Month: August

As a result of the above reforms, both the industry and audit profession have witnessed significant amendments in various provisions of the Companies Act 2013 (the Act), adoption of new accounting standards and auditing practices that are at par with global parameters, and formation of new regulatory bodies to closely monitor regulatory compliances.

The above initiatives have resulted into a multi-fold increase in the responsibilities of the members of ICAI, who are acting as an auditor of various companies, and vested with the responsibility to express an opinion on true and fair view of the financial statements, in light of the new provision and amendments introduced in the Act.

Although with all the above initiatives, we have witnessed a fast-paced improvement in both financial reporting and audit quality in a very short span of time, there is a lot of work that still needs to be done to ensure that this improvement process continue to give positive results and make high audit quality sustainable, and for which review boards and authorities have been constituted, as described below, to monitor and review the continuous progress:

National Financial Reporting Authority (NFRA): The NFRA is newly constituted by GOI in 2018, with an objective to continuously improve the quality of all corporate financial reporting in India by monitoring and enforcing compliance of accounting and auditing standards and by overseeing the quality of services of the professions associated with ensuring compliance with such standards, and suggest measures for improvement in the quality of services. The NFRA issues Financial Reporting Quality Review Report (FRQRR) post its review of quality of financial reporting of the company under review, and Audit Quality Review Report (AQRR) post its review of quality of audit services provided by the audit firm under review. Both these reports are available on NFRA website.

Quality Review Board (QRB): The GOI along with ICAI had constituted QRB in 2007, consisting of a chairperson and ten other members. The objectives of QRB are similar to NFRA, with a difference that the scope of QRB is limited to reviews of quality of audit services provided to private limited companies, unlisted public companies below the thresholds specified under Rule 3(1) of NFRA Rules, 2018 and other entities not specified under Rule 3(1) of NFRA Rules, 2018, and also entities that are referred to QRB by NFRA.

QRB issues a consolidated Quality Review Report every year summarizing its observations on quality of services, provided by various members of ICAI. The reports issued are available on QRB website.

Peer Review Board (PRB): PRB was constituted by ICAI in 2002, with an objective to ensure that in carrying out the assurance service assignments, the members of ICAI have complied with technical, professional and ethical standards as applicable including other regulatory requirements thereto and have in place proper systems including documentation thereof, to demonstrate the quality of assurance services. Thus, the focus of PRB is more towards enhancing the quality of professional work by adopting robust procedures and techniques that results into more reliable and useful audit and reports. Audit firms that successfully clears peer review are awarded peer review certificates.

Financial Reporting Review Board (FRRB): FRRB was constituted by ICAI in 2002, with an objective to bring improvement in the quality of financial reporting and auditor’s report thereon. The focus of FRRB is towards compliance of applicable accounting standards, compliance of the format and disclosure requirements of Schedule III and other provision of Companies Act 2013, and auditor’s report.

Apart from the above, Securities and Exchange Board of India (SEBI) and Registrar of Companies (ROC), also review financial results / statements filed with them, and issue notices to corporates, in case there are non-compliances of applicable rules and regulations.

The objective of this article is to highlight some of the common observations made by above regulators, towards compliance of Standards on Auditing, Accounting Standards and Schedule III of the Companies Act, during their reviews, so that the readers of this article who are also acting in the capacity of auditors, can take extra care while dealing with similar situation, and achieve high quality audit.

The major observations made by the regulators are summarised in three broad categories i.e. Observations related to Standards on Auditing, Accounting Standards, and Schedule III. Further, below are the review reports that are primarily referred to highlight the observations:

–    Report on Audit Quality Review for the financial year 2020-21, issued by QRB.
–    Report on Audit Quality Review for the financial year 2019-20, issued by QRB.
–    FRQRR on the financial statement of Prabhu Steel Industries Limited, for the financial year 2019-20, issued by NFRA.
–    FRQRR on the financial statement of KIOCL Limited, for the financial year 2019-20, issued by NFRA.
–    Study on Compliance of Financial Reporting Requirements (under Ind AS framework) issued by FRRB.

COMMON OBSERVATIONS WITH RESPECT TO STANDARDS ON AUDITING
We need to understand and acknowledge that audit planning and execution is a lengthy process and require significant efforts and professional judgement, to express an opinion on the financial statements that is appropriate in the circumstances. This responsibility of the auditor increases to a significant extent, as and when a new provision or amendment has been introduced by the regulatory authorities, as these amendments usually have implications on various aspects of audit.

ICAI has issued Standards on Auditing and also issues other auditing pronouncements from time to time, that provide appropriate guidance to the auditors in various aspects of audit and assist them in ensuring that sufficient appropriate audit procedures have been performed and adequate evidences have been obtained that are relevant and reliable in the circumstances, and assist auditors to discharge their responsibilities.

The regulators while reviewing the audit work of the auditors refer these guidance and pronouncements to ensure that they have been adequately complied by the auditors while performing the audit. The common observations that the regulators have highlighted during such reviews are as under:

1. Standard on Quality Control (SQC-1)

Some of the most common findings with respect to engagement quality control and compliance of Standard on Quality Control (SQC-1) primarily includes:

–    Lack of adequate quality control manuals or implementation and monitoring of policies and procedures to ensure that the firm and its personnel perform the work that complies with professional standards, regulatory and legal requirements and issue reports that are appropriate in the circumstances.

The reviewers have reported highest number of adverse observations with respect to the SQC-1 and the primary parameters considered by them for ensuring the compliance, includes the following:

–    Whether the firm’s code of conduct includes the ethical requirements relating to audits and reviews of historical financial information, and other assurance and related services engagements.

2. Audit engagement letter

The regulators in their review have commonly highlighted non-compliance of SA 210, Agreeing the terms of audit engagement, some of the commonly highlighted instances include:

–    Audit engagement letter executed post commencement of the audit.

3. Audit documentation

Audit documentation is the primary evidence for the auditor to demonstrate that all the required audit procedures have been adequately performed to ensure compliance with professional standards, and various regulatory and legal requirements and considering this significance, the regulators and reviewers expect that the audit documentation should be prepared in such way so as to sufficiently describe the status of compliance with the standards on auditing, the timing and scope of implementation of audit procedures, the grounds for judgments, and the conclusions reached.

Further the audit documentation should also demonstrate that all the audit documentation has been adequately reviewed in a timely manner by the more experienced audit team member, audit engagement partner, and engagement quality control reviewer to confirm that sufficient appropriate audit evidence has been obtained to support the audit conclusions reached.

Some of the commonly highlighted observations in the audit documentation includes, inadequate documentation with respect to following significant audit areas:

–    Impairment assessment of property, plant and equipment, and intangible assets.

Further with reference to the assembly and retention of audit file some of the below observations were highlighted:

–    Audit evidences collected / obtained were kept on record without linking it to any audit program or account balance;

–    Documents provided by the client and the documents generated / prepared by the audit team, were not adequately segregated and filed;

–    Inadequate documentation for discussions of significant matters with management or those charged with governance;

–    Delayed assembly of final audit file after the date of auditor’s report.

–    Addition and modification in audit documentation after the date of auditor’s report, without documenting the reasons for addition / modification.

4. Written representation

As per SA 580, written representations are necessary information that the auditor requires in connection with the audit of the entity’s financial statements. The regulators have highlighted that there are common instances where the auditors have missed to obtain the written representations from management on the matters like the management’s responsibilities for the design, implementation and maintenance of internal control to prevent and detect fraud, completeness of transactions and information provided, related party relationships and transactions with them, appropriateness of assumptions used in significant estimates etc.

It is worthwhile to highlight that it is mandatory for the auditors to obtain written representation from the management duly acknowledging their responsibilities with respect to various aspects of financial statements, also the written representation should be of a date that is close to the date of audit report, the best practice is to take the representation of the same date as of the audit report, and it should be taken on record by the Audit Committee and the Board of Directors, as the case may be, and signed by the personnel authorised by them.

5. Audit conclusion and reporting

The basic presumption of the regulators and reviewers before they start the review is that the audit opinion has been issued obtaining reasonable assurance whether financial statements as a whole are free from material misstatement, whether due to fraud or error; and the opinion complies with the applicable format of audit report and includes all the relevant paragraphs as required by standard on auditing. However, below are the few common observations that the regulators observed during their review:

–    Audit report strictly not in compliance with the format prescribed in SA 700 Forming an opinion and reporting on financial statements. The observations are more particularly towards reporting with respect to auditors’ and management responsibility paragraphs;

Auditor’s opinion is the final outcome of the audit, and hence it is imperative that the audit documentation must be prepared in such a manner, so that it can clearly support the audit opinion issued by the auditors.

The best practice in terms of ensuring the adequate documentation to support the audit opinion is to fill the various checklists with respect to Standard on Auditing, Accounting Standards, Schedule III, Companies Act compliances, and other regulatory compliances as applicable to the audit. The engagement partner should also encourage audit teams to map all the financial statement captions, that are subject to audit with their respective workpapers, and do tick and tie of numbers to ensure that there are no miss outs. Further, the audit engagement team should also maintain the repository of Guidance notes issued by ICAI and amendments introduced in the Companies Act, so that their compliance can be ensured before the audit opinion is issued.

COMPLIANCE OF ACCOUNTING STANDARD
Books of account are the primary records based on which financial statements are prepared by the management and then the audit is performed by the auditors. So, in order to conclude that the financial statements are free from material misstatement, the auditor are required to ensure that all the applicable accounting standards for recording and disclosure of transactions in the financial statements, have been adequately complied by the management.

Preface to the Statement of Accounting Standards states that the mandatory status of an Accounting Standard implies that while discharging their attest functions, it will be the duty of the auditors to examine whether the Accounting Standard is complied with in the presentation of financial statements covered by their audit. In the event of any deviation from the Accounting Standard, it will be their duty to make adequate disclosures in their audit reports so that the users of financial statements may be aware of such deviation.

Regulators considering that the Section 143(3) of the Companies Act, 2013 (‘the Act’) requires the auditors to report on the compliance of Accounting Standards as prescribed under Section 133 of the Act, also reviews the financial statements and audit file, to ensure whether the said reporting has been accurately done by the auditors based on the audit procedures performed.

Highlighted below are some more frequently observed non-compliances, with respect to accounting standards that have most number of observations, and also a graph depicting the observations across all the accounting standards:

Ind AS 107 – Financial Instruments: Disclosures

–    Nature of financial assets and liabilities based on their method of measurement are not adequately disclosed i.e., financial assets and liabilities that are measured at amortised cost, measured at fair value through other comprehensive income and measured at fair value through Statement of profit and loss.

–    Profit after tax is considered for the preparation of cash flow statement under indirect method.

–    Provision for gratuity not measured and recognised as per the valuation method prescribed under Ind AS 19.

–    Relationship between parent and its subsidiary, associates, joint ventures and other related entities have not been fully disclosed.

It is always advisable that the audit team must fill and document the accounting standard checklist as part of their documentation to ensure that the guidance of the applicable accounting standards with respect to recognition, measurement and disclosures have been duly complied with. Workpaper references of the detailed accounting evaluation of complex transactions should also be documented in the relevant sections of the checklist for ready references. Any such checklist must also be thoroughly reviewed both by the senior audit team members and the engagement partners before audit opinion is drawn.

The disclosure checklist as published by ICAI ‘Indian Accounting Standards (Ind AS): Disclosure Checklist (Revised February 2020)’, and ‘Accounting Standards (AS): Disclosure Checklist (Revised February 2020)’, can also be referred and used to achieve the above objective.

COMPLIANCE OF SCHEDULE III
The Companies Act, 2013 has prescribed the format for Balance Sheet and Statement of profit and loss under Schedule III, which is mandatory to be complied by all corporates in India. Auditors as part of their audit are required to ensure that general purpose financial statements as presented by the management must comply with the disclosure requirements of Schedule III, and material deviation if any, are reported in the auditor’s report.

Highlighted below are few non-compliances, with respect to the presentation of financial statements, as compared to the requirement of Schedule III, in their review report issued by the regulators:

Balance Sheet – Assets

–    Incorrect classification of advances given to vendors.

–    Working capital loan obtained from banks was not classified as loans repayable on demand from Banks under “Current Borrowings” in the balance sheet.

–    Interest income from related parties was not disclosed separately, instead it is clubbed under miscellaneous income.

It was also highlighted that rounding off requirements for the figures appearing in the financial statements to the nearest, lakhs, millions or crores, or decimals thereof, has not been complied with as per the requirements of Schedule III.

Further, Registrar of Companies (ROC), are also performing reviews of financial statements to ensure the compliance of the Act, and issuing notices to the auditors and companies for the non-compliances they are observing related to accounting standard, Schedule III and other requirements of the Act.

Financial statements as prepared by the management and audit opinion formed by the auditors are the two primary documents that are considered as the final outcome of the audit, and on which reliance will be placed by the various users of the financial statements. Hence, it is of utmost importance that due care must be taken to ensure that these documents are free from errors.

It is advisable that apart from filling of required checklists audit firms should also establish and follow the practice of independent reading of financial statements and audit reports, before they are attested and released, by the experienced audit partners or members of the firm, as part of their quality control practice, so as to avoid any apparent non-compliance or errors, that might have been missed by the audit team.

TO SUMMARISE
Auditors are playing a crucial role in achieving the objective of a robust financial reporting environment, and hence it is imperative that their quality of services should not be compromised and their independence should not be questioned by regulators and investors. To achieve this, the audit firms must follow a robust mechanism to ensure that they are continuously and consistently performing their duties, by complying with all the applicable rules and regulations, under all circumstances, and their independence is not getting impaired at any point of time.

The GOI has also acknowledged the efforts and contributions of auditors from to time, and have supported them in tightening the loose ends by appointing regulators that can review and highlight the weak points.

It has been rightly said that excellence can only be achieved by focusing on shortcomings and putting continuous efforts for improvement by producing better results, the saying equally applies to the auditing profession, with the advantage that independent regulators have been appointed to identify and highlight the shortcomings in audit, so that auditors can strive harder to improve their audit quality and issue audit opinions that are fully compliant with applicable laws and regulations.

New-age internal auditing is shifting its focus from transactional auditing to addressing risks of business processes. The audit scope has expanded and includes governance and executive management as well. More and more dimensions to their skills and challenges are waiting to be adopted. The auditor need not be a techie to unravel the mystery of technical frauds; he might as well depend upon the technical expertise within the organization or engage professionals with the required technical competency. What could be more satisfying than acquiring a little more technical knowledge and applying the same in auditing?

Auditing Standard SA 315 and International Auditing Standard ISA 315 (revised 2019) require the auditor to identify and assess the risk of material misstatement through an understanding of the entity and its environment.

Appendix 5 of ISA 315 contains illustrations about Understanding the Entity’s Use of Information Technology in the Components of the Entity’s System of Internal Control, which include understanding the complexity of IT applications and system security in general.

Appendix 6 of ISA 315 contains the areas to be covered under IT General Controls to identify and assess the risk of material misstatement to the auditee entity.

Hence, it has become necessary to identify and assess the risks arising out of the IT environment, including web applications, despite the complex nature of the applications and e-commerce transactions.

IT infrastructure consisting of hardware, physical servers, network components like routers, switches, firewalls, communication links, wireless access, cables and software such as operating systems, applications, virtual machines and databases are critical IT assets to any enterprise. This infrastructure’s resilience is entirely dependent upon how well it is managed and configured. Not only the management of the infrastructure, but the ability to monitor its security from external and internal threats has assumed paramount importance.

As the risk universe is becoming larger with advances in technology, not only the individual users but business enterprises, small or large, are becoming targets of cyber-attack.

The following case study would help to understand why such importance is to be given to vulnerability assessment:

Case Study: ABC Ltd. has a business model of providing a web application portal for online shopping for consumable products, garments and accessories for its customers. There is no retail outlet/showroom of the company, but it has multiple godowns/stores from where the goods are picked up and delivered to the customer’s doors as per online orders. The website provides payment gateway services through UPI, debit/ credit card payment facilities.

The internal auditor has conducted the audit for the internal control over financial reporting and also for its business processes for the last quarter and identified no significant deficiencies except for the reconciliation gaps in the suppliers’ accounts and internal control weakness in the goods receiving, returning and GST reporting.

On review of the internal audit reports by the audit committee, it was felt that despite an in- depth internal audit of the business processes and financial reporting, the following instances were not adequately addressed by the internal audit.

Customer complaints are increasing, which include slow response to the web application, duplicate deliveries, incorrect deliveries and Denial of Service due to frequent operational glitches of the system. Management has also received email alerts from Government Emergency Response Team that it has observed attempts to attack the company’s website portal from certain external IP addresses and has been advised to take appropriate measures.

The senior management discussed the matters with the internal audit team. The internal auditors, with the help of cyber security professionals, found the root cause was the lack of system monitoring and its operations and the absence of vulnerability assessment of the website and application. As a corrective action plan, the vulnerability assessment was carried out on the IT infrastructure and web portal, which unravelled the following weaknesses:

• Operating system was not updated for the latest security patches.

• Traffic to and from customer users was not secured due to outdated encryption protocol.

• No preventive measures were taken on the website source code to conceal internal database confidential information.

• Unprotected internal servers and weak firewall settings and their position have made the system vulnerable to external cyber-attack.

With the help of cyber security professionals and the internal audit team, all the high-risk vulnerabilities were fixed, and continuous monitoring of the web traffic was initiated. Consequently, the performance and website response improved, customer complaints reduced and reasonable information security was assured.

As an internal auditor, one always thinks of overseeing the implementation of the IT General Controls. There are a whole lot of areas, from access controls to business continuity plans which are reviewed and tested for operating effectiveness. However, that is not enough. The auditor may not discover operating system level weaknesses, or the lack of adequate controls embedded in the configuration of the servers and networking components. Similarly, the application installed to enable business processes may have weaknesses that would invite an external attack on the data supported by the application. The best way to identify serious and general weaknesses in the IT infrastructure and application is the Vulnerability Assessment.

Vulnerability Assessment is a method of identifying vulnerabilities or weaknesses in the installed IT infrastructure of an entity. The vulnerabilities are the gaps against a benchmark of parameters or globally accepted controls in the installation of devices. There are various methods by which vulnerability assessment is performed. A wide range of tools is available to identify vulnerabilities. At times, technically skilled professionals also conduct manual code reviews.

The following diagram will help to understand the process of vulnerability assessment and remediation.

 

For a better understanding, one can broadly divide the vulnerability assessment based on configuration related vulnerabilities or structural vulnerabilities and Software Application related vulnerabilities.

STRUCTURAL VULNERABILITIES
Vulnerabilities, where the weakness exists in the installation of hardware or network, are easy to identify, such as network is incorrectly designed, lack of security at entry level components like firewall, or configuration without considering the risk of data disclosure. Some of these are explained in the following paras for better understanding:

No Network Segregation
While designing a network, it is expected that all the machines used for specific functions should be segregated logically from other machines in the network. For example, machines (nodes) used for investment or treasury functions should be segregated from machines used for handling customer transactions. Similarly, super user functions like administration of database or user management should be segregated from end-user application machines. If this is not done, the risk of unauthorized intrusion into the network like ‘data entry level’ user being able to access the super user administrator machine and his privilege for malicious purpose cannot be ruled out.

Number of unnecessary Open Ports
In a network, a port refers to a logical door, necessary and forming part of a network device which has dedicated services attached to it. For instance, browsing service through the internet is made available by port 80 or 443; both have different protocols (method of using). For file transfer to a shared folder, port no. 20 is used. 23 is used for remote access protocol called Telnet and so on. A detailed list is available on any search engine.

If an entity computer is not used for remote access, a particular port that has enabled the remote access service through the open port needs to be disabled/closed.

Ports are an integral part of the internet communication model. All communication over the internet is exchanged via these logical ports. The internal auditor, therefore, needs to see that the network setup does not have unnecessary ports open. He needs to obtain a list of services required for the routine functioning of the network and should recommend the closure/disable of the unnecessary open ports. It is important to note that cyber criminals exploit unused ports for malicious use of the network.

Firewall misconfiguration
A firewall is a critical component which regulates the traffic between the internal network and the external world. It acts like a bastion for unauthorized entry into the internal network and, at times, prevents information from leaking to unauthorized destinations (URL). Firewalls are getting smarter and smarter these days with more flexibility in rules settings and can detect rogue users and perpetrators of DOS (denial of service) attacks.

A misconfigured firewall will be known through a vulnerability assessment, which helps greatly in fixing the intrusion detection issues.

Absence of DMZ or inappropriate network structure
In case web-based applications are accessed by customers, like in banking or online security trading, it is always advisable to create a subnet called a Demilitarized zone network to protect the internal network and critical servers and data from the external public internet. The risk of external attack is mitigated by providing an extra layer of security.

Remote access vulnerability
As in the work from home environment, access to the servers which store confidential data is made possible through an application or by entering an IP address from public internet from an unsecured endpoint. Due to frequent cyber-attacks on the communication lines, it is advisable to access the remote server by applying VPN (Virtual Private Network) for a secured link or applying high standard encryption to the communication messages. Remote access to a server by installing VPN helps not only to secure the endpoint, but provides traffic to be encrypted, which then cannot be sniffed by malicious intruders.

Uncontrolled direct access to the System
This occurs when a user is not verified through authentication like user ID and password. Further, when there is no layer of security of access levels, the user can simply enter the system by providing user ID and password, and can go beyond his role or privilege in accessing any unauthorized applications, data and root level file structures. A vulnerability assessment would indicate this weakness by reporting absence of Active Directory installation.

An Active Directory is a software tool installed in an enterprise network to control the users and their access area. It helps to organize users and provide a single sign-on access to the specified computing resources within the organization. Hence any user wanting to access any application or files first need to be present as an authorized user in the Active Directory.

SOFTWARE APPLICATION VULNERABILITIES
These vulnerabilities either arise out of disregarding security and confidentiality in input or processing of data activities. The weaknesses are inherent and cannot be revealed without a thorough application assessment. The vulnerability may arise out of web-based or independent, stand-alone applications. There are thousands of vulnerabilities that can be identified of which all are not critical. These can be graded based on impact on the security of a data or system. High damaging impact due to the existence of vulnerability is rated Critical, which needs to be addressed on priority. Other vulnerabilities can be high, medium or low-risk level vulnerabilities. Some vulnerabilities are ‘Information Type’ and may not harm the users of the application. Following are the most frequent high and critical risk level vulnerabilities often found in business applications and the network.

Weak Authentication Mechanism
In the case of application, the first level of access is user authentication by entering user identity, password and nowadays, additional authentication like OTP on mobile.

Vulnerability of weak authentication indicates that the user ID and password for access are easy to crack, or the password length and complexity are not strong enough to provide difficulty in cracking the password through Brute Force technique.

Network device with default password
Network devices like a router, firewalls or other components has been installed without taking care of changing the default password provided by the manufacturer/vendor.

As a result, hackers with knowledge of default passwords can access the network and cause data theft or data manipulation.

Remote access and code execution vulnerability
The remote code execution (RCE) vulnerability allows attackers to execute malicious code on a computer remotely. The impact of an RCE vulnerability can range from malware execution to an attacker gaining complete control over a compromised machine.

Application is vulnerable for directory traversal
Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. In some cases, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data or behaviour and ultimately take complete control of the server.

Web Page can be defaced by unauthorized remote intruders
Website defacement happens when hackers access a website and leave pictures or messages across the site, thus defacing it. Simply put, hacktivists replace the content on your site with the content of their choice.

Some preventive measures are the Principle of Lease Privilege – allowing access to only limited on role-based access; reducing use of add-ons and plugins, which increase website vulnerabilities; and limiting error messages on the site, which often provide detailed information about file information which hackers can exploit.

Privilege right of access can be escalated through an ordinary user
In a network where, by applying certain techniques, one gains access to the user credentials, the attacker will use the user ID to gain administrative access rights and use it to enter another application or manipulate security settings to serve his malicious purpose. This can be identified with suspicious login attempts and unusual malware on sensitive systems. This would need an urgent incident notification to limit the damage to the application and data.

Certain Services e.g., MS SQL (MS structured query language) is running with default userid and password
Default user ID or passwords are given by the vendor at first time installation of an application/ device. It is expected that the default user ID and password be changed to prevent access to others. If not done, the default passwords are used by attackers to gain access since these are widely known. For instance, your Wi-Fi router normally has admin-admin user ID and password. This vulnerability arises out of ignorance or negligence in setting up the application. When a service like SQL is running with a default password, you are inviting an attack on the database.
 
Application stores sensitive information in clear text format
When read and write access for an application is not restricted during the development stage, an attacker can access sensitive information stored and use the same for further damage to the data and may modify the data, cause incorrect results and possible denial of service attack, local file/data inclusion vulnerability.

Vulnerability related to readability of data files with remote execution command
Several web application components are needed to run a web application. In a basic environment, there should be at least a web server software (such as Apache or IIS), web server operating system (such as Windows, Linux, MacOS), database server (such as MySQL, MSSQL or PostgreSQL) and a network-based service, such as FTP or SFTP. All the components need to be protected with restricted access or masking. In the absence of restricted complex access, for a secure web server, all of these components also need to be protected to ensure that sensitive data is secured during remote access.

Secured service like HTTPS or SSL not implemented
SSL or secured socket layer technology keeps internet connection secured and protects the data transferred between two systems. So too HTTPS, indicating that the protocol protects the integrity and confidentiality of data between the user’s computer and the website. Hence, it is now common to implement these secured protocols. The vulnerability to not having these installed poses a high risk during the transmission of data to and from the web application server.

Unrestricted File Upload Vulnerability
Where a web application does not verify the contents of the file being uploaded and does not reject invalid files, this provides an opportunity to attackers to upload malicious files, which could, in extreme cases, result in taking over the target system. Therefore, validation of what is being uploaded through the web application is absolutely important.

SQL and other Injection Vulnerability
In most business applications, SQL databases are used to store data and employ SQL commands to execute database updates. An SQL injection attack may result in serious data damage. Attackers begin with identifying vulnerable user inputs in a web application using a SQL database such as SQL Server, MySQL, and Oracle, among others, because applications with SQL injection vulnerability leverage such user input to execute malicious SQL statements. Next, the attackers create and send malicious content to the SQL server to execute malicious SQL commands and hamper the database. Businesses may witness detrimental impacts of a successful SQL injection as attackers use such attacks to gain control over sensitive database tables, and user identities, and manipulate financial data through this vulnerability.

Cross Site Scripting Vulnerability
When a user interacts with a vulnerable website, he is returned with malicious code, which then takes the victim to another malicious site. Thus, vital details of the victim user are then captured and monitored. Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, carry out any actions that the user can perform, and access any of the user’s data. If the victim user has privileged access within the application, then the attacker might be able to gain full control over all the application’s functionality and data.

Web Cache Poisoning
A cache is temporary memory storage used for a website’s smooth operation. Cache poisoning is a type of cyber-attack in which attackers insert fake information into a domain name system (DNS) cache or web cache to harm users. In DNS cache poisoning or DNS spoofing, an attacker diverts traffic from a legitimate server to a malicious/dangerous server.

Vulnerability of URL being redirected (phishing attack)
When the user of a website is automatically redirected to another malicious website and is misguided to believe that the malicious website is a genuine website and is often asked to provide personal details like card number, bank account and UIDAI ID. Unfortunately, unless the user is aware of such masquerading, often the users are victims of financial loss and fraudulent transactions.

CONCLUSION
As more and more commercial transactions are conducted over the public internet, e-commerce and through apps, it has become all the easier for fraudsters to take the help of hacking tools and perpetrate frauds on innocent users/enterprises. Nowadays, the tools to hack IT servers, websites and web apps with guidelines and instructions are easily available on the dark net with minimal investment. The company’s employees and users who are unaware of the possible vulnerabilities may fall victim by clicking on unknown links or ignoring the system’s alert messages. It is therefore incumbent upon the internal audit team to perform a risk assessment of the IT environment by frequently conducting vulnerability assessments of the IT infrastructure and applications. It would certainly give the audit committee, and stakeholders improved assurance. The management would be made further aware of the red flags that compromise data integrity, processes, customer relations and company reputation.

This article highlights how Covid might have impacted the internal controls of companies. Needless to say, when the internal controls have been affected by the pandemic, the auditors of such companies need to consider its impact on their reporting on the adequacy and operating effectiveness of internal controls with reference to financial statements as prescribed u/s 143(3)(i) of the Companies Act, 2013.

The pandemic has hit all organisations globally and India is no exception. Considering this, the Securities and Exchange Board of India (SEBI) issued a Circular dated 20th May, 2020 encouraging listed entities to make timely disclosures about the impact of Covid on their companies. One of the items in the list of information that the Circular states listed companies may consider disclosing is internal financial reporting and controls.

The users of the financial statements, various stakeholders, including investors, lenders, suppliers and customers, Government agencies and so on, are keen to know to what extent the company has been affected by the pandemic. As stated in the ‘Guidance Note on Audit of Internal Financial Controls over Financial Reporting’ issued by The Institute of Chartered Accountants of India (GN on IFC) for the purpose of auditor’s reporting u/s 143(3)(i) of the Companies Act, 2013, ‘internal financial controls over financial reporting’ shall mean ‘a process designed to provide a reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.’ Therefore, to prepare reliable financial statements, internal controls over financial reporting are imperative. If such internal controls are affected by Covid and if the company has not taken adequate steps, the financial statements prepared may not be reliable for external purposes and the stakeholders will lose confidence in the entity’s financial reporting. From the governance perspective, it is important for the Audit Committee and management that new processes for financial statements closure and reporting of results and financial / operational controls are appropriately documented.

EXTENDED REPORTING TIMELINES

IMPACT ON FINANCIAL CLOSURES

(A) Performance reviews refer to overall analytical procedures of actual performance with budgets, forecasts, etc. However, it is very likely that the budgets, forecasts, prior period actuals, etc., did not include the impact of Covid at all, or had considered its impact based on information available at that time. In the absence of the robustness of a performance review, what controls does the company need to establish to ensure the reliability of financial information? Let’s understand this by way of an example. A company manufactures white goods such as dishwashers, washing machines, etc. Its volume of production in a given period is predictable as the company had established its plant many years ago. For F.Y. 2019-20, the company was able to run its normal operations throughout the year, except the last week near the year-end due to the lockdown. However, in F.Y. 2020-21, the lockdown was extended and therefore production was completely shut for part of the year. While reviewing the performance of F.Y. 2020-21 and comparing the same with the previous year, the variance can be quantified for that attributable to the period when the plant was shut.

(B) Information processing controls are application controls and general IT controls. Before Covid, these controls were usually based on the assumption that applications were being accessed by users through LAN. This identifies the user and has security firewalls to protect the data in the system to ensure its reliability. In the period of the pandemic, where many organisations had to close their offices and allow employees to work from home, IT systems are being accessed by employees through their home networks. The reduced number of employees may result in reduced controls being adhered to. Vulnerability of security for data protection and its unauthorised access pose a significant threat to the reliability of the financial close process. Further, there is heightened risk of data leakage. For example, a company has IT security through which tenders submitted by potential suppliers can be accessed by the procurement department only through the office LAN. During Covid, when staff is working on their home networks, such control cannot be implemented and needs to be modified without compromising on the security of the data. IT processes or controls that have an increased volume or that need to be performed differently due to changes in work environment or personnel, are likely to have additional risks in areas such as the following:

Access termination – Increased number of access termination requests and fewer people available to process them – this may increase the risk of unauthorised access due to terminated personnel not being removed in time. In many organisations, there is an exit form which the employee fills and after approval from the HR it is handed over to IT to ensure that all access given to that employee is terminated and confirmed by IT by signing the same form showing the date and time of termination. In the Covid scenario, the exiting personnel, HR staff and IT staff are all at different locations. To ensure coordination amongst them for terminating the access immediately when the employee leaves, different controls need to be put in place.

Change management – Verbal approvals may be accepted rather than waiting for approvals to be documented through a ticketing system, and thus there may be increased use of emergency IDs which may not be subject to the same degree or timeliness of monitoring as usually occurs. Whenever any change is required in the IT environment, many companies have a hard copy documentation system showing the requester, the approver and details of the changes made, followed by subsequent testing and implementation. During Covid, such hard copy documentation may not be possible given that the requester, approver, programme writer, testing team and implementation team are at different locations. This may require modification of the existing IT change management controls.

Execution of review controls – The questions to be answered are:
(a) What changes are made to the review process of access control, change management and other IT environment processes?
(b) To what extent are the company’s IT risks affected by the new way of working and what are the mitigating controls introduced to deal with the security threat to the IT systems that process financial data?

Many organisations are changing their strategies to take advantage of digital technology, such as storing data on cloud which can be accessed from anywhere by the authorised personnel. Even if the employee working on such data is not able to access the company’s server from her remote location, such data need not be copied on the workstation of the employee when it is available on cloud. With such changes in strategy, it is obvious that the relevant risk control matrix of the company will undergo a change. The new risks identified will be because the majority of employees are working from different locations. Controls to mitigate such risks, for example, data security risk as discussed above, will be plotted against each of such processes.

(C) Physical controls relate to the existence of assets and authorisations for their access. In the Covid scenario, such authorised person holding custody of the physical assets is away from the office or location of the assets for prolonged periods. How does the company ensure the existence of its assets when the person entrusted with their physical custody no longer has their custody? How has the company changed its internal controls which earlier were physical controls? For example, during partial lockdown, earlier internal controls might have been modified in respect of frequency of physical verification, the authority performing such verification, etc. Such modified controls may also consider any new digital technology implemented by the company or any supplemental controls to the original pre-Covid controls.

Safeguarding inventory
Safeguarding inventories is the responsibility of the management which is required to establish procedures to ensure the existence, condition and support valuation of all inventory. There may be transactions as at the yearend where the company has transferred the control of assets, but where physical possession is with the company such as bill-and-hold arrangements. The internal control framework relating to safeguarding and monitoring of inventories would need to include these considerations, e.g., assessing the inventory shrinkage by location, product type, or other disaggregated basis, comparing the actual inventory value of each location to an expected range, and investigate any individual locations that are outside of the expected range.

Further, with scenarios like localised lockdown, travel restrictions, etc., physical inventory counting would be challenging and in some cases impractical. In certain situations where the conventional method of physical verification is not practicable, management may establish internal controls to undertake physical verification remotely via video calls with the help of technology.

Environmental and safety norms
Companies may be using sensitive chemicals and industrial gases for producing goods. Some of these items are required to be stored in temperature-controlled containers and to be continuously monitored. If there is any leakage of hazardous gases or chemicals, the implications on the company could be very severe and even lead to closure of the factory, thereby affecting the going-concern assessment. Localised lockdowns imposed by various State Governments might induce stress on the monitoring mechanism relating to compliance with environmental and safety norms.

(D) Segregation of duties as a control was put in place by companies to ensure that employees preparing the information, authorising the information, recording the information and holding the custody of the documents are different. In the Covid scenario, the flow of physical documents to different employees performing these different roles is not possible. Further, many organisations had severe staff absences for prolonged periods as even the staff was affected by the pandemic. This requires delegating their responsibility to other staff and modifying internal controls around it. Has the company modified its internal control system and does the revised internal control system ensure effective segregation of duties, this is the question that companies need to answer.

Fraud risks
Fraud risks change in such a time of crisis, as new opportunities are created for internal as well as external parties. Incentives for committing fraud – both misappropriation of assets and financial reporting fraud – may also be heightened, especially if significant terminations are likely or employees suffer significant personal financial stress. As stated in the GN on IFC, ‘When planning and performing the audit of internal financial controls, the auditor should take into account the results of his or her fraud risk assessment.’ In the years when the company is hit by the Covid pandemic, fraud risk assessment of the auditor is expected to be different from the earlier years. The risk of fraud has increased significantly due to changes in the way of working. Such risks can range from the basic documentation process where scanned documents are being relied upon, which can be forged, as against the original signed documents; to frauds in complex transactions where significant estimation is involved such as fair valuation, etc., since these estimates are also significantly impacted by Covid. Some of the areas where fraud risk has increased are:

(i) Physical document approvals are replaced by email approvals in the Covid period. Such approvals carry the risk of emails being compromised.
(ii) Due to the new style of working, the demand for certain goods and services has significantly increased. This has created an opportunity in procurement fraud.
(iii) Owing to lockdown situations, many customers may be facing financial difficulties to pay their dues within the credit period. This increases the risk of financial reporting fraud by resorting to unethical means of recording receipts from debtors which are not genuine.

The auditors, while planning and performing the audit of internal financial control, will need to take into account as well as document how their audit plan is different from the earlier years due to higher risks of fraud, i.e., what is their audit response to such risks.

ASSUMPTIONS FOR THE FUTURE
Ind AS 1 requires the entity to disclose information about the assumptions it makes about the future, at the end of the reporting period, that have a significant risk of resulting in a material adjustment to the carrying amounts of assets and liabilities within the next financial year. In the Covid scenario, the future holds a lot of uncertainty and it will need the company to demonstrate its internal controls for arriving at the estimates, or its estimation process. It may have an impact inter alia on going-concern assessment, impairment of assets, fair valuation, etc., that is, financial statement items that are based on assumptions of the future. Companies faced difficulties in estimating the impact of Covid on their operations beyond the short term. This is an inherent risk because of uncertainty about the future which was never experienced before in history and has resulted from the global pandemic. Due to the disrupted supply chain and distribution models, uncertainty over pricing, etc., projecting future cash flows with acceptable precision is not possible for many companies. Coordination with management experts, such as those heading the strategy department, valuation specialists, etc., when performing impairment tests, assessing fair values of assets such as investment properties, investments, etc., and performing actuarial calculations and analyses, can be more challenging. Many auditors have considered these matters as key audit matters for their audit of the financial year ended 31st March, 2021. The question is do internal controls over the estimation process of the company consider the uncertainty brought by Covid?

Exceptions identified during control testing
It is likely that management will identify exceptions during its testing of controls because controls were designed for a totally different environment. To ensure that sufficient time is available for remediation before the year-end, management will need to modify the design of existing controls and test the operative effectiveness of the new controls during the year. If such remediation does not take place by the year-end, it will have consequences of communication with audit committees and modification in the auditor’s report. Further, in the absence of controls being effective, auditors may need to modify their strategy to evaluate the impact of ineffective controls. Therefore, companies should change their plan of testing controls affected by Covid earlier than usual in the year. If the company has had to incorporate new controls during the year, these controls should be documented in its internal control documentation and appropriately tested.

Planned changes in RCM
Each entity’s internal controls will be uniquely impacted by Covid, e.g., entities with significant dependence on technology will have different challenges to address than those with a more manual control environment. With a majority of staff working from home, manual controls maintained through hard copy documents cannot be adhered to. Technology-dependent controls may need revision with new technology suitable for the new environment. Hence, it is imperative that on a holistic basis the potential changes or shifts in focus, both in terms of scoping and risk assessment, testing approaches, etc., are made and additional controls or control modifications of existing controls are undertaken to address the risks arising from Covid. Based on the experience of Covid, companies will start making changes in their risk control matrix. It will include identification of additional risks posed by Covid, new controls to mitigate those risks, modification to existing controls in view of the ‘new normal’ and removal of some controls which have become redundant. This might include automation of all key manual controls to reduce dependency on people and physical access to the work environment, increased use of continuous monitoring and detection and defining indicators which would suggest that controls may not be operating effectively.

Changes to the design of management’s control may also require the auditor to alter the combination of testing procedures (i.e., inquiry, inspection, observation and re-performance). This includes making inquiries on the changes in the company’s mode of carrying out operations in response to Covid. For example, changes due to people working remotely, and consequently the change in the company’s policies and procedures, including execution of controls, segregation of duties, etc. This would also include evaluating the electronic or digital evidence made available by management, and the controls around the same, specifically with reference to review, reliability, security and storage of such evidence by the management.

Enhancing disclosures
The pandemic would also have wide-ranging implications on the financial statements. Hence, it is crucial that the management adequately presents their ‘side of the story’ in detail. Disclosures might include entity-specific information on the past and expected future impact of Covid on the strategic orientation and targets, operations, performance of the entity as well as any mitigating actions put in place to address the effects of the pandemic. Updating the information included in the latest annual accounts to adequately inform stakeholders of the impact of Covid, in particular in relation to significant uncertainties and risks, going-concern, impairment of non-financial assets and presentation in the statement of profit or loss, have garnered renewed focus.

SNAPSHOT
In short, the way Covid has impacted internal controls over financial reporting of companies is as follows:
a) New normal – The way companies carry out day-to-day transactions from initiation to closure that involves authorisations, recording, cash receipts or payments, etc., has changed. Given that these processes have undergone changes, all pre-Covid controls may not be relevant and new controls may be needed.
b) Risks change due to Covid – Not only are the new processes susceptible to new risks, but existing risks may also be heightened due to the change in the environment. In addition to this, there are certain inherent risks of dealing with the ‘unknown’, i.e., how long the pandemic will continue, what will be its severity and the resulting impact on the organisation, etc.
c) Controls must also change accordingly – Companies will need to thoroughly review their risk control matrix in light of the new risks. It will require addition of new controls (e.g., those relevant to new technology), changes in the existing controls (such as approval process through emails or physical verification of assets through virtual means, etc.), or removal of some of the irrelevant controls (like those related to physical documentation).
d) Audit of internal controls over financial reporting – With the new risk-control matrix, the auditors will need to plan their integrated audits in light of the changed processes of the client, the revised design of controls and testing their operating effectiveness. The auditors will need to evaluate ‘what could go wrong’ with increased audit scepticism considering the high fraud risk in the new reality, the risk of non-compliance with laws and regulations, the impact of uncertainty on the estimation process of the company, and so on.

NEXT STEPS
Companies establish criteria for internal controls over financial reporting. These are dynamic in nature and as the circumstances change, companies need to revisit internal controls on identified risks. The impact of Covid will require them to relook at their existing criteria and identify what changes are required to be carried out to achieve the objective. Many companies have prepared their own checklists to ensure that the internal controls criteria are updated based on the current environment.

At the same time, auditors need to be aware of what changes are being carried out by their clients in their criteria for internal controls and plan their audits accordingly. This may require the auditor to obtain samples of the period when operations were severely affected by Covid (and  therefore have a modified design of internal controls) and when operations were running normally.

A dialogue between the clients and auditors is imperative to discuss the exceptions observed in management testing, changes being made in internal controls, effective date of incorporating the changes, plan of management testing of such controls and ensuring that those are operating effectively.

(The views expressed in this article are the personal views of the author)

NEW CLAUSES AND MODIFICATIONS

Whilst the clause on reporting in respect of inventories has been present in the earlier versions, too, CARO 2020 has modified parts of the first clause and added certain reporting requirements in respect of current assets which are given below.

Modifications
a. Whether in the opinion of the auditor the coverage and procedure for physical verification of inventories is appropriate;
b. Whether any discrepancy in excess of 10% or more in the aggregate for each class of inventory was noticed and the same was properly dealt with in the books of accounts.

Additional Reporting
a. Whether at any point of time during the year the company has been sanctioned working capital limits in excess of Rs. 5 crores in aggregate from banks or financial institutions, on the basis of security of current assets;
b. Whether the quarterly returns or statements filed by the company with such banks or financial institutions are in agreement with the books of accounts and if not, to give details.

PRACTICAL CHALLENGES IN REPORTING
The reporting requirements outlined above entail certain practical challenges which are discussed below:

Verification of inventory:
a. On the appropriateness of coverage and procedure for physical verification of inventory, the auditor will have to observe the performance of the management’s physical count taking procedure, control over movement of inventory, adequacy of design and effective operations of internal controls.

b. Apart from ensuring that proper written instructions are issued, it is also incumbent for the auditor to point out specific areas where the instructions are not clear or other procedural lapses like inadequate segregation of duties, cut-off procedures not adhered to especially for sales and work-in-progress in continuous process industries, as may be observed. It is important for the auditor to comment on the specific areas where he feels that the procedures are not adequate rather than commenting that the ‘procedures are generally adequate’.

c. Covid-19: The onset of Covid-19 has caused significant disruptions in the business operations of companies which could pose challenges in conducting physical verification of inventories. This, in turn, would make it difficult for auditors to ensure compliance with SA 501, Audit Evidence-Specific Considerations for Selected Items, which requires the auditor to obtain sufficient appropriate audit evidence regarding the existence and conditions of inventories. SA 501 requires attendance at location/s of physical inventory count, unless impracticable, and performing audit procedures on inventory records to determine whether the records accurately reflect actual inventory count results. Some of the challenges may be broadly analysed under the following situations:

• Management does not conduct an inventory count (not even any alternative audit procedure) on the balance sheet date:
In such cases, as per Key Audit Considerations amid Covid-19 issued by ICAI on physical inventory (ICAI’s Covid guidance), the management should inform the auditors and those charged with governance about the reasons for the same. However, if carrying out a count is not feasible, the auditor would need to evaluate the reasonableness of the circumstances and the internal controls with respect to the existence and condition of inventory. Depending upon the materiality, the auditor may use his judgement to modify his audit report in accordance with SA 705 (Revised) Modifications to the Opinion in the Independent Auditor’s Report. Further, its impact on auditor’s opinion on internal financial controls u/s 143(3)(i) of the Companies Act, 2013 (‘ICFR’) also needs to be evaluated, in addition to reporting under this clause regarding coverage of physical verification of inventory.

• Physical verification conducted at a date other than the balance sheet date:
In such cases, the design and operating effectiveness of controls over inventory would need to be evaluated before reporting. Further, the following considerations are also relevant:
i.    Whether the inventory records are properly maintained;
ii.    Understanding reasons for differences in the physical verification count and the inventory records;
iii.    Performing roll-backward procedures, if the inventory count is done after the year-end or roll-forward procedures, if inventory count is done during the interim period;
iv.    Evaluating whether any adjustment is required in roll-forward or roll-backward procedures due to differences observed as in (ii) above;
v.    To consider whether the time between inventory count date and balance sheet date reflects appropriate assessment of the physical condition of the inventory.

• Impracticable for auditor to attend the physical count:
This issue is relevant for the auditor to issue an audit opinion on the financial statements and not on CARO 2020. However, in order to have complete discussion on physical verification of inventory, specifically its increased importance during Covid pandemic times, the same is also discussed here.

•  In the event that it is impractical for the auditor to physically attend the inventory count process, the auditor can perform alternative audit procedures to obtain sufficient appropriate audit evidence regarding the existence and condition of the inventory. In addition, to evaluate design and test the operating effectiveness of internal control over physical verification of inventory, the following may be considered:

i. Prepare a document substantiating the impracticality and unreasonableness of observing the count in person, given the Covid-19 situation;
ii. Use of web or mobile-based video-conferencing technologies (i.e., Microsoft Teams, Facetime, WhatsApp). In this case, care should be taken by the auditor that if inventory items cannot be identified with a unique reference number, etc., there is no chance of replacement of inventory during / after the count to avoid double counting. It would be advisable to retain the recording thereof as part of the audit documentation;
iii.    Consider using an external party, e.g., an independent CA firm in that location (ICA) or Internal Auditor (IA), in which case the auditor needs to evaluate
a. Objectivity and independence of ICA / IA;
b. Inquire for any relationships that may create a threat to their objectivity;
c. Evaluate their level of competence;
d. Determine the nature and extent of work to be assigned;
e. Communicate planned use of ICA / CA with those charged with governance;
f. Obtain written agreements from the entity for the use of ICA / IA for providing direct assistance;
g. Direct, supervise and review the work performed by ICA / IA providing direct assistance, including provide instruction / work programme, including sample selection, communicate management’s inventory count instructions, etc., and, if possible, supervise the count while it is in progress.

When inventory is under the custody and control of a third party, e.g., bonded warehouse, job worker / contractor, etc., the auditor shall verify the procedures undertaken by the management to evaluate the existence and condition of that inventory. This could be by way of obtaining confirmation from the third party as to the quantities and condition of inventory held on behalf of the entity and / or perform inspection or other procedures appropriate in the circumstances. The auditor needs to focus on whether inventory with third party is for a longer than normal period and obtain reasons for the same.

In the event the entity has specialised inventory where inventory count is not based on a normal physical verification process but on the confirmation of quantity / quality by an expert, the auditor will review the certification obtained by the entity and compare it with the book records. For example, in the case of coal, tonnage is calculated by considering the height, width, length of the stock yard and the moisture content in the coal to arrive at its tonnage. The entity will normally take the help of engineers in this process who would be internal or external experts.

a. Appropriate coverage: Even if the company has instituted proper procedures for physical verification, it is imperative that the coverage thereof is adequate and appropriate with respect to the nature, size, materiality, location, feasibility of conducting physical verification and risk of material mis-statement involved. This could involve significant judgement and an interplay of several factors, some of which are discussed hereunder:

• Classification of inventory – This is important for assessing the extent of coverage as also for evaluating the impact of discrepancies. Whilst the class of inventory is broadly specified in the Accounting Standards for manufacturing and trading companies, the same is not clear for service companies since all of it may not be amenable for quantification. Further, even if the classification for manufacturing and trading companies is appropriate to determine the adequacy of verification, an A-B-C analysis is desirable for which the basis would need to be evaluated for reasonableness. Further, the auditor also needs to examine whether there is a control system in place to identify and mark slow-moving, obsolete or damaged inventory.

• Periodicity of verification – The auditor would need to verify the periodicity of such verification and whether all the material items of inventory have been covered at least once in a year or as per the systematic plan as designed by the management. This would depend upon the nature of inventory, the A-B-C classification discussed above and the number of locations involved.

b. Dealing with discrepancies: The auditor should, based on his understanding of the business and operating effectiveness of internal controls, verify explanations provided by the management for discrepancies between inventory as per the books and as physically verified and steps taken by them to reconcile. Some of the common causes for discrepancies are:
• Incorrect data entry on receipt
• Issues not recorded
• Misplaced stocks
• Loss due to theft or natural calamity
• Human errors or incorrect unit of measurement used
• Inventory records not updated
• Supplier frauds
• Goods distributed as free samples
• Weight loss / gain due to passage of time

Under the modified (changed) reporting requirement, the auditor will have to report on any discrepancy noticed in excess of 10% or more in the aggregate for each class of inventory. Each class of inventory will have to be identified as per AS 2, ‘Valuation of Inventories’ / Indian Accounting Standard (Ind AS) 2, ‘Inventories’ and the internal policies of the management. The count at the time of physical verification will have to be compared with the book records and discrepancies in excess of 10% or more in the aggregate for each class will have to be reported. It may be worth it to note that the threshold limit of discrepancies of 10% should be applied to the value and not to the quantity. Hence, if the inventory has been valued other than at cost, e.g., net realisable value (NRV), the discrepancy of 10% needs to be compared with NRV.

It is worthwhile to note that this clause deals with discrepancies observed during physical verification only and not with discrepancies observed during audit. Further, even if the management has a valid explanation for the discrepancies, the fact needs to be brought out while reporting under this clause.

Working capital facilities:
a. This is a new reporting requirement wherein the auditor has to review quarterly returns or statements filed by the company with banks and financial institutions in case the sanctioned working capital limits with them are in excess of Rs. 5 crores in aggregate and to report if these are not in agreement with the books of accounts.

b. Collation of all working capital facilities: For calculating the limit of Rs. 5 crores, it is important to note that sanctioned amounts (not disbursed amounts) and both fund and non-fund-based amounts are required to be considered at any point of time during the year (as against only at the year-end) on the basis of security of current assets. This could present challenges in identifying the completeness thereof since sanctioned facilities as well as non-fund-based facilities are not reflected in the books of accounts. Accordingly, the auditor would need to make specific inquiries and obtain a representation and corroborate the same with the requisite documentary evidence like sanctioned letters, confirmations from the lenders, review of the minutes, ROC filings for charge created, etc. The aggregate of the sanctioned limit from all banks and financial institutions is also required to be collated. In case of a company which operates from multiple locations and working capital facilities are negotiated locally, care should be taken to ensure that all such sanctioned facilities are combined for the purpose of reporting under this clause. The auditor will also have to cross-verify the same with the relevant disclosures, if any, in the financial statements.

c. This clause is not applicable to unsecured sanctions or sanctions on the basis of security other than current assets or withdrawals above the sanctioned limit, e.g., in case the company has a combined sanctioned working capital limit of Rs. 4.75 crores but the same is overdrawn by Rs. 0.30 crore. In this case, the total outstanding working capital facility is in excess of Rs. 5 crores, however, since the aggregate sanctioned limit is less than Rs. 5 crores, this clause would not be applicable.

d. Considering the discussion in paragraphs (b) and (c) above, in case the sanctioned working capital limit exceeds Rs. 5 crores, the auditor is required to review quarterly returns and statements filed by the company with such banks / financial institutions and report if they are in agreement with the books of accounts and, if not, give details thereof.

The auditor will have to consider materiality of discrepancies, its relevance to the users of financial statements and their professional judgement while reporting discrepancies.

e. Each bank and financial institution may have its own requirements of submission of statements and returns. These submissions may be monthly, quarterly, yearly or of any other frequency, including event-based. However, for the purpose of reporting under this clause only quarterly statements / returns and that too which have relevance with the books of accounts of the company need to be considered, compared and reported.

Though this clause is applicable only if sanctioned working capital limits are provided based on the security of current assets, however, the responsibility of the auditor is to compare all the information provided in the quarterly statements / returns which can be compared with the books of accounts and is not restricted only to current assets. Such information may include aging of inventory and receivables, trade payable, property plant and equipment, other information, etc. So long as information can be compared with the books of accounts, it will be the responsibility of the auditor to report.

f. Challenges for MSMEs: Reconciliation of the details of statements / returns submitted to the lenders with the books of accounts on a quarterly basis could pose difficulties in case of MSMEs since they may not be regular in updating their accounting records. These MSMEs will have to keep their books of accounts updated based on which statements / returns submitted to banks and financial institutions can be compared, failing which their auditor will issue a disclaimer while reporting under this clause.

g. It is hoped that the introduction of this reporting requirement would lead to better discipline and improvement in internal controls which would result in a win-win situation for companies, lenders and auditors.

IMPACT ON THE AUDIT OPINION

In such cases, it is imperative that the Board’s Report contains explanations / comments on every reservation / adverse comment in the audit report as per section 134(3)(f) of the Companies Act, 2013 and that there will not be any factual inconsistency between the two if, in the auditor’s judgement, the matter / observation may have any adverse effect on the functioning of the company.

CONCLUSION