Investigations and reports on internal control over financial reporting

An audit follows rules written for audits. An investigation follows whatever rules the appointing body sets. It might be a regulator asking why a collapsed company’s audit failed, an institute checking a member, or a court-appointed inquiry.

Alongside this, the Financial Reporting Council of Nigeria (FRC) of Nigeria now expects public interest entities to report on their internal control over financial reporting, and their auditors to give assurance on management’s report.

This topic covers when investigations are used, how they differ from a statutory audit and what stages they follow. It then covers the two FRC guidance documents on internal control over financial reporting. The FRC guidance is recent and specific to Nigeria, so a scenario on a public interest entity can ask for its details.

When investigations are used

Accountants are involved in investigations in two ways. Sometimes an accountant is asked to investigate for someone else, such as in a forensic investigation. Sometimes the accountant is the one being investigated by Institute of Chartered Accountants of Nigeria (ICAN) or the police.

Investigations and the IAASB

The ISAs have no official definition of an investigation, and those who carry one out are not required to follow them as they would in a statutory audit. The laws and rules depend on the type of investigation and whose legal authority it falls under. The International Auditing and Assurance Standards Board (IAASB) Handbook does mention investigations in a few places:

• investigation of an audit failure by a professional body or independent audit regulator;
• investigations by an audit firm into complaints or allegations of wrongdoing;
• deficiencies in the design or operation of the firm’s quality control;
• an individual’s failure to follow the firm’s policies and procedures;
• exceptions or inconsistencies found during an audit;
• investigations by regulators and government departments that may lead to fines and penalties; and
• investigations by an authority into an actual or suspected illegal act.

Statutory audit and investigation compared

The syllabus compares them on duties and responsibilities. In a statutory audit the duty is to express an opinion on whether the annual financial statements are true and fair. In an investigation the duties are set by the appointing body and may be defined by statute in some cases.

Background: The same idea applies to the other features, which you can use in a comparison answer.

Stages of an investigation

Any investigation follows three stages.

1. Acceptance

The firm uses a process similar to accepting an audit or assurance engagement. It asks:

• Does the firm have the competence and experience to perform the investigation?
• Are staff with suitable experience available?
• Is there enough time to meet the deadlines?
• Would accepting breach any ethical standard?

2. Investigation

The work depends on the subject matter, and the terms of reference set it.

3. Reporting

The form of the report depends on the case. Sometimes it follows a prescribed standard, such as ISRS 4400 for an agreed-upon procedures investigation or an assurance report. Otherwise it usually has these core parts:

1. an addressee;
2. a caveat or limit on the investigator’s liability;
3. the respective responsibilities of the investigator and the addressee;
4. a description of the work performed; and
5. the conclusions.

Internal control over financial reporting: the FRC guidance

The FRC of Nigeria has issued two pieces of guidance on internal control over financial reporting, known as ICFR. One is for the external auditor or other assurance practitioner, and applies from annual periods ending 31 December 2023. The other is for management, and applies from annual reports ending on or after 31 December 2024.

Guidance for management

The management guidance gives a top-down, risk-based approach to evaluating ICFR. It applies to all public interest entities except small companies as defined by section 394(3) of Companies and Allied Matters Act 2020 (CAMA 2020), unit microfinance banks, insurance brokers, non-tertiary educational institutions, non-tertiary health institutions and others the FRC decides.

Management must keep a system of internal control that supports good reporting and must keep reasonable documented evidence for its assessment. The public interest entity files its audited statements with a signed management assessment, placed before the auditor’s report. The assessment includes:

1. a statement that management has established and maintains good ICFR;
2. the framework used to evaluate effectiveness. COSO is the preferred approach;
3. a statement on whether ICFR is effective, or whether a material weakness exists. If management has not fixed one or more material weaknesses, it cannot conclude that ICFR is effective; and
4. a statement that the practitioner who audited the financial statements has issued an attestation report on management’s assessment.

The chief executive officer and chief financial officer certify the report. The certification says that they have reviewed it, that it contains no untrue statement of a material fact, and that the statements fairly present the financial position, results and cash flows.

They also say that they are responsible for internal controls, have designed them, have evaluated their effectiveness within 90 days before the report, have told the auditors and the audit committee about all significant deficiencies, material weaknesses and any fraud involving management or significant employees, and have said whether there were significant changes in controls after the evaluation.

Guidance for the practitioner

The guidance helps the external auditor or other practitioner to design, plan, perform and report on an assurance engagement on controls over financial reporting. Its main requirements are these.

• Ethics and skill. Technical skill, professional scepticism, independence and due care. Work is planned, directed, supervised and reviewed.
• Understanding. The practitioner understands the control procedures and their operating effectiveness.
• Evidence. By inspection, observation, enquiry, reperformance and confirmation, covering the period of the financial statements.
• Framework. COSO is the standard used by the Nigerian regulator.
• Engagement letter. Signed with those charged with governance, confirming that they accept responsibility to design and implement a good system of control and to give the practitioner unrestricted access to information.
• Written assessment. The practitioner asks for management’s written assessment of the effectiveness of ICFR.
• Integrated engagements. If the ICFR engagement and the audit are done together, neither objective must be compromised. Planning considers knowledge of the company’s controls, industry and entity matters, recent changes, preliminary materiality, control deficiencies, pending cases, and risk assessment.
• Focus. High-risk areas, especially fraud risk. The focus is on controls over unusual transactions, journal entries, significant management estimates, related party transactions and access to information technology.
• Use of others. The practitioner considers their competence and objectivity, or does the work personally.
• Materiality. The same as for the audit of the financial statements.
• Top-down approach. Start with overall risk at the financial statement level, then entity-level controls, then significant accounts, disclosures and their relevant assertions: existence, completeness, valuation or allocation, rights and obligations, presentation and disclosure, accuracy, cut-off and classification.

Testing controls and evaluating deficiencies

Testing checks whether the controls were designed and implemented by competent people with authority, and whether they operate effectively to prevent fraud and error that could cause material misstatement. For each deficiency the practitioner decides whether it is a material weakness. The question is not how severe the deficiency looks but whether the control in place would fail to prevent or detect a misstatement.

The indicators of a material weakness are:

1. management fraud, no matter how small;
2. restatement of previously issued financial statements;
3. a material misstatement found by the practitioner that the entity’s controls should have detected; and
4. poor oversight by those charged with governance.

Forming the conclusion

• A qualified conclusion or a disclaimer is given for a scope limitation.
• A qualified or adverse conclusion is given for a material misstatement.
• Withdrawal may be considered for a scope limitation.

Written representations and communication

Management must give written representations that it has acknowledged and performed its responsibilities for adequate ICFR, has not used the practitioner’s procedures for its own assessment, has disclosed all significant or material deficiencies, has disclosed any fraud involving top management or those who work on ICFR whether material or not, has said whether deficiencies from the previous audit are resolved, and has said whether there have been significant changes in ICFR since the reporting date.

A failure to give the representations is a limitation on scope. All material weaknesses are communicated in writing to those charged with governance before the report is issued.

The report

The illustrative report says that the practitioner has performed an assurance engagement on ICFR at a date, against criteria such as the FRC guidance, that management is responsible for ICFR and its assessment, and that the practitioner’s responsibility is to report on it. The conclusion is in negative form: nothing has come to attention that the controls are not adequate.

The report is signed with the firm’s and the practitioner’s FRC numbers, gives the city and is dated when the practitioner has all the evidence. In an integrated engagement the dates of the two reports are the same.

Note. The illustrative report mixes wording. It says the practitioner’s responsibility is to express an opinion, yet it gives a limited assurance report with a negative conclusion. For the exam, give limited assurance in negative form.

The rules in more depth

Why a deficiency is judged by what it could let through

A control may look minor but sit on a high-risk process, like a journal approval that no one reviews. The test is whether the control would fail to stop or find a material misstatement. That is why the guidance asks the practitioner to look at the potential effect and not only the size of the gap.

Why the top-down approach saves effort

Starting at the financial statement level lets the practitioner focus on controls that matter for the significant accounts and assertions, instead of testing everything. Entity-level controls such as the control environment and the audit committee set the scene for the rest.

Investigations and the ICFR work compared

An investigation looks backward at a specific matter on terms set by someone else. An ICFR assurance engagement looks at a defined set of controls against a framework and follows a published guidance. Both need a clear engagement letter.

Worked example: a control test and an investigation

Control test. A public interest entity has a control that a finance manager must approve every manual journal over ₦5 million before posting. The practitioner selects 25 journals from the year and finds that two were posted without approval, a deviation rate of 2 ÷ 25 = 8%. The two journals total ₦9 million and were posted by the same accountant, who also has system access to approve.

Using an illustrative tolerable deviation rate of 5%, the control is not operating effectively. Journal entries are a high-risk area, and the lack of separation of duties means the control could fail to prevent a misstatement. The practitioner assesses whether this is a material weakness, considers whether any other control compensates, extends the testing and tells those charged with governance in writing before the report is issued.

If management has already concluded that ICFR is effective, the practitioner reports the disagreement and gives a qualified or adverse conclusion.

Investigation. The directors of Quest Ltd suspect that inventory is being stolen from a depot and ask an accountancy firm to investigate. The firm first decides whether to accept: it has staff who did similar work, there are eight weeks available, and it does not audit Quest, so there is no ethical bar.

The terms of reference say that the firm will report to the board only, that its liability is limited to the fee, and that it will not give an audit opinion. The firm then compares stock records to counts over six months, analyses margins by depot, tests cut-off and reviews who has access to the store.

The report describes the work, the shortfall of ₦22 million found in one depot and the control gaps that allowed it, and the firm’s conclusions.

How to score full marks

• Match the investigator to the subject. The professional body for ethics, the regulator for audit failure, the police for money laundering.
• Use the three stages. Acceptance, investigation and reporting, with the four acceptance questions.
• Say that there are no fixed standards. The terms of reference decide.
• For ICFR, split management from the practitioner. Management assesses and certifies, the practitioner gives assurance.
• Name COSO and the top-down approach. They are the two features examiners expect.
• Quote the four material weakness indicators. Fraud by management, restatement, a misstatement the controls missed, and poor oversight.

Common mistakes in the exam

• Saying that the ISAs must be followed in an investigation.
• Giving an audit-style report for an investigation.
• Forgetting that failure to give written representations is a scope limitation.
• Mixing up the management guidance and the practitioner guidance.
• Using a different materiality for the ICFR engagement from the one used in the audit.
• Saying that a small management fraud is not a material weakness. Fraud by management is an indicator whatever its size.

Quick revision

• Investigation: no International Standards on Auditing (ISA) requirement, terms set by the appointing body, three stages.
• Acceptance: competence, staff, time, ethics.
• Report: addressee, limit on liability, responsibilities, work done, conclusions.
• ICFR management guidance: top-down, COSO, signed assessment, CEO and CFO certify, 90 days.
• ICFR practitioner guidance: engagement letter, same materiality, top-down, five evidence methods, high-risk areas.
• Material weakness indicators: management fraud, restatement, missed misstatement, poor oversight.
• Conclusions: qualified or disclaimer for scope limitation, qualified or adverse for misstatement, withdrawal possible.

Practice questions

These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.