Auditing Non-Compliance with Laws and Regulations

1. The Auditor's Investigation: Procedures for Identified or Suspected Non-Compliance

When you come across information suggesting non-compliance—perhaps from reading board minutes, inspecting correspondence with regulators, or even during routine transaction testing—you must initiate a structured process. It's not about immediately jumping to conclusions or modifying the audit report. Instead, you must first investigate and understand the situation.

Let's watch a video that outlines the key steps you should follow.

As the video explained, your procedural response involves the following key steps:

1. Understand the Act and Circumstances: You first need to get the facts straight. What is the nature of the non-compliance? Was it intentional or an oversight? Is it an isolated incident or a pattern?
2. Evaluate the Possible Effect on the Financial Statements: This is your primary concern as an auditor. The non-compliance might result in fines, penalties, or litigation, which could require a provision or disclosure. In severe cases, it could even threaten the company's ability to operate (a going concern issue).
3. Discuss with Management and TCWG: Your first port of call is to discuss the matter with the appropriate level of management. If you suspect management is involved, you should escalate the discussion to Those Charged with Governance (TCWG). The goal is to obtain their perspective and any supporting information they might have.
4. Consider the Need for Legal Advice: What if management or TCWG cannot provide sufficient information, or you doubt their explanation? SA 250 states that you should consider obtaining legal advice. This is a critical step before considering any modification to your opinion, as the matter of whether an act constitutes non-compliance is ultimately a legal determination.
5. Evaluate the Implications for the Rest of the Audit: An instance of non-compliance, especially if it was intentional and concealed by management, should raise your professional skepticism. It may call into question the reliability of other management representations and could require you to reassess your overall risk assessment.

For a more formal and detailed explanation of these procedures, you should review the ICAI's study material.

2. Reporting Responsibilities: The Three Channels of Communication

Once your investigation has given you a clearer picture of the non-compliance and its effects, your next duty is to report your findings. SA 250 sets out three distinct channels for this communication.

Channel 1: Reporting to Those Charged with Governance (TCWG)

Unless the matter is "clearly inconsequential" (a very low bar, meaning almost everything should be communicated), you must report the non-compliance to TCWG.

Key points for reporting to TCWG:

• You must communicate all matters of non-compliance, unless they are clearly inconsequential. In your exam answers, using the phrase "other than when the matters are clearly inconsequential" demonstrates precise knowledge.
• If you believe the non-compliance is intentional and material, you must communicate it to TCWG as soon as practicable.
• If you suspect management or TCWG are involved, you must communicate the matter to a higher level of authority, such as an audit committee or supervisory board. If none exists, you should consider obtaining legal advice on how to proceed.

Channel 2: Reporting in the Auditor's Report

If the non-compliance has a material effect on the financial statements, it will impact your audit opinion. This is where SA 250 directly links with SA 705, Modifications to the Opinion in the Independent Auditor's Report.

The impact on your audit report depends on the situation:

• Material Effect Not Reflected: If you conclude the non-compliance has a material effect on the financial statements and it has not been adequately reflected (e.g., a required provision for a penalty has not been made), you must express a Qualified or Adverse Opinion.
• Scope Limitation by Management: If you are precluded by management or TCWG from obtaining sufficient appropriate audit evidence to evaluate the non-compliance, you must express a Qualified Opinion or a Disclaimer of Opinion.
• Scope Limitation by Circumstances: If you are unable to obtain sufficient evidence due to limitations imposed by circumstances (not management), you must evaluate the effect on your opinion, which could lead to a qualification or disclaimer.

Channel 3: Reporting to Regulatory and Enforcement Authorities

Your duty of confidentiality is a cornerstone of professional ethics. However, in certain cases, this duty can be overridden by law or regulation.

Your final reporting responsibility is to determine whether you have a duty to report the non-compliance to an outside party, such as the RBI, SEBI, or another regulatory body.

This determination requires careful consideration of the specific legal and regulatory framework applicable to the entity. In some regulated industries (like banking), this external reporting duty is explicit.

3. Application: A Case Study

Let's apply these concepts to a practical scenario. Imagine you are auditing a public company and discover the following.

LMN Limited has incurred a loss for the year. The company paid its Managing Director, who is also the majority shareholder, remuneration that exceeds the limits prescribed by the Companies Act, 2013 for a loss-making company. The management argues that obtaining shareholder approval is just a formality since the MD holds over 51% of the shares and they have not sought the required Central Government approval.

Think about this:

1. What is the non-compliance here?
2. What are your reporting responsibilities as the auditor?

Analysis:
The non-compliance is a clear violation of the Companies Act, 2013, a law with a direct effect on the financial statements. Management's argument is invalid; the legal procedure must be followed regardless of the shareholding pattern.

Your responsibility, as described in Case Study III of the article "SA 250: Consideration of Laws and Regulations..." from the Bombay Chartered Accountant Journal, would be to:

• First, advise the client to either seek the necessary approvals or recover the excess remuneration from the director.
• If management refuses to do so, the financial statements do not comply with the Companies Act. You would conclude that the non-compliance has a material effect that is not adequately reflected.
• Therefore, you would need to issue a modified opinion—specifically, a qualified opinion—in your auditor's report, explaining the non-compliance and its financial effect.

4. The Paper Trail: Documentation

As with all significant audit matters, your work on non-compliance must be properly documented in your audit file. This serves as evidence of the procedures you performed and the conclusions you reached.

In summary, your audit documentation (as per SA 230, Audit Documentation) should include:

• Details of the identified or suspected non-compliance.
• The results of your discussions with management, TCWG, and other parties (like legal counsel).
• A copy of the written representation you obtain from management stating that they have disclosed all known instances of non-compliance to you.

Conclusion

Today, you've learned the systematic process an auditor must follow after identifying potential non-compliance with laws and regulations. This isn't about rote memorization but about a logical sequence of investigation, evaluation, and communication.

Key Takeaways:

• Procedures: Upon suspecting non-compliance, you must first understand the act, evaluate its effect on the financial statements, discuss it with management/TCWG, and consider seeking legal advice.
• Reporting to TCWG: You must communicate all but "clearly inconsequential" matters to TCWG, and do so urgently if the non-compliance is intentional and material.
• Reporting in the Audit Report: If a material non-compliance is not adequately reflected in the financial statements, or if your scope is limited, you must modify your opinion (Qualified, Adverse, or Disclaimer) in line with SA 705.
• Reporting to Regulators: You have a professional duty to determine if you have a statutory obligation to report the non-compliance to an external authority, which may override your duty of confidentiality.
• Documentation: Always document the non-compliance, your discussions, and your conclusions.

Preview of the Next Lesson

We've discussed what to communicate to TCWG in the specific context of non-compliance (SA 250) and internal control deficiencies (SA 265). Our next lesson will broaden this focus. We will delve into SA 260, Communication with Those Charged with Governance, to explore the principles of effective, two-way communication that underpin the entire audit process. You will learn about the importance of establishing a constructive dialogue with those at the top of the entity.