As the firm works towards our goals around quality, client experience and growth
by collaborating to provide meaningful non-audit services to our audit clients
and their affiliates, it’s crucial that when proposed services are identified
and engagement teams submit service requests via Sentinel,
they are assessed for permissibility appropriately.
Service requests for our SEC audit clients and affiliates are routed
to the Sentinel Lead Partner and delegate, requiring their manual approval.
Each service request must include a draft engagement letter
or statement of work that describes all elements of the proposed services,
including the fee arrangement.
If a draft isn’t included, requests should be sent back for revisions.
For audits and attestation engagements, be sure the draft does not contain
indemnification or limitation of liability provisions,
which are impermissible for SEC audit clients.
To help determine the permissibility of the service, you will need to
review the documents to understand what services the client needs,
the intended use of the service and deliverables.
Confirm that all the information in the request is correct:
have all the engaging parties been selected?
Remember, when a service is being provided to an affiliate,
they should be listed as the engaging party,
not the Global Ultimate Parent.
Review the taxonomy codes, do they represent all aspects of the
proposed service including any technology components?
Evaluate the request against the applicable independence rules and firm policy.
Certain types of services and fee arrangements
are prohibited for restricted entities, such as contingent fees,
commissions, and referrals.
Compare the description in the Sentinel request to the
engagement letter, and confirm they are consistent.
Assess whether the requestor appropriately evaluated and documented
the threats and safeguards for each non-audit service.
Did they use the Threats and Safeguards Evaluation and Documentation Tool,
or otherwise document their evaluation?
Work with the requesting team to check that the information
included in the request is complete and accurate.
Be mindful of proposed services that present opportunities for scope creep.
Ensure all services are permissible, communicated to
and pre-approved by the Audit Committee, when required.
Pay special attention to service requests from non-US member firms;
their engagements may include embedded activities,
for example what would be viewed as legal services
in the US may not be permissible for audit clients.
If you have questions about permissibility,
consult with Risk Management- Independence.
As a best practice, obtain Audit Committee pre-approval
prior to approving a Sentinel request.
Services should be pre-approved in accordance with PCAOB and SEC rules,
this includes compliance with PCAOB Rules 3524 and 3525, as applicable.
Make sure you include your rationale for approving the service request.
Have conversations with client personnel to discuss limitations
on our services and remind the non-audit teams about any service limitations
and possible areas of scope creep.
For multi-year engagements, non-audit teams must submit a new Sentinel request
before KPMG is engaged to provide services for each year’s engagement.
For example, tax compliance services scoped for a three year period
would require a new Sentinel request each financial year.
It’s a best practice to reiterate this requirement within
the Sentinel approval comments to raise awareness among non-audit teams.
Setting a reminder when a new request should be submitted can help
with ensuring requests are received and necessary Audit Committee pre-approval,
if required is obtained prior to non-audit teams proceeding with recurring work.
If there are any additional client requests, they must be evaluated
for permissibility via an additional Sentinel request,
added to the engagement letter or statement of work, and pre-approved by the Audit
Committee prior to the non-audit team providing any additional service.