EU Statutory Audit Directive and Auditor Liability Gibraltar, 13 January 2009

1. EU Statutory Audit Directive and Auditor LiabilityGibraltar, 13 January 2009 Martin Manuzi Director, European Office and Head of European Affairs

2. Statutory Audit Directive (SAD): overview Most comprehensive single EU legislative initiative to impact on audit profession Follows IAS Regulation – harmonised financial reporting requirements (EU listed companies) Considerable degree of harmonisation – but not full harmonisation: Member State options Context was – and still is - perceived need for greater confidence in audit function, although “climate” in which SAD was prepared is quite different to today’s “climate” EU regards this legislation as critical to the success of its regulatory dialogue with US and other Third (non-EU) countries

3. SAD timeline: origins and adoption

4. SAD: summary of detailed content Recitals I Subject matter and definitions (including PIEs and network) II Approval, continuing education and mutual recognition III Registration IV Professional ethics, independence, objectivity, confidentiality and professional secrecy V Auditing standards and audit reporting VI Quality assurance VII Investigations and penalties VIII Public oversight and regulatory arrangements between member states IX Appointment and dismissal X Special provisions: statutory audits of public interest entities (PIEs) XI International (outside EU) aspects XII Transitional and final provisions

5. SAD timeline: implementation

6. Pan – EU implementation

7. Public Oversight: a “fact” of professional life Why Public Oversight? Public interest: Can a self regulated private body alone be in charge of public interest responsibilities such as approving and implementing standards on financial reporting or audit? Credibility and Trust How can the audit profession demonstrate that the appropriate structures are in place to prevent inappropriate behaviour? Can a self regulated body be a credible and effective disciplinary body without any public involvement? Where? At Member State level through implementation of SAD Directive At national level throughout the world (not least because of “equivalence” provisions in SAD Directive) At European level through the European Group of Accounting Oversight Bodies (December 2005). At global level through the International Forum of Independent Audit Regulators (IFIAR) was established in 2006, to share knowledge, promote collaboration in regulatory activity; and provide for contacts with other international organisations which have an interest in audit quality. At the global standard-setting level through the IFAC Public Interest Oversight Board (February 2005) to oversee IFAC's auditing and assurance, ethics, and education standard-setting activities as well as its Member Body Compliance Program.

8. Public Oversight: main SAD requirements (1) SAD, Article 32, requires Member States to establish a system of public oversight with: the ultimate responsibility on registration, standards, quality assurance, education and discipline the right, where necessary, to conduct investigations on statutory auditors and audit firms and must have the right to take appropriate action effective coverage of all auditors / firms

9. Public Oversight: main SAD requirements (2) The system of public oversight must be governed by non-practitioners Non-practitioners must be knowledgeable in areas relevant to audit A minority of practitioners is accepted Persons involved must be selected under an independent and transparent nomination procedure The system must be adequately and independently funded and “secure and free from any undue influence by statutory auditors or audit firms” The system must be transparent – include publication of annual work programmes and activity reports

10. Public Oversight: main SAD requirements (3) Directive does not set out the precise structure for oversight: it recognises different cultures and environments in the EU (i.e. minimum harmonisation) Given this, Article 33 requires that Member States ensure effective cooperation on regulatory arrangements Article 34 refers to mutual recognition of regulatory arrangements between Member States: “In the case of a statutory audit of consolidated accounts, the Member State requiring the statutory audit […] may not impose additional requirements […] concerning registration, quality assurance review, auditing standards, professional ethics and independence on a statutory auditor [..] carrying out a statutory audit of a subsidiary in another Member State.”

11. Quality assurance: main SAD requirements Article 29 of SAD requires: Independence from the reviewed auditor and subject to public oversight Funding is secure and free from undue influence.. Adequate resources Reviewers must have appropriate education and experience Avoidance of conflicts between reviewers and reviewed audit firm Scope of review and testing: compliance with reporting standards, independence requirements, quantity and quality of resources, fees charged and internal quality control Review to be subject of a report containing main findings Overall results to be published annually Recommendations of quality reviews shall be followed up by auditor within “reasonable time”…… if not, disciplinary actions/penalties Review to take place at least every six years For PIES: reviews at least every three years (Article 43)

12. EC Recommendation on External Quality Assurance (May 2008) (1) Pre-announced by Commissioner McCreevy in December 2007 “audit package” Appears to have been influenced particularly by EU-US dialogue (and desire to reach agreement of mutual reliance): hence reference to “international trends” Recommendation focuses on auditors of Public Interest Entities and is concerned to ensure effective trans-national cooperation Some “strong” language: Recital (1) focuses on importance of external quality assurance for high quality audit and credibility – “Any external quality assurance system should therefore be objective and independent from the auditing profession” However, Recommendation does not modify concept of “ultimate responsibility” and capacity of public oversight bodies to delegate - although this is particularly “unwelcome” where peer review is concerned.

13. EC Recommendation on External Quality Assurance (May 2008) (2) Article 6: Inspections can be delegated to another appropriate body on basis of adequate accountability and retention of at least the following responsibilities: - Approval and, if necessary, amendment of: inspection methodologies inspection reports assignment of inspectors issuance of recommendations and instructions to the body to which tasks have been delegated Retention of right to participate in inspections and get access to files Funding arrangements: should not be subject to approval or veto by persons affiliated with profession

14. EC Recommendation on External Quality Assurance (May 2008) (3) Independence – provisions targeted mainly at peer review - Article 11: “A person, who is a practising statutory auditor or is employed or otherwise associated with a statutory auditor [..] should not be allowed to act as an inspector” - Article 12: two years “cooling-off period” - Recognition that “specific expertise” might be required: in this case to be used under direct control of inspectors and that there may be special circumstances due to insufficient number of inspectors Methodological guidance for conducting inspections (Paul Simkins) Outcome of inspections: communication with inspected firms and with public – disclosure of major deficiencies, if not acted upon Transparency on overall system: annual report on recommendations issued, disciplinary actions, financial resourcing, staffing

15. Public Oversight: implementation EC Scoreboard: does not cover transposition of Directive in Gibraltar Overall mixed picture: - 11 Member States partially transposed, 16 partially - 9 Member States not transposed over 16 articles 24 Member States have legally established public oversight - 22 have appointed person in charge of public oversight Considerable variety in oversight structures: - UK model of Financial Reporting Council (see below) - The Netherlands – Authority for Financial Markets (AFM) - France – Haut Conseil du Commissariat aux Comptes (H3C) - Chambers of auditors/comparable Institutes playing a key role in many cases – with delegated responsibility for quality assurance or providing assistance, and role in audit registration, ethics etc

17. Financial Reporting Council (FRC)

18. Summary of roles within UK system Government Has ultimate responsibility and power to register, monitor and regulate auditors Delegates these powers to accountancy bodies, via FRC FRC Composition: Chair, a non-executive Deputy Chair, the Chief Executive, seven non-executive directors and the Chairs of the FRC’s six Operating Bodies Set accounting, auditing, auditor independence and corporate governance standards Reviews and investigates listed entity accounts for non-compliance with standards Monitors auditors of listed and certain other entities Investigates public interest complaints against members Oversees professional bodies activities Profession - ( to be elaborated upon by Paul Simkins) Registers and regulates auditors, through rules of suitability and conduct (registration of audit firms compulsory by law) Monitors auditors of unlisted entities Investigates complaints against members Set ethics standards other than for auditor independence

19. Selected example of oversight structures (1) Cyprus Draft legislation at final stages of review Oversight Five member Committee with “ultimate responsibility” One member of profession in practice plus Ministry of Finance, Stock Exchange, Ministry of Commerce and one other (Chairman) Five year term – renewable once Public funding Use of civil servants until has own staff (expected to be limited) Quality Assurance Delegated to ICPAC (professional institute) for all audits ICPAC undertake reviews using employees of an outside professional institute Work of reviewers is subject to oversight Manages Disciplinary Committee

20. Selected examples of oversight structures (2) Malta Oversight Malta has had public oversight, through the Accountancy Board, since 1979. The Accountancy Board is part of the Ministry of Finance – responsibility of the Minister Composition: previously five practitioners and two (including the chairman) non-practitioners Currently 11 members, not more than five can be practitioners (4 must be women!) Quality Assurance / Quality Assurance Oversight Committee Appointed by and reporting to Accountancy Board Composition: non-practitioners (five members) Fully functioned since 2007 – first visits of Quality Assurance Unit (QAU) QAU reviewers are Min Finance employees All firms and practitioners subject to review

21. Selected example of oversight structures: (3) Jersey - a “third country” Crown Dependency – not part of UK or EU High degree of integration within UK economy Jersey Financial Services Commission To act as oversight with assistance of UK Public Oversight Board ICAEW to undertake quality assurance to Jersey audit firms – subject to oversight Audit qualifications based on membership of UK / Irish professional bodies

22. SAD: Third country provisions SAD is key to EU/Third country regulatory dialogue in audit sphere Requirement on Member States to undertake registration and oversight of third country auditors in relation Third country entities listed on EU regulated markets UK, Luxembourg and Ireland especially concerned and have major commercial interest – involving many third countries (not just US/Japan but Kazakhstan/India/China..) Requirement can be waived/modified if Third country systems/structure are deemed equivalent Major resource challenge for Member State oversight bodies Disapplication/modification only “on basis of reciprocity” Transitional arrangements July 2008 – new decision imminent Audit working papers

23. Questions?

24. Auditor Liability: background to EU action (1) 2004 EC position: liability is a driver of audit quality Original EC proposal included no provision on auditor liability European Parliament amendment and compromise with Council of Ministers Specific Article in the Directive requiring an economic study including an objective analysis of limitation of financial liability and a report to EP with, if appropriate, recommendations to member states EC study and Forum: Challenge for profession to contribute as much as possible to the study. EC established EU Auditor Liability Forum in 2005 Members included: ICAEW only EU professional national body represented Representatives of firms, ECG and EGIAN Representatives of insurance industry, investors, employers, banks, academic world, etc.

25. Auditor Liability: background to EU action (2) London Economics study published in October 2006 Among issues highlighted: i) imbalance for audit firms: excessive risks against capital and insurance (uninsurability of large international audits) ii) auditors do not have deep pockets! iii) unlimited liability is a flawed concept iv) sustainability of audit function is in question: catastrophic collapse and barriers for mid-tier firms in the large audit market EC report January 2007 highlighted: i) desirability of less concentration in audit market ii) uncertainty regarding legislation on liability in relation to networks Consultation on four different options: - single monetary cap - cap based on size of audited entity - cap based on audit fees - proportionality

26. Auditor Liability: background to EU action (3) Respondents’ reactions: General support for limitation of auditor liability Support for the 4 options: - 38% in favour of proportionate liability - 30% would prefer proportionality + cap - 23% supportive of a cap based on a multiple of audit fees European profession supporting recommendation and retention of national solutions where they exist Recognition by all that single solution not possible across Europe

27. Auditor Liability: EC Recommendation (1) EC Recommendation promised in December 2007 – part of McCreevy audit package EC Recommendation published on 5 June 2008 Very succinct document: 2 pages in length! Targeted at auditors of listed companies (but no obstacle to Member States having broader focuses) Emphasis on importance of sustainable audit capacity to smooth functioning of capital market Member States invited to inform EC of actions taken by June 2010 Main element: the liability of auditors should be limited – except in cases of intentional breach of professional duties Given variations in civil liability systems at Member States level, it is appropriate for Member States to choose the right system for them.A number of methods are suggested:

28. Auditor Liability: EC Recommendation (2) From Article 5: establishment of a maximum financial amount or of a formula allowing for the calculation of such an amount; establishment of a set of principles by virtue of which a statutory auditor [..] is not liable beyond its actual contribution to the loss suffered by a claimant and is accordingly not jointly and severally liable with other wrongdoers Provision allowing any company to be audited and the statutory auditor [..] to determine a limitation of liability in an agreement

29. Auditor Liability: EC Recommendation (3) In relation to method c), Member States should ensure the following conditions are met: the agreement is subject to judicial review with regard to the company to be audited, the limitation is decided collectively by the members of the administrative, management and supervisory bodies the limitation and any modification thereof are published in the notes to the accounts of the audited company

30. Auditor Liability Implementation (1) Summary of UK situation: - Companies Act 2006: enabling legislation - permits contractual agreement between auditor and audit client (this solution is dependent on robust protection regarding third parties) - terms are subject to Courts considering agreements are “fair and reasonable” - FRC guidance on shareholder approval - Further work on concept of “recklessness” – outside limitation - ABI and other institutional investors will not oppose limitations based on proportionality Overview of EU situation EU Countries with a statutory cap (8) EU Countries with a cap in draft legislation (5) EU Countries where caps are being actively considered (3) Other EU Countries where there is an active liability debate (7) Other EU Countries (4) (including UK)

31. Auditor Liability Implementation (2) EU Countries with a statutory cap (8) Germany (fixed by nature of entity) Austria (fixed by size of entity but debate may be reopened) Belgium (fixed by nature of entity) Greece (ten times fees) Slovenia (fixed by size of entity) Bulgaria (three times fees) Slovak Republic (multiple of fees – 20 PIE, 10 Other) Latvia (2% of gross assets up to a max of €10 million)

32. Auditor Liability Implementation (3) EU Countries with a cap in draft legislation (5) Cyprus (proportionality plus multiple of 3 times fees) Poland (multiple of fees – Listed 20 times max €12m, Private 10 times max €3m) Sweden (fixed per engagement (approx €10.5 M) expected by 1 July 2010) Estonia (multiple of fees) Romania (in legislation but quantum to be set by Oversight Board) EU Countries where caps are being actively considered (3) Finland (focusing on listed companies at present) Ireland (CLRG recommendation to limit liability possible) Spain (Ministry now open to more than just proportionality)

33. Auditor Liability Implementation (4) Other EU Countries where there is an active liability debate (7) Netherlands Malta Lithuania Italy Luxembourg Portugal Denmark Other EU Countries (4) United Kingdom (contractual limitations & proportionality adopted) Czech Republic (no limitations on the agenda) France (unlimited liability but 3-year statute of limitations) Hungary (proportionate liability recently enacted)

34. Auditor Liability: next steps for EU Member States to report to EC by June 2010 General sense that Directive in this area would be very difficult However, current EC consultation on control and choice in audit market may have impact Issue of networks: further clarification required?

35. Questions?