Read the examples provided for the audit of estimates and explain which phase of the audit process each example relates to.

Explain why the CPAB recommended that the auditors needed to apply a heightened sense of professional skepticism to the audit or management estimates. Why do you think professional skepticism is so important in assessing management estimates?

Appendix D: CPAB's Inspection Results Audit committees of RIs in Canada have been requesting greater transparency into CPAB's inspection findings to help them in their role of overseeing and evaluating the external auditor. Effective in 2014, the Protocol for Audit Firm Communication of CPAB Inspection Findings with Audit Committees (Protocol) was introduced. Among other things, the Protocol sets out the written communications concerning CPAB's inspections that audit committees can expect to receive from their auditors. First, audit committees of RIs inspected by CPAB will receive specific communication of the results of the inspection of their reporting issuer. Second, they will also receive a copy of CPAB's Public Report each year. 15 A significant inspection finding identified by CPAB is defined as a significant deficiency in the application of generally accepted auditing standards related to a material financial balance or transaction stream where the audit firm must perform additional audit work in the current year to support the audit opinion and/or is required to make significant changes to its audit approach. CPAB requires the audit firm to respond in writing to all significant inspection findings. Section Three of this report highlights the most common inspection findings for the Big Four and Other Firms. This Appendix expands upon those findings where necessary and includes a number of other observations that may be of interest to audit committees. It is intended to assist audit committees in their discussions about audit quality and includes examples of themes they may wish to explore with their auditors as part of their oversight. While the themes contained in this section can relate to RIs of all sizes and across all industries, they have primarily been drawn from our inspections of firms inspected annually. At least one significant inspection finding15 arose at most of the firms inspected in 2013. If the Protocol had been in place for the 2013 inspection cycle, these findings would have been communicated to their respective audit committees by the audit firm. The largest number of findings came from companies with smaller market capitalization. Specifically, 42 per cent of all significant findings came from audits of RIs with less than $25 million in market capitalization. However, significant inspection findings were identified in all sizes of companies including the TSX60. All findings have been evaluated and grouped by theme. In each case, some specific examples together with suggested recommendations to improve the audit quality in these areas are provided. Auditing Accounting Estimates Accounting estimates by their nature are imprecise and can be influenced by management. Significant judgment must be exercised by both management and auditors. This is an area where CPAB continues to identify a number of deficiencies. Findings most typically arise where the engagement team did not demonstrate a sufficient degree of rigor and skepticism when auditing accounting estimates. Engagement partners and engagement quality control reviewers should perform thorough reviews of the audit of accounting estimates ensuring that they challenge audit team members to apply the appropriate level of professional skepticism. CPAB | 2013 PUBLIC REPORT 37 publicreport Examples of Findings Insufficient procedures were performed by the engagement team to assess the reasonableness of certain key assumptions used by management or experts to estimate fair value of assets either acquired in a business combination or when undertaking an impairment analysis. Specifically: The engagement team relied on the work of an auditor's expert but did not evaluate the adequacy of the expert's work with the appropriate level of professional skepticism. There were instances where the estimated fair value at the acquisition date and audited by the engagement team was materially adjusted with no evidence of any subsequent audit work to support the validity of the adjustments. There was no evidence in the file to demonstrate the appropriate depth of the engagement team's review of significant assumptions used in management's forecast. The engagement team did not adequately address contrary evidence questioning fair value even though such evidence was contained in the audit working papers. The engagement team did not perform adequate testing on the integrity of the underlying data and reports being relied upon. Recommendations Firms should provide additional training and/or guidance to reemphasize the requirements for accounting estimates including: The importance of understanding how management arrived at their estimates. The need to evaluate the underlying data management relied upon, including how this data was used in the estimates and whether the data was sufficiently evaluated to permit reliance. The need for heightened professional skepticism. The requirement to perform a look-back analysis on estimates made in prior years to assess management's ability to develop reliable estimates over time. Auditing Revenue Revenue is often a higher risk account and has a rebuttable presumption of fraud. Examples of Findings Our inspections identified a number of instances where there were deficiencies in the approach to auditing revenue including where engagement teams: Did not demonstrate sufficient understanding of the nature of the RI's business to design effective audit procedures. Relied on control testing without adequately evaluating the design of the internal controls to ensure that the controls were responsive to significant risk. (See also Audit of Internal Controls below). Did not evidence their assessment of, and support for, the accounting positions taken by management including accounting for multiple element arrangements. Did not perform any audit procedures on the significant revenue stream. Used substantive analytical procedures (SAP) that were inadequately performed for the following reasons: Not appropriately setting the precision for the procedure. Not adequately assessing factors used to set their expectations including the underlying assumptions and data relied upon. Not appropriately corroborating variances between the expectations and actual results. Specifically, variances were usually discussed with management with little or no verification to independent sources. CPAB | 2013 PUBLIC REPORT 38 publicreport Recommendations The engagement partners and EQCRs should be involved in the review of complex revenue recognition situations and should consult (or consider consulting) with their technical accounting experts. The engagement partner and EQCR should also review the audit approach to revenue at the planning stage to ensure the rationale for the approach is clear and well understood by all engagement team members. While SAPs can be effective as the primary source of audit evidence of revenue, CPAB's experience is that the use of SAPs is only appropriate in limited circumstances. Firms should consider providing guidance as to when SAPs can/ should be used as the primary source of audit evidence. Due to the level of judgment involved, these procedures should be conducted by audit staff with significant experience generally at the management level or above. Some firms require their engagement teams to obtain approval from national auditing standards before SAPs can be applied. Using the Work of Others/Reliance on Experts There are often areas of the audit where specialized skills are required. These include valuation of complex financial instruments, valuation of assets in a business combination and determination of mineral reserves. In such instances, the audit team will either rely on the work of management's expert or obtain their own expert. When placing reliance on the work of an expert (be it management's or the auditor's expert) the auditor is required to evaluate the appropriateness of the expert's work as audit evidence. This includes considering the objectivity of the expert, the relevance and reasonableness of assumptions and methods used, and the completeness and accuracy of the underlying source data. Examples of Findings The engagement team did not: Perform sufficient procedures to assess the reasonableness of certain key assumptions used by management's (or the auditor's) expert. Evidence the assessment of whether the ranges used by the valuation specialists were sufficiently narrow to effectively identify a potential material misstatement. Consider whether the level of assurance provided by the valuation expert was sufficient to meet the needs of the engagement team. Certain experts provide positive assurance and other experts only provide negative assurance. This distinction and its impact on audit assurance is not always considered by the engagement teams. Recommendations Firms need to communicate to their engagement teams the importance of: Evaluating the appropriateness of the expert's report by reading the report disclaimers, restrictions and scope. Understanding the methods used to develop significant estimates. Assessing the relevance and reasonableness of assumptions and assessing the underlying data. Working with the specialists to understand the level of assurance they can provide the auditors and what additional procedures would be required by the engagement team to achieve the appropriate level of audit assurance. CPAB | 2013 PUBLIC REPORT 39 publicreport Audit of Business Combinations Business combinations concepts are generally straightforward but there are often intricacies in the implementation that can cause management difficulties. In addition business combinations usually involve fair value measurements which require significant estimates and judgments. Examples of Findings When auditing the value of the shares issued as consideration for an acquisition, the engagement team used the weighted average market price for five days prior to the acquisition date which is not compliant with the standard that requires consideration to be measured at the date of acquisition. There were instances where the fair value of assets at the acquisition date estimated by management and audited and assessed as reasonable by the engagement team were later materially adjusted by management without evidence of any audit work by the engagement team. There was no evidence that the engagement team had performed procedures beyond making inquiries of management for the purposes of testing the accuracy and completeness of the underlying data used in valuation models including assessment of the reasonableness of forecasts used in the valuations. There were unexplained inconsistencies between assumptions used in the valuation models and other sources of information. For example, tax rates used in the valuation model were inconsistent with the entity's effective tax rate with no evidence that the engagement team considered potential reasons for the difference. Recommendations Firms need to: Re-emphasize to all auditors the IFRS requirements for accounting for business combinations. Incorporate key accounting considerations into the audit programs used by engagement teams. Evaluation of Accounting Policies The evaluation of accounting policies is an essential part of an audit since the selection or application of inappropriate accounting policies can have a material impact in the current and subsequent years. Certain of these findings arise from a lack of consultation on complex accounting issues and/ or incorrect consultation results due to incomplete and/or insufficient consultation analysis. CPAB | 2013 PUBLIC REPORT 40 publicreport Examples of Findings The engagement team did not address the appropriateness of accounting policies: Incorrect accounting treatment of contingent consideration or non-controlling interest in a business combination. Improper accounting for multiple element revenue arrangements. Improper measurement basis used in private company valuations. Improper identification of cash generating units for the purposes of impairment testing. Incorrect measurement of debt and equity components of convertible and non-convertible debentures. Recommendations Firms should: Re-evaluate their approach to auditing accounting policies and their approach to consultations including the use and adequacy of their technical resources and the need for specialized knowledge. Form technical topic teams who can become subject matter experts for key accounting standards to supplement their national resources. Response to Risk Assessment There were a number of instances where the engagement team did not adequately demonstrate its assessment of risk related to specific assertions and appropriately link this assessment to its audit response for each significant financial statement account. Recommendations Firms should: Review their methodology to determine if there are clear linkages between risks identified and related responses and amend their methodology as necessary. Ensure that engagement teams understand the linkages and can clearly articulate the audit responses to assessed risk. This discussion should be part of the planning process. Audit of Internal Controls Engagement teams continue to be challenged by the identification and testing of internal controls relevant to the audit. In part, this arises because there are many controls that are important to ensure the efficient operation of the business, but which have little or no relevance to the audit. Examples of Findings Inspections identified instances where the engagement team: Did not evidence a sufficient understanding of control activities to assess the risk of material misstatement at the assertion level to evaluate the effectiveness of their design. Did not perform sufficient and appropriate testing. Specifically, the testing of attributes examined as part of the test did not provide evidence that the control worked effectively. CPAB | 2013 PUBLIC REPORT 41 publicreport Inadequately assessed internal controls by relying on system-generated data that was not tested. Chose inadequate sample sizes in testing operating effectiveness and didn't roll-forward from interim testing. Was not planning on control reliance, so there was no evidence it obtained an appropriate understanding of the controls relevant to significant risks as required by auditing standards. Did not evidence how it assessed management's ability to detect and correct accounting errors on a timely basis. (If management has not implemented appropriate/effective controls responsive to significant risks, engagement teams should consider whether failure to do so is an indicator of a significant deficiency in internal control which would be required to be communicated with those charged with governance). Recommendations Firms should ensure engagement teams: Appreciate the importance of obtaining a sufficient understanding of the procedures by which significant classes of transactions are initiated, recorded, processed and reported. Benefit from real-time coaching where those with expertise and experience with internal controls perform real-time reviews of selected files to provide an independent assessment of the controls identified, testing performed and conclusions reached. Receive appropriate internal control training to reinforce procedures to be performed to permit reliance on systemgenerated data relied upon in control testing. Response to Fraud Risk CPAB is concerned that engagement teams do not fully appreciate the importance of the objectives of the required audit procedures to address the risk of fraud. CPAB also finds that engagement teams do not understand why journal entry testing is an effective means of detecting fraud and as such add journal entry testing as an afterthought. Examples of Findings Inspections identified instances where there was: Insufficient rationale and basis for selecting journal entries for testing. Insufficient rigor in the inquiries of management and others in the entity. Inadequate testing of the appropriateness of journal entries in response to the risk of management override. Inadequate consideration of the unique characteristics to be used to identify the population of journal entries to test and no reconsideration of these characteristics if the initial selection results in either a very large or very small sample. No journal entry testing at all. CPAB | 2013 PUBLIC REPORT 42 publicreport Recommendations CPAB believes there needs to be clear messaging from firm leadership acknowledging both the importance of and challenge in addressing the risk of fraud. Senior engagement team members should actively coach staff on responding to fraud risks which should extend beyond the planning phase and into the field audit itself. Certain firms require the engagement team to advise national office of their planned approach to journal entry testing prior to performing the procedures. Firms should consider involving forensic personnel to assist in identifying and responding to fraud risks. Firms need to develop specific guidance and related training materials to help facilitate fraud discussions with management and those charged with governance. This guidance should: Be integrated with the risk assessment process to ensure that the criteria used to select journal entries to test are relevant in the RI's circumstances. Also include a discussion of what constitutes an appropriate level of corroboration of explanations received, including examination of source documents. This publication is not, and should not be construed as, legal, accounting, auditing or any other type of professional advice or service. Subject to CPAB's Co