Guidance on auditor's acceptance and continuance of audit engagements

Guidance

This guidance replaces the Financial Supervisory Authority of Norway's circular 6/2021. The guidance explains how the Financial Supervisory Authority interprets and practices the rules on auditor's acceptance and continuance of audit engagements. It applies to all auditors and audit firms subject to supervision by the Financial Supervisory Authority.

1 Background and Purpose

The purpose of the acceptance assessment is to clarify whether the audit can be carried out in a sound manner. The auditor must assess their own circumstances, particularly independence, competence, and capacity. The auditor must also assess circumstances related to the audited entity, including whether management has the ability and willingness to comply with laws and regulations, and to facilitate the audit by providing access to necessary information and investigations. Similarly, the auditor must assess whether the engagement can continue if new circumstances or new information later emerge that suggest it.

The auditor must resign if the audited entity does not rectify illegal matters that the auditor has uncovered and pointed out in the audit. A new auditor shall then not accept the engagement until the audited entity has complied. If an audited entity does not comply and therefore fails to elect a new auditor, the entity will be compulsorily dissolved.

In addition to the Auditor Act and the Audit Regulation, International Standards on Auditing (ISA) also contain rules on the acceptance and continuance of audit engagements.

1.1 Topics covered by the guidance

Section 2 discusses the audit firm's responsibility for quality management.

Section 3 discusses actions before acceptance that fall under the responsibility of the engagement partner. The section also discusses actions related to acceptance and continuance that are the audit firm's responsibility but are often handled by the engagement partner on behalf of the audit firm.

Section 4 discusses continuance assessments in engagements where the question of resignation is not relevant.

Section 5 discusses situations where the auditor must consider resigning.

The duties related to the acceptance and continuance of audit engagements partly overlap with the duties under the Money Laundering Act. This applies to both risk assessments that the audit firm must undertake and actions incumbent on the engagement partner. The guidance does not discuss the duties under the Money Laundering Act. Audit firms must themselves assess how the duties in both sets of rules can most appropriately be fulfilled in acceptance and continuance assessments.

2 Audit firm's duties

2.1 Quality management

The audit firm shall establish a sound system for assessing acceptance and continuance in accordance with the requirements for quality management in Chapter 7 of the Auditor Act.

The legal provisions in the Auditor Act are supplemented by ISQM 1 (International Standard on Quality Management). Acceptance and continuance of client relationships and specific engagements are an element of the audit firm's quality management system, see ISQM 1 paragraph 30. The requirements mean that the firm must ensure that decisions on acceptance and continuance are based on sufficient and relevant information about the engagement, the client's integrity and ethical values, and the firm's ability to perform the engagement in accordance with professional standards and legal requirements. The firm must also ensure that financial or operational considerations do not lead to inadequate assessments of acceptance or continuance. Furthermore, the firm must assess whether the engagement partner has sufficient capacity, competence, and independence, and ensure access to necessary resources, see Auditor Act § 7-1 third paragraph letters b, d, and e.

To fulfill the requirements, the firm shall establish policies and procedures that specify the following:

Which assessments shall be made, by whom, at what time, and what shall be included in the basis for assessment, see, among others, Auditor Act § 9-2 second paragraph and § 9-3 first paragraph.

When drafting the policies, the audit firm's finances or other circumstances that may undermine the purpose of the provisions on acceptance and continuance shall not be emphasized.

Who shall make the decision on whether an engagement shall be accepted, continued, or resigned from.

It must be clear whether the decision shall be made by the engagement partner on behalf of the audit firm, and if so, whether and when the decision shall be discussed with others. Such discussion may, for example, be relevant when there is a question of whether there is a duty or right to resign. It must also be clear whether different processes apply for acceptance depending on criteria such as the nature of the business, size, or other relevant circumstances.

How the assessments of acceptance and continuance shall be documented, and how documentation of the basis for the decision shall be stored so that the documentation is traceable for control both internally in the firm and during external control or supervision.

How compliance with the policies shall be continuously monitored, by whom, and at what time.

How deviations shall be handled when breaches of legal requirements, auditing standards, and internal policies are detected.

For policies and procedures to function as intended, they must be easily accessible, understandable, and sufficiently detailed to provide real guidance for those who are to use them.

According to Auditor Act § 7-1 sixth paragraph, the requirements for organization and quality management shall be adapted to the nature, scope, and complexity of the business. The proportionality principle does not imply an exception from the legal duties but allows for different designs of risk management and control measures based on the specific characteristics of the business. The firm must therefore adapt control measures and reporting procedures to the size and risk profile of the business. In larger and more complex businesses, more extensive governance and control functions may be necessary than what follows from the minimum requirements of the law.

2.2 Use of templates

Templates for policies and procedures are a useful aid in risk and quality management work. However, it is not sufficient to merely fill in the audit firm's name and other standard fields in such templates. The audit firm must specifically assess which policies and procedures are necessary to manage and control the actual risks in the business.

3 Acceptance of audit engagements

3.1 Engagement partner's duties

The engagement partner shall make independent and specific acceptance and continuance assessments based on criteria, procedures, and methods established by the firm and in accordance with the requirement for good auditing practice, including ISA 220. This includes, among other things, assessing client integrity, whether the engagement team has sufficient competence and capacity, whether independence requirements are met, and whether the risk level is acceptable.

The engagement partner has a responsibility for the performance of the audit. This responsibility also includes assessing their own competence and capacity. If the audit firm has not ensured access to sufficient resources and necessary competence, the engagement partner must consider resigning from the engagement responsibility.

In the further discussion, it is assumed that there is no uncertainty regarding capacity, competence, and independence that prevents the engagement from being accepted by the audit firm and the designated engagement partner.

3.2 Information about the entity to be audited

The auditor must obtain necessary information about the entity to be audited to have a sound basis for assessing whether the engagement can be accepted.

3.2.1 Communication between previous and new auditor

Before an audit firm undertakes an engagement for statutory audit or attestation of mandatory sustainability reporting, the firm shall ask the audited entity's previous auditor to disclose whether there are circumstances indicating that a new auditor should not undertake the engagement, see Auditor Act § 9-2 first paragraph. It is not uncommon for larger entities to obtain offers from several audit firms. Giving an offer in such a situation does not trigger a duty to contact the previous auditor. The duty arises only when the audit firm has received a concrete request to undertake the engagement.

The duty to obtain information from the previous auditor does not apply if the entity had not elected an auditor for the financial year preceding the financial year the new auditor is to audit. The Financial Supervisory Authority nevertheless believes that the audit firm should also make contact in such cases. The previous auditor may have relevant information, especially in cases of self-resignation, and should therefore receive and respond to such inquiries.

Information from the previous auditor shall be documented and included in the audit documentation, either the engagement is accepted or rejected. The scope and completeness of the information will could vary, and the new auditor must be consciously aware of this. Manglende svar fra forrige revisor kan ikke tolkes som at alt er i orden. If the auditor does not receive sufficient information to make a sound assessment, the engagement shall not be accepted.

The previous auditor is obliged to provide complete information about all matters of significance for the new auditor's assessments. The information should be provided in writing and without undue delay. If the previous auditor does not fulfill the duty to provide information in time, the incoming auditor should report the matter to the Financial Supervisory Authority.

3.2.2 Relevant information

What information is necessary must be assessed specifically. The overall information basis must be sufficient for the auditor to make a sound assessment of the engagement based on the requirements of the Auditor Act, good auditing practice, and the audit firm's policies and procedures in the quality management system.

Information that may be relevant when assessing whether the audit engagement can be accepted, is among other things

the previous annual financial statements, including the board of directors' reports

the latest audit reports, particularly to clarify whether these contain qualifications or emphases

the latest interim financial statements

numbered communications from previous years and other central communication between the previous auditor and the audited entity

whether the audited entity has had frequent auditor changes, including whether a change occurred at an extraordinary general meeting

information about the entity's business and the industry/industries it operates within

information about management and management's integrity, obtained, for example, by searching public registers and media

correspondence between the audited entity and various supervisory authorities

3.3 Assessment of received information and further handling

Based on the received information, the new auditor must assess whether the engagement can and should be accepted. The fact that the previous auditor discloses circumstances indicating that the new auditor should not undertake the engagement does not preclude the engagement from being accepted. However, it sharpens the requirement for the new auditor's assessment and justification. In such cases, there is also a special duty to document the basis for the decision, see Auditor Act § 9-9 third paragraph.

A central part of the auditor's assessment is whether conditions should be set for undertaking the engagement, eventuelt hvilke. The received information may for example show that the entity does not comply with legal or regulatory requirements, such as illegal loans to shareholders, failure to follow the duty to act under the Public Limited Companies Act or the Private Limited Companies Act in case of breaches of requirements for sound equity and liquidity, breaches of the Bookkeeping Act and Accounting Act, including missing, delayed, or incorrect reporting to public authorities.

There may also be circumstances that the previous auditor has pointed out related to significant deficiencies in the entity's internal control, uncertainty about going concern, lack of competence, or lack of willingness on the part of management or other key personnel to rectify the circumstances. Emphases and qualifications in the latest audit report will always be central to the assessment. The same applies to matters pointed out by supervisory authorities.

The starting point is that breaches of law or regulation must be rectified before the audit engagement can be accepted. Examples of such circumstances are illegal loans to shareholders, missing concessions or permits, and insufficient capital injection, etc.

For circumstances that cannot be rectified quickly, the auditor shall require a realistic plan for how and when the circumstances shall be put in order. The auditor must assess whether it is overwhelmingly probable that the plan will be implemented, before the engagement is accepted. The plan must be in writing, and the auditor's assessment of each point shall be documented in the engagement documentation.

When the auditor submits a declaration of willingness to the Register of Business Enterprises, the auditor is bound to the engagement. An obligation may also arise on other grounds, for example, by entering into an engagement agreement or other conduct that gives the entity reasonable grounds to believe that the engagement has been accepted. The auditor must therefore be clear in communication and ensure that necessary reservations are made until a final decision on acceptance has been made. Conditions for acceptance and the consequences of non-compliance shall be clearly stated in the engagement letter or other written communication to the board, see Auditor Act § 9-5.

3.4 Follow-up after acceptance of the engagement

If acceptance is conditional on the entity rectifying circumstances, the auditor shall follow up that the conditions are complied with. Such follow-up cannot be postponed until the ordinary audit procedures. If the circumstances are not rectified, the auditor must consider immediate resignation. It is not sufficient to follow up with qualifications or emphases in the audit report.

4 Continuance assessments

Before the audit firm continues a statutory audit in medium-sized or large entities, or attestation of mandatory sustainability reporting, it shall be assessed whether the audit firm has sufficient competence and resources, and whether the engagement partner has the necessary approval, see Auditor Act § 9-2 second paragraph, cf. Accounting Act §§ 1-5 and 2-3. For statutory audits of public interest entities, the circumstances specified in Article 6 of the Audit Regulation shall be assessed. The assessments shall be documented in accordance with Auditor Act § 9-9.

Independence assessments shall be documented regardless of the entity's size, see Auditor Act § 8-5.

The continuance assessment shall include, among other things, the audited entity's follow-up of matters discussed in numbered letters, see Auditor Act § 9-5. Other communication with the audited entity may also be relevant. If the auditor has raised questions about management's integrity, this shall be included in the assessment. Other circumstances that may suggest a more extensive continuance assessment, are significant changes in the business, financial circumstances, including profitability, as well as changes in ownership.

The continuance assessment shall be carried out annually, and at such an early stage that it does not arise a pressure to continue the engagement. A new assessment shall also be made if the auditor becomes aware of new circumstances or new information that suggests it.

4.1 Appointment of new engagement partner

When engagements are transferred internally within the audit firm, the new engagement partner must make their own acceptance assessment of the engagement, see section 3.1. This applies regardless of the reason for the transfer.

5 Resignation from audit engagements

The auditor has a duty to resign from an engagement for statutory audit or attestation of mandatory sustainability reporting when the auditor, during their work, has pointed out significant breaches of legal requirements and the audited entity does not implement measures to rectify the circumstances, see Auditor Act § 9-6.

The auditor may otherwise only resign if the auditor is not given the opportunity to fulfill their duties, or if there are other special reasons. Such special reasons may be that the audit firm no longer has sufficient competence, significant cooperation problems or that necessary accounting material is not presented within a reasonable time.

To be able to resign, the matter must have been raised in numbered communication to the board, with indication of what must be rectified and within which deadline. It must be clear from the numbered communication that the consequence of the entity's failure to rectify will be that the auditor must withdraw from the audit engagement.

When resignation has been decided, the auditor shall notify the audited entity of this within a reasonable time. The auditor must assess specifically what is considered a reasonable time in each individual case. Such a notice shall be in addition to prior numbered communication, and the notice is in reality an orientation about the resignation and its timing.

The auditor shall report the resignation to the Register of Business Enterprises without undue delay, see Auditor Act § 9-6 last sentence. The auditor must also assess whether there is a reporting duty under other legislation.