On audit update courses that Insight Training have run during the Autumn, there has been much discussion about bank confirmations. The withdrawal of the FRC’s Practice Note 16 will lead to more flexibility of audit approach in this area. But the Patisserie Valerie case, where £20M of borrowings materialised that no-one was aware of, will perhaps cause auditors to think twice before radically changing their approach. Here are the most commonly discussed issues:
Can an auditor ever be confident about bank confirmations?
Based on the fact that the company has to provide details of its bankers for the purpose of the confirmation, possibly not. If directors want to engage in banking activities that a company’s auditors are not made aware of, surely they will use institutions other than the ones the auditor is circularising?!
One would have expected Patisserie Valerie’s bankers to require director approval before advancing loans. It remains to be seen what checks and balances the company and its banks had in place to prevent CFO Christopher Marsh negotiating two separate £10m loans with the café’s lenders without these being reported to the board – and whether the auditors identified and responded to any deficiency in internal controls in this area.
Isn’t the bank confirmation process fundamentally flawed anyhow?
Some feel it is. Some years ago, the process changed requiring companies to provide banks with details of the main account. Since then it seems that many auditors have been regularly chasing banks to correct erroneous confirmation certificates – asking them to add information which they know is missing.
What about Confirmation.com?
This is an online audit confirmation process. Although client authorisation is required, and a main account number must be provided, Confirmation.com’s consolidated confirmation process involves a full automated search across multiple bank departments and systems. The bank will confirm all balances and arrangements in respect of that entity.
Confirmation.com’s proposition is based on a fully automated system. This, the company feels, is particularly important in view of a number of high-profile confirmation frauds over the last decade.
In view of the notoriously slow current manual system, Confirmation.com’s promise of an average turnaround time of two days is also appealing – even if this a paid for system. Indications are that larger audit firms rely heavily on Confirmation.com, but it appears (somewhat inexplicably) to have been slower to take off with smaller audit firms.
If bank confirmations are abandoned, what other alternatives are there?
Guidance coming out of ICAEW is steering audit firms away from relying on client-provided copies of bank statements as these can be very easily fabricated – especially as they are increasingly likely to be no more than printouts from the on-line banking system.
In the event of an external bank confirmation not being sought, an alternative approach would be to observe a client logging onto the on-line banking system in order to demonstrate the company’s various accounts and the balances to the auditor.
Fraud can be a big risk here also. For a matter of a few hundred dollars, a resolute fraudster can create a very plausible – but fake – online banking platform which might easily hoodwink an auditor. Recent ICAEW advice has been to make sure that, if you adopt this approach, you make a client navigate away from the on-line banking platform and then back to demonstrate that the platform is legitimate.
Out with the old then?
Views on Insight Training courses and workshops have been mixed. In very simple, low-risk situations firms may well use the withdrawal of Practice Note 16 as an opportunity to move away from the current approach.
Where banking arrangements are more diverse, complicated and unfamiliar to auditors – or where it is felt that the current process will confirm other useful information (e.g. information about security or trade finance) – it may make more sense to stick with the more traditional approach, however imperfect it may seem.
Many also feel that the Patisserie Valerie saga will cause auditors to be more inclined to continue to seek traditional external balance confirmations. If bank balances go missing in the absence of formal confirmations, might auditors be accused of being negligent? In that event maybe a ‘belt and braces’ approach makes more sense to some.
When do the relaxed rules apply from?
Practice Note 16 is withdrawn for accounting periods beginning on or after 15 December 2017 (so 31 December 2018 year ends, ignoring short accounting periods). However, early adoption is allowed such that auditors can be taking advantage of the relaxed rules with immediate effect.
However, don’t forget that auditors should dispense with bank confirmations based on their assessment of risk. One firm recently mentioned, during an in-house seminar, that they send confirmations out early in the audit process, long before they plan and assess risk. On that basis such change to their current approach just doesn’t make sense.
Watch this space!
It will be very interesting to follow the FRC’s investigation into the audit of Patisserie Valerie, conducted by Grant Thornton UK LLP, and into the preparation and approval of Patisserie Holdings PLC’s financial statements and other financial information by the former CFO, Christopher Marsh. This might provide further interesting insights into the future of the humble bank confirmation!
Peter Herbert
Insight Training
November 2018
