Accounting

Taking audit into account

Governors must find ways of benefiting from the implementation of best practice in their school governance while limiting the cost impact of the new International Auditing Standards. Sandra De Lord explains how

Many independent schools will now be facing their first annual audit under the requirements of International Standards on Auditing (UK and Ireland) (ISAs). These standards have brought a shift in emphasis in particular aspects of auditors’ work, which have implications for the way audits are conducted and also for the cost of the audit process.

The Auditing Practices Board introduced thirty ISAs (UK and Ireland) to replace the existing UK auditing standards (SASs) for accounting periods commencing on or after 15 December 2004. Of these, the three which have impacted most on the audit approach are:

• ISA (UK and Ireland) 315 Obtaining an Understanding of the Entity and its Environment and Assessing the Risks of Material Misstatement;
• ISA (UK and Ireland) 330 The Auditor’s Procedures in Response to Assessed Risks; and
• ISA (UK and Ireland) 240 The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements. Each of these standards is explored in detail below.

Understanding the entity
Your auditors will need to review thoroughly the regulatory environment in which the school operates and the terms of its governing document. This includes risks associated with: particular types of activities, funding sources, geographical location, organisational structure, and lines of control and reporting, all need to be addressed when considering whether any aspects of the school’s operations are likely to give rise to significant errors.

“For schools there could be risks in the control and management of bursary income and endowed funds.”

Internal controls must be evaluated to ensure that they are capable of preventing or detecting and correcting material errors. It is also important to establish how the governing board manages the organisation by considering, for example, the level of skills represented on the board, procedures at board meetings, the delegation of particular powers and the school’s own internal processes for risk assessment and management.

Governors and management of the school can therefore expect to spend time discussing these operational and control issues with their auditors, particularly at the planning stage of the audit. The same level of understanding is required for all audits regardless of size and is likely to require a more in-depth review than in previous years.

Assessing the risks
Auditors are required to document the controls and their assessment of them in their audit files. As part of the risk assessment, auditors must highlight any risks that are considered to have special audit consideration. These are classed as “significant risks”. Whereas in the past a substantive approach to audit testing meant that controls which were not to be relied on were often not tested in any detail, the ISA (UK and Ireland) 315 requires review, and testing in operation, of all controls in place which address significant risks. Auditors are required to evaluate the design of the control related to the identified risk and to report to the trustees where controls are absent.

As part of their own risk assessment process, trustees should be aware of key risks. Completeness of income is generally a key consideration for most charities, but for schools there could be additional risks in the control and management of bursary income and endowed funds.

Trustees are also responsible for the safe custody of the school’s assets, so controls over title to assets, adequate maintenance of buildings and insurance cover could be areas of particular importance. External factors which might pose a risk could include the impact of falling student rolls and damage to reputation through adverse publicity.

Audit procedures in response to risk
ISA (UK and Ireland) 330 sets out the procedures that auditors must follow, having carried out a detailed assessment of inherent and control risks, to design appropriate levels of audit testing for a particular assignment.

The audit approach and the rationale for the type and extent of testing involved must be carefully thought out and documented. Where risks are significant, the auditor cannot rely on audit evidence obtained from a prior period’s audit. Auditors are also required to introduce an element of unpredictability into their audit testing so that audit tests cannot just be repeated without thought on an annual basis. Inevitably, the set-up and design of audit work programmes will take longer than may previously have been the case.

Consideration of fraud
The governors have ultimate responsibility for the prevention and detection of fraud. ISA (UK and Ireland) 240 requires the auditor to obtain an understanding of the charity’s processes for identifying and responding to fraud and the internal controls implemented to mitigate risk. Auditors are encouraged to adopt an attitude of professional scepticism in their consideration of the likelihood of fraud and to include consideration of the risk of management override of controls.

In considering areas with potential for management override, auditors are now specifically required to test for the risk of manipulation of the accounts and records through improper journal entries processed between the nominal ledger and the financial statements, the inclusion of biased accounting estimates and transactions outside the school’s normal business. Governors, who are often remote form the day-to-day activities, should be aware of the need to implement adequate controls over this type of risk.

“Areas of concern include the potential for misuse of school funds where staff have unlimited or unauthorised access to credit cards for purchases.”

Finance governors are now required to provide formal representations to their auditors of their own assessment of the risk that the financial statements may be materially misstated as a result of fraud. It is important for them to review the potential for fraud and its control as an important part of the risk appraisal process. Areas of concern might include the potential for misuse of school funds where staff have unlimited or unauthorised access to credit cards for purchases on behalf of the school. The collection, safe custody and proper recording of monies collected for school trips also needs careful consideration, as does the controls of funds raised through appeals for new school buildings, such as a sports hall or theatre.

Where the governors have already considered and established appropriate systems to cope with the risk of fraud, the auditors’ work associated with assessing the systems will be made easier and the extent of fraudrelated testing may be reduced.

How to improve procedures and processes
So how can the benefits of good governance improve not only the management of the school but also the audit process? As a matter of best practice, governors should regularly review activities and the operating environment. They should be confident that internal controls are adequate to support the operations, are properly documented and operate in practice in accordance with the documented guidance.

Particular care should be taken to identify and consider the risks relevant to the charity and its operating environment, including the risk of fraud. This should be linked to the design of controls and procedures to mitigate risks. It is also vital that governors are fully conversant with their governing document and in particular any restrictions that might arise on operating within given objects or investment and borrowing powers.

It is essential that managers and governors of schools demonstrate to their auditors how good governance has already been addressed and implemented. Presenting documented and practical evidence of proper control will allow your auditors, wherever possible, to reduce the time and cost impact of meeting the ISA requirements.

Expect to be involved in discussions at the planning stage of the audit and to receive more formal communication than in previous years, of matters such as an outline of the audit approach, and a management letter at the end of the audit addressing issues around internal control and fraud.

Sandra De Lord is a partner with Kingston Smith LLP.

Return to Accounting