Minimum Requirements for the Conduct of External Audits of Licensed Financial Institutions in Fiji

Reserve Bank of Fiji Banking Supervision Policy Statement No: 7 (Revised 2015) NOTICE TO FINANCIAL INSTITUTIONS LICENSED UNDER THE BANKING ACT 1995 AND THEIR EXTERNAL AUDITORS MINIMUM REQUIREMENTS FOR THE CONDUCT OF EXTERNAL AUDITS OF LICENSED FINANCIAL INSTITUTIONS IN FIJI 1 PART I: PRELIMINARY 1.0 Introduction 1.1 This policy is issued under Section 14 (3) and Section 58 of the Banking Act 1995 as part of the Reserve Bank of Fiji’s (hereafter referred to as Reserve Bank) rules for the prudential supervision of licensed financial institutions (LFIs) in Fiji. Some of the provisions relating to external auditors are captured under the Companies Act. Where there are inconsistencies between the provisions of the Companies Act and the Banking Act 1995, the provisions of the Banking Act 1995 will prevail. 1.2 In reviewing the policy that was issued in 2001, the Reserve Bank referred to the recommendations of the Basel Committee on Banking Supervision, internationally accepted auditing policies and practices, practices of other jurisdictions, the Banking Act 1995 (hereafter referred to as the Act) and other relevant legislations including the Companies Act. 2.0 Objective 2.1 The purpose of this policy is to outline the minimum responsibilities of LFIs for the appointment of external auditors and ensuring the quality performance of external audits. 3.0 Background and Outline of the Approach 3.1 An external auditor plans and performs the audit of a bank’s financial statements to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatements, whether due to fraud or error, and are prepared, in all material respects, in accordance with an applicable financial reporting framework1 . 3.2 The LFI’s Board and Board Audit Committee (of locally incorporated institutions) and delegated function (of foreign incorporated institutions) are responsible for the oversight and conduct of the external audit function. Effective engagement and regular communication between the external auditor and the LFI contribute to the quality of the audit. 3.3 Supervisors and external auditors have complementary concerns regarding matters such as the continuity of a LFI, the adequacy of its internal controls and the maintenance of reliable accounting systems.

1 International Standard on Auditing (ISA) 200 – Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing.

2 3.4 From the supervisor’s point of view, supervision can be made more effective by relying to a greater extent on the results of the external auditor’s work, when appropriate, and turning to external auditors to undertake additional tasks which contribute to the performance of the supervisor’s responsibilities. At the same time, external auditors may be able to discharge their functions more effectively with assistance from supervisors. 3.5 The external auditor’s opinion provides supervisors with an independent attestation of the reliability and accuracy of information examined, lends credibility to such statements, therefore assisting in promoting confidence in the banking system. 3.6 The basic responsibility for providing complete and accurate information to the supervisor remains with the LFI. At no time does the external auditor assume any of the responsibilities of the supervisor but is simply assisting the supervisor in the supervisory process. PART II: RESPONSIBILITIES OF LICENSED FINANCIAL INSTITUTIONS 4.0 Oversight of Audit Function 4.1 The Board of a locally incorporated LFI is required to form a Board Audit Committee (BAC) and will be responsible for the oversight and conduct of the LFI’s external audit. The composition and responsibilities of the Board and BAC must meet the requirements of Banking Supervision Policy Statement No.11. 4.2 For foreign incorporated institutions, the LFI must provide to the Reserve Bank confirmation from the LFI’s Board, of the function2 that has been delegated the responsibility for the oversight and conduct of the LFI’s audit. These delegations must be approved by the Reserve Bank. 4.3 The LFI’s Board (in the case of locally incorporated institutions) and the delegated function (in the case of foreign incorporated institutions) are responsible for ensuring that the financial statements of the LFI are: i) prepared in accordance with accounting policies and practices that are widely accepted internationally and that these are supported by record-keeping systems in order to produce adequate and reliable data; and ii) provided to the public as and when requested together with the independent external auditor’s opinion as a result of an audit conducted in accordance with internationally accepted auditing practices and standards.

2 This function would typically be placed with the Senior Management responsible for the LFI’s operations in Fiji.

3 4.4 Furthermore, the LFI’s Board and the delegated function (in the case of foreign incorporated institutions) must: i) have a robust process for approving, or recommending for approval, the appointment, re-appointment, removal and remuneration of the external auditor; ii) verify the qualifications and experience of the external auditor; iii) monitor and assess the independence of the external auditor; iv) monitor and assess the effectiveness of the external audit; v) ensure that there is effective communication with the external auditor; and vi) require that the external auditor report all relevant matters to the Board (for locally incorporated institutions) and the delegated function (for foreign incorporated institutions). 4.5 It is the responsibility of the the LFI to ensure that the appointed external auditor is aware of and satisfactorily complies with the requirements set out in this policy. 5.0 Appointment of the External Auditor 5.1 Subject to the approval of the Reserve Bank, each LFI must, on an annual basis, appoint one or more persons to be the institution’s auditors (external auditor). The approval of auditors to be appointed to carry out the audit responsibilities of a LFI will be conditional on the auditor being able to comply with the requirements set out in this policy and in any other relevant supervision, rules, regulations, orders, or directives issued by the Reserve Bank. 5.2 The Reserve Bank must be informed within 14 calendar days of the appointment, of the following details regarding the appointed external auditor: i) name (i.e. of the firm and the officers involved); ii) experience and qualifications; iii) date of the appointment; and iv) other particulars required by the Reserve Bank. 5.3 At the minimum, the external auditor to be appointed must: i) hold a current certificate of public practice issued by the Fiji Institute of Accountants; ii) have proficient knowledge and understanding of, and practical experience with, the banking sector, associated banking industry and bank-specific risks, and the operations and activities of banks and bank audits; iii) have adequate knowledge and competence to respond appropriately to the risks of material misstatement in the bank’s financial statements and to properly meet any additional regulatory requirements that may be part of the statutory audit; iv) have proficient knowledge of applicable accounting, assurance and ethical standards of Fiji;

4 v) have proficient knowledge of relevant regulatory requirements in the areas of capital adequacy, liquidity and the legal and regulatory framework applicable to banks; vi) have proficient knowledge and understanding of Information Technology relevant to bank audits; vii) not have any interest in the LFI otherwise as a depositor; viii) not hold the position of director, employee, or agent of the LFI; ix) not have committed an offence against the Act, and any other laws of Fiji, or laws of a foreign country, involving fraud and dishonesty; x) not have been declared bankrupt; and xi) not pose any conflicts of interest in having to perform the role as external auditor of the LFI. 5.4 The Reserve Bank may at its discretion, rescind or reject the appointment of an external auditor that is deemed to have inadequate expertise or independence, or is not subject to or does not adhere to established professional standards. 5.5 The LFI must inform the Reserve Bank in writing, within 30 calendar days after any resignation, termination of an external auditor. If the appointed external auditor is terminated prior to the end of their contract, the Reserve Bank must be informed of the grounds for termination. 5.6 Each LFI must rotate the appointed auditor (either by firm or by individual) every 5 years, at the most. Where the rotation is not by firm, the LFI must ensure that the officers3 involved are replaced to meet the rotation requirement. 5.7 Failure to appoint an external auditor or fill a vacancy may result in the Reserve Bank’s appointment of an external auditor for the LFI, whose remuneration will be paid by the LFI. 6.0 Additional Information to be Audited 6.1 The Reserve Bank may by notice in writing to a LFI, require that any information, data and returns which the institution is required to supply, be audited by the external auditor, on such terms as may be specified by the Reserve Bank. 6.2 The LFI may also be notified in writing to supply the Reserve Bank with a report, prepared by the external auditor or any other person approved by the Reserve Bank, on matters determined by the Reserve Bank, which may include an opinion. This may be on such matters as a LFI’s liquidity, solvency, compliance with statutory provisions, or a review of the accounting systems and internal controls of the LFI.

3 3 This refers to the partner in charge, the audit manager, and the auditing team.

5 6.3 The LFI may also be required within 3 months of the close of the financial year of the LFI, to provide the Reserve Bank and the LFI’s Board or the Senior Management if the LFI is foreign incorporated, a report as at the latest balance date detailing the approved external auditor’s opinion as to whether: i) the LFI has observed all prudential requirements set out under the Reserve Bank of Fiji Banking Supervision Policy Statements or notices from time to time; and ii) the LFI has complied with statutory banking requirements, any conditions on the authority to carry on banking business, and any other conditions imposed by the Reserve Bank of Fiji in relation to the LFIs operations. 6.4 In providing an opinion on whether the LFI has complied with the Reserve Bank’s prudential requirements under paragraph 6.3 the issue of ‘materiality’ may be considered by the external auditor in both regards as the ‘nature’ or ‘amount’ of the violation and the effect of its omission on the evaluation to be made by the Reserve Bank on whether the LFI is operating in a safe and sound manner. 6.5 The LFI may apply for an extension of time to submit the reports required under 6.3. 6.6 If the LFI is facing problems, the Reserve Bank may also require under section 60 of the Act, through the LFI that the external auditor: i) in addition to the normal scope of audit, focus on other areas of which are of concern to the RBF; ii) change the timing and/or frequency of an audit where it has requested through the LFI for the external auditor to look at other areas of concern; and iii) conduct special targeted reviews and opinions of selected areas of the LFI or, broader overall reviews. 7.0 Access to Information 7.1 The LFI must ensure that the external auditor has access to all supervisory and examination reports of the supervisor and all the LFIs records of meeting minutes and correspondences between the supervisor and the LFI, and other additional information, required for the purpose of the audit. PART III: RESPONSIBILITIES OF THE EXTERNAL AUDITOR 8.0 The external auditor must be objective and independent by ensuring that they are not affected by situations that give rise to conflicts of interest, adopt a questioning4 approach when reviewing information and forming

4 Being alert to conditions which may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence – ISA 200.

6 conclusions, and exercise professional judgement, when planning and performing an audit. 8.1 External auditors are required to audit the annual financial statements of LFIs. The duties of external auditors in this regard are set out under section 58 of the Act. In addition, external auditors are also required to audit the disclosure statements of LFIs prepared under the Reserve Bank of Fiji Banking Supervision Policy Statement Notice No’s 5A and 5B. 8.2 Additional information to be audited by the external auditor will be requested through the LFI by the Reserve Bank. 8.3 The information audited under paragraph 8.1 is to be submitted by the LFI within 3 months of the close of their financial year to the Reserve Bank of Fiji. 8.4 In conducting its responsibilities, the external auditor must ensure that: i) it has obtained reasonable assurance that the financial statements are free from material misstatements, whether due to error or fraud; ii) they report to the Reserve Bank matters that are likely to be of material significance to the Reserve Bank’s supervisory function; and iii) identify, assess and provide an appropriate response to the risks of material5 misstatement in the LFI’s financial statements. 8.5 As per section 6.2, the external auditor may be required to prepare an extended report, which may include an opinion, on matters determined by the Reserve Bank (Refer Annex I). As the alternative, the Reserve Bank may at its discretion bring up these matters for discussion, during the trilateral meetings covered in section 9.3 and 9.4. 8.6 Notwithstanding its primary obligations, the external auditor may also be requested to provide its views (where it reasonably can) on those matters of supervisory interest, as the Reserve Bank may determine. 8.7 The LFI must notify the Reserve Bank in instances where an expert6 is engaged to conduct any of the functions of the appointed external auditor. The appointed auditor is responsible for ensuring that the expert is competent, capable and objective in their conduct of their services. Furthermore, the auditor is to ensure that the expert conducts an adequate appraisal of the LFI’s operations.

5 This is left at the discretion of the external auditor on what they define as reasonable and expected to influence economic decisions of users taken on the basis of the financial statements. 6 An individual or organisation possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist in obtaining sufficient appropriate audit evidence. An auditor’s expert may be either an auditor’s internal expert (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm), or an auditor’s external expert.’ ISA 620.

7 PART IV: OTHER REQUIREMENTS 9.0 Meetings 9.1 There must be appropriate communication channels for exchange of information and co-operation between the Reserve Bank, the LFI and the external auditor. 9.2 Prior to the commencement of an audit (pre audit) and at its completion (post audit), trilateral meetings are held between the Reserve Bank, the LFI and the external auditor. 9.3 Pre Audit Meetings 9.3.1 At the minimum, the following matters will be discussed at the pre-audit meeting: i) scope of the audit covering areas of mutual interest; ii) timelines of the audit; iii) issues or recommendations from previous on-site examinations or off￾site supervision; iv) the implementation of the auditor’s recommendations and the Reserve Bank’s recommendations, by the institution; v) additional work that may be required by the Reserve Bank of the external auditor. 9.4 Post Audit Meetings 9.4.1 The post audit meeting must be held within 4 months of the LFI’s financial year end, whereby any matters arising from the appointed auditor’s review are discussed. 9.4.2 The LFI must ensure that the management letter relating to the work undertaken by the approved auditor is submitted to the Reserve Bank no later than 3 months after the LFI’s financial year end. 9.5 In line with section 8.6, bilateral meetings may also be held between the Reserve Bank and the external auditor to discuss matters of supervisory interest. The external auditor may include these issues as a part of its scope of the LFI’s audit and therefore would be reasonably expected to form its views. The exclusion of the LFI in such meetings allow for open and frank discussions. 9.6 The LFI must ensure that all meetings, when it is in attendance are recorded as meeting minutes to form part of the LFI’s records. These records should be made accessible to the Reserve Bank and the external auditor.

8 10.0 Disclosure of Information 10.1 In terms of the relationship between the external auditor and the LFI, the information that is privileged to the LFI and not available to the public, will be protected as permitted under existing laws and regulations. 10.2 However, any person who is, or at any time was, an approved auditor of a LFI is required under section 61 of the Act to disclose to the Reserve Bank of Fiji information relating to the affairs of that financial institution obtained in the course of holding the auditors office, if in the person’s opinion: i) the LFI is insolvent, or is likely to become unable to meet its obligations or is about to suspend payment; or ii) the LFI is carrying on its business in a manner detrimental to the interests of its depositors or of its creditors; and iii) the disclosure of that information is likely to assist, or be relevant to, the exercise by the Reserve Bank of Fiji of its powers under the Act. PART V: RESERVE BANK OVERSIGHT & IMPLEMENTATION ARRANGEMENTS 11.0 Reserve Bank Oversight 11.1 The Reserve Bank will where it deems necessary require the LFI to authorise access to the external auditor’s working papers. 11.2 Non-compliance with the requirements of this Policy may result in sanctions as specified in Section 15 of the Banking Act, 1995. 12.0 Implementation Arrangements 12.1 This Policy applies to all LFIs licensed under the Banking Act and every person who holds or at any time has held (where applicable) office as an external auditor of such an institution, for financial years ending on or after August 2015. Reserve Bank of Fiji April 2001 (Revised August 2015)

9 ANNEX I As per section 6.2, the external auditor may also be required to submit a report on matters determined by the Reserve Bank. Alternatively, discussions may be held during the trilateral meetings on these matters: i) Description of the annual audit mandate, the audit strategy and the audit procedures. ii) Description and assessment of the significant accounting and valuation methods, including structured and complex accounting activities. iii) Description of significant events that took place during the year under review. iv) Description of material changes to the legal, financial and organisational basis of the bank. v) Description of the internal controls over significant procedures and internal control functions such as risk management, compliance, internal audit, audit committee, and management information systems. vi) Assessment of business performance. vii) Assessment of the development of the net asset position, especially the nature and extent of off-balance sheet assets and liabilities. viii) Comments and explanation on individual balance sheet items and profit and loss accounts, taking the principle of materiality into consideration. ix) Comments on whether the balance sheet items have been properly valued, the valuation adjustments and provisions are appropriate, and the reporting requirements have been fulfilled. x) Assessment of the earnings position, including a description of the most important sources of and factors for generating earnings. xi) Assessment of the risk situation, the procedures for determining risk provisioning and the adequacy of risk provisioning. xii) Description of major features and material risks of the lending business, including risk concentrations and the way they are dealt with within the bank. xiii) Description of general credit lines and noteworthy loans (e.g. significant non-performing loans, loans for which sizeable loan loss provisions are necessary or were necessary in the concluded financial year, significant loans to board members, and loans for which an exceptional type of collateral has been provided). xiv) Follow-up on serious irregularities and weaknesses observed during previous audits xv) Assessment of the adequacy of risk management, including the internal control system and the internal audit and compliance functions. xvi) Analysis of the bank’s exposure to credit risk/counterparty risk, market risk, interest rate risk, settlement risk, foreign exchange risk, liquidity risk, profitability risk and operational risk. xvii) Analysis of the amount and composition of the bank’s own funds that have to be reported to the supervisor. xviii) Assessment of the appropriateness of procedures for the preparation of prudential returns. xix) Assessment of the appropriateness of measures taken by the bank to determine the level of own funds, its liquidity ratio and its solvency ratio.

10 xx) Assessment of the liquidity position and the liquidity management system of the bank. xxi) Description and assessment of the provisions for preventing money laundering and terrorist financing. xxii) Description and assessment of the provisions on conduct of business rules. xxiii) Any other issues that the Reserve Bank may determine.