In today’s dynamic landscape and with
Audit’s Growth strategy, teams such as the ESG Center of
Excellence and Tech Assurance, are offering permissible
non-audit services to audit clients. In addition, our
audits are leveraging various tools and new capabilities,
such as AI, to enhance the quality of our audits. These new
capabilities can also provide valuable insights for our
clients. But it’s important for us as the auditor to
recognize when we are performing activities or providing
information to our clients that extends beyond what is
required for the performance of the audit. Such activities
may be non-audit services, and additional independence
considerations are required.
This may take the shape of the client requesting the results
of insights at a frequency or level of detail that
exceeds what is needed for purposes of conducting the audit.
Therefore, it is essential for teams to determine if what
they are delivering aligns with the scope of the audit by
asking questions such as, Are we performing a procedure
necessary to plan the audit or obtain audit evidence? Are we
making a communication or providing information required by
the auditing standards?
In many cases, providing additional insights or performing
additional activities is permissible, but may be considered
a non-audit service, so the engagement team would need to
complete this evaluation. It would also require the team to
submit a separate Sentinel request that includes the
applicable non-audit Sentinel code and appropriate
documentation that addresses independence considerations,
including the SEC general standard and IESBA self-review
threat test. The team should also attach a draft non-audit
engagement letter and there are many non-audit engagement
letter templates available for the audit practice to use for
these services. The team will also need to obtain
pre-approval from the Audit Committee or those charged with
governance, if applicable.
Then, when it comes to delivering any non-audit services,
such as ESG and our Tech Assurance non-audit assessment
services, we must be mindful that we are not performing an
audit or attestation service. Therefore, we cannot provide
any assurance or make any conclusions around client data or
systems, such as the completeness and accuracy of data or
the effectiveness of controls, as may be done in an audit.
Non-audit assessment services generally should be limited to
high-level observations and recommendations and should not
be seen as designing or concluding on controls, or
developing the client’s action plan.
Remember to also utilize the “Focused Non-Audit Services
for Audit Clients” guidance which provides tips when an
activity may constitute a non-audit service. It also
identifies the most common permissible non-audit services
along with standard engagement letter templates available
for our audit clients. If no letter is available, the
“Non-audit Services Independence Permissions Matrix”
includes detailed independence guidance on the
permissibility of some of the most common types of
activities performed during non-audit services. All
documents can be found on the Independence Non-Audit
Services Portal.
It is crucial to maintain a clear understanding of the
boundaries between audit and non-audit services. By adhering
to independence considerations, seeking guidance when
needed, and following appropriate procedures, audit teams
can effectively navigate the evolving landscape and deliver
high-quality services to their audit clients.