Non-audit services and safeguarding independence

Most audit firms sell more than audits. They prepare tax returns, review information technology (IT) systems, advise on deals and sometimes keep the books. These services bring fees and closeness to the client, and both can weaken independence. The Code does not ban non-audit work outright. It asks what the firm is being asked to do, whether the client is a public interest entity, and what safeguards are in place.

This topic covers the threats from non-audit work, the ban on assuming management responsibility, accounting and bookkeeping, temporary staff, specialist valuations, the other services the Institute of Chartered Accountants of Nigeria (ICAN) code addresses, and how independence is safeguarded by the firm and by the profession.

Examiners present a client that asks for extra services and expect you to say, service by service, whether it is allowed, what threat it creates and what safeguard applies.

Why non-audit services create threats

When a firm earns a lot from non-audit work for an audit client, two threats arise. The fees may make the firm economically dependent on the client, which is a self-interest threat. And the people who audit the client may have to audit work done by colleagues in the same firm, which they may find hard to criticise. This is a self-review threat.

The services in question include accounting and bookkeeping, taxation work, outsourcing of internal audit to the external auditor, IT work and consultancy. Such services are now common in firms of all sizes. Most firms deal with the threat through their organisation: larger firms work in separate departments with their own partners and staff, so that audit staff differ from consultancy staff for the same client.

In some of the largest firms, consultancy has been separated legally from the audit arm. Smaller firms cannot always have separate departments, but they try to make different partners and staff responsible for different services.

The ban on assuming management responsibility

Non-audit services can lead the firm to take on a management role. The Code prohibits this, because it creates self-review, self-interest, familiarity and advocacy threats. Examples of management responsibility are:

• setting policies and strategic direction;
• hiring or dismissing employees;
• directing and taking responsibility for employees’ actions;
• authorising transactions;
• controlling or managing bank accounts or investments;
• deciding which of the firm’s recommendations to implement;
• reporting to those charged with governance on behalf of management; and
• taking responsibility for preparing financial statements, or for designing, monitoring and maintaining internal controls.

To avoid taking on management responsibility, the firm must make sure that the client names a person who is responsible for all client decisions and for overseeing the services.

Accounting records and financial statements

Accounting or bookkeeping services, including payroll and preparing financial statements, must not be done for a client that is a public interest entity. For other clients, the auditor may provide routine or mechanical accounting or bookkeeping, including payroll, with safeguards such as:

1. the service is not performed by a member of the audit team;
2. the firm has policies so that no one makes a management decision for the client;
3. the source data for accounting entries comes from the client;
4. the underlying assumptions are originated and approved by the client; and
5. the client approves any changes to the financial statements.

Temporary staff assignments

A client may ask the firm to lend staff to its accounts department for a time. This creates three threats. Self-review: the person may return to the audit team and not want to criticise work he did at the client. Familiarity: he becomes familiar with the client’s staff and may not challenge them. Advocacy: his views may align too closely with management’s.

It is allowed only on strict terms:

• the help is for a short period
• the person does not perform non-assurance services that the Code prohibits
• he is not involved in management decisions
• the client directs and supervises him

This can be hard to achieve where the person was a senior auditor with wide knowledge of the client.

A person who has been lent is not allowed to work on the audit team again. That creates a practical difficulty, because the team loses experienced people, so small and medium firms are reluctant to lend staff.

Specialist valuations

A client may ask the firm for a specialist valuation: actuarial valuations, valuations of intellectual property and brands, of other intangible assets, of property and of unquoted investments. These do not include valuations of shares before a stock exchange listing.

The threat is that the audit will include a review of the firm’s own valuation, which is a self-review threat. The firm’s views may be too close to the client’s (advocacy).

• For clients that are not public interest entities, the firm should not provide valuations where the matter is material to the financial statements and involves a significant degree of subjectivity.
• For a public interest entity, the firm shall not provide valuation services where the matter is material to the financial statements.

The ICAN guidance on other services

The ICAN code accepts that non-audit services are valuable to client and auditor, but the auditor must judge how serious any threat is. Some threats can be removed or reduced by safeguards. ICAN says that no safeguards work for these activities, because they put the firm into a management role:

• authorising or executing a transaction, or otherwise exercising authority for the assurance client, or having authority to do so;
• determining which of the firm’s recommendations should be implemented; and
• reporting, in a management role, to those charged with governance.

Most other services are allowed if management decisions are not taken and suitable safeguards are in place. The syllabus gives these examples.

The Nigerian Financial Reporting Council of Nigeria (FRC) Audit Regulation 2020 adds a limit: non-audit services need board approval after the audit committee recommends them, and may not exceed 80% of the annual audit fee. The FRC rules require disclosure of audit and non-audit fees in the financial statements.

Safeguarding independence

Responsibility for safeguarding independence is shared between the individual auditor or audit practice and the profession as a whole.

The firm’s responsibilities

There should be a culture in which every partner and employee believes that a good auditor is an independent auditor. Where possible, the engagement partner and senior staff should be rotated. A firm must also have:

• Training, including how to keep an independent opinion during the audit.
• Quality control procedures that make sure independence is considered on all work.
• Consultation procedures inside the firm so that independence questions can be discussed.

If an auditor knows of a situation that may threaten independence, action must be taken. This might be simple: refuse a gift, or dispose of shares. Sometimes a new appointment must be rejected, for example if fee income from the new client would exceed the maximum allowed. With an existing client, if the problem cannot be resolved, the final step is to resign from the audit.

The profession’s responsibilities

Professional bodies expect members to comply with their codes and take disciplinary action, which may be a fine, reprimand or exclusion. The profession and others suggest improvements, such as regular rotation of audit firms and the use of audit committees.

The rules in more depth

Why bookkeeping is barred for public interest entities

If the firm keeps the books and then audits them, it is checking its own records: the clearest self-review threat. For a small private client the knowledge may be harmless, and routine work with a client-led process can be safeguarded. For a public interest entity, the public cost of failure is too great to risk it.

Why the client must name a decision-maker

The firm may advise, but it may not decide. If a firm both recommends a control and chooses to install it, the firm will later audit the effect of its own decision. Requiring the client to designate a responsible person keeps the decision, and the accountability, with management.

Why lent staff cannot return to the audit

A person who has worked inside the accounts department will have made or shaped entries. Putting him back on the audit team would mean checking his own work. The ban is blunt but it removes the threat.

Numbers: the 80% cap

A public interest entity pays an audit fee of ₦30 million. The cap on non-audit fees is 80%, which is ₦30 million × 0.80 = ₦24 million. The firm already earns ₦20 million from tax work and is asked to take a ₦6 million assignment. The total would be ₦20 million + ₦6 million = ₦26 million, which exceeds the cap by ₦2 million. The firm can accept at most ₦4 million (₦24 million − ₦20 million), if the service is otherwise permitted, or decline.

Worked example: a client that asks for everything

1. Payroll and bookkeeping. Not a public interest entity, so it is allowed if routine or mechanical, done by staff who are not on the audit team, with the client providing source data and assumptions and approving changes, and with no management decisions by the firm.
2. Inventory system. Designing the controls takes responsibility for internal controls, and deciding which recommendations to use is a management role. ICAN says no safeguard works for choosing which of the firm’s recommendations to implement. The firm may recommend, but Delta must decide and a named Delta manager must oversee. The firm should not take the role as described.
3. Recruitment. Allowed in a limited form. The firm may review CVs and draw up a short list, but Delta must decide.
4. Lent assistant. Only for a short period, and a six-month placement running the department is a management role. The client must direct the person, and the person must never rejoin the audit team. The request should be refused or reshaped.
5. Patent valuation. The patent is material and the valuation involves significant subjectivity, so the firm must not provide it to this non-public-interest client.
6. Conclusion. Accept the payroll and short-list work with safeguards, advise on but not choose the controls, decline the long secondment and the valuation, and record the decisions.

How to score full marks

• Go service by service. For each service in the scenario: say whether it is allowed, name the threat, and give the safeguard. Use the three-part pattern every time.
• Ask first: is the client a public interest entity? Many answers change on that fact: bookkeeping, valuations and IT reviews.
• Look for a management role. If the firm decides, authorises or reports for management, say no safeguard works.
• Name the threat. Self-review for work the firm will audit, self-interest for fees and referral commissions, advocacy for defending the client, familiarity for lent staff.
• Add the Nigerian limits. Board approval after the audit committee’s recommendation, the 80% cap and the disclosure rule.
• Time. Spend time in proportion to marks and finish with a one-line recommendation for each service.

Common mistakes in the exam

• Saying all non-audit services are banned. Most are allowed with safeguards.
• Allowing bookkeeping for a public interest entity.
• Forgetting that the client must name a decision-maker.
• Saying the person on loan can rejoin the audit team afterwards.
• Giving a safeguard for an activity that ICAN says no safeguard can cure, such as choosing which recommendations to adopt.
• Missing the self-review threat in IT or system design work.
• Forgetting the 80% cap and board approval for a Nigerian public interest entity.
• Treating a referral fee as banned in every case. It is allowed with safeguards, but ICAN bars referral fees to obtain a client.

Quick revision

• Threats: self-interest (fees) and self-review. No management responsibility. Client names a decision-maker.
• Bookkeeping, payroll and financial statements: barred for public interest entities; routine and safeguarded for others.
• Lent staff: short, no management role, client directs, never back on the audit.
• Valuations: barred if material and subjective (non-PIE); barred if material (PIE).
• ICAN: no safeguard for authorising transactions, choosing recommendations or reporting to governance in a management role. Tax, internal audit and IT with safeguards.
• Litigation for the client where amounts are material: do not take it on.
• Independence: culture, rotation, training, quality control, consultation; reject, or resign as the last step. FRC: 80% cap with board approval.

Practice questions

These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.