The Institute’s practice review programme consists of two elements: audit quality assurance reviews and Anti-Money Laundering and Counter-Terrorist Financing (“AML/CTF”) Compliance Monitoring Reviews (“ACMR”).
The audit quality assurance reviews determine whether practices have observed, maintained or applied the professional standards, including all the statements and guidelines of professional ethics, financial reporting standards and standards on auditing and assurance. Prior to October 2018, the Institute’s practice reviews covered solely these reviews.
The ACMR programme, launched in October 2018, monitors the level of compliance of the Institute’s practice units with the Guidelines on AML/CTF for Professional Accountants (“AML Guidelines”) included as part of the Institute’s Code of Ethics. The programme was introduced after the amended Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (“AMLO”) extended the coverage of the legislation to accounting professionals and other designated non-financial businesses and professions.
The Institute applies a mixed risk-based-cycle approach for selection of practices for reviews. Within that approach, the Institute has a goal to review all active practices at least every 6 years. Selection of practices for review is based on their risk profiles, developed using information obtained from the practice review self-assessment questionnaire and other relevant sources.
In addition, for the purpose of the audit quality assurance reviews, consideration is also given to the following additional factors in practice selection:
Non-PIE AA clients are AA clients whose engagements fall outside the definition of public interest entity (“PIE”) engagements specified in the Financial Reporting Council (Amendment) Ordinance (“FRC(A)O”). They include primarily private entity clients. Non-PIE AA clients in the following categories are considered regulated non-PIE AA clients: a. “authorized institutions” as defined under the Banking Ordinance b. “insurers” as defined under the Insurance Ordinance c. “insurance brokers” as defined under the Insurance Ordinance d. “licensed corporations” and “associated entities” as defined under the Securities and Futures Ordinance For every audit quality assurance review carried out on a practice with AA clients, a practice review will include both an audit quality assurance review and an ACMR. For more details about the frequency of reviews of practices with AA clients, please refer to question 5 below.
Practices without AA clients will be subject to an ACMR. For the purpose of separate ACMR reviews, priority is given to practices that have prepared for or carried out for clients transactions specified in paragraphs 600.2.1 and 600.2.2 of the AML Guidelines (“Specified Transactions’) in practice selection.
The Institute has a goal to review all active practices at least every 6 years to improve the effectiveness of its practice review system and to benchmark to the review cycles used by many regulators worldwide. However, the frequency of practice reviews of practices with AA clients will be shortened based on the size and complexity of practices. All active practices with AA clients are separated into categories and will be subject to practice reviews by the Institute according to the following review frequencies:
Practices
Frequency of review
Standard
With 500 or fewer non-PIE AA clients and with 10 or fewer regulated non-PIE AA clients
6 year cycle (ultimately when achievable based on resources available)
Tier 1
With more than (i) 500 non-PIE AA clients or (ii) 10 regulated non-PIE AA clients
3 year cycle
Tier 2
With more than (i) 1,000 non-PIE AA clients and (ii) 10 regulated non-PIE AA clients
1.5 year cycle
Tier 3
With more than (i) 1,000 non-PIE AA clients; (ii) 20 regulated non-PIE AA clients and (iii) 50 practising partners or directors
Annually
The frequency of separate AMCRs of practices without AA clients will be shortened if a large proportion of their activities involve Specified Transactions.
As well as the above factors, other practice-specific information will be considered when determining the review frequency of individual practices. These factors include:
On 1 October 2019 the Financial Reporting Council (Amendments) Ordinance took effect, giving the Financial Reporting Council (“FRC”) more powers to regulate auditors of listed companies in Hong Kong. The FRC has taken on the responsibilities for inspections of PIE engagements, as defined in the ordinance, completed by PIE auditors on or after 1 October 2019. Those PIE engagements include annual audits, specified reports and accountants’ reports on a listed or “seeking to be listed” corporation or collective investment scheme. All non-PIE engagements, as well as those PIE engagements falling outside the definition in the ordinance, which are carried out by a practice registered with the Institute still remain under the remit of the Institute’s practice review programme. These activities include statutory audits and compliance reports on subsidiaries and regulated entities within a listed group.
The Institute continues to cover all active practices under its practice review programme but its remit changed to the regulation of non-PIE engagements and ACMR. The Institute may also still select PIE engagements completed prior to 1 October 2019 for practice review.
For an audit quality assurance review, reviewers will obtain an understanding of the practice’s system of quality control, assess compliance with Hong Kong Standard on Quality Control (HKSQC) 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements and the practice’s policies and procedures, and review completed audit engagements.
For an ACMR, reviewers will obtain an understanding of the practice’s relevant AML/CTF policies and procedures and inspect documentary evidence to assess level of compliance with the AML Guidelines and relevant laws and regulations.
The extent of review work that reviewers will carry out varies from practice to practice depending on the size of the practice, the nature of the practice’s client base and the extent of Specified Transactions undertaken by the practice (if any). The reviewers will discuss and agree findings identified in a practice review with partners or directors of the practices.
Depending on the size of the practice, the practice review site visit could last for a few days or several weeks.
