The pandemic has impacted businesses and the economy worldwide by disrupting organisations, small and big, at varying levels. Audit in these unprecedented times comes with its challenges, and here are eight critical issues auditors need to be wary of in the new environment.
Remote audit evidence
The audit profession in India is in the initial stages of embracing technology. The sudden move to a virtual environment is a significant first shift. Obtaining audit evidence is where the crisis begins. Access to the original document, validating the source, and control over preparation, are vital factors of ‘evidence.’ The audit evidence that is 'sufficient and appropriate' to form a basis for an opinion is now different. Remote access, electronic records, scan copies of the document, video conferencing, and virtual meetings are the new toys. These changes extend to obtaining balance confirmations and account statements.
Auditors will have to use their judgement in determining if the evidence so obtained is reliable. They must exercise scepticism about such records' authenticity and perform additional procedures to assess controls over producing these electronic records.
Revision of audit plans
Risk assessment is a dynamic process in an audit. Auditors must evaluate additional risks presented due to Covid-19, the changes in the organisation's operations and strategies, and revise existing audit plans accordingly.
Auditors should evaluate the impact on the supply chain, reducing customer base, new channels of operation, contractual breaches, employee absence, changes in process and procedures to meet the current environment, modification to components of controls, and the risk of fraud. Audit teams will also have to consider the impact on materiality due to all of these.
Going concern
The pandemic has forced governments to implement physical restrictions that have caused disruptions to operations. These include supply-chain disorder, increased cost of materials, export restrictions, reduced demand, loss of contracts, delays in cash flows, difficulty collecting debts and liquidity issues.
Audit teams will have to evaluate the management's assessment of the organisation as a going concern. They will have to check if all factors impacting a going concern have been considered and perform additional audit procedures to test the assumptions used in such evaluation. These include management's forecasts, the period considered, the likelihood of uncertainty, prolonged lockdown measures in different geographical locations and so on.
Asset verification
Lockdown has had a significant impact on physical inventory counts and asset verifications in an audit. There are situations where physical count could not be carried out by the organisation at the period end, absence of auditors' physical presence during the physical count, inventory held at a third-party location.
Audit teams will have to evaluate if physical count can be carried out on a different date, with additional procedures like rollback, remote observation through a live feed, or perform alternate procedures like document verification, and reconciliation. Where physical verification or alternate audit procedures are not possible to obtain sufficient evidence, auditors may have to evaluate the impact on their opinion.
Accounting estimates
Accounting estimates and disclosures are the responsibilities of the management. They are pervasive throughout the financial statements and the audit. Some examples are: impairment of assets, providing for a decline in value of investments, valuation of receivables, and loans and advances. The management uses assumptions and projections in the use of such estimates. The uncertainty around these assumptions could increase, as there is no clarity on how long Covid-19 will last.
Auditors must check the appropriateness of the assumptions, methods applied, reliability of information used. Procedures should include a test for relevance and appropriateness to the current environment. The audit team may have to employ experts (say, valuation specialists), as appropriate.
Consolidations
If the parent company's auditor is not the auditor of all the component companies, he uses the component auditors' work. In these times, the principal auditor may face challenges in meeting the component audit team, evaluating and review essential audit working papers, obtain sufficient appropriate evidence in time, or even face restrictions in the transfer of data. Where the component auditor has not been able to get adequate proof or perform audit procedures, it could impact the overall audit of the group entity.
Subsequent events
Management is required to consider events that occur after the reporting period and use their judgements in preparation of financial statements. Amounts recognised in the financial statements are adjusted to reflect adjusting events, while only disclosures are required for material non-adjusting events. Given the uncertainties involved around the pandemic period, the management's assessment will have to be reviewed frequently and updated till the financial statements are issued.
Focus on information security
The pandemic has forced people to rely on technology at a pace that organisations would not have been prepared for. This includes enabling a work from home environment, remote access to records, data, information, ERP, processing, data transfer, cloud storage, and virtual meetings.
This increased role of technology has introduced an additional focus on information technology reviews in audits, for auditors to obtain confirmation and assurance on controls for the security, availability, confidentiality, and privacy of the information collected, processed, stored, and their disposal. The absence of such defined technology controls in organisations that are not matured would require additional audit procedures.
In short, the neo-normal challenges require the auditor to reassess critical aspects of the audit continuously. Hence, the audit procedures will have to be dynamic and robust with the changing times. Many elements of an audit will be impacted by the pandemic, and thus the importance of the exercise of professional scepticism and judgement by auditors obtains more considerable significance.
(The author is a chartered accountant specialising in audit, internal controls, and information security).