Practice review - Audits
Q1. What are the key elements of the Institute’s practice review programme?
The Institute’s practice review programme consists of two elements: audit quality assurance reviews and Anti-Money Laundering and Counter-Terrorist Financing (“AML/CTF”) Compliance Monitoring Reviews (“ACMR”).
The audit quality assurance reviews determine whether practices have observed, maintained or applied the professional standards, including all the statements and guidelines of professional ethics, financial reporting standards and standards on auditing and assurance. Prior to October 2018, the Institute’s practice reviews covered solely these reviews.
The ACMR programme, launched in October 2018, monitors the level of compliance of the Institute’s practice units with the Guidelines on AML/CTF for Professional Accountants (“AML Guidelines”) included as part of the Institute’s Code of Ethics. The programme was introduced after the amended Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (“AMLO”) extended the coverage of the legislation to accounting professionals and other designated non-financial businesses and professions.
Q2. How are practices selected for practice review?
The Institute applies a mixed risk-based-cycle approach for selection of practices for reviews. Within that approach, the Institute has a goal to review all active practices at least every 6 years. Selection of practices for review is based on their risk profiles, developed using information obtained from the practice review self-assessment questionnaire and other relevant sources.
In addition, for the purpose of the audit quality assurance reviews, consideration is also given to the following additional factors in practice selection:
Size – based on the number of non-public interest entity audit and assurance clients (“non-PIE AA clients”) and practising partners or directors
Complexity – based on the number of regulated non-PIE AA clients.
Non-PIE AA clients are AA clients whose engagements fall outside the definition of public interest entity (“PIE”) engagements specified in the Financial Reporting Council (Amendment) Ordinance (“FRC(A)O”). They include primarily private entity clients. Non-PIE AA clients in the following categories are considered regulated non-PIE AA clients:
Practices without AA clients will be subject to an ACMR. For the purpose of separate ACMR reviews, priority is given to practices that have prepared for or carried out for clients transactions specified in paragraphs 600.2.1 and 600.2.2 of the AML Guidelines (“Specified Transactions’) in practice selection.
Q3. Will practising certificate holders practising in his or her own name be selected for practice review?
Yes. All practices including firms, corporate practices and practising certificate holders are subject to practice review unless they are inactive.
Q4. Will practices be subject to practice review if they have not performed audit or assurance work?
Yes. Practices that are not performing audit and assurance work are still subject to an ACMR.
Q5. How often will practices be subject to practice review?
The Institute has a goal to review all active practices at least every 6 years to improve the effectiveness of its practice review system and to benchmark to the review cycles used by many regulators worldwide. However, the frequency of practice reviews of practices with AA clients will be shortened based on the size and complexity of practices. All active practices with AA clients are separated into categories and will be subject to practice reviews by the Institute according to the following review frequencies:
Practices
Frequency of review
Standard
With 500 or fewer non-PIE AA clients and with 10 or fewer regulated non-PIE AA clients
6 year cycle (ultimately when achievable based on resources available)
Tier 1
With more than (i) 500 non-PIE AA clients or (ii) 10 regulated non-PIE AA clients
3 year cycle
Tier 2
With more than (i) 1,000 non-PIE AA clients and (ii) 10 regulated non-PIE AA clients
1.5 year cycle
Tier 3
With more than (i) 1,000 non-PIE AA clients; (ii) 20 regulated non-PIE AA clients and (iii) 50 practising partners or directors
Annually
The frequency of separate AMCRs of practices without AA clients will be shortened if a large proportion of their activities involve Specified Transactions.
As well as the above factors, other practice-specific information will be considered when determining the review frequency of individual practices. These factors include:
Previous regulatory history – based on past practice review results and regulatory actions taken by the Institute and other regulators Other risk factors identified through the Institute’s regulatory system A small number of reviews randomly selected every year
Q6. What is audit regulatory reform and how is its impact on practice review?
On 1 October 2019 the Financial Reporting Council (Amendments) Ordinance took effect, giving the Financial Reporting Council (“FRC”) more powers to regulate auditors of listed companies in Hong Kong. The FRC has taken on the responsibilities for inspections of PIE engagements, as defined in the ordinance, completed by PIE auditors on or after 1 October 2019. Those PIE engagements include annual audits, specified reports and accountants’ reports on a listed or “seeking to be listed” corporation or collective investment scheme. All non-PIE engagements, as well as those PIE engagements falling outside the definition in the ordinance, which are carried out by a practice registered with the Institute still remain under the remit of the Institute’s practice review programme. These activities include statutory audits and compliance reports on subsidiaries and regulated entities within a listed group.
The Institute continues to cover all active practices under its practice review programme but its remit changed to the regulation of non-PIE engagements and ACMR. The Institute may also still select PIE engagements completed prior to 1 October 2019 for practice review.
Q7. How do reviewers conduct review work during the site visit?
For an audit quality assurance review, reviewers will obtain an understanding of the practice’s system of quality control, assess compliance with Hong Kong Standard on Quality Control (HKSQC) 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements and the practice’s policies and procedures, and review completed audit engagements.
For an ACMR, reviewers will obtain an understanding of the practice’s relevant AML/CTF policies and procedures and inspect documentary evidence to assess level of compliance with the AML Guidelines and relevant laws and regulations.
The extent of review work that reviewers will carry out varies from practice to practice depending on the size of the practice, the nature of the practice’s client base and the extent of Specified Transactions undertaken by the practice (if any). The reviewers will discuss and agree findings identified in a practice review with partners or directors of the practices.
Q8. How long is a practice review site visit?
Depending on the size of the practice, the practice review site visit could last for a few days or several weeks.
Q9. Can my practice request a change of the site visit date, which was specified in the practice review notification letter?
The site visit will normally be scheduled for six weeks after the formal notification. You should notify the Institute’s Quality Assurance Department (“QAD”) immediately if you are unable to accommodate the review team on the selected visit dates. The QAD will try to accommodate requests for changes to visit dates with valid reasons and evidence of proof. Date change requests without valid reasons and evidence of proof will not be accommodated as the QAD have to ensure that review activities can be carried out throughout the year.
Q10. When will the practice be informed of the engagements selected for practice review?
As a general policy, the Quality Assurance Department will inform the practice of the engagements selected for practice review 7 working days prior to the commencement of the practice review site visit. The 7 working day notification period is conditional on the Quality Assurance Department receiving a client list from the practice no less than 3 weeks before the scheduled visit.
Q11. How can I contact the Institute’s Quality Assurance Department?
