresultsoftheDFSA’smonitoringvisitsofAFsandAMIsconductedoveraperiodoffive(5)yearsandsetsoutkeyissuesidentifiedduring2008-2012.ThisReportdoesnotcoverRAsofPLCs.

ThisReportcomplieswiththeInternationalForumofIndependentAuditRegulators(IFIAR)1CorePrinciples2forIndependentAuditRegulators,inparticular,Principle3relatingtothetransparencyandaccountabilityofauditregulators.

InthecourseoftheDFSAreviewingasampleofselectedauditengagementfilesofaRA,anauditmonitoringvisitmayidentifywaysinwhichaparticularauditengagementfileisdeficient.Itisnotthepurposeofanauditmonitoringvisit,however,toreviewalloftheRA’sauditengagementsortoidentifyeverydeficiencywhichmayexistinanauditengagement.Accordingly,thisReportdoesnotprovideanyassurancethattheRA’sauditsofthefinancialstatementsarefreeofdeficienciesnotspecificallydescribedinthisReport.

Unlessstatedotherwise,notallmattersinthisReportapplytoeveryRA.

DuringthisPeriod,theDFSAalsocarriedoutinspectionsfocusedonRA’sAnti-MoneyLaundering(AML)obligations.ThefindingsofthoseinspectionsarenotincludedinthisReport.

ThisReportdoesnotcoveranyenforcementactionstakenbytheDFSAontheRAs.TheoutcomesofallenforcementactionsarereportedonDFSA’swebsite(www.dfsa.ae)andthroughseparatemediareleases.

Referenceto“instances”/“occasions”/“auditengagementfiles”and“engagementteams”inthefindingsshouldbeconsideredinrelationtoafindingonaparticularauditwhilereferenceto“RA”shouldbeconsideredinrelationtowholefirm-widerelatedissue.

WehopethisReportisbeneficialtoRAs,otherauditfirms,AFs,AMIs,auditcommitteesandotherinterestedstakeholders.

1-IFIARisanorganisationofindependentauditregulators.Theorganisation’sprimaryaimistoenableitsmemberstoshareinformationregardingtheauditmarketenvironmentandpracticalexperiencesofindependentauditregulatoryactivity,withafocusoninspectionsofauditorsandauditfirms.TheDFSAisamemberofIFIAR.

2-TheCorePrinciplesseektopromoteeffectiveindependentauditoversightglobally,therebycontributingtomembers’overridingobjectiveofservingthepublicinterestandenhancinginvestorprotectionbyimprovingauditquality.


3. Dubai Financial Services Authority

TheDFSAistheindependentregulatoroffinancialandancillaryservicesconductedinorfromtheDIFC,apurpose-builtfinancialfree-zoneinDubai.

TheDFSA regulates abroad rangeof Firmsbased in theDIFC, includingbanks, insurers, fundmanagers,advisoryfirmsandbrokers,exchangesandclearinghouses,togetherwithcreditratingagencies,RAsandotherancillaryserviceproviders.TheseFirmsprovideawiderangeofservicestotheirclients,includingIslamicfinance.

Inaddition to regulatingfinancial andancillary services, theDFSA is responsible for supervisingand enforcingAML andCombating the Financing of Terrorism requirements applicable in theDIFC.TheDFSAhasalsoacceptedadelegationofpowersfromtheDIFCRegistrarofCompaniesto investigatetheaffairsofDIFCcompaniesandpartnershipswhereamaterialbreachofDIFCCompanies Law is suspected and to pursue enforcement remedies that are available to theRegistrar.

With respect toRAs, theDFSA is responsible for the registration, oversight and suspension /removalofRAsintheDIFCinrespectofAFs,AMIsandPLCs.

8

4. Key findings

ReviewsofengagementfilesacrossRAsinspectedraisedanumberofissuesaboutthesufficiencyandappropriatenessofevidenceobtainedbyRAstosupporttheirconclusionsonsignificantareasoftheaudit.Keyfindingsweremainlyintheareasoutlinedbelow:

4.1 Professional scepticism Professional scepticismmust bemaintained andexercised throughout theplanningandperformanceofanaudit.

AuditPrincipalsandstaffshouldhavequestioningminds,obtainafullunderstandingofallrelevantfacts,notbeoverreliantonmanagement’sexplanationsandrepresentations,andnot justseektoobtainauditevidencethatcorroboratesratherthanchallengesmanagement’sjudgement.ItisthedutyoftheAuditPrincipaltomaintainanappropriatelevelofprofessionalscepticism.

It is essential forAudit Principals and relevant staff to have a sound knowledgeofInternational Financial Reporting Standards (IFRS) and other relevant accountingstandardsandframeworkstoconductaneffectiveaudit.

4.2 Going concernISA570-Goingconcernrequiresanauditortoevaluatemanagement’sassessmentof an entity’s ability to continue as a going concern. It also requires an auditor toundertake specific procedureswhen events or conditions thatmay cast significantdoubtonanentity’sabilitytocontinueasagoingconcernhavebeenidentified.

Infive(5)auditengagementfiles,therewasalackofevidencethattheAuditPrincipalschallengedevidenceprovidedbythemanagementoftheAFtosupporttheirassumptionthattheentitywasagoingconcern.TheAuditPrincipalsoftenacceptedmanagement’sestimatesoffuturecashflowswithoutcriticallyassessingtheassumptionsunderlyingthoseestimates.

4.3 Independence of employeesTheDFSAnoted that six (6)RAs retained the passports of their employees. Theargumentput forwardby thoseRAswas for securitypurposes,however,evidencesuggestedthatthismightnotbethereason.

TheDFSA is of the view that the retentionof an employee’s passportmay affecttheindependenceofthoseemployeesintermsofraisingtheirconcerns(ifany)onaparticularaudit.

Subsequenttoouron-siteassessments,theseRAsconfirmedthattheyhadreturnedthepassportsoftheiremployees.

TheDFSAwillcontinueclosemonitoringof issuesrelatingtothe independenceofemployees.


4.4 External confirmationsAuditevidenceintheformofexternalconfirmationsreceiveddirectlybytheauditorfromconfirmingpartiesmaybemorereliablethanevidencegeneratedinternallybythe entity. It is a generally accepted audit practice that independent confirmationsshouldbeobtained formaterialand /or significantbalances (suchascashatbank,investments,andloanswithfinancialinstitutionsanddebtors)tosupporttheaccuracy,existenceand/orcompletenessoftheauditassertions.

Whereexternalconfirmationsarenotobtained,theauditor isrequiredtoperformalternativeproceduresthatwillprovidesufficientappropriateauditevidenceabouttheauditassertionsthattheconfirmationwasintendedtocover.

Oneight (8) audit audit engagement files, the audit teams failed to receive externalconfirmationsfromindependentthirdparties.Theydidperformalternateproceduresonone(1)occasiontosatisfythemselveswhileontheremainingseven(7)auditengagementfiles,noalternateprocedureswerecarriedout.Wherenoalternateprocedureswerecarriedout,theauditengagementfilesdidnotcontainanadequateexplanationastowhyanyalternateprocedureswerenotcarriedoutbytheengagementteam.

Oneighteen(18)auditengagementfiles,therewasnotrailoftheconfirmationprocess,whilefifteen(15)engagementteamsfailedtokeeppropercontrolovertheexternalconfirmationprocessasrequiredbyISA505–Externalconfirmations.TheseRAspreparedtheconfirmationletters,providedthesametotheirclientsinsoftcopyandallowedtheclienttosendtheconfirmationtotherelevantbanks.

4.5 Implementation of Clarity ISAsIn 2009, the InternationalAuditing andAssurance StandardsBoard (IAASB) issuedClarityISAs.

ThefinalsetofClarityISAscomprisesthirtysix(36)ISAsandISQC1,including:• one(1)newstandard,addressingcommunicationofdeficienciesininternalcontrol;• sixteen(16)standardscontainingnewandrevisedrequirements;and• twenty(20)standardsthathavebeenredraftedtoapplythenewconventionsandreflectmattersofgeneralclarity.

AllClarityISAswereeffectiveforauditsoffinancialstatementsforperiodsbeginningonorafter15December2009.

InrelationtoanumberoftheDFSA’sinspectionsduringthePeriod,theClarityISAswerenot yeteffective.Moreover, theDFSAreminded theRAs tomakeadequatearrangementstoimplementClarityISAsforauditsoffinancialstatementsforperiodsbeginningonorafter15December2009.

4.6 Preparation of financial statements for audit clients - self-review threat Asper the IFACCodeofEthics,providingservicessuchaspreparationoffinancialstatementsforanauditclientcreatesaself-reviewthreatwhentheauditorsubsequentlyauditsthesefinancialstatements.

10

Anauditormayprovide services related to thepreparationof financial statementsbasedoninformationinthetrialbalancetoanauditclientwhichisnotapublicinterestentitysolongasanyself-reviewthreatcreatedisreducedtoanacceptablelevel.

Inanycase,thesignificanceofanysuchthreatcreatedshallbeevaluatedandsafeguardsappliedwhennecessary toeliminatethethreatorreduce it toanacceptable level.Suchsafeguardsincludearrangingforsuchservicestobeperformedbyanindividualwhoisnotamemberoftheauditteam.

The DFSA noted that five (5) audit teams prepared / provided assistance withpreparationoffinancialstatementstotheirauditclients.Basedonourdiscussionswiththemanagersin-chargeontheseaudits,thefinancialstatementswerepreparedbythemembersof theaudit teamwhosubsequentlyperformedtheauditof thefinancialstatement.

Althoughtheauditteamscorrectlyidentifiedtheself-reviewthreat,theAuditPrincipalsfailedtoappropriatelyevaluateandmitigatethesametoanacceptablelevel.

4.7 Insufficient evidence of review due to the audit work being conducted by another office of the same firmUndertheDFSArules,auditsofDomesticAFsmustbeconductedbyRAsregisteredwiththeDFSA.OftenauditworkiscarriedoutbyanotherofficeofthesamenetworkoftheRA.Regardlesswheretheworkwascarriedout,aRAmustappointanAuditPrincipalwhoisresponsibleforthedirection,supervisionandperformanceoftheauditengagement.

Findings from particular files:

• TheauditworkwasconductedbyanotherofficeofthesamenetworktowhichtheRAbelonged. The audit reportwas signed by theRAbasedon an inter-officeopinionsignedoffbyapartnerfromanotheroffice.TheengagementletterwasissuedbytheotherofficeandnotbytheRAasrequiredundertheDFSArules. TheRA recorded itswork containing reporting documents preparedbytheotheroffice.However,reviewworkconductedbytheRAwasnotevidentonthisfilenorwasthereanyevidenceofAuditPrincipal’sreview,withonlytheauditmanagersign-offevident.TheDFSAcouldnotdeterminefromthefilewhatreviewworkhadbeenconductedbytheRAinordertosatisfy itselfthatauditevidencewassufficient.

• TheunderlyingauditworkwasundertakenattheofficeofanaffiliateoftheRAwiththeRAsigning-offontheauditreportbasedontheworkdonebytheaffiliateoffice.The audit engagement file included information submitted by the affiliate officebutdidnotreflecttheworkdonebytheRAoverdirectingthescopeoftheauditorcontainsufficientevidenceofreviewproceduresdone.Therewas insufficientevidenceonthefileofAuditPrincipal’sinvolvementontheauditwithinter-officearrangements.


4.8 Quality of audit workRAsareresponsibleforthequalityofindividualaudits,andshouldaimtoensurethatqualityauditsareconsistentlyperformed.Aqualityauditislikelytobeachievedwhentheauditor’sopiniononthefinancialstatementscanberelieduponasitwasbasedonsufficientappropriateauditevidenceobtainedbyanengagementteam.

In respect of two (2) RAs, theDFSA noted issueswith the quality of auditworkconductedrelatingtobothdocumentationandunderlyingauditapproach.

Theengagementfilesdidnotdisplayathoroughunderstandingoftherequirementsofauditingstandards.Itwasconcludedthattheauditstaffdidnothavepriorknowledgeofauditrequirementsandhadnotreceivedsufficienttraining.

4.9 Involvement of Audit PrincipalUndertheDFSArules,aRAmustappointanAuditPrincipalwhoisresponsibleforthedirection,supervisionandperformanceoftheauditengagement.


• TheAuditPrincipal,who retained responsibility for signing theaudit report,wasnotsufficientlyinvolvedintheaudit.The‘engagementpartner’rolewasdelegatedtoarecentlypromotedpartner,whohadnotasyetbeenregisteredasanAuditPrincipalwiththeDFSA.TheAuditPrincipalthatsignstheauditreportmustfulfillthe‘engagementpartner’roleasdefinedinISA220–Qualitycontrolforanauditoffinancialstatements.

• A directorwhowas not anAudit Principal, as defined by theDFSARulebook,managedtheconductoftheRA’sauditwork.However,adifferentpartnerwhowas anAuditPrincipal signed theaudit report.Therewasnoevidence that thesigningpartnerhadbeensufficientlyinvolvedintheauditprocess,orthathehadperformedanyreviewtasksbeforesigningtheauditreport.ThisdidnotmeettherequirementsofGENModule8.9.2whichrequirestheAuditPrincipaltomanagetheconductoftheauditworkandsigntheauditreport.

• ThesigningAuditPrincipalwasonlyinvolvedatthefinalstageofcompletionandwasnotresponsiblethroughouttheauditforitsdirection,supervisionandperformance.

4.10 Insufficient audit work The RA should design and perform audit procedures that are appropriate in thecircumstances for the purposes of obtaining sufficient appropriate audit evidence.Sufficiency is the measure of the quantity of audit evidence. The quantity of theauditevidenceneededisaffectedbytheauditor’sassessmentoftherisksofmaterialmisstatements.


• No audit work was conducted on a significant revenue transaction other thanobtainingarepresentationletterfrommanagement.Therewasnootherevidenceontheauditengagementfile.TheAuditPrincipalhaddiscussedthismatterwiththe

12

AFandwassatisfiedwiththeoutcome.Therewasnodocumentaryevidencetosubstantiatethisdiscussion.

• ConsideringtheAF’srelianceonlargetransactionstogenerateincomeandcoupledwith the fact thatat thefinancial yearendoutstandingdebtorsconstituted82%oftheclient’sbalancesheettotal,itistheDFSA’sviewthatadditionalauditworkshouldhavebeenconductedinrelationtotherecognitionofrevenueinparticularthoserelatingtolargetransactions.

• Unsatisfactory auditworkhadbeendoneon the revenue component.Randominvoiceswerefiledintheworkingpaperfile.Invoiceswerenotcross-referredtotheagreementstoensurethattheentityhaslegalrightovertheseinvoices.Someoftheinvoicesfiledpertainedtothenextfinancialyear.

• Thesenior-in-chargeofthisparticularauditstatedtotheDFSAthathehadsighteddocuments (placementmemorandum and other relevant contracts details) andobtainednetassetvaluationsbuttherewasnodocumentaryevidencetosubstantiatethisstatementonthefile.

• Unsatisfactoryauditworkhadbeendoneonthereceivablesbalance.TheRAfailedtoobtain independentconfirmationsfromthedebtorsandalsodidnotperformalternativetests.TheRAclaimedthatitperformedthesubsequentreceipttestbutthesamewasnotdocumented.

• TherewasasignificantinvestmentinaSpecialPurposeVehicle(SPV)whichhadbeenpurchasedfromarelatedentity.ThisSPVrepresentedamaterialamountonthebalancesheet.TheSPVheldanunderlyingassetandtheRA’sapproachwastotestthevalueoftheunderlyingassetandnottheSPV.InsufficientauditworkhadbeendoneontheSPVasawhole.

4.11 Disclosure of an asset placed with a related entity as a cash equivalent CashequivalentsaredefinedinInternationalAccountingStandards(IAS)7–Statementofcashflowsas‘short-term,highlyliquidinvestmentsthatarereadilyconvertibletoknownamountsofcashandwhicharesubject toan insignificantriskofchanges invalue’.

Findings from a particular file:

• AsignificantbalancewasclassifiedascashandcashequivalentswhichrepresentedanamounttransferredtoarelatedentitythatitselfplaceditwithathirdpartybankinitsownnameandnotthatoftheAF.Althoughtheamountwasheldinabank,itwasnotheld ina ring-fencedbankaccount in thenameof theAF.Theauditwork conductedby theRAextended to seeking confirmation from the relatedentityonlyanddidnotgoasfarasseekingconfirmationfromthethirdpartybank.Astheamountwascontrolledbyarelatedentitythereisariskthattheamountisnotreadilyconvertibleintocash.ThishadnotbeenadequatelyconsideredanddocumentedbytheRA.


5. Other findingsTheDFSAhasclassifiedotherfindingsintothefollowingcategories:

1.Independence;

2.Auditplanning;

3.Auditexecution;

4.Auditconclusion;

5.Auditreviewprocedures;

6.Financialstatementdisclosuresandauditreport;and

7.Wholefirm-wide.

ThesefindingswerecommunicatedtorespectiveRAsinadetailedform.

Belowisasummaryoftheotherfindings.AfullsummaryofallfindingsisprovidedinAppendix2.

Key issues Audit planning• 26%of the audit engagement files inspected failed to show sufficient evidence that theprocedures required to address the risk of fraud, as stated in ISA 240 – The auditor’sresponsibilitiesrelatingtofraudinanauditoffinancialstatements,hadbeenconducted;and

• 26%oftheauditengagementfilesinspecteddidnotconsideranauditor’srightanddutytoreporttotheDFSAunderArticle104(3)ofDIFCLawNo.1of2004.

Audit execution• 27%oftheauditengagementfilesinspecteddidnotadequatelydocumentmatterswhichwereimportanttosupporttheauditopinion.

Audit conclusion• 18%oftheauditengagementfilesinspectedfailedtoevaluateanddocumenttheaggregateduncorrectedmisstatementsarisingoutoftheaudits;and

• Therewasinsufficientdocumentationofworkdoneonsubsequenteventson17%oftheauditengagementfilesinspected.

Financial statements disclosures and audit report• 31%oftheauditreportscontainedreferencestolawsthatdonotapplytoAFsand/orAMIs;and

• 28%oftheauditopinionsdidnotcomplywiththerequirementsofDFSARulebook.

14

Appendix 1 - The DFSA’s audit monitoring programme

ObjectiveTheDFSA’sauditmonitoringprogrammeaimstopromotehigh-qualityexternalauditsoffinancialreportsissuedundertheDFSARulebook.

Thepurposeof an auditmonitoring programme is to ensure thatRAs in theDIFCmeet therequirementsofISAs,ISQC1andtheIFACCodeofEthics.

The DFSA’s supervisory approachTheDFSAadoptsarisk-basedapproachwithrespecttoRAswhichincludesbothevent-drivensupervisionandon-goingsupervisionactivities.

RAsaresubjecttoanon-siteassessmentatleastonceinathree(3)yearperiod.However,thiscanbevarieddependingonanyotherriskfactorsidentified.TheseassessmentsareconductedbytheDFSAstaffandcaninvolveassistancefromaninternationalprofessionalbodywhichprovidesmonitoringassistanceandtechnicaladvicetotheDFSA.

TheDFSA’ssupervisorytoolsincluderegistration,on-siteassessments,desk-basedreviews,eventdrivenreviewsandthemereviews.Thesearediscussedindetailbelow:

A. RegistrationAspartoftheregistrationprocess,theDFSAassessesthefitnessandproprietyofRAsandtheirAuditPrincipals.Theassessmentissimilartoanon-siteassessment,butisrestrictedtothereviewofwholefirm-wideprocedures.

B. On-site assessmentsPurposeTheon-siteassessmentinvolvestheDFSAundertakingananalysisoftheRA’soperationsandbusinessandhowitconductsanauditofanAF,AMIorPLC.

FrequencyARA is subject to at least one (1) on-site assessment every three (3) years. Theon-siteassessmentresultsintheRAsbeingassignedariskrating.Thefrequencyofon-siteassessmentscanbevarieddependingontheriskratingthathasbeenassignedtotheRA.

RA selectionSelectionforanon-siteassessmentisbasedonanumberoffactorsincludingriskratingoftheRA,theriskratingandactivitytypeoftheAF,AMIorPLCthattheRAaudits,resultsofanypreviouson-siteassessmentsandanyotherrelevantinformation.


Notification to the RATheDFSAinformstheRAwhenithasbeenselectedforanon-siteassessment,atleastfour(4)weeksbeforethevisit(unlessthisvisithasalreadybeenpostponedorrescheduled).Thevisitnotificationletterprovidesthefollowingdetails:

• Theproposeddateforthevisit,

• Thetimethevisitisestimatedtotake;and

• Anyresourcerequirements.

ReschedulingAvisitisonlyrescheduledinverylimitedcircumstances.IftheRAwishestorequestareschedule,itshoulddosoimmediatelyuponnotification,inwriting,advisingofthereasonsfortherequestedreschedulingandproposedalternativedates(preferablyearlierthaninitiallyproposed).

Pre-visit questionnaireThenotificationletter includesapre-visitquestionnaire.Thisquestionnaire includesa listofadditionaldocuments,recordsandother informationthatwerenot included intheAnnualInformationDocument(AID)submittedbyeachRAatthestartofeverycalendaryear.

Pre-selection of audit engagement filesThe DFSA pre-selects the audit engagement files for review. The pre-selection list iscommunicatedtotheRAatleastone(1)weekbeforethevisit.

Pre-visit phone call Approximatelyone(1)weekbeforethevisitdate,theDFSAcontactstheRAbytelephoneinorderto:

• Confirmthefinalarrangements;

• DealwithanyqueriesthattheRAmayhave;

• Clarifyanymattersarisingfromthedocumentationinhand;and

• Confirmtheavailabilityoffilesand/ortherelevantpartners.

Opening meetingTheDFSAholds initialdiscussionswith theRA’sAuditPrincipals toobtain informationontheRA’sbusinessprofileandobtainanunderstandingofhowtheRArunsitspractice.Thesediscussionscover:

• RA’sprocedurestoensurecompliancewiththeDFSA’slawsandrules;

• TheextentandscopeoftheRA’sowninternalqualitycontrols;

• Detailsofcompliancereviewsconducted;

• Clientprofile;

• Natureandextentofactivities;and

• Staffprofileincludingindividualrolesandresponsibilities.

16

Engagement files review Having assembled the required data, theDFSA commences the detailed file reviews. TheDFSAdecidesontheengagementfilesthatitwishestoreviewfromthepre-selectedlist.TheDFSAalsoholdsdiscussionswith the relevantAuditPrincipal /engagementauditmanagerbeforethestartofanengagementfilereview.

File review queriesOncetheauditengagementfilereviewiscompleted,theDFSAstaffsummarisesthemattersarising froman individualengagementfileandpreparesquerynotesdocumentinghis /herobservations.

The query notes are handed over to the respective Audit Principal / engagement auditmanagertopreparearesponse.Oncetheresponseisprepared,eachobservationalongwithitsresponseisdiscussed.

Other aspects of firm-wide reviewThefollowingfirm-widedocumentsarealsoexamined:

• Correspondencewithotherregulators;

• Correspondencewithclientspertainingtodisputes;

• DocumentationrelatingtotheRA’sprofessionalindemnityinsurance;

• Partnerandstaffappraisalrecords;and

• ContinuousProfessionalDevelopment(CPD)recordsoftheAuditPrincipalsandauditstaff.

AnyfindingsarisinginthecourseofthisworkarediscussedwiththeRAand/ortheindividualsconcernedsothatanyminormatterscanbeclearedatthistime.

Closing meeting There shouldbenomatters included in theclosingmeeting thathavenotbeendiscussedduringthecourseofthevisit.

Thepurposeoftheclosingmeetingisto:

• Confirmthefactualaccuracyofthemattersreported;

• Presentthepreliminaryoverallvisitfindings;and

• Discusstheimplicationsofthefindings.

Preliminary on-site assessment report DependingontheRA’sclosingmeetingresponse,theDFSAaddsitsconclusiontothereporttogetherwithanyrecommendationsfor improvements.Thispreliminaryon-siteassessmentreportisthensenttotheRAwithanopportunitytomakefinalcommentswithinfourteen(14)days.


Final on-site assessment letter OnreceiptoftheRA’scommentsonthepreliminaryon-siteassessmentreport,theDFSAanalysestheresponseandconcludestheon-siteassessmentwithafinalletter.

C. Desk-based reviewsAdesk-basedreview(Review)isayearlyactivitytriggeredbythereceiptoftheAIDandtheAnti-MoneyLaunderingOfficer(AMLO)’sreport.Thesearetheprimaryinputdocumentsfortheauditmonitoringplan.TheseassisttheDFSAinprioritisingmonitoringvisits.TheReviewwillbebasedonanymattersarisingfromthesetwodocumentstogetherwithmattersarisingfrompreviouson-siteassessments(ifany)andinformationobtained.

D. Event-driven reviewsAnevent-drivensupervisoryactivitymaybetriggeredbyanotification,surveillanceorcomplaint(internally or externally). The DFSA utilises a combination of the supervisory tools whenconductingevent-basedsupervision.

E. Theme reviewsThemereviewsaregenerallyundertakenondiscreteareasoftheRA’soperations.Thesemaybeeitherdesk-based,on-siteoracombinationofboth.GenerallytheseareusedtoensurethateachRAcontinuestomaintainthelevelofcompetencedisplayedatthetimeofregistration.

18

3-Independenceofmind:thestateofmindthatpermitstheexpressionofaconclusionwithoutbeingaffectedbyinfluencesthatcompromiseprofessionaljudgement,thereby,allowinganindividualtoactwithintegrityandexerciseobjectivityandprofessionalscepticism.4 - Independence inappearance: theavoidanceof factsandcircumstances thataresosignificant thata reasonable and informed third party would likely to conclude, weighing all the specific facts andcircumstances, that a firm’s, or a member of the audit or assurance team’s, integrity, objectivity orprofessionalscepticismhasbeencompromised.

Appendix 2 - Other findings

BelowisafullsummaryofthekeyfindingsreportedinSection5ofthisReport.

IndependenceIndependenceisdefinedunderIFACCodeofEthicsasIndependenceofmind3andappearance4.

Description of other findings

Number o f engagement files that hadthese findings

Number of RAs that hadthese findings

FailuretoobtainindependenceconfirmationfromauditstaffinaccordancewithISQC1 N/A 5

Failuretocompleteclientacceptanceproceduresbeforesigningofengagementletter 3 3

Noindependencethreatevaluatedforperformingnon-assuranceservices 2 2

Failuretoobtainprofessionalclearanceinwritingfromthepredecessorauditor 1 1


Audit planning Auditplanninginvolvesestablishingtheoverallauditstrategyanddevelopinganauditplan.Adequateplanningbenefitstheauditoffinancialstatements.

TheDFSAidentifiedissuesinauditplanninginthefollowingareas:




Failuretoshowsufficientevidencethattheproceduresrequiredtoaddresstheriskoffraud,asstatedinISA240–Theauditor’sresponsibilitiesrelatingtofraudinanauditoffinancialstatements,hadbeenconducted

28 11

No consideration for the auditor’s right and duty to report toregulatorsunderArticle104(3)ofDIFCLawNo.1of2004 28 10

Failure to document an understanding of internal controls ofthe entity relevant to the audit in accordance with ISA 315 –Identifyingandassessingtherisksofmaterialmisstatementthroughunderstandingtheentityanditsenvironment

11 6

Insufficientdocumentationof auditplanning inorder tocomplywiththerequirementsofISA315–Identifyingandassessingtherisks ofmaterialmisstatement through understanding the entityanditsenvironment

10 5

NoevidencetosubstantiateappropriateanalyticalproceduresasrequiredbyISA520–Analyticalprocedures 5 3

Failuretoincluderelevantworkingpapersintheengagementfilewhenrelyingonworkconductedatthegrouplevel 5 5

Failuretodocumentthemattersdiscussedattheteamplanningmeeting 9 4

Failure to revise materiality despite significant adjustmentsbeingmadetothemanagementaccounts 3 3

Failuretodocumentthemattersdiscussedwiththemeeting 2 1

Failuretoevaluateconsiderationsforserviceorganisations 1 1

20

Audit execution TheDFSAnotedtheissuesintermsofauditexecutioninthefollowingbroadcategories:




Theauditengagementfilesdidnotadequatelydocumentmatterswhichwereimportanttosupporttheauditopinion 29 12

Auditevidenceonrevenueappearedtobeinsufficientandthequalityofauditdocumentationwaspoor 8 6

Nostandardprocedureforselectionofsamplesize 4 2

Failuretodocumentrationaleforconclusion 3 2

Failuretoconduct/documentanyworktoconfirmtheAF’scompliancewithShari’arulesandprinciples 2 2

Failuretodocumentworkonopeningbalances 1 1

Noevidenceofreviewoffinalactuarialreportconfirmingthefinalinsurancebalances 1 1

Failuretodemonstratecut-offtestingtoensurecashtransactionswereinitiatedinthesameperiod 1 1

Failuretodocumentthedetailedunderstandingofrelevantestimates 1 1

Failuretodocumentconsultation 1 1


Audit conclusion TheDFSAidentifiedissuesinauditconclusioninthefollowingareas:




Failuretoevaluateanddocumenttheaggregateduncorrectedmisstatementsarisingoutoftheaudits 19 6

Insufficientdocumentationofworkdoneonsubsequentevents 18 5

Failure to evidence communication to those charged withgovernance inaccordancewith ISA260–Communicationwiththosechargedwithgovernanceand ISA265–Communicatingdeficienciesininternalcontroltothosechargedwithgovernance

16 4

ThecontentsoftherepresentationletterdidnotcomplywiththerequirementsofISA580–Writtenrepresentation 10 3

Insufficientdocumentationofworkcarriedoutonmaterialjournalentries 9 1

Audit review proceduresTheDFSAnotedtheissuesintermsofauditreviewproceduresinthefollowingbroadcategories:




AuditPrincipalnotinvolvedthroughouttheaudit 4 3

Failuretodemonstrategatheringofsufficientauditevidencebeforetheissuanceofauditreport 2 2

FailuretoappointmandatoryEngagementQualityControlReviewer 2 1

FailuretocompleteEngagementQualityControlReviewbeforeissuanceofauditreport 1 1

FailuretonotifytheDFSAonappointmentofanAuditPrincipal 1 1

22

Financial statements disclosures and audit reportFindingsintheareaoffinancialstatementsdisclosuresandauditreportareasfollows:




Referencesintheauditreporttonon-applicablelaws 33 12

AuditopiniondidnotcomplywiththerequirementsoftheDFSARulebook 30 11

MinordisclosureissueswherethefinancialstatementsdisclosureswerenotinaccordancewithIFRS 9 7

Incorrectornoreferencetotheapplicableemploymentlawforcalculationofendofservicebenefits 7 6

AuditreportfailedtocomplywiththerequirementsofISA700–Forminganopinionandreportingonfinancialstatements 6 4

The financial statements did not contain adequate relatedpartydisclosuresasrequiredbyIAS24–Relatedpartydisclosures 4 4

Failuretopreparefinancialstatementsunderappropriatebasisofpreparation 2 2

Failuretoprepareconsolidatedfinancialstatements 1 1

Insufficientaudittrailoveraqualifiedauditopinion 1 1

Whole firm-wideWholefirm-widefindingsareasfollows:

Description of other findingsNumber of RAs that hadthese findings

Absenceofaformalanddocumentedprocessforpartner/staffappraisalandevaluation 6

FailuretomaintainadequateCPDrecords 5

Failuretofollowanappropriatemechanismtoascertainthelimitsforprofessionalindemnityinsurance 4


Appendix 3 - Auditors registered for the Period

ThefollowingRAswereregisteredduringtheperiodandsubjecttoanon-siteassessmentbytheDFSA,theresultsofwhicharepresentedintheReportbelow:

Firm Number

Name Date ofRegistration

F001428 AshokKapur&AssociatesLimited 28January2007

F001571 BDOCharteredAccountants&Advisors 04June2008

F000241 DeloitteandTouche(M.E.) 03January2005

F001429 DeloitteLLP 28November2006

F000031 Ernst&Young 03January2006

F001430 GrantThorntonLLP 15January2007

F001431 HorwathMAKLimited 15January2007

F001432 KPMGLLP 19April2009

F000641 MazarsCharteredAccountants 10May2011

F001792 MeralisCharteredAccountants&RegisteredAuditors* 02April2012

F000383 MooreStephens,CharteredAccountants 06February2007

F001434 PriceWaterhouseCoopersLimited 07January2008

F001435 RussellBedford(Dubai)Limited 05February2007

F001436 SajjadHaiderCharteredAccountantsLLP 03March2008

F001265 Sangani&Company* 16July2012

F001054 UsamahTabbarah&Co-NexiaInternational 26March2009

*RAsregisteredin2012arenotsubjecttoafullon-siteassessment.

24

Appendix 4 - Auditors withdrawn during the Period

ThefollowingRAswithdrewtheirregistrationduringtheperiodandweresubjecttoanon-siteassessmentbytheDFSA,theresultsofwhicharepresentedintheReportbelow:

Firm Number

Name Date ofRegistration

Date of Withdrawal

F000691 Farahat&CoLLP** 03March2008 13June2010

F000020 KPMG 03January2005 19April2009

F001433 MazarsMiddleEastLLP 12February2008 10May2011

F000599 MorisonMenonCharteredAccountants 07January2008 22January2012

F000025 PriceWaterhouseCoopers 03January2005 28December2010

**Notsubjecttoafullon-siteassessment.

Tel: +971 4 362 1500

Fax: +971 4 362 0801

PO Box 75850

Level 13, The Gate, Dubai, UAE

Email: [email protected]

Website: www.dfsa.ae

DFSA’S AUDIT MONITORING PROGRAMME 2013/Audit... · 2017-08-10 · The DFSA’s audit monitoring...

Documents

Transcript of DFSA’S AUDIT MONITORING PROGRAMME 2013/Audit... · 2017-08-10 · The DFSA’s audit monitoring...