ESG and GenAI are everywhere, and the firm
has been adapting quickly to seize opportunities.
Let’s check in with Paloma, the audit partner for SEC audit
client, Estatewood and Kai, a Tech Assurance managing
director, as they talk through two opportunities for Estatewood.
PALOMA: The planning workshop for Estatewood’s audit went
really well! They were impressed with the new AI technology
that we’ll be using on the audit this year.
KAI: Yeah, they were! I agree! Actually - Estatewood’s CFO
just reached out to me about helping with their GenAI transformation.
I was thinking about an Ignition Experience at Lakehouse. We
can share benchmarking and insights about their performance
compared to their competitors, and brainstorm GenAI use cases.
PALOMA: That’s a great idea! But let’s make sure we’ve
considered any independence implications.
If we plan to provide a benchmarking deliverable, we need to
ensure that during that session, we aren’t providing
services beyond the audit that haven’t been pre-approved.
KAI: I see what you mean…
PALOMA: The Independence Guidance on Ignition Experiences
and AI services are helpful resources. The Ignition
Experience you’ve described may be permissible, provided we
don’t delve into developing their AI solutions. But it would
be considered a separate non-audit service, regardless of
whether we charge a fee.
Kai is now more aware of the ways in which activities we
plan to offer to our audit clients can expand into providing
non-audit services. Although these non-audit services may be
permissible, they still require evaluation in Sentinel and
Audit Committee pre-approval.
Paloma and Kai talk through what Estatewood would like to
achieve with GenAI. They come up with an appropriate agenda
to address the client’s needs that would also be permissible
from an independence perspective.
Because they also have an ongoing ESG reporting assessment
engagement with Estatewood, Kai continues the discussion
with Paloma, talking through the draft deliverable they
would like to share with the client.
KAI: Oh, I’ve been meaning to ask…Have you had a chance to
review the draft deliverable for the ESG reporting
assessment service? We had some valuable IT insights, and
wanted to provide them as soon as possible!
PALOMA: I have reviewed it. The team did a great job.
KAI: Thanks, Paloma.
PALOMA: And it’s great you used the standard deliverable
template, but in certain places we do need to adjust our
level of recommendations to avoid going beyond the scope of
work in the approved ESG engagement letter.
KAI: OK. Where were your concerns?
PALOMA: There were a few places where we made assurance type
statements like “the report is complete and accurate” or
“the control is designed effectively”.
We aren’t auditing here, so, our work can’t go beyond
high-level observations and recommendations.
KAI: Ok, I see what you mean. We can’t conclude or provide
inadvertent assurance, since this is a non-audit service
done under consulting standards.
So - for our observations and recommendations, if we frame
them as high-level feedback for the client’s consideration
and categorize the feedback as high, medium, and low – would
that be permissible?
PALOMA: Yes, that’s permissible.
We should avoid making recommendations that are too specific
and extensive, as it could in substance be seen as designing
or concluding on the client’s controls, or developing their
action plan, which would be impermissible.
KAI: That makes sense.
I’ll make those changes to the ESG deliverable.
Paloma emphasized the importance of staying within the
approved scope and that teams need to take off their “audit”
hat when drafting deliverables for non-audit services.
She also reinforced the importance of providing objective
recommendations and observations without conclusions,
avoiding scope creep and maintaining independence.
As Audit and Tech Assurance offer more non-audit services to
audit clients, it is important to keep these considerations in mind.