2.7 Lack of consent from audit client for sharing audit working paper files

Brief facts of the enquiry

As per requirements of S.R.O. 1044 (1)/2015 dated October 22, 2015, all non-listed companies which are required to appoint QCR rated audit firms as their statutory external auditors, are bound to facilitate their statutory external auditors in ICAP quality control review process of their audit working paper files by authorizing them to make available all the relevant information including the audit working paper files.

The above referred engagement was not offered for quality control review process contrary to the above referred S.R.O., on the pretext that the company had not given its consent to the auditors to share its information/ record.

In this respect the Auditing Standards & Ethics Committee is requested to provide opinion regarding the following:

i)Whether the firm was in non-compliance with the provisions of paragraphs 150.1 and 210.1 of the Code of Ethics (April 2015) reproduced as follows:

150.1 – The principle of professional behavior imposes an obligation on all chartered accountants to comply with relevant laws and regulations and avoid any action that the chartered accountant knows or should know may discredit the profession. This includes actions that a reasonable and informed third party, weighing all the specific facts and circumstances available to the chartered accountant at that time, would be likely to conclude adversely affects the good reputation of the profession.

210.1 – Before accepting a new client relationship, a chartered accountant in practice shall determine whether acceptance would create any threats to compliance with the fundamental principles. Potential threats to integrity or professional behavior may be created from, for example, questionable issues associated with the client (its owners, management or activities).

ii)In case the above provisions are not applicable, guidance is requested to apprise other provisions of relevant laws and regulations which the firm should have followed in case of lack of consent by its audit client to offer audit files for quality control review purposes.

The Auditing Standards and Ethics Committee’s comments and conclusion

1.The Committee considers and issues opinions on audit and ethics-related matters after consideration of:

the particular facts and information provided in each enquiry; and

the requirements of the International Standards on Auditing as applicable in Pakistan (ISAs), ICAP Code of Ethics, and audit and ethics-related provisions contained in the Companies Act, 2017.

In the context of the enquired matter, in addition to ICAP Code of Ethics, the Committee also analyzed the relevant provisions and requirements of:

ICAP’s Quality Control Review (QCR) Framework;

Directive 4.15 issued by the Institute;

SECP’s S.R.O. 1044 (1)/2015; and

Professional misconduct requirements of Chartered Accountants Ordinance, 1961.

The Committee noted that the ICAP Code of Ethics and ICAP QCR Framework are issued under the provisions of the Chartered Accountants Ordinance, 1961.

The Committee’s analysis and response to the enquired matter are based on the parameters outlined above and do not include ascertainment of documents/facts relating to the enquired matter or independent study or evaluation of the legal and statutory obligations.

2.Regarding the QCR Framework and related directives, the Committee noted that Directive 4.15 requires a practicing chartered accountant to submit the audit working papers for QCR purposes.

Directive 4.15 states that:

“The Council has reiterated that it is a professional requirement for practicing Chartered Accountants to submit their audit working paper files for a Quality Control Review (QCR) by the Institute. Thus practicing members are directed to only accept audit engagements, if the client gives consent to a QCR.”

3.The Code of Ethics is issued by the Council as Directive 6.04.

In context of the enquired matter:

a)Paragraph 140.1 of the Code of Ethics 2015 outlines the principle that a chartered accountant shall not disclose confidential information, subject to certain exceptions.

b)Paragraph 140.7 (c)(i) permits practicing chartered accountant to disclose information for QCR program of ICAP, unless such a disclosure is prohibited by law.

4.The Chartered Accountants Ordinance, 1961, also specifies the professional misconduct related provisions. Regarding the matter under discussion, the following misconduct-related provisions would be relevant:

a)a chartered accountant in practice shall be deemed to be guilty of professional misconduct, if he/she discloses information to any person, without the client’s consent or otherwise than as required by any law. (clause (1), Part 1 of Schedule II).

b)a chartered accountant shall be deemed to be guilty of professional misconduct, if he/ she does not comply with any of the directives issued or pronouncements made by the Council of the Institute. (clause (3), Part 4 of Schedule I).

5.With regards to SECP’s S.R.O. 1044 (1)/2015 (dated October 22, 2015), the Committee observed that this S.R.O. requires:

a)non-listed companies falling in the following categories to appoint QCR rated firms (who hold satisfactory QCR rating) as their statutory external auditors:

Public Interest company;

Large-sized company; and

Public Interest and Large-sized companies licensed / formed under Section 42 and Section 43 of the Ordinance.

b)companies (which are required to appoint QCR rated audit firms as their statutory auditors) to facilitate their statutory auditors in quality control review of the audit working paper files by authorizing them to make available all the relevant information/ documentation/ records including audit working papers to the Quality Assurance Department of the Institute.

6.The Committee noted that a reading together of above paragraphs (2), (3) and (4), raise the following legal questions:

a)whether the requirements of ICAP Code of Ethics (which is a Directive of the Institute) requiring a chartered accountant to provide information for quality control review program would be considered as ‘required by law’.

b)whether by providing working paper files and information relating to an audit client without client’s consent or against client’s consent would not attract penal action under the Chartered Accountants Ordinance, 1961 or any other law.

7.The Committee noted that the response to the enquired matter requires legal study and analysis. The Committee, ordinarily, does not express views on legal matters, however, given the professional nature of the enquired matter, the Committee views of a legal advisor on the above-mentioned key questions.

8.The legal advisor concluded that:

“It has been well established and deliberated above that Directives would be considered as laws for members of ICAP. Compliance with laws (including Directives) is mandatory, as Article 4 of the Constitution makes this requirement absolutely clear.

There are 2 aspects to this question. First is providing information, which appears to be mandatory as it is required under the Corporate Governance Regulations, the SECP Act (albeit indirectly) and Directive 6.04.

Second is issue with or without client consent, which again is immaterial because disclosure is permissible “if required by law”, and as we have ascertained, it is a requirement of law for an auditor to be QCR compliant if he wishes to conduct audit of specified entities. Secondly, Directive 4.15 also makes it mandatory for all auditors to have client consent anyways from the start (as a part of the engagement letter), so technically, the situation of not having client consent should never arise anyways.”

9.The legal advisor, has also referred to the following case laws on the validity and enforceability of agreements vis-a-vis law to clearly established through judicial precedence and decisions that no agreement shall be valid or enforceable if the purpose, object or consideration of the agreement is such that law or legal provisions shall be negated or overridden:

“The parties to contract cannot agree to do something which is prohibited by law and would tantamount to overriding legal provisions. Such an agreement shall be unenforceable. (2003 CLJ 683)

“When an object or consideration of an agreement is to evade the law, the agreement is bad under Section 23 (of the Contract Act) (PLJ 1980 S.C 431).”

The Committee’s conclusion:

10.The Committee, based on its understanding of the enquired fact pattern and legal expert’s discussion and views, concluded that:

a)Disclosure of client information by a chartered accountant in practice is permissible if so required by law. Such a disclosure would not amount to a professional misconduct under the Chartered Accountants Ordinance, 1961.

b)Directives issued by the Institute would be considered as ‘laws’ for members of the Institute, Compliance with laws (including Directives) is mandatory for members.

c)Through Directive 4.15, a chartered accountant in practice is directed to only accept audit engagements if his clients have given consent to the Institute’s quality control review. Chartered accountant in practice is required to submit the audit working paper files for the Institute’s quality control review. Directive 4,15 is reproduced below:

“The Council has reiterated that it is a professional requirement for practicing Chartered Accountants to submit their audit working paper files for a Quality Control Review (QCR) by the Institute. Thus practicing members are directed to only accept audit engagements, if the client gives consent to a QCR.”

d)The ICAP Code of Ethics has been issued under Directive 6.04. ICAP Code of Ethics permits a chartered accountant in practice to disclose information for the Institute’s quality control review program, unless such a disclosure is prohibited by law.

e)SECP through S.R.O. 1044/(I)/2015 has also notified that listed companies, public interest companies and large-sized companies shall appoint QCR rated auditor. Importantly, S.R.O. 1044/(I)/2015 requires such companies to facilitate their statutory auditors in quality control review of the audit working paper files by authorizing them to make available all the relevant information/ documentation/ records including audit working papers to the Quality Assurance Department of the Institute.

(Issued in November 2022)