CSA Consultation Paper 52-403 - Auditor Oversight Issues in Foreign Jurisdictions

CSA Consultation Paper 52-403

Auditor Oversight
Issues in Foreign Jurisdictions

April 25, 2017

I. Introduction

The Canadian Securities Administrators (CSA or we) are publishing this consultation paper (the Paper) for a 60-day comment period to invite stakeholders to provide views on the desirability and feasibility of introducing requirements for oversight of work done by a foreign audit firm relating to the audit of a reporting issuer's financial statements.

This Paper describes a proposal from the Canadian Public Accountability Board (CPAB) to the CSA to amend National Instrument 52-108 Auditor Oversight (NI 52-108) to require certain audit firms involved in the audit of a reporting issuer's financial statements to register as a participating audit firm (PAF). This Paper also describes potential disclosure enhancements to inform stakeholders about any restrictions CPAB has faced in inspecting audit work performed.

The CSA will review and assess submissions put forward by stakeholders on the proposal and identify a course of action.

II. Background

NI 52-108 requires each audit firm that prepares an auditor's report for a reporting issuer to have a participation agreement with CPAB. A participation agreement, among other things, permits CPAB to inspect a PAF to assess compliance with applicable rules and professional standards in connection with the issuance of an auditor's report on the financial statements of a reporting issuer.

In recent years CPAB has expressed concern with the number of instances where it was denied access to inspect audit work performed in a foreign jurisdiction. CPAB is also concerned that stakeholders, including audit committees, may not be fully aware of such access restrictions for certain reporting issuer audits.

We acknowledge that CPAB currently faces challenges in accessing audit work performed in certain foreign jurisdictions, and that it continues to consider ways to respond to these challenges. Auditors are important gatekeepers in our market, and the ability of CPAB to inspect their work contributes to public confidence in the integrity of financial reporting.

III. Component Auditor registration

CPAB has requested that the CSA amend NI 52-108 to require certain audit firms involved in the audit of a reporting issuer's financial statements to register as a PAF, which would give CPAB a legal basis to inspect the audit work done by these audit firms in relation to reporting issuer audits.

A number of reporting issuers have operations in a foreign jurisdiction that differs from the jurisdiction where their head office resides. This may present challenges for auditors of such reporting issuers due to different languages, laws and business practices in the foreign jurisdiction. In responding to those challenges, some PAFs may ask an audit firm (a Component Auditor) in a foreign jurisdiction to perform work that forms part of the audit evidence supporting a PAF's auditor's report. A Component Auditor could be a member of the PAF's international network, or an unrelated foreign or domestic audit firm.

If a PAF decides to use the work of a Component Auditor, the PAF must comply with Canadian Auditing Standard 600 Special Considerations -- Audits of Group Financial Statements (Including the Work of Component Auditors) (CAS 600),{1} which clarifies that the PAF is responsible for the direction, supervision and performance of the overall audit. Although CAS 600 requires the PAF to document the type of work performed by a Component Auditor, there is no requirement for the PAF to retain in its files a copy of the work performed by the Component Auditor.

In order to assess whether sufficient audit evidence has been obtained to support the PAF's audit opinion, CPAB has determined that it must have access to a substantial portion of the audit work performed. However, CPAB has encountered some instances where a substantial portion of the audit work has been performed by a Component Auditor in a foreign jurisdiction, and CPAB was not permitted access to inspect the work.

According to CPAB, in 2016 a foreign Component Auditor was involved in a significant portion of the audit{2} for approximately 597 reporting issuer audits in 95 foreign jurisdictions. These reporting issuers had a market capitalization of $0.3 trillion as of September 30, 2016, which represented approximately 11% of the total market capitalization of $2.7 trillion for all reporting issuers on TMX exchanges.{3} However, it is not clear what portion of the $0.3 trillion represents foreign operations.

CPAB has represented that a requirement in NI 52-108 for certain Component Auditors to register with CPAB would provide it a legal basis to access audit working papers in most foreign jurisdictions, although there would continue to be a small number of foreign jurisdictions where barriers to access would not be resolved. Further detail about the use of foreign Component Auditors for reporting issuer audits can be found in Appendix A, including the following information:

• Reporting issuer audits that involve foreign components in the United States, United Kingdom and Australia, comprise 37% of the total number of reporting issuers whose audits involve foreign Component Auditors, and 90% of the market capitalization.{4}

• If a Component Auditor registration requirement was in place CPAB has represented that it would continue to be restricted from inspecting work in China. CPAB has also represented that it is not clear whether working papers in Burkina Faso, Egypt, Ghana, Guatemala and Zambia would be accessible.

The introduction of a Component Auditor registration requirement may create some new challenges, as described below:

i. Challenges in finding Component Auditors to perform the work

An existing Component Auditor may be unwilling to continue providing services to a PAF if it must be subject to inspection by CPAB. This would require the PAF to identify a new Component Auditor or travel to the foreign jurisdiction to perform the work itself. In some situations an existing PAF may be unwilling to continue providing audit services due to the difficulties relating to those two options; the PAF may not find a suitable Component Auditor or may not be willing or able to perform the work itself. As a result, the reporting issuer would have to engage a new auditor. In some situations a reporting issuer may even have difficulty finding a new auditor. Such changes in audit arrangements would cause disruption to reporting issuers.

ii. Potential for higher audit fees charged to reporting issuers

A Component Auditor may charge additional fees in connection with being subject to additional oversight. If a PAF performs the audit work in a foreign jurisdiction that was previously audited by a Component Auditor, the PAF may charge additional fees to compensate for additional costs incurred. In each case the result would be higher audit fees charged to the reporting issuer.

Currently, the United States is the only jurisdiction we are aware of that requires certain Component Auditors to register with the audit oversight regulator. However, the basis for having such requirement may partially be due to unique features with respect to the United States reporting regime.

The United States audit oversight regulator, the Public Company Accounting Oversight Board (PCAOB), requires an audit firm that plays a 'substantial role' in an audit of a public company to register with it. An audit firm plays a substantial role in an audit if it performs:

a) material services that a public accounting firm uses or relies on in issuing all or part of its auditor's report, or

b) the majority of the audit procedures with respect to a subsidiary or component of any issuer, the assets or revenues of which constitute 20% or more of the consolidated assets or revenues of such issuer necessary for the principal auditor to issue an auditor's report.{5}

We note that the PCAOB's registration requirement does not ensure access. For example, we note that the PCAOB currently is prevented from inspecting the U.S.-related audit work and practices of PCAOB-registered firms in certain European countries, China and Hong Kong (the latter to the extent their audit clients have operations in China).{6} The PCAOB publishes a list of instances where it has been denied access to inspect audit work of registered firms.

- - - - - - - - - - - - - - - - - - - -

Question 1: Is a Component Auditor registration requirement the way to proceed to assist CPAB in obtaining access to inspect work performed by foreign audit firms? If not, please suggest other ways to address CPAB's access challenges. Please explain the reasons for your views.

Question 2: Are there any additional implications, other than those discussed above, to consider in assessing whether to require a Component Auditor to register with CPAB?

Question 3: If NI 52-108 is amended to require Component Auditor registration:

(a) Should the requirement be based on an asset and revenue threshold that is equivalent to that used in the PCAOB's 'substantial role' threshold? If not, please specify your recommended threshold, if any, and explain why that threshold would be more appropriate.

(b) Should certain components of an entity be exempt when applying the threshold referred to in (a), such as investments accounted for using the equity method?

- - - - - - - - - - - - - - - - - - - -

IV. Public disclosure about CPAB access restrictions

CSA staff are considering whether to amend a national instrument to require additional transparency about situations where CPAB has been prevented from inspecting the work of a PAF or Component Auditor.

If a reporting issuer has significant operations outside of Canada, its continuous disclosure documents should include information about the magnitude of its foreign operations along with the risks involved with operating in those foreign jurisdictions. Despite stakeholders having information on the impact of foreign operations from the reporting issuer's perspective, there is no requirement for public disclosure of how the foreign operations impact the audit of the reporting issuer's financial statements, or CPAB's ability to inspect the audit work performed in the foreign jurisdiction.

In 2015, CPAB published a list of the 10 largest foreign jurisdictions by market capitalization in which CPAB did not have access to working papers. The 2015 publication also identified six significant foreign jurisdictions where CPAB requested, but was denied access to inspect working papers.{7} In 2016, CPAB reported that the number of foreign jurisdictions where CPAB has requested, but was denied access to inspect working papers had increased to eight.{8} In its publications CPAB did not identify which reporting issuers were being inspected when access was denied.

In recent years, the PCAOB has emphasized the importance of stakeholders understanding how the use of foreign audit firms impacts an entity's audit and corresponding PCAOB oversight. For example, the PCAOB maintains a list on its website of each instance where it has been prevented from inspecting the work and practices of a PCAOB-registered firm. The list identifies the name of the issuer, name of the auditor, and location the auditor resides.{9}

Disclosure about restrictions CPAB faced when inspecting a specific reporting issuer's audit would make stakeholders aware of situations where they were deprived of the potential benefits of a CPAB inspection of the auditor.

Disclosure about specific instances of access restrictions CPAB faced would not result in fulsome information about all reporting issuer audits that involve Component Auditors in foreign jurisdictions. Disclosure about the use of a Component Auditor in a foreign jurisdiction would only occur if CPAB has had access restricted as part of an inspection, with disclosure of the restriction referring to the reporting issuer audit that CPAB inspected. If a different reporting issuer used the same Component Auditor, but CPAB did not request access for an inspection, then there would be no disclosure that the Component Auditor was involved in that reporting issuer's audit.

- - - - - - - - - - - - - - - - - - - -

Question 4: Would additional transparency about situations where CPAB has been prevented from inspecting the work of a PAF or Component Auditor that plays a 'substantial role' be useful to investors and others, and if so in what situations? Please explain the reasons for your views, including any potential implications that we should consider if such disclosure was required.

Question 5: If we were to require this disclosure, who should provide the disclosure -- CPAB or reporting issuers? Please explain the reasons for your views.

- - - - - - - - - - - - - - - - - - - -

V. Comments and submissions

We invite participants to provide input on the issues outlined in this public consultation paper. You may provide written comments in hard copy or electronic form. The consultation period expires June 24, 2017.

Certain CSA regulators require publication of the written comments received during the comment period. We will publish all responses received on the websites of the Autorité des marchés financiers (www.lautorite.qc.ca), the Ontario Securities Commission (www.osc.gov.on.ca), and the Alberta Securities Commission (www.albertasecurities.com). Therefore, you should not include personal information directly in comments to be published. It is important that you state on whose behalf you are making the submission.

Please submit your comments in writing on or before June 24, 2017. If you are not sending your comments by email, please send a CD containing the submissions (in Microsoft Word format).

Address your submission to all of the CSA as follows:

British Columbia Securities Commission

Alberta Securities Commission

Financial and Consumer Affairs Authority of Saskatchewan

Manitoba Securities Commission

Ontario Securities Commission

Autorité des marchés financiers

Financial and Consumer Services Commission (New Brunswick)

Superintendent of Securities, Department of Justice and Public Safety, Prince Edward Island

Nova Scotia Securities Commission

Securities Commission of Newfoundland and Labrador

Superintendent of Securities, Northwest Territories

Superintendent of Securities, Yukon

Superintendent of Securities, Nunavut

Deliver your comments only to the addresses below. Your comments will be distributed to the other participating CSA regulators.

{1} CAS 600 is consistent with a corresponding International Standard on Auditing (ISA 600). The International Audit and Assurance Standards Board is currently examining whether clarifications or amendments are needed to ISA 600. However, any future changes are unlikely to address the foreign jurisdiction access issues discussed in this Paper.

{2} A Component Auditor would be involved in a significant portion of the audit if the assets or revenues it audited constitute 20% or more of the consolidated assets or revenues of the reporting issuer.

{3} https://www.tsx.com/resource/en/1398

{4} In the CPAB Report Access to Foreign Jurisdictions, November 2016, CPAB stated that these are well regulated jurisdictions where CPAB has existing or in-process MOUs facilitating working paper access. CPAB stated that given their long established regulatory and legal regimes, these are not considered high risk jurisdictions.

{5} PCAOB Rules, Rule 1001 paragraph (p)(ii).

{6} https://pcaobus.org/International/Inspections/Pages/IssuerClientsWithoutAccess.aspx

{7} CPAB Report Access to Foreign Jurisdictions, November 2015.

{8} CPAB Report Access to Foreign Jurisdictions, November 2016.

{9} https://pcaobus.org/International/Inspections/Pages/IssuerClientsWithoutAccess.aspx

 

Appendix A

Reporting Issuer Audits with Foreign Component Auditors that Play a Substantial Role{*}

Country of the Component	# of Reporting Issuers	Market Capitalization -- $ Billions
With Audit Regulators
United Kingdom[SUP]1 2[/SUP]	88	937.2
United States[SUP]1 2[/SUP]	81	1,036.9
Australia[SUP]1 2[/SUP]	51	373.6
China[SUP]3[/SUP]	24	23.0
Brazil	18	8.0
South Africa	13	2.4
Germany[SUP]1[/SUP]	12	6.6
France[SUP]1[/SUP]	11	25.5
Turkey	9	2.0
New Zealand	8	2.7
Spain[SUP]4[/SUP]	7	0.5
Belgium[SUP]5[/SUP]	4	5.4
Sweden[SUP]4 5[/SUP]	3	4.4
Egypt[SUP]6[/SUP]	2	2.9
Austria[SUP]4[/SUP]	2	1.9
Portugal[SUP]4[/SUP]	2	--
Norway	1	36.2
Netherlands[SUP]1[/SUP]	1	12.9
Slovakia[SUP]4[/SUP]	1	2.6
Without Audit Regulators
Mexico[SUP]4[/SUP]	38	46.5
Argentina	22	30.3
Columbia	19	5.6
Peru	15	2.2
Chile	13	8.9
Philippines	7	3.4
Ghana[SUP]6[/SUP]	5	3.3
Burkina Faso[SUP]6[/SUP]	4	2.4
Tunisia[SUP]4[/SUP]	3	0.1
Zambia[SUP]6[/SUP]	1	7.5
Guatemala[SUP]6[/SUP]	1	5.2
Other[SUP]7[/SUP]	131	16.6
Total	597	2,616.7

1 CPAB has a sharing agreement in place with the audit regulator.

2 In the CPAB Report Access to Foreign Jurisdictions, November 2016, CPAB stated that these are well-regulated jurisdictions where CPAB has existing or in process MOUs facilitating working paper access. CPAB stated that given their long established regulatory and legal regimes, these are not considered high risk jurisdictions.

3 CPAB has represented that access to working papers would continue to be restricted even if a Component Auditor registration requirement was in place.

4 In the CPAB Report Access to Foreign Jurisdictions, November 2016, CPAB identified these as jurisdictions where CPAB has requested and been denied access to Component Auditor working papers. CPAB has represented that if a Component Auditor registration requirement was in in place, CPAB would have access to Component Auditor working papers in these jurisdictions.

5 CPAB in process of negotiating a sharing agreement with the audit regulator.

6 CPAB's understanding is that the PCAOB has not requested access to information in this jurisdiction, and as a result it is not clear whether a Component Auditor registration requirement would result in CPAB getting access.

7 The composition of this category includes countries with, and without, audit regulators.

{*} Content for this appendix was provided by CPAB based on information available as at September 30, 2016.