Investigation into CEAC at Audit Firms

Get started! Results of the investigation into client and engagement acceptance and continuance of audit firms with a regular license Read more UNDER EMBARGO

Contents 2 Contents Summary 3 01 Investigation into CEAC, an essential quality safeguard 8 02 Improvements in CEAC necessary and AFM shares good examples 11 2.1 Concurrence of services 12 2.2 Long-term involvement 17 2.3 Integrity of the audit client 20 2.4 Required time, resources, and qualified personnel 21 2.5 Timeliness of the assessment 23 2.6 CEAC policy 24 03 Description of the research methodology 27 3.1 Selection of audit firms and statutory audits 27 3.2 The investigation focuses on three CEAC topics 27 3.3 Results presented with qualification in grey-green, green, orange, or red 28 3.4 The AFM relies on document analysis, interviews, and data 28 3.5 Reporting on the investigation results 28 3.6 The AFM acknowledges limitations of the investigation 29 Appendix 1 CEAC results per statutory audit 30 UNDER EMBARGO

Summary 3 Audit firms with a regular license perform the majority of statutory audits Audit firms with a regular license have a market share of 55% of the total market of approximately 20,000 statutory audits in the Netherlands.1 In addition to 2482 audit firms with a regular license, there are six3 audit firms with a PIE license. AFM supervises audit firms with a regular license from 2022 The Netherlands Authority for Financial Markets (AFM) has been fully responsible for supervising audit firms with a regular license (audit firm(s)) since January 1, 2022. In this phase of supervision, the AFM aims to gain more insight into quality risks in this sector, make audit firms aware of their current quality level, and encourage the sector to implement necessary quality improvements for the performance of statutory audits. The AFM wants to stimulate the learning capacity of audit firms by highlighting good examples from the sector. With this, the AFM expects to sustainably raise the quality of statutory audits together with the sector. Good client and engagement acceptance or continuance (CEAC) essential starting point for statutory audit The acceptance or continuance of an audit client and the statutory audit is an essential first quality safeguard for the quality of the statutory audit (English: ‘client and engagement acceptance or continuance’, CEAC). 1 Derived from the AFM Monitor Audit Firms 2021. 2 Derived from the Register of Audit Firms as of 18-10-2022. 3 BDO Audit & Assurance B.V., Deloitte Accountants B.V., Ernst & Young Accountants LLP, KPMG Accountants N.V., Mazars Accountants N.V. and PricewaterhouseCoopers Accountants N.V. The purpose of this is to ensure the independence of the audit firm and the external auditor in advance, to prevent relationships with non-integral audit clients, and to make available the required time, resources, and qualified personnel for the performance of the statutory audit. If the CEAC is insufficiently or not timely performed, it may happen that the external auditor is not independent, the external auditor has entered into a relationship with a non-integral audit client, and does not have the required time, resources, and qualified personnel available for the performance of the statutory audit. An insufficient CEAC can therefore have a negative impact on the quality of the statutory audit. An insufficient CEAC does not necessarily mean that the quality of the statutory audit is insufficient. AFM investigated CEAC at 30 audit firms and 83 statutory audits The AFM investigated the CEAC policy and its implementation in 83 statutory audits at 30 audit firms. Investigation focuses on three main CEAC topics The investigation focuses on the following main CEAC topics:

1. The independence of the auditor,4 for which the following were chosen: • ‘Concurrence of services’; performing the statutory audit in combination with non-assurance services such as preparing financial statements or tax services (risk of auditing one's own work). • ‘Long-term involvement’; being involved in providing services to the audit client for a long period (risk of familiarity).
2. The assessment of the ‘integrity of the audit client’ for whom the auditor will perform the audit. 4 Articles 18 to 20 and Article 28 of the Regulation on the independence of auditors in assurance engagements. Summary UNDER EMBARGO

Summary 4 71 of the 83 investigated CEACs are insufficient on the three main topics In 71 (86%) of the 83 investigated statutory audits, substantive findings were identified on at least one of the three CEAC topics and/or there were findings regarding the untimely assessment of these topics. For 54 of these 71 statutory audits, the assessment was insufficient and/or untimely (red). For 17 of these 71 statutory audits, the assessment was insufficient but, if necessary, a measure was taken, and the assessment was timely (orange). In 12 (14%) of the 83 investigated statutory audits, all three CEAC topics were sufficient, and the external auditor performed the assessment timely. This is shown in Figure 2. Figure 2. Number of statutory audits where CEAC was sufficient, insufficient with measure, or insufficient 12 17  Sufficient  Insufficient with measure (if necessary)  Insufficient 54 Policy also insufficiently safeguards the qualitative implementation of CEAC The AFM also notes that the policies of audit firms insufficiently safeguard that the implementation of CEAC in the investigated statutory audits complies with laws and regulations. The investigation shows that for the investigated audit firms where the policy complies with laws and regulations, the implementation of CEAC does not always comply. For audit firms where the policy does not comply with laws and regulations, the implementation of CEAC rarely complies with laws and regulations. 3. The assessment of the ‘required time, resources, and qualified personnel’ for the performance of the statutory audit. Laws and regulations require the audit firm and the external auditor5 to perform an assessment of these topics, among others, before accepting or continuing a statutory audit. Based on this investigation, the AFM cannot judge to what extent the CEAC, including the measures taken by the external auditor, has impacted the safeguarding of the quality of statutory audits. The AFM conducted an investigation into CEAC and not into the quality of statutory audits. More than half of the 30 audit firms have findings in CEAC policy 18 (60%) of the 30 audit firms have findings on at least one of the investigated topics in their CEAC policy. This is shown in Figure 1. Clear and unambiguous policy must ensure that implementation always meets the set quality requirements and laws and regulations. The policy must also ensure consistent implementation. Figure 1. Number of audit firms with no or at least one finding on investigated main topics in CEAC policy  Sufficient  Insufficient 12 18 5 Pursuant to Article 12 of the Decree on the supervision of audit firms (Bta), the audit firm is responsible for the acceptance or continuance of engagements. Pursuant to NV COS 220.12, the external auditor must be satisfied that appropriate procedures regarding the acceptance and continuance of client relationships and audit engagements have been followed, and must determine that conclusions drawn in this regard are appropriate. The investigation shows that in almost all investigated CEACs, the external auditor makes the final judgment (in consultation with the audit firm) regarding the acceptance or continuance of a statutory audit. Therefore, the term external auditor is sometimes used in this report to improve readability, instead of the audit firm. UNDER EMBARGO

Summary 5 The AFM expects audit firms to quickly improve their CEAC The AFM expects audit firms to start by studying the findings in this report and to check whether their policy and the implementation of CEAC in statutory audits comply with laws and regulations and to implement necessary improvements. The good examples and enhancements in this report can support this. In addition, the AFM expects audit firms to ensure that employees have sufficient knowledge of CEAC regulations and offer training. This report can also serve as input for education and training of (prospective) auditors. The public expects an independent auditor The public must be able to rely on the judgment of the external auditor and the audit opinions issued by them. This begins with an adequately performed CEAC as an essential quality safeguard. The public expects the external auditor and the audit firm to be demonstrably independent and to timely identify when audit clients are not integral. In the coming years, the AFM will actively monitor quality improvement for CEAC and, if necessary, adjust its future supervisory activities accordingly. So, get to work! Improvements in CEAC are necessary, and the sector must act immediately: loudspeaker symbol Based on the investigation results, the AFM concludes that improvements in CEAC are necessary and that the sector must act immediately. These improvements (indicated by a ‘loudspeaker’) are necessary in both the policy and the implementation of CEAC in statutory audits. The AFM expects that CEAC improvements apply to all audit firms, as a representative sample of audit firms was included in the investigation. AFM observes and shares good examples: writing pen symbol The AFM has observed good examples of the policy and implementation of (parts of) CEAC at some of the investigated audit firms. These good examples (indicated by a ‘writing pen’) are included (anonymized) in this report so that audit firms can learn from each other. The AFM encourages audit firms to reflect on their own policies and the implementation of CEAC in their statutory audits, including the content of the assessment and the timely completion of the CEAC assessment, and to implement possible improvements. Opportunities to further strengthen CEAC: stairs with arrow symbol The AFM also sees opportunities to further strengthen CEAC in this report. The AFM encourages audit firms to apply these enhancements (indicated by ‘stairs with an arrow’) in the context of continuous improvement of the quality management system and its implementation in statutory audits. UNDER EMBARGO

Summary 6 Term Explanation Audit firms with a regular license Audit firms with an AFM license to perform statutory audits for clients that are not public interest entities. Audit firms with a PIE license Audit firms with an AFM license to perform statutory audits for clients that are public interest entities and statutory audits for clients that are not public interest entities. Policy A set of guidelines, procedures, and work instructions. Client and engagement acceptance or continuance The assessment by an audit firm before accepting or continuing an engagement for a statutory audit. Qualification A qualification is a judgment indicating the extent to which the CEAC in the investigated statutory audit complies with laws and regulations. Quality safeguards Quality safeguards are working methods, procedures, and measures included in an audit firm's quality management system. These are intended to ensure that the external auditor issuing the audit opinion can do so in a professionally competent, independent, integral, and recognizable manner. Long-term involvement Un