Hot and cold file reviews for high audit standards

Hot and cold file reviews are important components in the infrastructure that exists to ensure the highest standards of audit quality by firms and regulators. Auditors who want to get more from them will benefit from considering Audit Quality Inspection Reports from the Financial Reporting Council (FRC) and their findings and annual audit monitoring reports from ICAEW’s Quality Assurance Department (QAD) and their findings (at ). After all, they cumulatively consider thousands of audit files in a single year – and there is strength in numbers.

ICAEW’s Audit Monitoring Report 2020 shares some common problems seen by QAD and ways to avoid these, or identify and address them, with the assistance of hot and cold file reviews and techniques such as root cause analysis (see Digging deep). “Effective cold reviews enable audit firms to identify areas where audit work could be improved on a timely basis,” says Trevor Smith, Director of QAD, while emphasising that a cold file review is not itself sufficient to right any wrongs. “We see firms that have very thorough reviews but fail to take appropriate actions to address the findings.”

Missed opportunities

Undertaking hot reviews during the audit can help the responsible individual (RI) and other team members to identify and address problems before the report is signed. “We think many of our findings should have been picked up by manager or RI reviews before completion of the audit,” says Smith. Some firms could have avoided shortcomings such as: gaps in audit programmes, missing documents, incomplete tests, exceptions not followed through, clear logic flaws in tests, poorly supported conclusions, faulty cross-referencing, uncleared queries, and lack of a clear trail from schedules to the financial statements and obvious errors in these.

QAD does not expect RIs to review everything in detail themselves. Depending on the size of the audit team, an RI may need to rely on a manager or another team member to do a detailed review of all areas. “We would, however, expect the RI to review areas of significant risk,” says Smith. But this review can itself be an area of weakness. “Sometimes this review appears to take place by discussion rather than review of key working papers on the file, with the result being that the documentation on the file is not as the RI had assumed,” says Smith.

Some firms do not always appear to allow time for in-depth review, and it is possible that senior team members or managers may not always fully appreciate what is expected or required. “The firm and RI are responsible for ensuring relevant audit personnel have sufficient time and are competent to perform the review function, although in some cases this skill may be assumed rather than actively trained,” says Smith. Some firms provide training to new managers on how to carry out effective reviews, and some build testing of review skills into their management recruitment processes.”

Common weaknesses

It isn’t just reviewers from QAD and other regulators who see some of the same problems cropping up again and again. “Although each audit will present a unique combination of issues, there are common themes that emerge in reviews,” says Jeremy Williams, Audit and Accounts Lecturer, Mercia Group. This occurs particularly across small-to-medium entity audits, he says, adding that isolating and addressing some of these weaknesses is an effective way to improve audit quality and, in many cases, audit efficiency too.

Williams suggests 10 areas where auditors may want to pay more attention: recording judgement; thinking assertively; calculating and evaluating samples; evaluating fraud risk; tackling related party issues; corroborating substantive analytical procedures; addressing going concern issues; using representations properly; getting the audit report right; and qualifying audit reports. He expands on this list and offers practical tips on how to address some of the commonest shortcomings in these areas, in an earlier Audit & Beyond article.

Use of external reviewers can make hot and cold file reviews more effective. “In our experience, firms often benefit greatly from having external reviews as they provide a fresh and more objective perspective,” says Smith. “Once they have experienced an external review, many smaller firms prefer and find it beneficial to have them every year rather than revert to in-house reviews,” he adds.

Although external hot and cold file reviews are required for compliance only in certain circumstances, they can assist firms in various ways, as outlined overleaf in A worm’s-eye view.

Digging deep

Another way to make hot and cold file reviews more beneficial is to combine them with root cause analysis (RCA) to promote continuous improvement, by helping firms to understand the root causes of both areas of weakness and examples of good practice. RCA is an activity that can be scaled to benefit firms of all shapes and sizes, across various scenarios.

There is a faculty webinar to assist senior managers with pre-sign-off reviews that touches on other types of hot file review too. It shares suggestions on how senior managers (and firms more widely) can make their reviews more productive by, for example, being clear about objectives, making the process less adversarial, carefully timing reviews, and sharing findings with individuals and teams.

More faculty tools to assist with RCA are available along with links to other support materials from the FRC and the International Auditing and Assurance Standards Board. Meanwhile David Gallagher, a member of the faculty’s Technical and Practical Auditing Committee and Technical Partner at MHA Macintyre Hudson, shares some words of wisdom.

Tips for first-timers

“RCA can enable firms to take actions that can prevent recurrence of negative outcomes and promote recurrence of positive ones,” he says, while acknowledging that the prospect of this can appear quite daunting for first-timers. “Cold file reviews can be a good place to begin,” he suggests. Strengths and weaknesses can be analysed to identify root causes and to support the consistent application of best practices, helping firms to improve the quality and efficiency of audit work and some non-audit work too.

“There are lots of ways that cold file reviews and RCA can be combined effectively,” says Gallagher. He shares some of his firm’s experiences with audit teams in a previous article. There is also a faculty webinar on combining cold file reviews and RCA. It outlines which stage of the cold file review process is the optimal place to begin RCA; how to use this most effectively with individuals and teams to identify, analyse and address issues on individual audit files and audits; and how to benefit from pooling what has been learnt from RCA conducted on multiple files.

Driving continuous improvements

Requests to conduct RCA can be triggered by significant findings during QAD reviews, to ensure that firms understand the root causes and have developed an action plan to prevent recurrence.

“In the context of cold file review findings, RCA can be a valuable technique to prevent recurrence of the same weaknesses or failings, year after year, in monitoring or compliance reviews,” says Smith. So readers will also find some pointers in QAD’s 2020 audit monitoring on how RCA can be combined with hot and cold file reviews to maximise their benefits.

A worm’s-eye view

Nigel Hughes shares personal perspectives on conducting external file reviews

In the pre-COVID-19 days when social interaction was allowed, if asked what I do for a living I’d say: “Chartered accountant”. Then, after the usual banter about being boring, balancing books and requests for help with tax problems, I’d admit I don’t do that sort of thing and confess that I earn a chunk of my living being rude to partners in accounting firms. Many seemed to think this is quite a noble calling.

While carrying out hot and cold file reviews for firms, I try to be the constructive, critical friend. Sometimes the messages are a bit tough; sometimes I criticise a file only to find I’ve missed something that was staring me in the face (and be quick to admit I got it wrong); usually there are things to discuss and lessons to be learned by all concerned, including myself.

Challenging times

Auditors face a number of challenges. Once we had no written auditing standards; then we had two. Now we have auditing, ethical and quality standards and their revisions to consider. Some audit work by UK auditors and firms is monitored directly by the FRC (soon to become the Audit, Reporting and Governance Authority); some is monitored by bodies such as ICAEW. Some auditors may feel as if they need all the help they can get.

Help can come from external reviews: to check on objectivity, compliance with standards, and relevance and sufficiency of audit evidence to support the audit opinion, before sign-off (hot) or after (cold), and cold reviews can also focus on compliance with firm policies, processes and procedures and consider efficiency. They can be a valuable way for firms to gauge and improve their performance on audits.

Standards matter

Standards require an audit file to include sufficient documentary evidence to enable an experienced auditor, unconnected with the audit, to understand what was done, what the results were, significant matters arising, and the audit judgements. Yet without the auditor’s long experience and in-depth knowledge of the client this is not always apparent from the file.

If the right work was done and the right conclusions drawn, the lack of clear, complete documentation will not, of itself, lead to suffering. But here’s the thing: the standards require adequate documentation. The audit report explicitly states that audit standards have been complied with and this is what reviewers from ICAEW’s QAD and the FRC’s Audit Quality Review team are looking for.

Serious consequences

There may even be something wrong with the accounts that is ignored or missed by the audit team due to familiarity with the client, time pressure or some other reason. If this has not been understood because the risks were not fully understood, work done did not address them, or results of this work were not correctly interpreted, and the audit opinion was not justified, this is serious. There was something for the auditor to find and do something about, and they did not.

It is hugely important that the file makes it blindingly clear both that risks are properly assessed and explicitly addressed and that conclusions are clearly justified. If not, reviewers from the AQR or the QAD may not accept that the file complies with audit standards and this may have consequences for the firm.

Communicating clearly

I think accountants and auditors are in the communications business. The audit file has to communicate why, in all probability, the figures in the accounts are correct rather than wrong and do this in a way that is as clear as possible to anyone looking at the file. As not every auditor has sufficient steely resolve to see every bit of audit work through a fresh pair of eyes, being the critical friend who can may indeed be a noble calling.