The amendments to the IRBA Code of Professional Conduct for Registered Auditors (IRBA Code) relating to Non-compliance with Laws and Regulations (NOCLAR) may still be relatively new, but have you already been a victim of a myth or two?
It happens to all of us. A standard or legislative amendment is released and before you’ve had the opportunity to digest the complete text, you are pulled into a conversation in which you are asked for your opinions and an analysis of the consequences of the amendment. You present and defend your views with a few key messages from one conversation to the next, and soon you have ‘learnt’ several ‘facts’.
While corridor conversations are one of the effective ways to learn and share with colleagues and keep up to date with the ever-changing environment, occasionally these ‘learnt facts’ turn out to be myths. The recent amendments to the IRBA Code, based on the International Ethics Standards Board for Accountants (IESBA) Code of Ethics, have been no exception. This article intends to dispel a few of those myths.
Myth 1: NOCLAR is not new for South Africa
According to recent media reports, South African entities, both private and public, have been associated with non-compliance with laws and regulations. Additionally, the reporting of certain non-compliance is well embedded in South African legislation, for example the requirement in section 45 of the Auditing Profession Act 26 of 2005 (APA) regarding reportable irregularities (RI). However, the NOCLAR amendments set out some new responsibilities for registered auditors (RAs) when encountering non-compliance or suspected non-compliance.
The NOCLAR provisions set out a framework for RAs on what actions to take when they become aware of a suspected non-compliance. These include any act of omission or commission, intentional or unintentional, committed by a client, including by management, those charged with governance, or by others working for or under the direction of the client, which is contrary to prevailing laws and regulations.
While this article’s primary focus is on the RAs, professional accountants (who include chartered accountants) will have similar considerations, in response to NOCLAR, when rendering professional services or within their employing organisations. This is new for the accounting profession in South Africa.
The NOCLAR provisions share some similarities with RI responsibilities and other legislative requirements where the RA is required to report directly to a regulator. The NOCLAR provisions do envisage the possible existence of local laws that govern how the RA addresses non-compliance.
An RA is required to comply with jurisdictional laws and regulations. Additionally, an RA needs to be aware of any differences between the NOCLAR provisions and local legislative requirements, and then comply with the more stringent requirement and guidance, unless prohibited by law or regulation.
Simply dismissing the NOCLAR provisions as nothing new may lead to inadequate planning, training and documentation on the part of the RA. There could then be a risk that a NOCLAR is not responded to adequately, which would be a contravention of the IRBA Code.
Myth 2: The NOCLAR provisions considerations are only required for audit engagements
An RA’s responsibility to NOCLAR extends to all professional services, which include engagements other than the audit of financial statements.
The framework is considered under the following categories:
Audit of Financial Statements, and
Professional Services Other than Audits of Financial Statements
Each category has different approaches and considerations.
While RAs may find their experiences with the RI requirements helpful, they should be cognisant of the specific requirements and considerations under the NOCLAR provisions, as these differ from the RI requirements.
Myth 3: Reporting is always required under the NOCLAR provisions
The RI reporting requirement has allowed RAs to become familiar with a reporting framework. However, reporting is only one consideration of the NOCLAR provisions, and not the necessary default position. The NOCLAR provisions have a response framework that may include a reporting consideration.
The robust NOCLAR response framework includes the following:
- Become aware of NOCLAR
- Obtain an understanding of the matter
- Address the matter
- Communication with different individuals, for instance within the firm
- Consideration whether further action is required in the public interest after management’s response to the NOCLAR. This includes:
- Disclosing the matter to an appropriate authority even when there is no legal or regulatory requirement to do so, and/or
- Withdrawing from the engagement and the professional relationship, where permitted by law or regulation
- Documentation, including all considerations
There are circumstances when the RA will make disclosure to the appropriate authority immediately. But this is only in exceptional circumstances, when the RA becomes aware of actual or intended conduct, that the RA has reason to believe would constitute an imminent breach of a law or regulation that would cause substantial harm to investors, creditors, employees or the general public.
Myth 4: Reporting a reportable irregularity negates the NOCLAR provisions
The RA must firstly comply with local law or regulation, which in this instance is the APA. However, Section 225 of the IRBA Code contains other provisions that would still apply, if not already required or prohibited by law or regulation.
Examples of the NOCLAR response framework that may still need to be complied with are:
- Provisions addressing the escalation of the matter within the entity
- In the case of an audit of group financial statements, communication with the relevant RA involved in the group audit
- Advising management or those charged with governance to take appropriate action, if they haven’t already done so, to rectify, remediate or mitigate the consequences of the non-compliance; to deter the commission of the non-compliance, where it has not yet occurred; or to disclose the matter to an appropriate authority, where required by law or regulation or where considered necessary in the public interest, and
Determination of the need for further action (including withdrawal from the client relationship) in appropriate circumstances
Complying with section 45 of the APA, and its specific timelines, may result in the RA partially discharging some obligations that are required by the NOCLAR provisions. This will not need to be repeated, but the RA will be required to document their consideration of both the RI and the NOCLAR provisions.
Though an RA may have reported an RI to the IRBA, the RA must still respond to NOCLAR or suspected NOCLAR, including the consideration of reporting the NOCLAR or suspected NOCLAR to an appropriate authority. Also, it is possible that an RA may report an RI to the IRBA and determine that additional disclosure of the matter to an appropriate authority is an appropriate course of action.
Myth 5: NOCLAR will lead to a loss of client trust
The NOCLAR provisions should not change the RA’s relationship with clients or the outlook on the engagement. The RA does not approach an engagement looking for potential NOCLAR, but rather considers his obligations when he/she encounters a NOCLAR or suspected NOCLAR.
An RA is always expected to use professional judgement while performing all professional services and professional scepticism in assurance engagements. Thus, the RA’s outlook should not change, and the relationship of trust should not be drastically altered.
Additionally, while the NOCLAR provisions may allow for the RA to report directly to an appropriate authority, this is usually within a framework that includes sufficient consultation with the client. This, however, does not necessarily put the client and the RA at odds with each other.
Communication with a client on the NOCLAR provisions is vital. Investing in sharing information and conversations on the NOCLAR provisions will help facilitate the process of responding to a NOCLAR or suspected NOCLAR, if required to in the future.
Myth 6: The NOCLAR provisions are burdensome and involves more work, time and costs for the RA
The default answer is the NOCLAR provisions are not necessarily burdensome as not every engagement will include a consideration of the NOCLAR response framework.
Yes, additional documentation, training, and more time may be required, but this is not unlike any other new requirements in standards or legislation.
In producing the NOCLAR amendments, the IESBA and IRBA were responding to a need for guidance on what actions an RA should take in the public interest when they become aware of a NOCLAR or suspected NOCLAR. The success of this initiative will be dependent on the positive contribution of all parties and the proper application of the framework. All parties will agree that there is no myth in that.
RAs and others are encouraged to refer to additional guidance that has been released on this subject, and this includes the IRBA Frequently Asked Questions on NOCLAR available on the IRBA website link below.
AUTHOR l Saadiya Adam CA(SA) is Professional Manager: Ethics, Independent Regulatory Board for Auditors (IRBA)
