The Audit of Related Parties and The Application of Professional Skepticism
The Audit of Related Parties and The Application of Professional Skepticism
The Audit of Related Parties and The Application of Professional Skepticism
PROFESSIONAL SKEPTICISM
Email Print Twitter Facebook Linkedin Add This
RELATED LINKS
Multiple-choice questions
Read more articles from Accounting and Business
The audit of related party relationships and transactions is a crucial aspect in the
performance of an audit of financial statements under the International Standards on
Auditing (UK and Ireland) (ISAs). Massimo Laudato, technical adviser at ACCA, explains
the main points.
Studying this technical article and answering the related questions can count towards
your verifiable CPD if you are following the unit route to CPD and the content is
relevant to your learning and development needs. One hour of learning equates to one
unit of CPD. We'd suggest that you use this as a guide when allocating yourself CPD
units.
Many financial reporting frameworks, including UK GAAP and IFRS, include specific
requirements in respect of accounting for and disclosing related party relationships,
transactions and balances. The rationale for these requirements is grounded in the fact that
related parties by their nature are not independent of each other and, therefore, additional
disclosures and more stringent rules should apply to relationships and transactions between
the entity and related parties in order to enable users of the financial statements to understand
their nature and the actual or potential effects on the business.
ACCA has published Technical Factsheet 180 that deals with reporting requirements in
respect of related parties. The document can be accessed here.
HIGHER RISK
In many cases related party transactions are undertaken in the course of the normal business
of an entity, for instance a company may perform the acquisition of certain items for all the
entities in a group or, rather, members of the management of an entity may occasionally buy
the same goods or services offered to the entitys clients with the same staff discount
applicable to other employees.
In such a case, related party transactions may not pose a higher risk of material misstatement
of the financial statements than similar transactions with unrelated parties.
However, in other circumstances, in view of the nature of related party relationships and
transactions, they may carry a higher risk of material misstatement in respect of:
Risks from inappropriate accounting;
While the auditor should not disregard past experience with management and directors of an
entity, believing that they are honest and have integrity does not relieve the auditor from
maintaining professional skepticism or accepting audit evidence that is not persuasive.
The application of professional skepticism in the audit of related party relationships and
transactions is particularly relevant in a number of circumstances, such as:
While remaining alert during the audit for information that may indicate previously
unidentified or undisclosed related parties or transactions;
In respect of identified significant related party transactions outside the normal course
of the entitys business, when evaluating whether the business rationale, or lack of it,
of the transactions suggests that they may have been used to misappropriate assets or
for fraudulent financial reporting;
When assessing significant risks of material misstatement due to fraud as a result of
the presence on a related party with dominant influence.
In view of the susceptibility of related party relationships and transactions to fraud, the
exercise of professional skepticism is also especially relevant in dealing with the risks of
management manipulation or override of controls. In that respect ISA 240 notes that the risk
of not detecting a material misstatement resulting from management fraud is greater than for
employee fraud, as management is frequently in a position to directly or indirectly
manipulate accounting records, present fraudulent financial information or override controls
designed to prevent similar frauds by other employees.
In the audit of related parties professional skepticism should therefore be incorporated, as an
auditors attitude, in the performance of all the procedures outlined below.
The performance of audit procedures in respect of related parties, the audit evidence
obtained from them and the conclusions drawn by the auditor will have to be duly
documented in the audit file, as that will be significant in understanding how the engagement
was planned and performed and in supporting the auditors opinion.
RISK ASSESSMENT UNDERSTANDING THE ENTITYS RELATED PARTIES
Obtaining a detailed understanding of related parties is essential to adopt a risk-based
approach to the audit of related party relationships and transactions and needs to involve the
following procedures:
Discussion among the engagement team of related parties issues;
Inquiry of management about the identity of related parties, the nature of relationships
and the type and purpose of related party transactions;
Inquiry of management and others within the entity to understand the entitys controls
on related party relationships and transactions.
understanding of the controls, or rather lack of them, that the entity has in place in respect of
related parties for the purpose of:
Identifying and disclosing parties and transactions under accounting requirements;
Authorising and approving significant transactions and arrangements with related
parties and
Authorising significant transactions outside the entitys normal course of business.
Apart from management, those that may know about the entitys related parties and controls
on them may include internal auditors, in-house legal counsel or employees with the
authority to initiate, process or record significant transactions outside the normal course of
business.
As part of gaining an understanding of the overall control environment of the entity it is
important for the auditor to take into account whether features of such environment may
mitigate the risk of related parties material misstatement.
For instance that would be the case if the entity had policies in place for the timely disclosure
of interests that management and directors have in related party transactions. Likewise a
positive aspect of the tone at the top would be the fact that management has taken proactive
action to resolve related party disclosure issues by seeking advice from the auditor or
external lawyers.
However in some cases the auditor may gather that related parties controls are deficient or
non-existent for an entity. That may happen for a number of reasons, such as that the
management does not grasp the related party requirements under the applicable financial
reporting framework, or rather that it attaches low importance to such requirements. More
concerning is the possibility that controls may not be implemented or operated intentionally
because, for example, related party disclosures may reveal information, like transactions
with family members of management, that management may not want to divulge.
If the auditor encounters deficient or non-existent controls, it may not be possible to obtain
sufficient appropriate audit evidence about related party relationships and transactions and
the auditor should consider the implication for the auditors report, including qualification.
When assessing an entitys control on related parties, the auditor should also be alert to the
possibility of management override of controls that may otherwise appear to be designed and
operating effectively.
The risk of fraud arising from management override of controls is difficult to assess given
the higher potential of collusion with other parties, manipulation and concealment that is
available to management. However if it is ascertained that the entity does business with other
entities controlled by management, or a member of it, the risk would be greater as, for
instance, management may be incentivised to conclude transactions for the benefit of the
other parties. That may be achieved by creating fictitious terms of transactions with related
parties in order to misrepresent their business rationale.
When auditing a smaller entity the auditor may find that there are less formal controls or no
documented processes to identify related parties and authorise transactions with them.
Sometimes the direct involvement of an owner-manager may reduce the risks in respect of
related party transactions or may instead increase them, given the greater potential for
override of any controls. For the auditor of a smaller entity, inquiry of management would
not be enough to obtain an understanding of related parties and any related controls and
further procedures should be performed, for example inspection of relevant documentation
for related party transactions and observation of how management supervises or unduly
influences the work of the entitys personnel.
REVIEWING RECORDS AND DOCUMENTS FOR UNIDENTIFIED OR
UNDISCLOSED RELATED PARTIES OR TRANSACTIONS
Searching for related party relationships or transactions that management has not identified
or disclosed to the auditor is likely to be an onerous task, especially as management may be
unaware or may be trying to conceal them. ISA 550 takes a robust but practical approach to
the problem by mandating the inspection of limited types of documents, such as:
Bank and legal confirmations obtained as part of the audit procedures, and
Minutes of shareholders and board of directors meetings.
However the standard requires the exercise of the auditors professional judgement to
consider which other records or documents should be inspected, by taking into account the
specific circumstances of the entity.
There is a vast array of records and documents potentially capable of providing information
about related parties that the auditor may consider inspecting. Some of them include:
Other third party confirmations obtained by the auditor;
Returns made by the entity to regulatory authorities;
Shareholder registers to identify significant shareholders;
Records of the entitys investments;
Contracts and agreements with key management and directors;
Contracts and agreements with other entities that have directors in common;
Significant contracts and agreements outside the entitys normal course of business;
Specific invoices and correspondence from the entitys professional advisers (perhaps
in respect of the sale of the entitys assets).
The auditor may encounter certain arrangements that, by virtue of their peculiarity, may
indicate the existence of unidentified or undisclosed related party relationships or
transactions. That could be the case for instance for:
Agreements for the provision of services to certain parties under terms and conditions
that are outside the entitys normal course of business;
Relationships of guarantees and guarantor.
It is important for the auditor to remain alert throughout the performance of the engagement
for information that may indicate the existence of unidentified or undisclosed related parties.
SIGNIFICANT TRANSACTIONS OUTSIDE NORMAL BUSINESS
Consideration of significant transactions outside the entitys normal course of business is
very important in the audit of related parties as it is a means to help identifying undisclosed
related party relationship and transactions and fraud risk factors.
ISA 550 does not specifically require the auditor to search for these transactions but rather to
understand which controls are in place to authorise and approve them.
If the auditor identifies significant transactions outside the entitys normal business, when
inspecting records or documents or when performing other audit procedures, it will be
necessary to make specific inquiries of management about:
The nature of these transactions, ie understand their business rationale and the terms
and conditions involved;
Whether related parties may be involved.
Examples of significant transactions outside normal business that may require inquiry of
management may include:
Complex equity transactions like corporate restructuring or acquisitions;
Transactions with offshore entities in jurisdictions with weak corporate law;
Sales transactions with large discounts or returns;
Transactions with circular arrangements, like sale and repurchase agreements.
By obtaining further information on significant transactions outside normal business, the
auditor would be able to evaluate whether fraud risk factors are present. For instance a
related party may be involved in such a transaction not only directly, by being party to it, but
also indirectly, by influencing the transaction via the use of an intermediary. Such influence
may be an indication of the existence of a fraud risk factor.
If the managements explanations of the transaction is inconsistent with the its actual terms,
the auditor should consider the reliability of other managements explanations and
representations on other significant matters.
When it is possible to establish that significant related party transactions outside the entitys
normal business have been authorised and approved by management, directors, or
shareholders in certain circumstances, the auditor may infer that these have been properly
considered at the appropriate level within the entity and the approval may also provide audit
evidence that they have been properly disclosed in the financial statements.
On the other hand when such transactions are not subject to authorisation and approval and
in the absence of rational explanations, they may represent a risk of material misstatement
due to error or fraud. In any case, if the entity is subject to dominant influence by a related
party or in view of the possibility of collusion between related parties, authorisation and
approval may not be effective and may not provide sufficient evidence to exclude the risk of
misstatement due to fraud.
When auditing a smaller entity the auditor may rely less on authorisation and approval to
obtain audit evidence in respect of significant related party transactions outside the entitys
normal business. In fact a smaller entity is unlikely to have the type of controls available in a
larger entity with different levels of authority and approval. In such circumstances the
auditor may perform other procedures like inspecting relevant documentation, confirming
aspects of the transactions with relevant parties or observing the involvement of the ownermanager with the transactions.
FRAUD RISK FACTORS
One of the objectives of the audit is that of identifying fraud risk factors arising from related
parties and assessing the probability that they can lead to fraudulent financial reporting.
For such purpose the auditor should remain alert to fraud risk factors throughout the audit
and, as already mentioned, especially when:
Considering the fraud potential of related parties at the engagement team discussion;
Considering whether the features of the entitys control environment may deter or
facilitate fraud, especially in terms of potential management override of controls;
Considering the fraud implications of the intentional non-disclosure by management
of related party relationships or transactions; and
The business rationale of significant related party transactions outside the normal
business of the entity is evaluated.
RELATED PARTY WITH DOMINANT INFLUENCE
Related parties may be in a position to exert dominant influence over an entity or its
management and, when a single person or small group of persons is capable of exerting such
influence, that represents a fraud risk factor.
The auditor may recognise the existence of dominant influence by a related party when some
indicators, suggested by ISA 550, are present. That could be the case when, for instance:
The related party has vetoed some significant business decisions taken by management
or directors;
Significant transactions require final approval by the related party;
When business proposals are initiated by the related party they are not questioned by
management or directors;
Transactions involving the related party are not independently authorised or approved.
Dominant influence may also exist when the related party has been a founder of the entity
and continues to be significantly involved in its management. That could often be the case
for the owner-manager of a smaller entity and the auditor should consider that dominant
influence is more likely than not to exist in owner-managed entities.
When other risk factors are present alongside the fraud risk factor of a related party with
dominant influence, that may indicate significant risks of material misstatement due to
fraud.
Such significant risk may exist if there is a high turnover of management or professional
advisers, as in certain cases that may suggest that the related party is imposing unethical or
fraudulent business practices to serve its own purposes.
Similarly, if business intermediaries are used for significant transactions that do not have a
clear business rationale, that may indicate that the dominant related party may have an
interest in such transactions and may control the intermediaries for fraudulent purposes.
If the auditor has assessed a significant risk of misstatement due to fraud as a result of the
existence of a related party with dominant influence, the auditor should apply the
requirements of ISA 240, which deals specifically with fraud. The procedures required by
ISA 240 may include, among others, testing of the appropriateness of journal entries and
other adjustments in the preparation of the financial statements and reviewing accounting
estimates for bias.
In addition to applying the requirements of ISA 240, the auditor may perform some other
procedures to understand what business relationships the dominant related party may have
established, directly or indirectly, with the entity and to determine whether further
substantive procedures are needed.
The procedures that can be performed to obtain such understanding may include:
Analysing accounting records to identify further transactions with the newly identified
related parties;
Checking the terms and conditions of transactions with the newly identified related
parties and verifying if they have been accounted for and disclosed in line with the
applicable financial reporting requirements.
If management has intentionally not disclosed to the auditor-related party relationships or
significant transactions, the omission would represent a considerable risk of material
misstatement due to fraud. In such a case the requirements and guidance in ISA 240 in
respect of the auditors responsibilities relating to fraud in an audit of financial statements
will apply.
In particular the possible involvement of management in a misstatement due to fraud
requires reconsidering the reliability of the audit evidence previously obtained, as this may
raise doubts about the completeness and truthfulness of the representations made by
management and the genuineness of accounting records and documentation. In turn, this will
require the auditor to re-evaluate the assessment of the risks of material misstatement due to
fraud and the nature, timing and extent of the audit procedures to respond to the assessed
risks. In other words the intentional non-disclosure by management of related parties and its
potential involvement in fraud requires a substantial re-planning of the audit.
Additionally, in accordance with ISA 240, the fact that the auditor has significant concern
about the integrity of management or the directors of the entity, as it could the case if
management intentionally omitted to disclose related party information to the auditor for
fraudulent purposes, is one of the exceptional circumstances that brings into question the
auditors ability to continue performing the audit. In such circumstances the auditor should
consider whether it is appropriate to withdraw from the engagement.
ARMS-LENGTH ASSERTIONS FOR RELATED PARTY TRANSACTIONS
An entity could make a statement in the financial statements that a related party transaction
was conducted on terms equivalent to those that prevail in an arms-length transaction. When
these types of statements are included in the financial statements, the auditor should obtain
sufficient appropriate audit evidence to verify the assertion.
The auditor may face some practical difficulties when trying to obtain audit evidence in
respect of all the various aspects of a related party transaction. In fact, while the auditor may
be able to confirm that such a transaction has been conducted at market price, like a similar
arms-length transaction, as audit evidence in that respect may be readily available, it may be
difficult to confirm whether other terms and conditions are equivalent to those that would
apply with an independent party. For instance the transaction may feature different credit
terms or provisions for contingencies or charges.
However financial reporting frameworks normally require management to make an armslength statement in respect of related party transactions only if such assertion can be
substantiated, as it is the case for FRS 102 and IAS 24, Related Party Disclosures. The
auditor should therefore be able to obtain sufficient appropriate audit evidence by testing the
managements support for the arms-length assertion.
If, for instance, management has based its assertion on comparing the terms of the related
party transaction with those of an identical or similar one with unrelated parties or with the
known market terms for broadly similar transactions, the auditor may consider whether the
approach taken by management is appropriate to support the assertion and may verify the
source of the internal or external data and check whether the data is accurate, complete and
relevant.
EVALUATION OF THE ACCOUNTING FOR AND DISCLOSURE OF RELATED
PARTIES
In forming an opinion on the overall financial statements the auditor will need to evaluate
whether:
1. Accounting and disclosure of related party relationships and transactions comply with
the requirements of the applicable financial reporting framework, and
2. The effects of the related party relationships and transactions prevent the financial
statements to achieve fair presentation.
The evaluation of related party disclosures in respect of the applicable financial reporting
requirements may need special attention by the auditor as they may be complex and are often
a source of material misstatement. The same complexity and excessive detail of the
disclosures may actually obscure the substance of the related party transactions.
Related party disclosures should be evaluated considering whether the facts and
circumstances of the entity have been appropriately summarised and presented so that
disclosures are understandable. Disclosures may not be understandable if the business
rationale and the effects of the transactions on the financial statements are unclear or if the
key terms, conditions or other important elements necessary for understanding the
transactions are not appropriately disclosed.
OTHER REQUIREMENTS IN ISA 550
The auditor is required to obtain written representations from the entitys management, and
in certain circumstances from directors when these are not involved in managing the entity,
that:
1. They have disclosed to the auditor the identity of related parties and all the related
party relationships and transactions they are aware of; and
2. They have accounted for and disclosed such relationships and transactions as required
by the reporting framework.
The auditor may request written representations from directors to confirm oral
representations on details of certain related party transactions or when they have interests in
related party transactions.
Additionally, unless all the directors are involved in managing the entity, the auditor is
required to communicate with directors (those charged with governance) significant related
party matters arising during the audit.
Discussing with directors significant related party issues, as they arise during the audit, helps
in reaching a common understanding of facts and circumstances and in finding a resolution
to these issues on a timely basis.
Significant related party matters that can be discussed with directors include non-disclosure
(intentional or not) by the management of related parties or significant transactions, which
may alert directors of the existence of relationships or transactions of which they were not
aware.
Similarly the auditor may point out to directors significant related party transactions not
appropriately authorised and approved, which may indicate suspected fraud.
The auditor should also discuss with directors any disagreement with management about the
disclosure of related party transactions under the applicable financial reporting requirements.
In respect of related parties documentation, ISA 550 requires the auditor to document the
names of the identified related parties and the nature of the related party relationships.
The schedule below illustrates the documentation requirements in respect of related parties
included in ISA 550 and relates to a family-owned/managed business consisting of a hotel
and leisure centre.
Name of
related
party
Nature of
relationship
Types of transactions
Likely value of
transactions
2-3,000 per annum
through the DLA
Dividend
Wilma
Hamilton
Non-executive director
Uses the restaurant and spa
and 20% shareholder
on a regular basis
Name of
related
party
Nature of
relationship
Types of transactions
Likely value of
transactions
through the DLA
Dividend
Frank
Hamilton
Dividend
20,000 per annum
through his DLA
Jack Hamilton
Name of
related
party
Nature of
relationship
Types of transactions
Likely value of
transactions
Dividend
Salary