ACC14 Final Examination Overview PDF

**OVERVIEW OF SPECIALIZED INDUSTRIES** ***What is Specialized Industries?*** - A distinct market that has a unique way of accounting for transactions and reporting its financial results. - Not necessarily rare or even unusual - They are likely either to have specific financial reportin...

**OVERVIEW OF SPECIALIZED INDUSTRIES** ***What is Specialized Industries?*** - A distinct market that has a unique way of accounting for transactions and reporting its financial results. - Not necessarily rare or even unusual - They are likely either to have specific financial reporting standards applicable to them, or to have distinct accounting policies which have been developed to account for specialized transactions and balances which are based on the normally-applied financial reporting standards. - Examples: banking and insurance, public utilities, agriculture, oil extraction, airline ***Audit Considerations*** **[Competence]** - ISQC 1, Quality Control for Firms That Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements requires the audit firm to consider whether the firm is competent to perform the engagement and has the capabilities, including time and resources, to do so. - Audit firm personnel has knowledge of relevant industries and has experience with relevant regulatory or reporting requirements, or the ability to gain the necessary skills and knowledge effectively. - **Larger audit firms** -- already possess necessary skill and competence through having existing clients in the particular industry OR have the resource available to bring in experts and/or provide any necessary staff training. - **Smaller firms** -- may have to carefully consider their competence to take on an audit client in a specialized industry if they have not previously worked with an audit client in the same industry. - Regardless of size, audit firms may choose to specialize themselves in the audit of clients in a particular market or sector - Ensure that there is adequate documentation to demonstrate that competence has been considered - Steps that have been taken to improve competence where necessary (e.g., through appropriate staff training) **[Audit Planning]** - Identification of the risk of material misstatement -- same way as in any other audit -\> by obtaining appropriate understanding of the business and its environment - Audit firm is likely to have additional resources available. - There may be briefing notes or internal technical guidance on how financial reporting standards should be applied within the sector. - Example: Audit of banking sector clients -- an audit firm may produce guidance on the specific application of IFRS Standards relating to the range of financial instruments typically held by banks. - There must also be appropriate consideration of the "normal" balances and transactions. - Example: In the audit of a bank, there will be plenty of risks to consider other than those relating to bank-specific transactions and balances (i.e., the depreciation of properties, recognition of provisions and impairment of goodwill would all still be relevant). **[Reliance on experts]** - The auditor may plan to use an auditor's expert to obtain audit evidence. - Despite being competent to perform the engagement, the audit firm may not have the necessary specific expertise in some areas. - For instance in the audit of a bank, specialists may be brought in to value complex financial instruments. - Adhere to the requirements and principles of PSA 620, Using the Work of an Auditor's Expert - The auditor must consider whether the expert's findings are consistent with the auditor's understanding of the client and with the conclusions of other audit procedures. - Any inconsistencies must be investigated. ***Specialized Industries*** **[Bank]** - Performing bank audit aim is to provide an objective evaluation of a bank\'s business activities, information systems and controls. - Key areas vary based on (1) the services it offers, (2) the risk of fraud and (3) the complexity of the systems it has in place. - A bank audit should reveal whether a bank has sound, ethical practices that abide by regulations put in place to protect consumers. - Compliance with regulations: auditors need to make sure banks are following regulations (e.g., BIR, BSP), as well as their own policies. - These regulations are put in place to protect consumers, and violations could endanger people. - Bank auditors usually make recommendations to improve the procedures. **[Special audit considerations arise in the audits of banks because of:]** - the particular nature of the business risks associated with the transactions undertaken by banks; - the scale of banking operations and the resultant significant exposures which can arise within short periods of time; - the extensive dependence on computerized systems to process transactions; - the effect of the regulations in the various jurisdictions in which they operate; and - the continuing development of new products and banking practices which may not be matched by the concurrent development of accounting principles and auditing practices. **[Insurance]** - A contract between two parties whereby one party agrees to undertake the risk of another in exchange for consideration known as a premium and promises to pay a fixed sum of money to the other party on happening of an uncertain event (death) or after the expiry of a certain period (in case of life insurance) or to indemnify the other party on happening of an uncertain event (in case of general insurance). - Insurance auditors shall examine policy and liability procedures, risk valuation, tax documents and various other financial records of insurance. - It is to ensure that proper insurance rates and premiums are implemented and regulators laws (e.g. BIR, IC) are being followed by the insurance companies. - Claims and commissions are also the core areas to verify during the course of insurance audit. - Insurance auditors might be expected to maintain quality control between the insurance companies and policyholders. - Four important audit points in Insurance Company Profit & Loss Account - Verification of Premium - Verification of Claims - Verification of Commission - Verification of Operating Expenses ***IFRS*** **[IFRS for Banks and Financial Institutions]** - Financial Instruments (IFRS 9/IAS 39, IAS 32) -- impairment, classification and measurement, distinguishing liabilities from equity - Presentation of FS (IAS 1, IAS 7, IFRS 7) - Statement of financial position in a bank, Statement of profit or loss and OCI in a bank, Statement of Cash Flows, Disclosures - Consolidation and SPEs (IFRS 10, IFRS 12) **[IFRS for Agriculture]** - IAS 41 Agriculture -- prescribes the accounting treatment, financial statement presentation, and disclosures related to agricultural activity **[IFRS for Airline]** - IFRS 16 Leases -- substantially all lease contracts will be on the balance sheet of the lessee. **[IFRS for Oil extraction]** - IFRS 6 Exploration for and Evaluation of Mineral Resources - allowing entities adopting the standard for the first time to use accounting policies for exploration and evaluation assets that were applied before adopting IFRSs. - modifies impairment testing of exploration and evaluation assets by introducing different impairment indicators and allowing the carrying amount to be tested at an aggregate level (not greater than a segment). **AUDIT OF INSURANCE COMPANIES** ***Introduction*** **Insurance** -- a contract between two parties whereby one party agrees to undertake the risk of another in exchange for consideration known as **PREMIUM** and promises to pay a fixed sum of money to the other party on happening of an uncertain event *(death)* or after the expiry of a certain period *(in case of life insurance)* or to indemnify the other party on happening of an uncertain event *(in case of general insurance)*. - Insurer or Assurer -- the party bearing the risk - Insured or Assured -- the party whose risk is covered - The insurance industry occupies a very important place among financial services all over the world. - Individuals as well as business firms turn to insurance for managing various risks. ***Legal Framework*** - Auditor should familiarize him/herself with various statutes governing the insurance industry. - Auditor should look into the important aspects arising out of those which might have an effect on determination of nature, timing and extent of audit procedures. - Presidential Decree No. 612: The Insurance Code (Ordaining and Instituting an Insurance Code of the Philippines) - Republic Act No. 2427: Insurance Act (An Act Revising the Insurance Laws and Regulating Insurance Business in the Philippines) - Republic Act. No. 10607 -- (An Act Strengthening the Insurance Industry, further amending Presidential Decree No. 612) **[Requirements as to the Minimum Paid-up Capital]** - Advisory No. 2-A-2020: Compliance with the P900 Million Minimum Net Worth and Minimum Capital Investment Requirements as of 31 December 2019 (February 18, 2020) - Under Republic Act 10607 or the Insurance Code, new players in the industry are required to have P1 billion in paid-up capital when they establish a business in the country. - Existing insurers must have a net worth of at least P250 million by June 30, 2013, P550 million by Dec. 31, 2016, P900 million by Dec. 31, 2019 and P1.3 billion by Dec. 31, 2022. ***Form and Contents of FS*** - Statement of Financial Position - Statement of Comprehensive Income - Statement of Changes in Equity - Statement of Cash Flows - Notes to the Financial Statements - Supplementary information ***Audit of Accounts*** Based on the Republic Act No. 10607, The Insurance Code: "No external auditor shall be engaged by the supervised persons or entities unless it has been issued an accreditation certificate by the Commissioner. The accreditation certificate shall be valid until December 31 of the third year from issuance unless it is revoked or suspended. The Commissioner shall issue rules and regulations to govern the accreditation of the external auditor and the revocation and suspension of the accreditation. ***Auditing in an IT Environment*** - The IT environment does not materially affect the scope and objectives of an audit. - The auditor has to familiarize him/herself with the IT environment in insurance companies. - The auditor should gain an understanding to the workflow of various important transactions. - The auditor may select a few transactions of each type and trace them through the system, i.e., identify the audit trail. - When the auditor is satisfied about the design and operation of the IT system, he/she may limit the extent of his checking of transactions in so far as those aspects are concerned, where the IT system has built-in control. - The auditor should seek a written representation from the management about any changes in the IT systems that may have taken place during the year. ***Specific Control Procedures*** **[Specific Control Procedures related to Audit of Life Insurance Companies]**   ***Accounting Principles for Preparation of FS*** - FS is prepared under the historical cost convention, as modified by the revaluation of AFS financial assets and financial assets and liabilities (including derivatives) at FVTPL and revaluation of properties held for own use and investment properties, which are carried at revalued amounts and fair value, respectively. - The preparation of FS in conformity with PFRS requires the use of certain critical accounting estimates. - It also requires management to exercise its judgment in the process of applying the Company's accounting policies. - The areas involving a higher degree or complexity, or areas where assumptions and estimates are significant to the financial statements are disclosed on a separate note to the financial statements. - **[Premium:]** shall be recognized as income when due; For linked business, the due date for payment may be taken as the date when the associated units are created. - **[Acquisition costs,]** if any: shall be expensed in the period in which they are incurred; costs that vary with and are primarily related to the acquisition of new and renewal insurance contracts. - **[Claims]**: shall comprise the policy benefit amount and specific claims settlement costs, wherever applicable. - **[Actuarial valuation --]** Liability for Life Policies: The estimation of liability against life policies shall be determined by the appointed actuary of the insurer pursuant to his/her annual investigation of the life insurance business. Actuarial assumption are to be disclosed by way of notes to the account. - Procedure to determine 'Value of Investments' - **[Loans:]** Shall be measured at historical cost subject to impairment provisions. - **[Linked Business:]** A separate set of FS, for each segregated fund of the linked business should be annexed. (Segregated funds represent funds maintained in accounts to meet specific investment objectives of policy holders who bears the investment risk.) ***Disclosures forming part of FS*** The following shall be disclosed by way of notes to the BS: 1. Contingent liabilities 2. Actuarial assumptions for valuation of liabilities for life in force. 3. Encumbrances to the assets of the Company in and outside the Philippines. 4. Commitments made and outstanding for Loans, Investments and Fixed Assets. 5. Basis for amortization of debt securities. 6. Claims settled and remaining unpaid 7. Value of Contracts in relation to Investment for (a) Purchases where deliveries are pending; (b) Sales where payments are overdue. 8. Operating expenses relating to insurance business, basis of allocation of expenditure to various segments of business. 9. Computation of managerial remuneration. 10. Historical costs of those Investments valued on FV basis. 11. Basis of revaluation of Investment property. The following accounting policies shall form an integral part of the FS: - All significant accounting policies in terms of accounting standards, and significant principles and policies. Any other accounting policies followed by the insurer, shall be stated in the manner required under PAS 1. - Any departure from the accounting policies shall be separately disclosed with reasons for such departure. ***Audit of Accounts of Life Insurance Companies*** **1. Actuarial Process** - The job of actuary or actuarial department in any Life Insurance Company involves, detailed analysis of data to quantify risk. - The actuarial department is calculating and modelling hub of the Company. **[Role of Auditors:]** - Required to certify, whether the actuarial valuation of liabilities is duly certified by the appointed actuary, including the effect of the assumptions for such valuation are in accordance with the guidelines and norms, if any, issued by the authority. **2. Underwriting** - A proposal is an application for an insurance cover. - The process of verifying the level of risk in each new entrant. - The underwriter assess the risk and determines the premium to be charged. - The underwriter is to acquire or to "write"-business that will bring money to the insurance company, and to protect the company's business from risks that they feel will make a loss. **[Role of Auditor:]** - Review the process of acceptance of risk through the underwriting process, and evaluate and test the effectiveness of internal controls in place to ensure timely and accurate Insurance policy. **3. Reinsurance** - A risk mitigating tool adopted by Insurer whereby the risk underwritten by one insurer is transferred partially to another insurer. - One insurer purchasing coverage from a second insurance company for a risk that the first insurer is insuring. **[Role of Auditor:]** - To check and confirm the reinsurance premium calculation and payment is in accordance with the agreement with the reinsurer. - Necessary provision has been made for the outstanding reinsurance premium and is properly accounted for in books of accounts under respective heads. **4. Policy Lapse and Revival** - Lapse: Discontinuance of the policy owing to non-payment of premium dues. - In order to keep a life insurance policy "in force," the policyholder is required to pay premiums when due. - The insurer should have taken persistent measures for monitoring receipts of renewal premium within the due dates. **[Role of Auditor:]** - To check and confirm that due dates are recorded and monitored properly and policies are marked as "lapsed" on non-receipt of renewal premium within due dates/grace period. **5. Policy Surrender** - Refers to the voluntary termination of the insurance contracts before the expiry of the term of the contract. - The process of surrender is initiated by the policyholder. **[Role of Auditor:]** - To check and confirm that surrender requests are received from the policyholder only, and that adequate controls are in place to ensure proper verification process for checking of request, whether premiums are paid on regular basis. - Check whether the surrender amount is paid only to the policyholder and is paid only as per terms and conditions mentioned in the policy document and appropriate entries are passed. **6. Premium Collection, Accounting and Reconciliation** - Refers to recognizing the premium earned by the insurer as income in the accounting system. - Income is recognized as - New business premium -- premium received for the first policy year, and - Renewal premium -- premium received for subsequent policy years. Premium received but not identifiable against any policy would be treated as 'unallocated premium' / 'suspense amount' **[Role of Auditor:]** - Collection of Premium - Check whether there is daily reconciliation process to reconcile the amounts collected, entered in the system and deposited into the bank. - Check that there is appropriate mechanism to ensure all the collections are deposited into the bank on timely basis. - Calculation of Premium - Check the accounting system, employed by the Company, calculates premium amounts and its respective due dates correctly. - Check that system employed as such is equipped to calculate all types of premium modes correctly. - Recognition of Income - Check that premium is recognized only on the basis of 'Issued Policies' and not on underwriting dates. - Check that there is inbuilt mechanism the system, all the premium collected are correctly allocated, all various component of the Policies. - Check that there is appropriate mechanism in place to conduct reconciliation on daily basis and reconciling items, if any, are rectified/followed up. - Accounting of 'Advance Premium' - Check whether system has capability to identify regular and advance premium. - Check whether there is a process of applying advance premium to a contract when premium is due. - Investments - Review the investment management structure - Review of insurer's investment policy - Review of functioning and scope and minutes of Investment Committee - Compliance of all Investment regulations - Claims - Checking the accuracy of processing and accounting of claims lodged with the Insurer, is the primary objective of Audit of Life Insurance Companies. - Operating Expenses related to Insurance Business (Expenses of Management) - Legal and Professional Charges - Employee's Remuneration and Welfare Benefits - Interest and Bank Charges - Depreciation - Interest, Dividend and Rent **AUDIT OF BANKS (part 1)** ***Introduction*** - **Bank** is a type of financial institution whose principal activity is the taking of deposits and borrowing for the purpose of lending and investing and that is recognized as a bank by the BSP. - Banks commonly undertake a wide range of activities. - Most banks continue to have in common the basic activities of deposit taking, borrowing, lending, settlement, trading and treasury operations. - Other activities: securities underwriting and brokerage, and asset management - BSP requires that the auditor report certain events to them or make regular reports to them in addition to the audit report on the banks' financial statements. - PAPS 1004, "The Relationship Between Bangko Sentral ng Pilipinas (BSP) and Bank's External Auditors" [Banks have the following characteristics that generally distinguish them from most other commercial enterprises:] - They have custody of large amounts of monetary items, including cash and negotiable instruments, whose physical security has to be safeguarded during transfer and while being stored. - They also have custody and control of negotiable instruments and other assets that are readily transferable in electronic form. - The liquidity characteristics of these items make banks vulnerable to misappropriation and fraud. - Banks therefore need to establish formal operating procedures, well-defined limits for individual discretion and rigorous systems of internal control. - They often engage in transactions that are initiated in one jurisdiction, recorded in a different jurisdiction and managed in yet another jurisdiction. - They operate with very high leverage (that is, the ratio of capital to total assets is low), which increases banks' vulnerability to adverse economic events and increases the risk of failure. - They have assets that can rapidly change in value and whose value is often difficult to determine. - They generally derive a significant amount of their funding from short-term deposits (either insured or uninsured). A loss of confidence by depositors in a bank's solvency may quickly result in a liquidity crisis. - They have fiduciary duties in respect of the assets they hold that belong to other persons. This may give rise to liabilities for breach of trust. - They engage in a large volume and variety of transactions whose value may be significant. This ordinarily requires complex accounting and internal control systems and widespread use of Information Technology (IT). - They ordinarily operate through networks of branches and departments that are geographically dispersed. This necessarily involves a greater decentralization of authority and dispersal of accounting and control functions. - Transactions can often be directly initiated and completed by the customer without any intervention by the bank's employees. - They are regulated by the BSP, whose regulatory requirements often influence the accounting principles that banks follow. Non-compliance with regulatory requirements e.g., capital adequacy requirements. - Customer relationships that the auditor, assistants, or the audit firm may have with the bank might affect the auditor's independence in a way that customer relationships with other organizations would not. - They generally have exclusive access to clearing and settlement systems for checks, fund transfers, foreign exchange transactions, etc. - They are an integral part of, or are linked to, national and international settlement systems and consequently could pose a systemic risk to the countries in which they operate. - They may issue and trade in complex financial instruments, some of which may need to be recorded at fair values in the financial statements. They therefore need to establish appropriate valuation and risk management procedures. [Special audit considerations arise in the audits of banks because of matters such as the following:] - The particular nature of the risks associated with the transactions undertaken by banks. - The scale of banking operations and the resultant significant exposures that may arise in a short period. - The extensive dependence on IT to process transactions. - The effect of the regulations in the various jurisdictions in which they operate. - The continuing development of new products and banking practices that may not be matched by the concurrent development of accounting principles or internal controls. ***Audit Objectives*** PSA 200, "Objective and General Principles Governing an Audit of Financial Statements," states: The objective of an audit of financial statements is to enable the auditor to express an opinion whether the financial statements are prepared, in all material respects, in accordance with generally accepted accounting principles in the Philippines. - The objective of the audit of a bank's financial statements conducted in accordance with PSAs is, therefore, to enable the auditor to express an opinion on the bank's financial statements, which are prepared in accordance with accounting principles generally accepted in the Philippines. - The auditor's report indicates that accounting principles generally accepted in the Philippines have been used to prepare the bank's financial statements. ***Agreeing the Terms of the Engagement*** - The [engagement letter] documents and confirms the auditor's acceptance of the appointment, the objective and scope of the audit, the extent of the auditor's responsibilities to the client and the form of any reports. - In considering the objective and scope of the audit and the extent of the responsibilities, the auditor considers his own skills and competence and those of his assistants to conduct the engagement. The auditor considers the following factors: - the need for sufficient expertise in the aspects of banking relevant to the audit of the bank's business activities; - the need for expertise in the context of the IT systems and communication networks the bank uses; and - the adequacy of resources or inter-firm arrangements to carry out the work necessary at the number of domestic an international locations of the bank at which audit procedures may be required. The auditor considers including comments on the following when issuing an engagement letter: - The use and source of specialized accounting principles. - The content and form of the auditor's report on the FS and any special-purpose reports required from the auditor in addition to the report on the FS. - The nature of any special communication requirements or protocols that may exist between the auditor and BSP and other regulatory authorities (e.g., PDIC, SEC). - The access that the BSP will be granted to the auditor's working papers, and the bank's advance consent to this access. ***Planning the Audit*** **[Obtaining a Knowledge of the Business]** - Requires the auditor to understand (1) the bank's corporate governance structure; (2) the economic and regulatory environment in which the bank operates; and (3) the market conditions existing in each of the significant sectors in which the bank operates. - The auditor obtains an understanding of the bank's corporate governance structure and how those charged with governance discharge their responsibilities for the supervision, control and direction of the bank. - The auditor obtains and maintains a good working knowledge of the products and services offered by the bank (e.g., many variations in the basic deposit, loan and treasury services that are offered and continue to be developed by banks in response to market conditions.) - The auditor considers legal and regulatory restrictions, and obtains an understanding of how the management and those charged with governance monitor that the system of internal control (including internal audit) operates effectively. - The auditor obtains an understanding of the nature of risks associated with banking industries and how the bank manages them. This understanding allows the auditor to assess the levels of inherent and control risks associated with different aspects of a bank's operations and to determine the nature, timing and extent of the audit procedures. **[Understanding the Nature of Banking Risks]**    **[Understanding the risk management process]** An effective risk management system in a bank generally requires the following: **1. Oversight and involvement in the control process by those charged with governance** - Those charge with governance should approve written risk management policies. The policies should be consistent with the bank's business strategies, capital strength, management expertise, regulatory requirements, and types and amounts of risk it regards acceptable. **2. Identification, measurement and monitoring of risks** - Risk that could significantly impact the achievement of the bank's goals should be identified, measured and monitored against pre-approved limits and criteria. **3. Control activities** - A bank should have appropriate controls to manage its risks, including effective segregation of duties (particularly between front and back offices), accurate measurement and reporting of positions, verification and approval of transactions, reconciliations of positions and results etc. **4. Monitoring activities** - Risk management models, methodologies and assumptions used to measure and manage risk should be regularly assessed and updated. This function may be conducted by an independent risk management unit. **5. Reliable information systems** - Banks require reliable information systems that provide adequate financial, operational, and compliance information on a timely and consistent basis. Those charged with governance and management require risk management information that is easily understood and that enables them to assess the changing nature of the bank's risk profile. ***Development of Overall Audit Plan*** **AUDIT OF BANKS (part 2)** *INTERNAL CONTROL* ***Introduction*** Framework for Internal Control Systems in Banking Organizations (September 1998) - Issued by The Basel Committee on Banking Supervision - Provides banking supervisors with a framework for evaluating banks' internal control systems - Auditors of banks' financial statements may find a knowledge of this framework useful in understanding the various elements of a bank's internal control system. Management's responsibilities include - the maintenance of an adequate accounting system and internal control system - the selection and application of accounting policies - the safeguarding of the assets of the entity. - The auditor obtains an understanding of the accounting and internal control systems sufficient to plan the audit and develop an effective audit approach. - The auditor considers the assessment of inherent and control risks so as to determine the appropriate detection risk to accept for the financial statement assertions and to determine the nature, timing and extent of substantive procedures for such assertions. - Control risk -\> less than high -\>less extensive ST - Control risk -\>high -\> more extensive ST ***Risk Assessments and Internal Control*** PSA 400: Internal controls relating to the accounting system are concerned with achieving objectives such as the following: - Transactions are executed in accordance with management's general or specific authorization - All transactions and other events are promptly recorded at the correct amount, in the appropriate accounts and in the proper accounting period - Access to assets is permitted only in accordance with management's authorization - Recorded assets are compared with the existing assets at reasonable intervals and appropriate action is taken regarding any differences ***Overall responsibility for the system of internal control*** - Rests with those charged with governance, who are responsible for governing the bank's operations. - Banks' operations -\> generally large and dispersed - Decision-making functions need to be decentralized - Authority to commit the bank to material transactions is ordinarily dispersed and delegated among the various levels of management and staff. - Found in the lending, treasury and funds transfer functions Structured system of delegation of authority results in the formal identification and documentation of: - those who may authorize specific transactions; - procedures to be followed in granting that authorization; and - limits on the amounts that can be authorized, by individual employee or by staff level, as well as any requirements that may exist for concurring authorization. ***Authorization controls*** - Important to the auditor in considering whether transactions have been entered into in accordance with the bank's policies - Example: In the case of the lending function -\> have been subject to appropriate credit assessment procedures prior to the disbursement of funds. - TOC -\> Auditor considers whether limits for levels of exposures exist are being adhered to and whether positions in excess of these limits are reported to the appropriate level of management on a timely basis. - Proper functioning of a bank's authorization controls is particularly important in respect of transactions entered into at or near the date of the financial statements. - Aspects of the transaction have yet to be fulfilled, or there may be a lack of evidence with which to assess the value of the asset acquired or liability incurred. - Examples: Commitments to purchase or sell specific securities after the period-end and loans, where principal and interest payments from the borrower have yet to be made. ***Factors Important in a Banking Environment*** [1. Banks deal in large volumes of transactions that can individually or cumulatively involve large sums of money.] - Bank needs to have balancing and reconciliation procedures that are carried out within a time-frame that allows the detection of errors and discrepancies so that they can be investigated and corrected with minimal loss to the bank. - Procedures may be carried out hourly, daily, weekly, or monthly, depending on the volume and nature of the transaction, level of risk, and transactions settlement time-frame. - Purpose: To ensure the completeness of transaction processing across highly complex integrated IT systems [2. Many of the transactions entered into by banks are subject to specialized accounting rules.] - Banks should have control procedures in place to ensure those rules are applied in the preparation of appropriate financial information for management and external reporting. - Examples of control procedures : Those that result in the market revaluation of foreign exchange and security purchase and sale commitments so as to ensure that all unrealized profits and losses are recorded. [3. Some of the transactions entered into by banks may not be required to be disclosed in the financial statements ] - Control procedures must be in place to ensure that such transactions are recorded and monitored in a manner that provides management with the required degree of control over them and that allows for the prompt determination of any change in their status that needs to result in the recording of a profit or loss. - Example: transactions that generally accepted accounting principles allow to be regarded as off balance sheet items [4. Banks are constantly developing new financial products and services.] - The auditor considers whether the necessary revisions are made in accounting procedures and related internal controls. [5. End of day balances may reflect the volume of transactions processed through the systems or of the maximum exposure to loss during the course of a business day.] - Relevant in executing and processing foreign exchange and securities transactions. - Assessment of controls in these areas takes into account the ability to maintain control during the period of maximum volumes or maximum financial exposure. ***IT and EFT Systems*** - Has a significant effect on how the auditor evaluates a bank\'s accounting system and related internal controls. - Audit procedures include an assessment of those controls that affect system development and modifications, system access and data entry, the security of communications networks, and contingency planning. - EFT -\> The auditor gives additional emphasis to the assessment of the integrity of pre-transaction supervisory controls and post-transaction confirmation and reconciliation procedures. ***Access to Bank's assets*** - A bank's assets are often readily transferable, of high value and in a form that cannot be safeguarded solely by physical procedures. - In order to ensure that access to assets is permitted only in accordance with management's authorization, a bank generally uses controls such as the following. - Passwords and joint access arrangements to limit IT and EFT system access to authorized employees. - Segregation of the record-keeping and custody functions - Frequent third-party confirmation and reconciliation of asset positions by an independent employee. - The auditor considers whether each of these controls is operating effectively. - However, given the materiality and transferability of the amounts involved, the auditor also ordinarily reviews the confirmation and reconciliation procedures that occur in connection with the preparation of the year-end financial statements and may carry out confirmation procedures himself. ***Considering the Influence of Environmental Factors*** In assessing the effectiveness of specific control procedures, the auditor considers the environment in which internal control operates. Some of the factors that may be considered include the following: - The organizational structure of the bank and the manner in which it provides for the delegation of authority and responsibilities. - The quality of management supervision. - The extent and effectiveness of internal auditing. - The extent and effectiveness of the risk management and compliance systems - The skills, competence and integrity of key personnel. - The nature and extent of inspection by supervisory authorities. *PERFORMING SUBSTANTIVE PROCEDURES* **Introduction** - As a result of the assessment of the level of inherent and control risks, the auditor determines the nature, timing and extent of the **substantive tests** to be performed on individual account balances and classes of transactions. - In designing these substantive tests, the auditor considers the risks and factors that served to shape the bank's systems of internal control. - There are a number of audit considerations significant to these risk areas to which the auditor directs attention. - Tests of the completeness assertion are particularly important in the audit of bank's financial statements particularly in respect of liabilities. - Banking transactions do not have the same type of regular trading cycle as other commercial entities. - Large assets and liabilities can be created and realized very quickly and, if not captured by the systems, may be overlooked. - Third party confirmations and the reliability of controls become important in these circumstances. ***Audit Procedures*** The auditor may perform the following procedures: a. inspection; b. observation; c. inquiry and confirmation; d. computation; and e. analytical procedures. *In the context of the audit of a bank's financial statements, inspection, inquiry and confirmation, computation and analytical procedures require particular attention.* **[Inspection]** - Consists of examining records, documents, or tangible assets. - The auditor inspects in order to: - be satisfied as to the physical existence of material negotiable assets that the bank holds; and - obtain the necessary understanding of the terms and conditions of agreements (including master agreements) that are significant individually or in the aggregate in order to (1) consider their enforceability; and (2) assess the appropriateness of the accounting treatment they have been given. Examples of areas where inspection is used as an audit procedure are: - securities; - loan agreements; - collateral; and - commitment agreements, such as (a) asset sales and repurchases and (b) guarantees.\\ **[Inquiry and confirmation]** - Inquiry -\> consists of seeking information of knowledgeable persons inside or outside the entity. - Confirmation -\> consists of the response to an inquiry to corroborate information contained in the accounting records. - The auditor inquires and confirms in order to: - obtain evidence of the operation of internal controls; - obtain evidence of the recognition by the bank's customers and counterparties of amounts, terms and conditions of certain transactions; and - obtain information not directly available from the bank's accounting records. - A bank has significant amounts of monetary assets and liabilities, and of off- balance-sheet commitments. - External confirmation may be an effective method of determining the [existence and completeness] of the amounts of assets and liabilities disclosed in the financial statements. Examples of areas for which the auditor may use confirmation are: - Collateral. - Verifying or obtaining independent confirmation of, the value of assets and liabilities that are not traded or are traded only on over-the-counter markets. - Asset, liability and forward purchase and sale positions with customers and counterparties - Legal opinions on the validity of a bank's claims. **[Computation]** - Computation consists of checking the arithmetical accuracy of source documents and accounting records or of performing independent calculations. - In the context of the audit of a bank's financial statements, computation is a useful procedure for checking the consistent application of valuation models. **[Analytical procedures]** - Consist of the analysis of significant ratios and trends including the resulting investigation of fluctuations and relationships that are inconsistent with other relevant information or deviate from predicted amounts. - A bank invariably has individual assets (for example, loans and, possibly, investments) that are of such a size that the auditor considers them individually. May be effective for the following reasons: **1. Interest income and interest expense** - Ordinarily two of the most important elements in the determination of a bank's earnings - These have direct relationships to interest bearing assets and interest bearing liabilities. - To establish the reasonableness of these relationships, the auditor can examine the degree to which the reported income and expense vary from the amounts calculated on the basis of average balances outstanding and the bank's stated rates during the year. **2. High volume of transactions** - The accurate processing of the high volume of transactions entered into by a bank, and the auditor's assessment of the bank's internal controls, may benefit from the review of ratios and trends and of the extent to which they vary from previous periods, budgets and the results of other similar entities. **3. Going concern assumption** - By using analytical procedures, the auditor may detect circumstances that call into question the appropriateness of the going concern assumption, such as undue concentration of risk in particular industries or geographic areas and potential exposure to interest rate, currency and maturity mismatches. **4. Availability of wide range of information** - There is a wide range of statistical and financial information available from regulatory and other sources that the auditor can use to conduct an in-depth analytical review of trends and peer group analyses. ***Specific Procedures*** Specific Procedures in Respect of Particular Items in the Financial Statements      ***Reporting on the FS*** In expressing an opinion on the bank's financial statements, the auditor: - adheres to any specific formats and terminology specified by the law, the regulatory authorities, professional bodies and industry practice; and - determines whether adjustments have been made to the accounts of foreign branches and subsidiaries that are included in the consolidated financial statements of the bank to bring them into conformity with GAAP in the Philippines. - The financial statements of banks are prepared in the context of the legal and regulatory requirements and accounting policies are influenced by such regulations. - The BSP regulatory accounting principles for banks (RAP) may differ materially from generally accepted accounting principles (GAAP). - Banks often present additional information in annual reports that also contain audited financial statements. - This information frequently contains details of the bank's risk adjusted capital, and other information relating to the bank's stability, in addition to any disclosures in the financial statements. **AUDIT OF SHARED SERVICES** ***BPO vs SS*** **[Business Process Outsourcing]** - The process of engaging a third-party vendor with the right skills and resources, to carry out work on your behalf. **[Shared Services]** - Relates to the creation of an autonomous business unit, based on-site, which carries out these processes for multiple functions within an organization (HR, Finance, procurement). **[Business Process Outsourcing]** - Often thought to be more efficient à having better systems and processes - Frequently based offshore à labor costs and overheads can be significantly lower than having this service in-house. - Outsourcing can often be implemented quickly and more effectively, due to the experience of the resource within these companies. - Feedback is often that *'BPO can be seen as 'faceless' or lacking the human approach'* that people sometimes want from these services and in a world where employee engagement and experience is paramount, this can cause real issues. **[Shared Services]** - Can be a better solution if your needs are bespoke. - BPO can often be one size fits all, and if you have requirements that are specific and processes that aren't bog standard, then a shared services model may be the best choice. - Implementation of SS function within a business can be slow and painful -\> due to lack of experience internally to deliver this and if systems, processes and data are not clean and efficient, the service will fail. ***Service Delivery Model*** Transforming back office and/or middle office to be more service focused can take many forms: 1. Shared service center (SSC) -- where certain activities and processes are delivered from a shared location (generally in a lower cost location) 2. Outsourcing -- where a business process outsourcer delivers activities and processes 3. Combination of both Regardless of the model chosen, the key principles remains the same: standardization, consolidation, reengineering and automation. ***Shared services ≠ Centralization ≠ Outsourcing*** - SSC operates as an internal customer service business - It typically charges business units for services provided, and uses SLA as a contractual arrangement which specifies cost, time and quality performance measures. - Business Unit Management is able to focus a greater portion of its time on external customers and issues of strategic importance by redirecting the role of local finance to one of decision support and analysis. - It differs from outsourcing, where an outside organization is responsible for the tasks. - With SS, employee still performs the jobs and the systems should be fully integrated with the BU's systems and processes. Comparison of various attributes of SSC or outsourced model to centralization:  ***Drivers of Change*** Companies are considering shared services or outsourcing to address a number of challenges, including: - Support function costs (e.g., IT, finance, HR) are too high and growing too fast. - Lack of standardized systems, restricting the implementation of technology solutions. - Desire to manage business growth without adding a proportionate number of finance and administration staff. - Company mergers and acquisitions - Globalization and increased competition. - The drive for increased shareholder value. ***Who could benefit from transforming their service delivery model?*** Characteristics of an organization that would benefit from shared services include: - Multiple, dispersed locations - Unnecessary local administrative presence - Non-standard processes - Duplication of work across sites - Incompatible information systems between locations - Development of local or temporary solutions at each site - Sites that struggle with their service levels ***Benefits of SSC*** **1. Increased efficiency** - Best practice processes; economies of scale; greater span of control; lower labor costs; get the most from investment in technology; standardization; reengineering; integrated procurement; acquisition synergies. **2. Increased effectiveness** - Enhance customer service focus from front-office mindset and SLAs and service costing; make the most of specialist skills; management freer to focus on business issues; improved decision support; easier to do data warehousing; improved control environment. ***What processes can be shared or outsourced?*** - Many companies transforming their service delivery model have focused primarily on finance processes, with payables, expense processing and general ledger being the most common. - These processes are usually (or should be) similar between one BU and another, are rarely seen as strategically important or particularly close to external customers, and involve significant numbers of staff. - As a result, moving such processes to SSC or an outsourcer can provide a significant cost reduction. - HR administrative processes and tax and legal activities can be shared or outsourced or both. - Customer management processes -- order entry and resolving customer queries -\> thru call centers where customer linkages via phone, e-mail, fax, EDI or post can be maintained. - Processes best suited to shared services are those that are not strategically critical to the business and are common across BUs. [Shared services have undergone major transformation:] - **FROM** standardization and consolidation of processes while ensuring a compliant controls environment (underlying goal -- mainly cost reduction) - **TO** focus on enhancing services and providing higher value activities such as forecasting, reporting and treasury As SS delivers improved quality, finance, HR and IT can concentrate on being partners to the business and help drive strategic growth. ***Process Splits*** - Processes for inclusion in a service delivery model will need to be mapped to determine which parts of the process must be performed by LBUs (remain local) and which can be consolidated. - The split of work will need to be defined at a very granular level to ensure absolute clarity of accountabilities. Below is a sample of high-level split between SSC/Outsource and local activities in more detail. **[Purchase to pay process]** ***Shared Services Models***  ***High-level Organization Structure*** - Organization structure helps visualize what SSC would look like, supports stakeholders engagement and determines headcount and the manager-to-clerk ratio (or span of control) - An SSC should be organized to improve both process efficiency and effectiveness. An SSC can be organized by: - Process -- e.g., AP, AR, GL etc. - BU -- maximizes customer and business focus - Regional -- maximizes regional knowledge Example of high-level SSC organizational chart ***High Level Site Location*** ***SSC Organizational Structures*** ***SLA and Performance Measures*** - What relationship will the SSC have with its internal customers? - How will they be charged for services provided? - How will the SSC's performance be monitored and reported back to the business? - When disputes over cross charges and service levels arise, how will they be resolved? It is important that these matters are agreed upfront and communicated to users, to demonstrate accountability and assuage any business unit fears of a head office takeover. **[Service Level Agreements (SLAs)]** - Useful in defining the relationship between the SSC and its internal customers, the local business units (LBUs) - Contain a number of key performance indicators (KPIs) to provide mechanism to quantify performance in terms of cost, quality and time. - Target performance levels will be negotiated for each KPI. - Should not be treated as a "one-off" document -\> should be used in customer meetings, and tracked on a monthly basis to demonstrate service levels and progress against agreed levels. - Periodically revisit SLAs and performance indicators to ensure their ongoing relevance **IT on SSCs** Some of the good examples of automation or effective use of enabling technology solutions use across process by leading SSCs: **Changing Role of Finance** - One of the key benefits of SSC is a new role for LBU management. - By stripping out non-strategic processes from the LBUs and consolidating them into an SSC environment, LBU management is able to focus a greater portion of its time on issues of strategic importance. - The role of the retained LBU finance function shifts from predominantly transaction processing to business partnering, as local finance staff provide business leaders with analysis to support revenue growth, strengthen cost management and optimize capital investment. - This relative shift in the role of finance is indicated in the diagram below **Key Processes and Accounts** The following are the key processes in SSCs/BPOs: - Central Billing process - Accounts Receivable and Collections process - Accounts Payable - Fixed Assets - Payroll - Management fees (cost and revenue) - Cash - Trade debtors - Trade creditors - Fixed assets - Salaries expense