The impact of an adviser’s qualified internal controls report

In the last few months there have been several high-profile instances of reporting accountants qualifying their opinions on internal controls at service organisations. These have resulted from systemic failures of controls including the effects of fraud.

We look at what a qualified opinion is, why it happens and what it means for trustees and your scheme auditors, including what trustees should consider when reviewing the internal controls at these organisations.

What is a qualified opinion from a reporting accountant?

A qualified opinion means that the internal controls were not designed (Type I or II report) or operating (Type II report only) effectively over a sufficient number of essential control objectives included within an internal controls report such that it affects the reporting accountant’s opinion. It is most likely that this results from a systemic failure of controls, failure of a significant number of controls, or failure of a pervasive control at the service organisation.

In an internal controls report, management states that certain controls are in place. If the reporting accountant performs test procedures that contradict management’s assertion, they include a description of the exceptions noted and management may include their responses to these exceptions. This usually includes the systems and procedures they have put in place to remedy the exceptions. If these exceptions are pervasive or considered key to the service organisation’s service, the reporting accountant will need to consider qualifying their report.

Exceptions within an internal controls report mean that when the test was undertaken the reporting accountant detected an occurrence where:

• the evidence to prove the control operated was not available,
• the evidence to prove the control operated was not complete, or
• there was evidence that showed that the control did not operate.

An example would be that, a checklist requiring signatures for both the preparer and approver:

• cannot be provided,
• was missing the approver’s signature, or
• shows that it was completed long after the event.

The degree of importance of an individual control depends on what it is designed to do. For example, one that prevents inappropriate access to the vital systems is of more significance than one that ensures reporting to clients is compiled accurately.

It is not uncommon for service organisations to receive a number of exceptions, maybe even a qualified opinion in the first year of a Type II report as the operation of controls becomes formally embedded into the organisation. However, control failures can also occur when controls have operated successfully in the past. For example, where, due to employee turnover, a control performed by a former employee is no longer performed consistently by another employee.

Reporting accountants and service organisations alike should not shy away from a situation where the internal controls report needs to be qualified. Management should recognise mistakes or other errors in processing and reporting accountants should not be afraid to call out a problem. Both parties should place the interest of the end users of the internal controls report first and foremost.

For each report, management and the reporting accountant will consider the number and impact of the exceptions within the report and decide whether a qualification; either on an area or across the whole operation, is required.

What does it mean for the trustees and your scheme auditor?

Trustees

A service organisation’s qualified opinion should be viewed in the context of the services that are provided to your scheme. Not all controls are created equal and, therefore, careful analysis is required to see what risks are not being covered due to control deficiencies.

In some instances, it may necessitate the scheme itself to implement new controls. In further instances, the trustees will need to consider whether the issues are severe enough to warrant using a different service organisation. In other instances, it may not impact the scheme at all. Context and the risks of what has or could go wrong for your specific scheme are the key considerations.

For your scheme financial statement purposes, the trustees will need to consider the impact on the systems and controls that specifically relate to the balances and transactions in the financial statements.

A qualified report does not mean that trustees cannot rely on the internal controls report at all. The control objectives in the report that are designed and/or operating effectively can still be relied upon, in most cases. However, the trustees should consider that a large number of non-relevant exceptions does not inspire confidence in the overall control environment at the service organisation.

Auditor

The scheme auditor will make their own assessment of the impact on the systems and controls that specifically relate to the balances and transactions in the financial statements. The auditor may be able to perform additional testing on secondary controls at trustee level to mitigate the risk presented by the ineffective controls in the internal controls report. If this is not possible, the trustees and auditor will need to discuss the impact on the financial statements and the audit report.

In all the circumstances mentioned above, the scheme and auditor are likely to incur additional costs in resolving the issues raised by the qualification.

Summary

Exceptions where individual internal controls are not working as stated by management are noted in many internal controls’ reports. However, where the exceptions are severe or pervasive enough, the reporting accountant may provide a qualified opinion related to the one or more areas with issues.

We are aware of a number of internal controls reports released in 2020 that have qualified reporting accountant’s opinions. We are expecting that there is an increase likelihood of further such reports being issued due to the impact of the COVID-19 pandemic causing a breakdown or a forced change in internal controls. This could include the potential for the usual systems at service organisations to be circumvented or where the internal controls are physically not able to be followed or evidence of historical operation not available.

DISCLAIMER
By necessity, this briefing can only provide a short overview and it is essential to seek professional advice before applying the contents of this article. This briefing does not constitute advice nor a recommendation relating to the acquisition or disposal of investments. No responsibility can be taken for any loss arising from action taken or refrained from on the basis of this publication. Details correct at time of writing.

Ref: 123020eb