Review engagements and due diligence

Not every client wants a full audit. A small company may only need a bank to be satisfied. A listed company must have its half-year figures looked at but not audited. A buyer wants to know what it is really buying before it signs. Accountants offer services for each of these, and the main difference between them is the level of assurance they give.

This topic covers review engagements under ISRE 2400 and ISRE 2410, the difference between attestation and direct reporting engagements, and due diligence. No written question in the two recent diets tests these directly, but the syllabus names them and a scenario can ask you to distinguish an audit from a review, list review procedures or advise on what a due diligence exercise should cover.

Audit and audit-related services

An audit enables the auditor to give an opinion on whether the financial statements give a true and fair view, with a high (but not absolute) level of assurance. Audit-related services give less assurance, and some give none.

The last two are covered in the next topic.

Types of review engagement

In a review engagement the practitioner reviews financial or other information but does not audit it. The work is less detailed than an audit, so the assurance is limited. The syllabus distinguishes two types.

• Attestation engagement. To attest is to affirm or vouch for something. The practitioner affirms that certain procedures within an entity have been performed in a prescribed way. The practitioner does not comment on how good the procedures are, only on the fact that they were performed.
• Direct reporting engagement. The practitioner gives a special report on some aspect of the client’s affairs, usually with limited or negative assurance, in line with the agreed terms. The report follows an independent examination of information prepared for use by another party. Due diligence is the commonest example.

ISRE 2400: review of historical financial statements

Objectives

The objectives are to obtain limited assurance, mainly by enquiry and analytical procedures, about whether the statements as a whole are free from material misstatement, so that the practitioner can say whether anything has come to attention that causes the practitioner to believe the statements are not prepared, in all material respects, in accordance with the applicable framework, and to report on the statements as a whole.

A review needs less evidence than an audit. Detailed substantive tests are not usually carried out. That usually means fewer staff, but more experienced ones.

General principles

The practitioner must:

• comply with the relevant code of ethics;
• plan and perform the work with professional scepticism, recognising that the statements may be materially misstated;
• obtain sufficient appropriate evidence, mainly through enquiry and analytical procedures; and
• use professional judgement.

The terms are agreed with the client in an engagement letter.

Procedures

Review procedures usually include:

1. setting materiality for the statements as a whole;
2. understanding the entity’s business and industry;
3. enquiries into accounting policies, practices and procedures, including how the statements are prepared, into the material assertions, into decisions taken at board and other meetings that may affect the statements, and into the completeness of the accounting records;
4. analytical procedures designed to identify unusual relationships and items, such as comparing with prior periods, comparing with expected results and position, and studying relationships that should follow a predictable pattern;
5. discussions with the company’s auditors;
6. written representations from management;
7. considering the appropriateness of accounting policies;
8. enquiries into subsequent events;
9. a review of the statements as a whole;
10. staying alert for related party relationships and transactions, and discussing them with management;
11. if fraud or non-compliance with laws and regulations is suspected, communicating it to management or those charged with governance, considering the effect on the statements, and deciding whether to report to an outside party; and
12. reviewing management’s assessment of going concern.

If the work suggests that a misstatement might exist, the practitioner extends the scope of the work.

Background: The revised ISRE 2400 applies to reviews of historical statements by a practitioner who is not the entity’s auditor, for periods ending on or after 31 December 2013. The auditor of the entity uses ISRE 2410 for interim information.

Reporting

The report takes one of two forms. If nothing has come to the practitioner’s attention, the report gives a clear limited assurance conclusion: based on our review, nothing has come to our attention that causes us to believe that the statements are not prepared, in all material respects, in accordance with the framework.

If matters have come to attention, indicating a material misstatement or a lack of sufficient appropriate evidence, the reporting follows International Standard on Auditing (ISA) 705. The practitioner:

• describes the matters;
• assesses whether they are material or pervasive; and
• distinguishes a material misstatement from a limitation on scope.

A qualified conclusion has a Basis for Qualified Conclusion section describing the matter, for example inventory shown at cost without a write-down to net realisable value, and a conclusion that says “except for the effects of the matter”.

ISRE 2410: review of interim financial information

Companies that must publish interim (for example half-year) statements do not have them audited. Their auditor reviews them under ISRE 2410. The same firm usually audits the year-end statements, so the same ethical and quality rules apply. The firm also agrees terms in an engagement letter, uses professional scepticism and keeps enough documentation.

Procedures

1. Understand the entity and its environment, including internal control, to assess the risk of misstatement and select the review procedures.
2. Make enquiries and perform analytical procedures sufficient to reach a conclusion on whether anything has come to attention that suggests the information is not prepared, in all material respects, in accordance with the framework.
3. If something comes to attention, make more enquiries or do other procedures.
4. Check that the information agrees or reconciles to the accounting records.
5. Find out whether management has considered subsequent events and assessed going concern.
6. Obtain written representations: management acknowledges its responsibility for internal control, the information is prepared in accordance with the framework, uncorrected misstatements are immaterial individually and together, and there has been full disclosure of significant facts, risk assessment, non-compliance with laws and subsequent events.
7. Check that other information issued with the interim information is materially consistent with it.

The report

The report has a title, an addressee, identification of the information reviewed with the dates and period, a statement that management is responsible for the information and that the auditor is responsible for a conclusion, a statement that the review followed ISRE 2410 and consisted of enquiries and analytical and other review procedures, a statement that a review is substantially less in scope than an audit and no audit opinion is expressed, the conclusion, the date, the location and the signature.

A qualified or adverse conclusion is given where the information is not prepared in accordance with the framework. If there is a limitation on scope, the auditor tells management and those charged with governance and considers whether a report can be issued. A going concern uncertainty is dealt with in the same way as under ISA 570.

Due diligence

Due diligence is any engagement in which a practitioner makes enquiries into the accounts, organisation or activities of an entity. It is mainly used in mergers and takeovers. The aim is to find out everything relevant about the target’s operations, financial performance, financial position and prospects, and about its business environment. The practitioner interviews senior management, other key employees and sometimes outside parties.

It does not include tests of controls, unless the client asks, or substantive tests. It is not audit work.

The main purpose is to help the client decide whether the takeover is desirable and whether the proposed price is reasonable. An adverse report can lead to the deal being dropped or the offer price being cut.

What the practitioner investigates

• Financial performance and position. The past few years’ statements with ratio analysis, management accounts, budgets, profit and cash flow forecasts and the business plan.
• Operational issues. Contracts with major customers and when they end, labour turnover, and warranty and guarantee costs.
• Management representations. For example, that the target is not subject to a tax investigation or litigation. The work tests whether they appear correct.
• Identification of assets. Internally generated intangibles such as patents, customer lists, databases and brands are not on the target’s statement of financial position but must be recognised at acquisition. They are identified and valued.
• Benefits and costs of the takeover. Synergies such as economies of scale, and one-off costs such as redundancy and reorganisation.

Why use an accountancy firm

Management could do the work, but a firm saves management time and has experienced staff. A professional review also reassures the buyer’s shareholders, and lenders who provide finance, that the deal has been properly evaluated.

The due diligence report

There is no set format. The content is agreed in advance and recorded in the engagement letter. It usually has an introduction or executive summary that highlights areas of concern, a main section and appendices.

The main section can include analysis of audited statements for several years, past audit issues, legal issues such as potential litigation, corporate governance, a strengths, weaknesses, opportunities and threats (SWOT) analysis, financial obligations such as loans and leases, key suppliers and customers, employment matters such as pensions and redundancy obligations, and key employees. The appendices hold the supporting documents.

The rules in more depth

Limited assurance and negative form

A negative conclusion does not say the statements are correct. It says that the work done found nothing to suggest otherwise. The risk is higher than in an audit, so the user gets less comfort. That is why the report says in terms that the review is less in scope than an audit and no audit opinion is expressed.

Independence and the same firm

An auditor can review interim information and audit the year-end statements. A firm that does due diligence for an audit client must watch for self-review and advocacy threats, especially if it is also giving advice on the deal. The independence topics earlier in this course apply.

Direct reporting

A direct reporting engagement need not be on financial statements. The practitioner can report on systems, performance measures or compliance. The topics on assurance engagements later in the course deal with the International Standard on Assurance Engagements (ISAE) 3000 framework for these.

Worked example: an interim review and a takeover

Analytical review. Mara Foods Plc’s half-year revenue is ₦4,800 million (prior year ₦4,000 million), cost of sales is ₦3,840 million (prior year ₦2,800 million) and receivables are ₦1,900 million (prior year ₦900 million). Revenue rose by 20%. Cost of sales rose by (₦3,840 million − ₦2,800 million) ÷ ₦2,800 million = 37%. The gross margin fell from (₦4,000 million − ₦2,800 million) ÷ ₦4,000 million = 30% to (₦4,800 million − ₦3,840 million) ÷ ₦4,800 million = 20%. Receivables more than doubled, which is an increase of 111%, against a rise in revenue of 20%.

The reviewer enquires into price cuts, input costs, inventory valuation and credit terms, and into whether revenue has been recognised early. The reviewer extends the work if the explanations do not fit.

Due diligence. Bidder Plc offers ₦900 million for Target Ltd, which makes profit after tax of ₦100 million (nine times earnings). The work finds that a customer worth 35% of the target’s revenue has a contract that ends in six months, that an unrecorded tax assessment of ₦40 million is under dispute, and that the target owns a customer database that is not in its statement of financial position.

The report recommends that Bidder reduces the price by at least the ₦40 million tax exposure to ₦860 million, seeks a warranty or retention for the dispute and links part of the price to the renewal of the contract. It also recommends that the database is valued for the consolidated statements.

How to score full marks

• Name the level of assurance. Limited for a review, none for agreed-upon procedures and compilations, high for an audit.
• Use the negative form in the conclusion. “Nothing has come to our attention” is the phrase examiners look for.
• Say that a review rests on enquiry and analytical procedures. Not on substantive tests.
• For due diligence, say what it is for. To help the buyer decide whether to proceed and at what price, and say it is not an audit.
• Apply the headings to the target. Use the case facts in each of the five areas.

Common mistakes in the exam

• Giving a positive opinion in a review report.
• Listing substantive tests as review procedures.
• Saying a review is the same work as an audit with a smaller sample.
• Describing due diligence as an audit of the target.
• Forgetting the unrecorded intangible assets in a takeover.
• Forgetting to mention the engagement letter.

Quick revision

• Audit: high assurance, positive opinion. Review: limited assurance, negative form, enquiry and analytical procedures.
• Attestation: affirm that procedures were performed. Direct reporting: report on an examination, for example due diligence.
• ISRE 2400: historical statements. ISRE 2410: interim information reviewed by the auditor.
• Report: describe matters, material or pervasive, misstatement or scope limitation.
• Due diligence: performance and position, operations, representations, assets, costs and benefits.
• Report can lead to dropping the deal or cutting the price.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.