Procedures the auditor should adopt in respect of auditing accounting estimates include:

• Enquire of management how the accounting estimate is made and the data on which it is based.
• Determine whether events occurring up to the date of the auditor’s report (after the reporting period) provide audit evidence regarding the accounting estimate.
• Review the method of measurement used and assess the reasonableness of assumptions made.
• Test the operating effectiveness of the controls over how management made the accounting estimate.
• Develop an expectation of the possible estimate (point estimate) or a range of amounts to evaluate management’s estimate.
• Review the judgments and decisions made by management in the making of accounting estimates to identify whether there are indicators of possible management bias.
• Evaluate overall whether the accounting estimates in the financial statements are either reasonable or misstated.
• Obtain sufficient appropriate audit evidence about whether the disclosures in the financial statements related to accounting estimates and estimation uncertainty are reasonable.
• Obtain written representations from management and, where appropriate, those charged with governance whether they believe significant assumptions used in making accounting estimates are reasonable.                                                                     (Any 8 points @ 1 mark each = 8 marks)

• Procedures to verify the number of serious accidents in the workplace
•  Review records held by human resources, which summarise the number and type of accidents reported in the workplace.
• Review the accident log book from a sample of locations.
• Discuss the definition of a ‘serious’ accident (as opposed to a ‘minor’ accident) and establish the nature of criteria applied to an accident to determine whether it is serious.
• Review correspondence with legal advisors which may indicate legal action being taken against EnvironmentalCare Ghana in respect of serious accidents in the workplace.
• Review minutes of board meetings for discussions of any serious accidents and associated repercussions for the company.
• Ascertain through discussion with management and/or legal advisors, if EnvironmentalCare Ghana has any convictions for health and safety offences during the year (which could indicate that serious accidents have occurred).
• Enquire as to whether the company has received any health and safety visits (the regulatory authority would usually perform one if an employee has a serious accident). Review documentation from any health and safety visits for evidence of any serious accidents.
• Consider talking to employees to identify if any accidents have not been recorded in the accident book.
  (Any 3 points @ 1 mark each = 3 marks)

Procedures to verify the annual training spend per employee

• Review EnvironmentalCare Ghana’s approved training budget in comparison to previous years to ascertain the overall level of planned spending on training.
• Obtain a breakdown of the total training spend and review for any items mis-classified as training costs.
• Agree significant components of the total training spend to supporting documentation such as contracts with training providers and to invoices received from those providers.
• Agree the total amount spent on significant training programmes to cash book and/or bank statements.
• Using data on total number of employees provided by the payroll department, recalculate the annual training spend per employee.                                                                                     (Any 3 points @ 1 mark each = 3 marks)

Matters that should be considered in making acceptance decision
Objectivity
The proposed assurance engagement represents a non-audit service. IFAC’s Code of Ethics for Professional Accountants adopted by Institute of Chartered Accountants– Ghana does not prohibit the provision of additional assurance services to an audit client, however, the audit firm must carefully consider whether the provision of the additional service creates a threat to objectivity and independence of the firm or members of the audit team. For example, when the total fees generated by a client represent a large proportion of a firm’s total fees, the perceived dependence on the client for fee income creates a self-interest threat. Due to the nature of the proposed engagement, self-review and advocacy threats may also be created, as the Sustainability Report is published with the audited financial statements, and the audit firm could be perceived to be promoting the interests of its client by providing an assurance report on the key performance indicators (KPI)s.

Sustainability Ghana should only accept the invitation to provide the assurance engagement after careful consideration of objectivity, and a review as to whether safeguards can reduce any threat to objectivity to an acceptable level. As EnvironmentalCare Ghana is a ‘major client’, the fee level from providing both the audit and the assurance services could breach the permitted level of recurring fees allowed from one client. The fact that the company is listed means that the assessment of objectivity is particularly important, and a second partner review of the objectivity of the situation may be considered necessary.

The fact that a separate team, with no involvement with the audit, will be working on the KPIs strengthens the objectivity of the assignment.
EnvironmentalCare Ghana’s requirements
Assurance engagements can vary in terms of the level of work that is expected, and the level of assurance that is required. This will clearly impact on the scale of the assignment. For example, EnvironmentalCare Ghana may require specific procedures to be performed on certain KPIs to provide a high level of assurance, whereas a lower level of assurance may be acceptable for other KPIs. Sustainability Ghana should also clarify the expected form and content and expected wording of the assurance report itself, and whether any specific third party will be using the Sustainability Report for a particular purpose, as this may create risk exposure for the firm.
Competence
The audit firm’s sustainability reporting assurance team has only been recently established, and the firm may not have sufficient experienced staff to perform the assurance engagement. The fundamental principle of professional competence and due care requires that members of an engagement team should possess sufficient skill and knowledge to be able to perform the assignment, and be able to apply their skill and knowledge appropriately in the circumstances of the engagement.
Some of EnvironmentalCare Ghana’s KPIs appear quite specialised – verification of CO2 emissions for example, may require specialist knowledge and expertise. Sustainability Ghana could bring in experts to perform this work, if necessary, but this would have cost implications and would reduce the recoverability of the assignment.
Scale of the engagement
The Sustainability Report contains 75 KPIs, and presumably a lot of written content in addition. All of these KPIs will need to be verified, and the written content of the report reviewed for accuracy and consistency, meaning that this is a relatively large engagement. Sustainability Ghana should consider whether the newly established sustainability reporting assurance team has enough resources to perform the engagement within the required time scale, bearing in mind the time pressure which is further discussed below.
Time pressure
Given that the financial statements are scheduled to be published in four weeks, it is doubtful whether the assurance assignment could be completed, and a report issued, in time for it to be included in the annual report, particularly given the global nature of the assignment. Sustainability Ghana may wish to clarify with EnvironmentalCare Ghana’s management whether they intend to publish the assurance report within the annual report, as they have done previously, or whether a separate report will be issued at a later point in time, which would allow more time for the assurance engagement to be conducted.
Fee level and profitability
Such a potentially large scale assignment should attract a large fee. Costs will have to be carefully managed to ensure the profitability of the engagement, especially considering that overseas travel will be involved, as presumably much of the field work will be performed at EnvironmentalCare Ghana’s Sustainability Department in Fartown. The fee level would need to be negotiated bearing in mind the specialist nature of the work, and the urgency of the assignment, both of which mean that a high fee could be commanded.
Global engagement
The firm’s sustainability reporting team is situated in a different country to EnvironmentalCare Ghana’s Sustainability Department. Although this does not on its own mean that the assignment should not be taken on, it makes the assignment logistically difficult. Members of the assurance department must be willing to travel overseas to conduct at least some of their work, as it would be difficult to perform the engagement without visiting the department responsible for providing the KPIs. Other locations may also need to be visited. There are also cost implications of the travel, which will need to be built into the proposed fee for the engagement. Language may also present a barrier to accepting the engagement, depending on the language used in Fartown’s location.
Risk
EnvironmentalCare Ghana is a large company with a global presence. It is listed on several stock exchanges, and so it appears to have a high public profile. In addition, pressure groups are keen to see the added credibility of an assurance report issued in relation to the KPIs disclosed. For all of these reasons, there will be scrutiny of the Sustainability Report and the assurance report. Sustainability Ghana should bear in mind that this creates a risk exposure for the firm. If the assignment were taken, the firm would have to carefully manage this risk exposure through thorough planning of the engagement and applying strong quality control measures. The firm would also need to ensure that the fee is commensurate with the level of risk exposure. Given the inconsistency that has come to light regarding one of the draft KPIs, which appears to overstate charitable donations made by the company, we may need to consider that management are trying to show the company’s KPIs in a favourable way, which adds to the risk of the engagement.
Commercial consideration
If Sustainability Ghana does not accept the assurance engagement, the firm risks losing the audit client in future years to another firm that would be willing to provide both services. As EnvironmentalCare Ghana is a prestigious client, this commercial consideration will be important, but should not override any ethical considerations.
(Any 7 points well explained points @ 2 marks each = 14 marks)

Provide the range of services required
Mobilefone Ltd. requires an enhanced range of services this year including review of and implementation of additional control systems. This service provides the following risks:
• Skills necessary
Kasim Hamza & Co must check whether they can provide these services. Kasim Hamza & Co is only a seven partner firm and so the company must ensure it has the necessary staff and skills to undertake this work.
• Self-review threat
There is a self-review threat. If Kasim Hamza & Co are to implement new control systems then they may also be auditing those systems as part of the statutory audit. Kasim Hamza & Co must ensure different staff implement and audit the systems. Preferably different departments in the firm should undertake the work. If insufficient staff are available then Kasim Hamza & Co must refuse the additional systems work.
• Acceptance of non-audit work
There is a possibility that Kasim Hamza & Co will be breaching ethical or statutory guidelines by accepting the work. Kasim Hamza & Co will need to ensure that the firm follows guidance in the Ethical Standards to limit any self-review threat.
• Fee income
Acceptance of additional work will result in additional fee income for Kasim Hamza & Co. IFAC Code of Ethics and Conduct states that the amount of fee income derived from any one client should not exceed 15% for non-listed audit clients. Kasim Hamza & Co will need to ensure that total fee income from Mobilefone Ltd. does not breach these guidelines.
• Client growth
Mobilefone Ltd is growing quickly. The company has poor internal controls providing high risk of financial misstatement. Kasim Hamza & Co will need to ensure sufficient staff of appropriate experience are available and that enough time is allocated to the audit to complete all audit procedures.
• Internal audit
Client expectations regarding the use of internal audit may be difficult to meet. As a new department, it will take time for the internal auditors to understand the systems at Mobilefone Ltd and produce any useful reports. Expectation of reduced fee will have to be managed carefully and checks made to ensure the auditor does not limit work because of fee pressure.

• Association threat
Mobilefone Ltd are producing a new mobile telephone. The legal status of the telephone is currently uncertain; it may be illegal. Kasim Hamza & Co need to determine the likelihood that the telephone is illegal. The audit firm may not wish to be associated with a company producing illegal products.
• Report on cash flow
The mobile telephone application also requires a report on Mobilefone Ltd’s cash flow forecast. This will be a separate engagement, with risk to Kasim Hamza & Co because Mobilefone Ltd may attempt to show an unrealistic cash position in the forecast. Mobilefone Ltd must determine exactly what type of report is required (positive or negative) and ensure they have the time and staff with the necessary skills to provide the service.
• Possible going concern
It is not clear whether failure to obtain the new mobile telephone licence will result in Mobilefone Ltd no longer being a going concern. Kasim Hamza & Co will need to review the cash flow forecasts closely to determine the company’s status in the future.

(Any 5 points well explained @ 2 marks each = 10 marks)

The following may give rise to ethical issues for Abdulai Afriyie and Co:
i) The preparation of accounts as well as auditing them.
ii) The request to deal with the failure to pay royalties and
iii) The offer of a gift from the client to members of the audit team.

These issues are addressed below: Accountants producing and then auditing the financial statements of companies is a near-universal practice in the case of private, unlisted entities. Similarly conducting specific extra assignments on behalf of the client would not be unusual. However these situations are not without ethical difficulties. In particular the following threats arise:

• If no note is provided to the financial statements, then there is a breach of IAS 10. In this case there is insufficient disclosure provided in the notes to the financial statements regarding a material non-adjusting event after the reporting date.
• According to ISA 701: Modifications to the Independent Auditor’s Report, in cases where the auditor is in disagreement(material misstatement) with management regarding the application of a financial reporting standard and where the disagreement is material to the financial statements, the auditor should express a qualified or an adverse opinion. Here, the matter is material (as discussed in (b)(i) above) but is not pervasive to the financial statements, so a qualified ‘except for’ opinion should be given.
• The audit report should contain a paragraph which explains the reason for the qualification, specifying the breach of accounting standards, and stating the relevant financial amount. It would also be best practice for the auditor to clarify that the profit for the year is not affected by the breach of accounting standards, and that the disagreement is solely due to inadequate disclosure in the notes to the financial statements.
• The auditors should ensure that the matter, and the potential consequence for the audit report, has been made known to those charged with governance. This will allow the highest level of management (including executive and non-executive directors) the opportunity to discuss the matter, having reference to all relevant facts of the disagreement and implications thereof.
• Finally, the auditors could choose to raise this issue at the annual general meeting, where the matter leading to the qualified audit opinion should be explained to the shareholders of the company.

Financial Reporting Implications
The announcement of a restructuring after the reporting date is a non-adjusting event after the reporting date, according to IAS 10: Events After the Reporting Period. This is because the event does not provide evidence in relation to a condition that existed at the year end.
Materiality calculations in respect of the potential cost of closure are as follows: Based on revenue: GH¢ 250,000/15 million = 1·67%
Based on profit: GH¢ 250,000/3 million = 8·3%
Based on assets: GH¢ 250,000/80 million = <1%
Therefore this amount is material to the statement of comprehensive income.
Per IAS 10, a note should be provided to the financial statements, which describes the nature of the event, and provides an estimate of the financial effect.
Tutorial note: credit will also be awarded for discussion of whether a provision for the restructuring costs is required under IAS 37 Provisions, Contingent Liabilities and Contingent Assets.

Audit procedures could include:
• Review any potential note to financial statements which should disclose the non-adjusting event, providing a brief description of the event, and an estimate of the financial effect.
• Discuss the reason for the restructuring with a member of key management personnel, and read minutes of board meetings where the plan was discussed, in order to gain an understanding about the reason for the restructuring.
• Verify the approval of the plan itself, and the approval of the announcement of the plan, which can be performed through a review of board minutes.
• Confirm the date on which the plan was approved, and also the date of the announcement, using supporting documentation such as press release, letters sent to employees, internal meetings held with employees, etc.
• Obtain a copy of the announcement and review for details, particularly a description of the exact nature of the restructuring, including the number of employees to be affected.
• Agree the GH¢ 250,000 potential cost of closure to supporting documentation, including a schedule showing the number and grade of staff to be made redundant, which should be supported by payroll/contract details.
• Using the results of the discussion with management, assess the planned restructuring in the context of the auditor’s knowledge of the business, considering whether any further costs are likely to be incurred.

• Organisations using electronic systems for conduct of business need to have cyber security policy and strategy. By their design cyber security policies serve many purposes including informing organisation users and third parties of their obligations to protect the organisation’s digital assets.
• It describes what must be protected and outlines possible threats to those assets. Cyber security policies also provide information on what is acceptable usage. For example employees cannot use the organisation’s internet outside office hours or for private work.
• Another element of a cyber security policy is classification of digital assets, where system files, data and equipment can be classified either as confidential or non-confidential.
• A good cyber security policy recognises the fact that employees are the biggest security threat to an organisation because their wilful action or inaction can cause damage.
• It provides mitigations such as limited access to qualified persons only, logging the usage of the system and making it mandatory for employees to change their password periodically.

Cyber security audit is a formal process of carrying out cyber security assessment. It is an assessment carried out by a certified third party, an independent organisation or consultant. Cyber security audits usually involve an external assessment to ascertain the level of cyber risks an organisation is exposed to.
The audit process covers processes such as digital assets management, cyber security awareness training, data security, resources planning, information and communication.

What it is intended to achieve:

• When done properly a cyber security audit can help the organisation understand what risks to information system and software exist in the situation.
• It can help prioritise these risks, align the information protection to that of the central authority such as the Data commission, Communication Authority or even the central bank and to external security frameworks such as National Standards and Technology Institute (NISTI) cyber security framework of USA and European Network and Security agency (ENISA) as well as the ISO/IEC 2700 family on information security management systems.
• Once the audit and assessment is completed the reviewer will provide a detailed report articulating gaps or vulnerabilities in the organisation’s security profile.
• The tangible outcome of cyber security audit is clear cut road map which is expected not only to improve cyber security readiness, but also ensure long term compliance and robust system of risk management.

Government entities are subject to a variety of laws and regulations not generally applicable to private sector, profit making entities. For example local laws may restrict the authority of Metropolitan, Municipal and District Assemblies to issue debt, and they may be required to pay the proceeds from internally generated funds into special funds etc, other laws may restrict the disbursement of social service payments to eligible applicants.
Violations of any of these, among other laws and regulations could have a direct and material effect on the operations of those entities and their financial statements.
The Auditor General is required to bring to light the infractions of laws and regulations in the annual report.
The compliance audit determines the extent to which, rules, policies, laws, covenants or government regulations are followed by the entity being audited.

• The laws and regulations under which the entity being audited operates and of which it is required to comply. This will ascertain those laws and regulations to determine whether the auditee is fully aware of them and the consequences of any breach thereof.
• Internal rules, procedures and directives. These involve ascertaining the entities procedures designed to ensure that the operations and activities are designed to be in compliance with the laws and regulations.
•  Compliance with the laws and regulations: The audit is conducted to ascertain the extent of compliance or non-compliance with the laws and regulation and the determination of whether non-compliance is deliberate or due to ignorance.
• Consequence of non-compliance: The audit will determine the possible sanctions or punishment that would arise as a result of the non-compliance.

• The laws and regulations governing the entity that ought to be complied with. This may be termed as the criteria against which the entity’s compliance is measured.
• The entities awareness of the laws and regulations and the conduct of operations in line with the laws and regulation. The conditions noted.
• The effect of non-compliance. The consequences of the non-compliance will be clearly spelt out in the report.
• Recommendations. These are intended to enable the auditee to rectify and/or prevent future reoccurrence of the non- compliance.

The 1992 Constitution of Ghana gives Parliament the following roles in Public Accountability and judicious use of resources:

• Taxation: No taxation shall be imposed otherwise than by or under the authority of an Act of Parliament.
• Where an act of Parliament confers power on any person or authority to waive or vary any tax imposed by Parliament, the exercise of the power of waiver or variation in favour of any person or authority shall be subject to prior approval of Parliament by resolution.
• Apart from the Consolidated fund and Contingency fund, Parliament has the authority to establish other public funds by an act of Parliament.
• Parliament also has the power to authorise any authority or department to retain any revenue received by them for the purposes of defraying the expenses of that department.
• It is also Parliament that can authorise payment of monies into or withdrawal from the Contingency fund.
• No monies shall be withdrawn from the consolidated fund unless it is authorised by an appropriation act passed by Parliament or by supplementary estimate approved by a resolution passed by Parliament for that purpose.
•  Parliament may by resolution authorised government to enter into an agreement for a loan out of any public fund or public account.
• Apart from the finance function, Parliament also has Public Accounts Committee which receives the annual report of the Auditor General
• The committee pursues the implementation of the recommendations of the Auditor General’s report to ensure that MDAs and MMDAs comply with the recommendations.