Ethics and Terms of Audit Engagements

Weightage: Chapter 9 of ICAI's Paper 5 syllabus, roughly 8 marks. Ethics is short, structured and reliable — the method chapter's promise, delivered in full here — and terms of engagement return to the very first stage of the audit sequence: accept the engagement and agree its terms.

The fundamental principles

The ICAI Code of Ethics requires every member to comply with five fundamental principles:

Integrity — to be straightforward and honest in all professional and business relationships.

Objectivity — not to allow bias, conflict of interest or undue influence of others to override professional or business judgements.

Professional Competence and Due Care — to maintain professional knowledge and skill at the level required to ensure a client receives competent professional service, and to act diligently in accordance with applicable technical and professional standards.

Confidentiality — to respect the confidentiality of information acquired as a result of professional and business relationships, and not to disclose it to third parties without proper and specific authority, unless there is a legal or professional right or duty to disclose, nor to use the information for personal advantage.

Professional Behaviour — to comply with relevant laws and regulations and avoid any conduct that discredits the profession.

These five are the vocabulary this chapter's ethics questions are built on, and they connect directly back to the qualities of an auditor introduced in the first chapter of this subject — this is where that earlier vocabulary is finally developed in full.

The conceptual framework: threats and safeguards

Rather than a rigid rulebook attempting to list every possible ethical scenario, the Code adopts a conceptual framework approach: the member must identify threats to compliance with the fundamental principles, evaluate the significance of those threats, and apply safeguards, where necessary, to eliminate the threats or reduce them to an acceptable level.

The five threats

Self-interest threat — the threat that a financial or other interest will inappropriately influence the member's judgement or behaviour. (Example: holding shares in an audit client; undue dependence on total fees from one client.)

Self-review threat — the threat that a member will not appropriately evaluate the results of a previous judgement made, or service performed, by the member (or another individual within the same firm), when that judgement needs to be re-evaluated in forming a conclusion on the current engagement. (Example: the audit firm having prepared the accounting records that the same firm is now auditing.)

Advocacy threat — the threat that a member will promote a client's or employer's position to the point that the member's objectivity is compromised. (Example: acting as an advocate on behalf of an audit client in litigation or a dispute with a third party.)

Familiarity threat — the threat that, due to a long or close relationship with a client or employer, a member will be too sympathetic to their interests or too accepting of their work. (Example: a senior member of the audit team having a long association with the audit client; an immediate family member employed in a senior position at the client.)

Intimidation threat — the threat that a member will be deterred from acting objectively because of actual or perceived pressures, including attempts to exercise undue influence over the member. (Example: being threatened with dismissal from an engagement or replacement over a disagreement about an accounting treatment.)

Safeguards

Safeguards fall into two broad categories: those created by the profession, legislation or regulation (educational, training and experience requirements; continuing professional development; professional standards and monitoring; external review of a firm's reports, returns and communications), and those within the work environment, at both the firm-wide level (leadership emphasising quality and ethical behaviour; policies for identifying threats; disciplinary mechanisms) and the engagement-specific level (involving an additional professional to review work performed; consulting an independent third party; rotating senior personnel; discussing ethical issues with those charged with governance).

The recurring exam pattern: a fact pattern describes a scenario, the candidate identifies the threat by name, and then identifies a safeguard that specifically addresses that threat — rotating the engagement partner addresses familiarity; involving a second partner to review the work addresses self-review or self-interest; declining to provide the conflicting service addresses self-review or advocacy directly at the source, which is often the most robust safeguard where a genuine conflict cannot otherwise be adequately reduced.

Independence — the specific application of objectivity to audit

Independence of mind — the state of mind that permits an opinion to be expressed without being affected by influences that compromise professional judgement, allowing genuine integrity, objectivity and professional scepticism.

Independence in appearance — the avoidance of facts and circumstances significant enough that a reasonable and informed third party would conclude the auditor's integrity, objectivity or professional scepticism had been compromised.

Both are required together: an auditor who is genuinely independent in mind but whose circumstances would lead a reasonable observer to doubt that independence has still failed the appearance requirement, and vice versa — this distinction is examined precisely because candidates assume being genuinely unbiased is sufficient on its own, when the Code requires both the substance and the perceived credibility of independence.

Terms of audit engagements — SA 210

Preconditions for an audit — before accepting an audit engagement, the auditor must determine that the preconditions for an audit are present: confirming that the financial reporting framework to be applied is acceptable, and obtaining the agreement of management that it acknowledges and understands its responsibility for the preparation of the financial statements in accordance with that framework, for internal control necessary to enable financial statements free from material misstatement, and for providing the auditor with access to all information relevant to the audit.

Where preconditions are not present — if management imposes a limitation on the scope of the auditor's work in the terms of a proposed audit engagement such that the auditor believes the limitation will result in a disclaimer of opinion, the auditor shall not accept such a limited engagement as an audit engagement, unless required by law or regulation to do so.

The engagement letter documents and confirms the auditor's acceptance of the appointment, the objective and scope of the audit, the extent of the auditor's responsibilities, and the form of any reports to be issued — the agreed terms should be recorded in an audit engagement letter, and its content typically includes: the objective and scope of the audit; the responsibilities of the auditor; the responsibilities of management; identification of the applicable financial reporting framework; and reference to the expected form and content of any reports to be issued.

Recurring audits — the auditor may decide not to send a new engagement letter each period, but certain factors may make it appropriate to revise the terms or remind the entity of existing terms: any indication the entity misunderstands the objective and scope of the audit; any revised or special terms of the engagement; a recent change of senior management; a significant change in ownership; a significant change in the nature or size of the entity's business; a change in legal or regulatory requirements; or a change in the financial reporting framework applicable.

Closing the circle

This is where the audit sequence, opened in the very first chapter of this subject, returns to its starting point: accepting an engagement and agreeing its terms is stage one of seven, and everything this whole paper has covered — risk assessment, evidence, sampling, documentation, completion, reporting — happens inside the boundary this chapter's agreed engagement terms set. A candidate who has held the seven-stage sequence throughout their preparation should recognise, arriving here, that the syllabus has come full circle — which is itself confirmation that the sequence, not the syllabus's flatter chapter order, is the real structure of this subject.