Code of Practice for Engagement with External Auditors of Financial Institutions

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 1 Table of Contents

1. INTRODUCTION ..........................................................................................................2
2. PURPOSE OF THE CODE OF PRACTICE..................................................................3
3. LEGISLATIVE REQUIREMENTS...............................................................................5
4. THE PRINCIPLES .........................................................................................................8
5. CONDUCT OF MEETINGS........................................................................................10 5.1 Bilateral Meetings.........................................................................................................11 5.2 Trilateral Meetings........................................................................................................11
6. PERIODIC REVIEW OF THE CODE OF PRACTICE ..............................................12 APPENDIX I........................................................................................................................13 GLOSSARY.........................................................................................................................15

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 2

1. INTRODUCTION 1.1 Globally, the ability of regulators to rely on the audited information furnished by financial institutions1 is an integral aspect of the supervisory process. In March 2014, the Basel Committee on Banking Supervision (‘BCBS’) issued guidance entitled “External Audit of Banks” to improve the external audit quality of banks and enhance the effectiveness of prudential supervision and hence financial stability. A key aspect of the document therefore provided guidelines for ensuring an effective relationship and communication between the regulator and banks’ external auditors. While the BCBS document focused on banks, the principles can be applied to any financial institution. 1.2 The primary role of the external auditors2 is to express an opinion on a financial institution’s audited financial statements. The external auditor is required to conduct the audit in accordance with International Standards on Auditing (ISA), published by the International Auditing Assurance and Standards Board (IAASB), or such other standards as the Central Bank of Trinidad and Tobago (‘Central Bank’/ ‘Bank’) may direct. Those standards require inter alia the external auditor to comply with ethical requirements and perform the audit to obtain reasonable assurance about whether the financial statements are free from material misstatement. 1.3 External auditors are duty-bound to follow the standards and principles established in the ISA in the conduct of audits of entities. Similarly, the Central Bank seeks to adhere to the principles established by international standard setters such as the BCBS and IAIS3 for the supervision of banking and insurance entities, respectively. The relationship between external auditors and the Central Bank is premised on both parties operating within their particular regulatory framework as well as within the limits and requirements placed on them by the standards to which they subscribe. 1.4 The Central Bank has long recognized the importance of leveraging the work of external auditors in assessing the safety and soundness of financial institutions. This policy stance is reflected in the various pieces of legislation governing financial institutions under its regulatory purview. Notwithstanding the legislative provisions, the Central Bank is cognizant of the need to deepen the regulator/ external auditor relationship and is seeking to adopt best practices with respect to communication as documented in this Code of Practice for Engagement with External Auditors of Financial Institutions (Code).

1 A financial institution refers to an institution (i) licensed under the Financial Institutions Act, 2008 (FIA) or (ii) registered under the Insurance Act, Chap 84:01 (IA). 2 External auditors may be required to conduct other reviews by law. For example, Trinidad and Tobago’s AML/CFT laws require external auditors to review a financial institution’s compliance with AML/CFT legislation and submit a report to the financial institution’s Board of Directors and the Central Bank. 3 IAIS is the abbreviation for International Association of Insurance Supervisors.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 3 2. PURPOSE OF THE CODE OF PRACTICE 2.1. The objective of this Code is to strengthen the Central Bank’s regulatory processes by promoting an effective relationship with the external auditors of financial institutions in order to ensure enhanced prudential supervision and contribute to high quality external audits. As a consequence, this Code sets out principles that establish, in the context of a particular financial institution: a) the nature of the relationship between the Central Bank and external auditor; b) the form and frequency that communication between the two parties should take; and c) the responsibilities and scope for sharing information between the two parties, subject to the availability and accessibility of information to either party. 2.2. The nature of the relationship and information sharing between the Central Bank and external auditors should be considered in the general context of the respective roles and responsibilities of the Central Bank, external auditors, and a financial institution’s board and management. a) The Central Bank is primarily concerned with maintaining the stability of the financial system and fostering the safety and soundness of financial institutions in order to protect the interests of the depositors, policyholders and pension plan members and beneficiaries. Therefore, the Central Bank monitors the present and future viability of financial institutions and reviews their financial statements in assessing their financial condition and performance. Accordingly, this Code will apply primarily to any domestic systemically important financial institution licensed or regulated by the Central Bank. The Code will be applied to other regulated financial institutions on a risk basis. The Central Bank is also concerned with the maintenance of a sound system of internal controls as a basis for safe and prudent management of the financial institution’s business. Consequently, the Central Bank must be satisfied that each financial institution maintains adequate records, prepared in accordance with consistent accounting policies and practices that enable the Central Bank to appraise the financial condition of the financial institution. In this regard, the financial institution is required to publish and make available on a regular basis, financial statements that fairly reflects its condition.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 4 When the Central Bank conducts an onsite examination, the conclusions drawn from the examination are customarily communicated to the financial institution. These communications can be useful to external auditors inasmuch as they provide an independent assessment in important areas, such as the Bank’s view of the adequacy of the provisions for loan losses, and focus attention on specific areas of supervisory concern. The Central Bank may also develop certain prudential ratios or guidelines that are made available to the financial institutions, which can be of assistance to external auditors in performing analytical reviews. b) A financial institution’s Board and Management must fulfill the following responsibilities as it pertains to an external audit: i. ensuring that the financial statements are prepared and presented fairly in accordance with International Financial Reporting Standards (IFRS); ii. establishing accounting procedures that provide for the maintenance of documentation sufficient to support the financial statements; iii. establishing and maintaining effective internal controls and procedures for financial reporting; iv. ensuring that the external auditor has complete and unhindered access to, and is provided with, all necessary information that may have material effect; v. providing all information to the Board and supervisory agencies as required by law or best practice; vi. preventing and detecting fraud and other irregularities; vii. engaging, monitoring and compensating the external auditor; viii. discussing and resolving disagreements between Management and the external auditor on financial reporting; ix. reviewing reports received from the external auditor on critical accounting policies, discussions with management and any material communications with management; and x. reviewing and monitoring Management's planned actions to implement the external auditor’s recommendations on the internal control environment.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 5 c) External auditors are responsible for: i. expressing an opinion on financial statements which are audited in accordance with ISA. The external audit involves procedures which include, but are not limited to, assessment of the risks of material misstatement of the financial statements, whether due to fraud or error; ii. considering the adequacy of the accounting procedures, records and such internal control systems of the financial institution as may be relevant to its financial reporting function; and iii. evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by management; and evaluating the overall presentation of consolidated financial statements (where applicable). d) While the external auditor’s relationship with regulators is designed to enhance the effectiveness of both the audit and the supervisory process, it should not detract from the independent role the external auditor plays in forming judgments and opinions on a financial institution’s financial statements. 3. LEGISLATIVE REQUIREMENTS 3.1. The legislative powers of the Central Bank as it relates to the audits of financial institutions and requirements of external auditors can be found in the Insurance Act Chapter 84:01 (IA) and the Financial Institutions Act, 2008 (FIA). Specifically: a) Section 51(1) of the IA empowers the Inspector of Financial Institutions (Inspector) to request from the external auditor any information necessary to ascertain the ability of insurance companies to meet their obligations. b) Sections 78 and 84 of the FIA empower the Central Bank to request any information it may require on a financial institution from the external auditor and to have access to the external auditor’s working papers. 3.2 In addition, Regulation 10(1) of the Financial Obligations Regulations 2010 (FOR) made pursuant to the Proceeds of Crime Act 2000 requires a financial institution to have its AML/CFT compliance programme reviewed by its internal and external auditors.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 6 3.3 Both the FIA and the IA place certain obligations on the external auditor. For example:- a) Sections 83 and 84 of the FIA require the external auditor to: i. audit the statutory returns of the financial institution; ii. report on the adequacy of the financial institution’s accounting records; iii. communicate in writing to the financial institution about control deficiencies arising from the audit of financial statements of that financial institution; iv. report on accounting issues that have led to a misrepresentation of the financial position of the financial institution; v. report on contraventions of any legislative provisions relating to capital adequacy and liquidity requirements; and vi. report on any irregular transactions or conditions that pose significant risks to the financial institution. b) Sections 57 (1) and (3) and 64 (3) and (4)(b) of the IA require the external auditor to: i. audit the accounts of insurance companies annually; ii. report whether the preparation of the accounts have been done in accordance with the IA; iii. report whether the revenue account and profit and loss accounts are a fair representation of the results of the company’s operations; iv. report whether the balance sheet fairly presents the state of the company’s affairs; v. report whether the reserves relating to unexpired policies have been calculated in accordance with the IA; vi. report on whether the provisions regarding outstanding claims are adequate; vii. state whether the records of accounts have been adequately maintained and are up to date;

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 7 viii. report to the Inspector on matters in respect of which they were unable to obtain information or are not completely satisfied with such information; and ix. provide the Inspector or any person authorized by the Central Bank with any books or papers specified (section 64 (3)) and to explain the contents or any books or papers relevant to the institution’s insurance business where necessary (section 64(4)(b)). 3.4 The external auditor therefore plays an important role in assessing the risks of the financial institution through the audit of financial statements and statutory returns and concomitant assessments of internal controls, risk management, and governance in the execution of the audit. The Central Bank places reliance on the external auditor to opine on whether the financial statements are presented fairly in all material respects. Similarly, and in the context of enhancing the overall audit, the external auditor would gain a better understanding of, and insight into the financial institution’s vulnerabilities and risks where he/she is privy to relevant information from the Central Bank, including access to Central Bank’s reports, correspondence, and directives to the financial institutions. 3.5 The legislation places responsibilities on the external auditor to disclose and share information with the Central Bank. Moreover, section 85(1) of the FIA permits external auditors to communicate, in good faith, to the Central Bank any information or opinion on a matter that the external auditor reasonably believes is relevant to any function of the Central Bank. The Central Bank is intent on building its relationship with the external auditor, while being cognizant of the confidentiality requirements in the IA, FIA as well as the Central Bank Act as follows: a) Section 6A(1) of the IA provides that the Central Bank may only share information on a registrant with a local or foreign regulatory agency or body that regulates financial entities; b) Section 8(1) of the FIA prohibits the Central Bank from disclosing any information regarding the business or affairs of a licensee or its affiliate or any depositors or customers that is obtained in the course of official duties. However, subsection (5) of section 8 also provides for, inter alia, the Central Bank or its officers or employees being able to disclose information that it considers necessary for the purpose of analysis of the financial condition of the licensed financial institution (licensee);

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 8 c) Section 56(1) of the Central Bank Act prohibits also the disclosure of information relating to the affairs of, inter alia, any financial institution, registrant under the IA, or customers, except as may be necessary for the due performance of the objects of the Central Bank and subject to the requirements of section 8 of the FIA. 4. THE PRINCIPLES4 4.1 This Code is premised on the principles set out by the Basel Committee on Banking Supervision’s paper on “External Audits of Banks” published in March 2014 and should be applied in a manner proportionate to the level of risk of the particular financial institution. The relevant principles are as follows: o Principle 6: The regulator and the external auditor should have an effective relationship that includes appropriate communication channels for the exchange of information relevant to carrying out their respective statutory responsibilities. o Principle 7: The regulator should require the external auditor to report to it directly on matters arising from the audit that are likely to be of material5 significance to the functions of the regulator. o Principle 8: There should be open, timely and regular communication between the Central Bank, audit firms and the accounting profession as a whole on key risks and systemic issues as well as a regular exchange of views on appropriate accounting techniques and auditing issues. 4.2. Principle 6: The regulator and the external auditor should have an effective relationship that includes appropriate communication channels for the exchange of information relevant to carrying out their respective statutory responsibilities. a) Communication between the Central Bank and the external auditor should be as frequent as necessary and take whatever form as agreed between the two parties to ensure that their statutory responsibilities are effectively fulfilled. The form, content and frequency of this dialogue will vary depending on the characteristics and circumstances of the financial institution. b) Communication may be both through formal channels, such as scheduled bilateral meetings (between the Central Bank and external auditor) and/or

4 Bank for International Settlements, Basel Committee on Banking Supervision, External Audits of Banks, March 2014 5 Material in the context of this document means information if omitted or misstated could change or influence the assessment or decision of the Central Bank or external auditor relying on that information for the purpose of making regulatory or auditing decisions respectively.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 9 trilateral meetings (Central Bank, external auditor and financial institution), and through informal channels, such as telephone calls and unscheduled meetings as appropriate. c) Under Principle 6, external auditors are also required by internationally accepted ethical standards to treat much of the information received while carrying out their functions as confidential. In this regard, the IA (Section 51) and the FIA (Section 85) permit the external auditors to share information with the Central Bank. In addition, the Central Bank may share information with the external auditor where deemed necessary to fulfil its legislative obligations, subject to section 8 (5) (a) of the FIA and 56 (1) of the Central Bank Act. The FIA and IA also provide for external auditors to communicate in good faith with the Central Bank without contravening other duties they are subject to (as discussed in Section 3). Accordingly, contractual agreements between external auditors and financial institutions should not hinder information sharing with the Central Bank. Specifically, the terms of the audit engagement should include a provision, which acknowledges that the Central Bank and the financial institution’s external auditor may discuss any material issue that is of relevance to the Central Bank’s oversight of the financial institution and that this communication will not be determined to be a breach of duty by either party. 4.3. Principle 7: The regulator should require the external auditor to report to it directly on matters arising from the audit that are likely to be of material significance to the functions of the regulator. a) Alongside the legislative requirements outlined in section 3 of the Code, the overriding consideration should be to disclose information that, based on the judgment of the lead audit partner and requirements in law, would assist the regulator in carrying out its functions. Such information should be communicated in writing in a timely fashion by the external auditor directly to the Inspector and copied to the financial institution. It is not sufficient for the external auditor to rely on the financial institution to notify the Inspector (refer to section 83(1) of the FIA). b) Similarly, the Central Bank should disclose material information to the external auditor that it judges to be relevant to the fulfillment of the external auditor’s duties, while at the same time being mindful of its responsibility of confidentiality. 4.4. Principle 8: There should be open, timely and regular communication between the Central Bank, audit firms and the accounting profession as a whole on key risks and

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 10 systemic issues as well as a regular exchange of views on appropriate accounting techniques and auditing issues. There should be open and constructive two-way dialogue between the external auditor and the Central Bank to support the effective fulfillment of their respective statutory functions. Communication channels between both parties should always be open and an environment that facilitates frank discussions should exist. This can be achieved through the adoption of the following measures: a) Financial institutions should advise the Central Bank of the contact details of the audit partner responsible for the external audit; b) Financial institutions should advise the external auditor of the contact details of its Inspector, Deputy Inspector and Manager responsible for the supervision of financial institutions at the Central Bank; c) Meetings between the external auditor and the Central Bank should be governed by the following principles: i. The Central Bank shall share with the external auditor information which it believes will assist the external auditor in the conduct of its audits; ii. The external auditor shall share with the Central Bank any information that it believes may assist the Central Bank in the exercise of its supervisory functions; and iii. All communications between the Central Bank and the external auditor shall be deemed confidential6. d) At all times, both parties should aim to create an open and co-operative relationship that supports the other in carrying out their statutory functions. 5. CONDUCT OF MEETINGS As indicated in 4.2 b) of this Code, one form of communication with the external auditor is through either bilateral meetings (Central Bank and external auditor) or trilateral meetings (Central Bank, external auditor and financial institution). The following paragraphs provide guidance on the conduct of such bilateral or trilateral meetings.

6 Section 8(1) of the FIA requires inter alia all information regarding the business or affairs of a license to be kept confidential.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 11 5.1 Bilateral Meetings a) Where the Central Bank plans an on-site examination of a financial institution, a meeting should be scheduled with the external auditor prior to the commencement of the on-site examination. The scope of this meeting will be institution specific and guided by the focus of the onsite examination. Prior to the meeting, the Central Bank should prepare and circulate an agenda to all attendees. b) The bilateral meetings should be attended by the following representatives of the Central Bank and the external auditor: i. Central Bank – Relationship Officer of the financial institution, Senior Examiner, Manager Supervision, Deputy Inspector of Supervision. ii. External Auditor – Lead Audit Partner or their delegate. c) Other bilateral meetings to discuss specific issues may be requested by either party as deemed necessary. Appendix I provides guidance on possible discussion items for other bilateral meetings. The attendees for such meetings should include the following persons: i. Central Bank – Relationship Officer of the financial institution, Senior Examiner and the Manager Supervision. The Deputy Inspector of Supervision may attend depending on the nature of the issue being discussed. ii. External Auditor – Lead Audit Partner or their delegate. 5.2 Trilateral Meetings a) In addition to bilateral meetings, the Central Bank may arrange trilateral meetings annually or less frequently as necessary. The Central Bank, through its Corporate Governance requirements7, expects the financial institution’s Audit Committee to ably monitor the effectiveness and adequacy of the financial institution’s internal and external audit functions. It is because of this reliance that the Central Bank proposes to hold trilateral meetings, which would include the Central Bank, the external auditor, the Chair of the Audit Committee or an Independent Director where no Audit Committee exists, to discuss areas of

7 Refer to Section 8 of the Corporate Governance Guideline issued by the Central Bank.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 12 concern and/or mutual interest pertaining to the financial institution. The financial institution’s internal auditor may also attend these meetings. b) Trilateral meetings may be scheduled by the Central Bank following an onsite examination, completion of the annual external audit, or such other specific work requested by the Central Bank pursuant to Section 83(2) of the FIA. The external auditor may also initiate a trilateral meeting. The Central Bank or the external auditor will prepare and circulate an agenda prior to the meeting. c) Trilateral meetings may include discussions of mutual interest on the following: i. the audit process and any material issues raised by the external auditor with the financial institution arising out of the audit; ii. other relevant issues affecting the preparation or presentation of the financial statements, including material changes in accounting treatment or practice and compliance with IFRS; iii. the operations and effectiveness of internal controls within the financial institution generally or within a significant group entity or business line; iv. the operations and effectiveness of the internal audit and compliance functions within the financial institution, including the role and work of the Audit Committee; v. the operations and effectiveness of the financial institution’s arrangements for the monitoring, management and control of all material risks in its business; and vi. any other issues that the relevant parties may deem necessary to discuss. d) The Inspector may also attend trilateral meetings in addition to other Central Bank representatives. 6. PERIODIC REVIEW OF THE CODE OF PRACTICE 6.1. The Code will be reviewed bi-annually and will be updated to reflect changes to legislation, auditing practice and other relevant developments as necessary; and 6.2. Either party may initiate discussions for amendment to or updating of the Code of Practice. February 2018

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 13 APPENDIX I The scope for other bilateral meetings may include, but are not limited to, the following: i. Risk assessment and scope – both the external auditor’s and Central Bank’s assessments in light of the external environment and the financial institution’s performance, changes in business lines, drivers of income, strategy, risk appetite etc.; ii. Weaknesses identified in previous external audits; iii. Overview of weaknesses identified through the supervisory process; iv. Discussion on current key risks the financial institution poses to the Central Bank’s objectives, skilled persons’ report findings and other supervisory reviews; v. Audit strategy/approach and views on materiality; vi. Observations on control functions of the financial institution (e.g. risk management function, internal audit, compliance); vii. Views and judgments on key risk areas based on audit/supervisory work performed to date, including specific significant transactions, material valuations and impairment decisions etc.; viii. Assessment of risks relating to going concern assumption; ix. Accounting policy application and changes; x. Sources of potential management bias; xi. Culture and tone set from the top; xii. Observations on any areas of potential reputational risk for the financial institution; xiii. Observations arising from any work on regulatory reporting, including capital; xiv. Changes in corporate governance and internal governance structures of the financial institution; xv. Actions from previous years;

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 14 xvi. Discussion on the external audit findings as originally presented to the firm and the adequacy of the financial institution’s response to these findings; xvii. Discussion on areas where management of the financial institution applied significant judgment and its impact on the external auditor’s view of the financial statements and on the risk profile of the financial institution. This discussion would include the level of professional skepticism applied by the external auditor; xviii. Material information which is deemed to be of immediate interest to the other party; xix. Any issues that affected communications between the external auditor and/or the Central Bank and/or the financial institution during the year that could be improved; and xx. The future strategy of the financial institution and the impact that it may have on external audit and regulatory issues.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 15 GLOSSARY Bilateral Meeting a meeting held between the Central Bank and a financial institution’s external auditor. External Audit an external audit in this document refers to the annual audit of a financial institution under taken in fulfilment of section 77 of the FIA or 57 of the IA. External Auditor an independent firm of accountants, appointed by a financial institution pursuant to Section 81 of the FIA, to conduct an external audit on behalf of that financial institution. Independent Director a person as defined in the FIA – Section 36(6)(c). Onsite Examination refers to an examination of a financial institution conducted by the Central Bank. On-site examinations are generally used to determine the safety and soundness of the financial institution’s operations and financial condition. Examiners evaluate the quality of the financial institution’s assets; the effectiveness of internal controls, policies, and risk management systems; and compliance with relevant laws and regulations. Regulator means the Central Bank of Trinidad & Tobago as established under the Central Bank Act Chap 79:02. Skilled person refers to an expert with the appropriate knowledge and/or skills relating to the business of a licensee and experience to prepare an objective report on the matters concerned. A skilled person may be an individual or a firm and includes, but is not limited to, the following:  external auditor;  actuary;  accountant;  lawyer; or  any other person with the relevant business, technical or technological skills.

Code of Practice for Engagement with External Auditors of Financial Institutions Central Bank of Trinidad and Tobago Page 16