House of Representatives

Explanatory Memorandum

(Circulated by the authority of the Parliamentary Secretary to the Treasurer, the Hon David Bradbury MP)

Audit deficiency notifications and reports

Outline of chapter

4.1 Part 2 of Schedule 2 to the Bill contains the amendments to the ASIC Act relating to audit deficiency notifications and reports.

4.2 ASIC is the key regulator under the Corporations Act and has responsibility for the surveillance, investigation and enforcement of the financial reporting requirements of the Corporations Act, including the enforcement of auditor independence and audit quality requirements. The scope of ASIC's audit inspection powers was enhanced by the Australian Securities and Investments Commission Amendment (Audit Inspection) Act 2007 . The amendments introduced by this Act ensured that ASIC's audit inspection and information gathering powers were brought into line with corresponding powers granted to key overseas audit regulators.

4.3 The objective of ASIC's audit inspection program is to promote high quality external audits of financial reports of listed and other public interest entities in Australia so that users can have greater confidence in financial reports. ASIC publishes its generic public inspection reports periodically to better inform all firms, the investing public, companies, audit committees and other interested stakeholders of findings and areas of focus.

4.4 After each inspection, ASIC issues the firm with a confidential inspection report and the firm responds as to how it will deal with the issues which ASIC has identified. ASIC then revisits the firm, generally after around 12 months, to gauge the extent to which the firm has taken remedial action.

4.5 Although there is no legal obligation to report publicly, ASIC's usual practice is to publish on the ASIC website, a public report which sets out key themes and issues identified by ASIC's audit inspection program during the preceding inspection period (which may be up to 15 months). These public reports are prepared on an aggregated basis across firms and are intended to inform stakeholders of systemic themes and issues with the objective of contributing to better audit quality by all firms. These public reports do not attribute specific matters to any firm or audit client of a firm. Section 127 of the ASIC Act prevents ASIC from issuing public individual firm reports without the consent of the audit firm concerned.

4.6 During the course of the preparation of Treasury's audit quality paper, ASIC informed Treasury that in a number of important overseas jurisdictions, the independent audit regulator is permitted to make public disclosure about defects in an individual audit firm's quality control systems, subject to appropriate natural justice protections.

4.7 In the US, the PCAOB is required by the Sarbanes Oxley Act to produce public inspection reports, although portions of the complete report are omitted to comply with confidentiality requirements in the Act. The Sarbanes Oxley Act provides a framework for a remedial process whereby firms have 12 months to remedy defects in their quality control systems to prevent these defects being made public.

4.8 In the UK, the Audit Inspection Unit, part of the UKFRC's Professional Oversight Board, issues a confidential report to the audit firm inspected. In addition to the confidential report, the Audit Inspection Unit publishes both an annual overview report on its audit inspection activities and a high level public report on the inspection of an individual audit firm, detailing findings from reviews of individual audits (without client names) concerning failures to comply with auditing standards or good practice. Criticism (if relevant) of the audit firm's quality control policies and procedures is also made public. Specific reports are also issued to engagement partners of deficiencies in the file reviewed with an expectation that this is shared with the relevant client audit committee or board of directors.

4.9 In Canada, the Canadian Public Accountability Board (CPAB), produces private reports of findings and recommendations to the individual firms inspected. Failure to implement one or more recommendations to CPAB's satisfaction within a prescribed timeframe (generally six months) may result in CPAB making public the relevant portions of the inspection report.

4.10 Treasury discussed the various options for ASIC public reporting on individual audit firms with stakeholders during the consultation process on Treasury's audit quality paper. A majority of stakeholders supported a reporting model along the lines of the more restrictive Canadian approach. This approach would allow ASIC to issue a public report on an individual audit firm only after the firm had failed to take remedial action to address an audit defect identified by ASIC within a prescribed time frame. The following reasons were advanced in favour of this reporting model:

•

it should be a significant driver of audit quality because it would provide a strong incentive for an audit firm to take remedial action to address an audit deficiency identified by ASIC in order to avoid the publication of an adverse public report by ASIC;

•

this reporting model would be able to operate in a timely manner;

•

it should not impose any significant additional financial/resource burdens on either ASIC or the audit firms; and

•

the model could incorporate adequate time for remediation processes by an audit firm.

4.11 The amendments in Schedule 2, Part 2 of the Bill have adopted the more restrictive approach under the Canadian public reporting model. ASIC is given the power to issue an audit deficiency report in relation to specified failures by the audit firm that ASIC has identified during the exercise of its statutory audit functions and reasonably believes indicates a significant weakness in either the Australian auditor's quality control system or the conduct of the audit, and may be detrimental to the overall quality of the audit. A specified failure is:

•

a failure by the auditor to comply with the auditing standards;

•

a failure by the auditor to comply with the auditor independence requirements in the Corporations Act;

•

a failure by the auditor to comply with any applicable code of professional conduct; or

•

a failure by the auditor to comply with the provisions of the Corporations Act dealing with the conduct of audits.

4.12 ASIC is required to notify the auditor of the identified audit deficiency and to set out any remedial action that ASIC thinks necessary to remedy the deficiency. ASIC must also invite the auditor to make written submissions to ASIC, within six months, about the deficiency and any remedial action taken or proposed to be taken to remedy the deficiency.

4.13 At any time after the end of the six month period, ASIC may prepare an audit deficiency report if ASIC is satisfied that the Australian auditor has not taken appropriate remedial action to remedy the identified audit deficiency. Before preparing the report, ASIC must take into account any submissions received from the auditor and whether or not the auditor has taken any remedial action to remedy the deficiency.

4.14 ASIC may, if it considers it appropriate to do so, publish the report on the ASIC website. ASIC must give a copy of the audit deficiency report to the Australian auditor before publishing the report on its website and invite the Australian auditor to give ASIC comments on the report within 21 days. A copy of the comments received from the Australian auditor must be published in a separate part of the report.

Context of amendments

4.15 The underlying policy rationale for ASIC public reporting on individual audit firm deficiencies is to improve confidence in the capital markets through increased transparency in the audit process. Furthermore, where the reporting model provides the opportunity for an audit firm to correct weaknesses identified in the private confidential report, coupled with the possibility of public disclosure for any failure to take remedial action, it provides a strong incentive for an audit firm to make prompt improvements in overall audit quality.

Summary of new law

4.16 ASIC is given the power to publish an audit deficiency report in relation to specified audit failures by an Australian auditor that have been identified by ASIC. ASIC is required to notify the auditor of the audit deficiency, set out any remedial action that ASIC thinks necessary and ASIC must invite the auditor to make written submissions to ASIC, within six months about any remedial action that the auditor proposes to undertake. ASIC is required to publish comments received from the Australian auditor on the report in a separate part of the report.

Comparison of key features of new law and current law

Detailed explanation of new law

4.17 An audit deficiency in relation to an audit conducted by an Australian auditor is where ASIC reasonably believes that there is a significant weakness in the Australian auditor's quality control system or a significant weakness in the conduct of the audit that may be detrimental to the overall quality of the audit, as a result of:

•

a failure by the auditor to comply with the auditing standards;

•

a failure by the auditor to comply with the auditor independence requirements in the Corporations Act;

•

a failure by the auditor to comply with any applicable code of professional conduct;

•

a failure by the auditor to comply with the provisions of the Corporations Act dealing with the conduct of audits.[ Schedule 2, Part 2, item 16, subsection50A(1 )]

4.18 The new measures apply in circumstances where ASIC identifies an audit deficiency while exercising any of the following functions or powers in relation to audit:

•

in relation to audit-related matters (Corporations Act audit requirements) under Chapter 2M, Chapter 5C, Part 7.8, or Part 9.2 or 9.2A of the Corporations Act or under other provisions of that Act that relate to that Chapter or that Part;

•

for the purposes of ascertaining compliance with Corporations Act audit requirements;

•

in relation to:

-

an alleged or suspected contravention of Corporations Act audit requirements;

-

an alleged or suspected contravention of a law of the Commonwealth, or of a State or Territory in this jurisdiction, being a contravention that relates to an audit matter and that either concerns the management or affairs of a body corporate or involves fraud or dishonesty and relates to a body corporate; and

•

for the purposes of an investigation under Division 1 of Part 2 of the ASIC Act relating to a contravention referred to in the preceding paragraph. [ Schedule 2, Part 2, item 16, subsections 50A(1 ) and ( 2 )]

4.19 ASIC may, in writing, notify the Australian auditor of the identified audit deficiency. The notice must set out:

•

the identified audit deficiency;

•

any remedial action that ASIC thinks necessary to remedy the deficiency; and

•

such other matters in relation to the deficiency as ASIC thinks fit.

4.20 The notice must also invite the auditor to make written submissions to ASIC, within six months, about the deficiency and any remedial action taken, or proposed to be taken, to remedy the deficiency. [ Schedule 2, Part 2, item 16, section 50B ]

4.21 ASIC may prepare an audit deficiency report, at any time after the six month period, if ASIC is satisfied that the Australian auditor has not taken appropriate remedial action to remedy the identified audit deficiency. [ Schedule 2, Part 2, item 16, subsection 50C(1 )]

4.22 The report must set out:

•

the identified audit deficiency;

•

the remedial action that ASIC thinks necessary to remedy the deficiency;

•

if the auditor has taken remedial action to remedy the deficiency, details of the remedial action;

•

if the auditor has not taken remedial action, the fact of the failure to take any action; and

•

such other matters in relation to the deficiency as ASIC thinks fit. [ Schedule 2, Part 2, item 16, subsection 50C(2 )]

4.23 Before preparing an audit deficiency report, ASIC is required to take into account:

•

any submissions received from the auditor in response to ASIC's invitation under paragraph 50B(2)(b); and

•

whether or not the auditor has taken any remedial action to remedy the deficiency. [ Schedule 2, Part 2, item 16, subsection 50C(3 )]

4.24 Subsection 50C(4) provides that an audit deficiency report is not a legislative instrument. Subsection 50C(4) is included to assist readers of the Bill, as the instrument is not a legislative instrument within the meaning of section 5 of the Legislative Instruments Act 2003 . This provision is not a substantive exemption from the Legislative Instruments Act 2003 and is merely declaratory of the law. [ Schedule 2, Part 2, item 16, subsection 50C(4 )]

4.25 ASIC may, if it considers it appropriate, publish the audit deficiency report on its website provided it complies with the following requirements:

•

if the audit to which the report relates was conducted by an audit firm or audit company, ASIC may disclose identifying particulars of the audit firm or audit company but must not disclose identifying particulars of any professional member of the audit team involved in the audit;

•

if the audit to which the report relates was conducted by an individual auditor who did not act on behalf of an audit firm or audit company, ASIC may disclose identifying particulars of the auditor but must not disclose identifying particulars of any other professional member of the audit team involved in the audit; and

•

ASIC must not disclose identifying particulars of the audited body. [ Schedule 2, Part 2, item 16, section 50D ]

4.26 No provision has been made for a review by the Administrative Appeals Tribunal (AAT) of ASIC's decision to publish an audit deficiency report. The audit deficiency report measures are aimed at the very few audit firms that may fail or refuse to cooperate with ASIC in relation to taking remedial action to address concerns identified by ASIC. The great majority of audit firms willingly cooperate with ASIC and see ASIC's activities as contributing positively to improving the quality of the audits that the firms undertake. The threat of publication of an adverse report is a powerful incentive for the few recalcitrant audit firms to take remedial action to remedy any audit deficiencies identified by ASIC.

4.27 The likely delay before an AAT review could be completed, together with the six month period already provided for the audit firm under section 50B to make submissions to ASIC and to take remedial action, would effectively defeat the purpose of the audit deficiency report measures. Furthermore, the audit firm is also given the opportunity to comment on any proposed deficiency report as ASIC is required to give the audit firm a copy of the report at least seven days prior to publication.

4.28 Before ASIC publishes an audit deficiency report on its website, it must give a copy of the report to the Australian auditor to which it relates and invite the Australian auditor to give ASIC comments on the report within 21 days. Comments on the report received from the Australian auditor must be published in a separate part of the report. [ Schedule 2, Part 2, item 15, section 50E ]

Application and transitional provisions

4.29 The new measures introduced in relation to audit deficiencies identified by ASIC apply to audit deficiencies identified by ASIC after the commencement of these provisions on Royal Assent. [ Schedule 2, Part 4, item18, subsection 294(1 )]

Consequential amendments

4.30 A definition of an audit deficiency report is included in subsection 5(1) of the ASIC Act and has been given the meaning as described in subsection 50C(1). [ Schedule 2, Part 2, item 15, subsection 5(1 )]