Leah is the new audit engagement partner for Estatewood,
a private audit client. Christian, a managing director
in advisory previously provided permissible gap analysis
services to Estatewood, aimed to kickstart a desired upgrade
of their Enterprise Resource Planning system. In response to
KPMG’s high-level observations and recommendations,
Estatewood requested assistance to address deficiencies
noted in their current financial information system.
Christian, excited to win more work with the client, reached
out to Leah about possible service options.
Christian: In speaking with Estatewood, I think we’re in
a good position to provide design and implementation
services to address those deficiencies in their financial
information system that we spoke about.
Leah: Hmmm ….Because that system will be subject to our audit,
those services would be impermissible. We can still support
them though in finding a solution.
Christian: How so?
Leah: Well, your team can review some commercial off-the-shelf,
“COTS” options and provide the pros and cons of each.
Estatewood can then decide if one of the options would work for them.
Christian: Don’t you think that scope is a little too high
level for their needs?
Leah: Once Estatewood chooses a commercial off-the-shelf
software, we can configure and install it to fit their needs.
Christian: Okay, I think that’s a viable solution. We’ll
need to customize it a bit to fully address deficiencies.
Leah: We can only configure the software; customizing would
not be permissible.
Christian: Most of the configuration should be pretty
standard, so it’s not a big deal if we slightly customize
the software in this case. Leah determines that to make an
informed decision around the permissibility of the proposed
services, she needs to collect information and connect with
the Independence Group. After receiving their guidance, she
decides to reframe the discussion with Christian to focus
the scope of the engagement on what is permissible and in
the best interest of both Estatewood and KPMG.
Leah: With the right safeguards in place, there’s a lot we
can do for private audit clients like Estatewood. But we
need to be mindful of where the guardrails are. The
difference between configuration and customization of a
commercial off-the-shelf solution defines whether or not
this work would be permissible.
Christian: How so?
Leah: Customizing the COTS software, which would entail
writing any code that isn’t already incorporated into the
financial system or is outside its original functionality
would result in providing impermissible design and
implementation services of a financial information system.
Christian: That makes sense.
Leah: I’m glad because customization, even if it was only
minimal, would result in an independence violation. If that
occurred, Those Charged With Governance might lose trust in
KPMG’s ability to maintain our independence and we could
lose not only future advisory work but our audit work.
Estatewood could be required to find an alternative audit
service provider.
Christian: So, I guess a little bit of customization would
be a big deal! I’m just concerned that Estatewood’s needs
may be too specific for this type of rigid solution.
Leah: Well, in discussing this with Independence, they
illustrated many different ways a system can be configured
to benefit the client.
Christian: You make a good point. I guess I was so focused
on the design aspect of the proposed service that I didn’t
think of all of the configuration capabilities already baked
into the software.
Leah: That’s great to hear. If you’re in line with this
solution, I would be okay with you submitting this proposal
to Estatewood. Just be aware that as you move through the
engagement, you must always act based on the configuration
decisions of Estatewood management and not our
determinations. They must make all the management decisions,
reviews, and approvals.
Christian: Understood. So they will have to assume all
management responsibilities, correct?
Leah: Yes, they’ll also need to designate an individual to
oversee the service, evaluate the adequacy of the service
results and accept responsibility for the results.
Christian: Okay, so that’s how we safeguard against the
threat of performing a management function?
Leah: Well, those are general requirements. To safeguard
against that threat, your team should maintain documentation,
such as meeting minutes and emails, to illustrate that you
implemented configuration in response to decisions made by
Estatewood, and adhered to the general requirements. I can
also review deliverables before the team provides them to
the client.
Christian: That makes sense. We can do that. I’ll also
schedule status updates with you throughout the engagement.
Leah: Great! We’ll need to loop in Estatewood management
and Those Charged With Governance to be sure they understand
the independence considerations. After that, if you document
the possible threats and safeguards within your
Sentinel request and we have monthly touchpoints, I feel
good about proceeding with the work for Estatewood.