Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697810983004.pdf (Mauritius)
Financial Reporting Council – Audit Practice Review Panel Quality and Risk Controls Assessment Period ending 30 June 2008 FRC Licence No: Firm Name: Completed by: Name: Title: Signature: Date: Firm Information: Partners who are Licensed Auditors: Name FRC Licence No Own specimen Signature Specimen Signature of firm Partners who are NOT Licensed Auditors: Name Own Specimen Signature Specimen Signature of firm This document is substantially based on the requirements of ISQC1, and is part of FRC’s off-site inspection programme.
Description of the Control Environment All sections should be completed as indicated in the document.

The firm’s documentation of its control environment should include a description of the policies, procedures, and controls in place to address the stated objectives.

WP ref Upon submission of the completed document, you are not expected to send in any other additional documents as support or justification for your statements.
The firm is however expected to provide reference to where the firm policy or process is available in writing.

This will be subject to FRC’s verification subsequently as part of its own assessment and on-site inspection.

Coverage period This assessment covers the period between 1 July 2007 and 30 June 2008.

The firm should therefore consider the design, implementation, and effectiveness of the relevant policies and controls during the period under review.
Where a control, procedure or policy has been in place for only part of the period, this must be stated and the response should take into account the preparer’s understanding of the effectiveness of the Firm’s procedures since the new policy came into force.
Self Assessment of Controls After documenting the policies, procedures and controls in place across all areas of the firm to address the objectives, the Firm should record its assessment of the control environment according to the evaluation criteria discussed below.

The evaluation criteria are as follows: Fully Compliant (“F”) – substantial compliance with quality and compliance requirements throughout the year.
Partially Compliant (“P”) – compliance with quality and compliance requirements needs improvement or did not cover the full period Not Effective (“N”) – significant non-compliance with quality and compliance requirements.

FRC assessment As part of its on-site inspection, FRC will seek evidence to understand and concur, or not, with firm’s assessment.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 1.0 Risk Management 1.1 The firm should establish a system of quality control designed to provide it with reasonable assurance that the firm and its personnel comply with professional standards and regulatory and legal requirements, and that reports issued by the firm or engagement partners are appropriate in the circumstances.
The quality control policies and procedures should be documented and communicated to the firm’s personnel.

The firm has designed and delivered a “quality and risk management” training programme to new joiners and existing staff on at least an annual basis that covers the firm’s risk management and quality control policies and associated procedures.
Leadership Responsibilities for Quality The firm should establish policies and procedures designed to promote an internal culture based on the recognition that quality is essential in performing engagements.

1.2 1.3 2.0 2.1 2.2 Any person or persons assigned operational responsibility for the firm’s quality control system should have sufficient and appropriate experience and ability, and the necessary authority, to assume that responsibility.
Ethical Requirements The firm should establish policies and procedures designed to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements.
3.0 3.1 Objectives Description of Control Environment WP ref Self- assessment FRC assessment 4.0 4.1 4.2 Independence The firm should establish policies and procedures designed to provide it with reasonable assurance that the firm, its personnel and, where applicable, others subject to independence requirements (including experts contracted by the firm and network firm personnel), maintain independence where required by the IFAC Code and national ethical requirements.
Such policies and procedures should enable the firm to: (a) Communicate its independence requirements to its personnel and, where applicable, others subject to them; and (b) Identify and evaluate circumstances and relationships that create threats to independence, and to take appropriate action to eliminate those threats or reduce them to an acceptable level by applying safeguards, or, if considered appropriate, to withdraw from the engagement.
Such policies and procedures should require: (a) Engagement partners to provide the firm with relevant information about client engagements, including the scope of services, to enable the firm to evaluate the overall impact, if any, on independence requirements; (b) Personnel to promptly notify the firm of circumstances and relationships that create a threat to independence so that appropriate action can be taken; and (c) The accumulation and communication of relevant information to appropriate personnel so that: (i) the firm and its personnel can readily determine whether they satisfy independence requirements; (ii) the firm can maintain and update its records relating to independence; and Objectives Description of Control Environment WP ref Self- assessment FRC assessment 4.3 (iii) the firm can take appropriate action regarding identified threats to independence.
The firm should establish policies and procedures designed to provide it with reasonable assurance that it is notified of breaches of independence requirements, and to enable it to take appropriate actions to resolve such situations.
The policies and procedures should include requirements for: (a) All who are subject to independence requirements to promptly notify the firm of independence breaches of which they become aware: (b) The firm to promptly communicate identified breaches of these policies and procedures to: (i) (ii) The engagement partner who, with the firm, needs to address the breach; and Other relevant personnel in the firm and those subject to the independence requirements who need to take appropriate action; and (c) Prompt communication to the firm, if necessary, by the engagement partner and the other individuals referred to in subparagraph (b)(ii) of the actions taken to resolve the matter, so that the firm can determine whether it should take further action.
4.4 At least annually, the firm should obtain written confirmation of compliance with its policies and procedures on independence from all firm personnel required to be independent by the IFAC Code and national ethical requirements.
The firm should establish policies and procedures: (a) Setting out criteria for determining the need for safeguards to reduce the familiarity threat to an acceptable level when using the same senior personnel on an assurance engagement over a long period of time; and 4.5 Objectives Description of Control Environment WP ref Self- assessment FRC assessment (b) For all audits of financial statements of public interest entities, requiring the rotation of the engagement partner after a specified period in compliance with the IFAC Code and national ethical requirements that are more restrictive.
The firm provides mandatory independence training to all firm personnel on an annual basis.

It regularly communicates updates to or clarification of independence policies to firm personnel outside of mandatory annual training.
4.6 5.0 Client and Engagement Acceptance and 5.1 Continuance The firm should establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, designed to provide it with reasonable assurance that it will only undertake or continue relationships and specific engagements, designed to provide it with reasonable assurance that it will only undertake or continue relationships and engagements where it: (a) has considered the integrity of the client and does not have information that would lead it to conclude that the client lacks integrity; (b)is competent to perform the engagement and has the capabilities, time and resources to do so; and (c)can comply with ethical requirements.
The firm should obtain such information as it considers necessary in the circumstances before accepting an engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client.

Where issues have been identified, and the firm decides to accept or continue the client relationship or a specific engagement, it should document how the issues were resolved.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 5.2 Where the firm obtains information that would have caused it to decline an engagement if that information had been available earlier, policies and procedures on the continuance of the engagement and the client relationship should include consideration of: (a) The professional and legal responsibilities that apply to the circumstances, including whether there is a requirement for the firm to report to the person or persons who made the appointment or, in some cases, to regulatory authorities; and (b) The possibility of withdrawing from the engagement or from both the engagement and the client relationship.
6.0 Human Resources 6.1 The firm should establish policies and procedures designed to provide it with reasonable assurance that it has sufficient personnel with the capabilities, competence, and commitment to ethical principles necessary to perform its engagements in accordance with professional standards and regulatory and legal requirements, and to enable the firm or engagement partners to issue reports that are appropriate in the circumstances.
The firm should assign responsibility for each engagement to an engagement partner.

The firm should establish policies and procedures requiring that: (a) the identity and role of the engagement partner are communicated to key members of client management and those charged with governance; (b) the engagement partner has the appropriate capabilities, competence, authority and time to perform the role; and (c) the responsibilities of the engagement partner are clearly defined and communicated to that partner.
6.2 Objectives Description of Control Environment WP ref Self- assessment FRC assessment 6.3 6.4 The firm should also assign appropriate staff with the necessary capabilities, competence and time to perform engagements in accordance with professional standards and regulatory and legal requirements, and to enable the firm or engagement partners to issue reports that are appropriate in the circumstances.
The firm provides and monitors the delivery of sufficient training (both core and non-core)to partners and professionals and identifies and adequately addresses the training needs of personnel on a timely basis.

Partners and client service personnel receive a minimum of 21 hours of structured professional education (CPE) in any one year and accumulate a total of 120 CPE hours over a three year period.
6.6 Attendance at training sessions is monitored and 6.5 follow-up procedures are in place for non-attendees to attend alternative sessions or complete appropriate self-study courses.

6.8 6.7 An annual performance management process exists for all levels of personnel, including partners.

The firm has a Code of Conduct made available to all personnel.
The firm has communicated to all personnel the need to seek the designated partner approval before undertaking personal investments, activities or appointments that could be viewed by third parties as being conducted under the control of the firm.

6.9 6.10 The firm has identified individuals who are 7.0 7.1 7.2 authorized to sign firm communications and have communicated these details to all personnel.
Engagement Contract The firm requires that each engagement is subject to a written engagement contract which is signed by authorized personnel prior to start of work.

The firm’s written engagement contracts define the terms and conditions of the engagement, as well as the responsibilities, rights, and obligations of the firm and the client and comply with all applicable laws, regulations and professional standards and contain (at a minimum) the items below.
The engagement letter is periodically reviewed and updated when client circumstances change.

o Identity of the contracting firm and the client.
o Scope of the engagement o Description of the deliverables o Timetable o Responsibilities of the client o Fees or a description of fee arrangements o Limitation of liability provisions where permissible o Governing law and jurisdiction o Statement that the contract is the entire agreement and provisions regarding modifications to the contract o Authorised signature of the contracting parties or other acceptance by them Engagement Performance The firm should establish policies and procedures designed to provide it with reasonable assurance that engagements are performed in accordance with professional standards and regulatory and legal requirements, and that the firm or the engagement partner issue reports that are appropriate in the circumstances.
The firm should establish policies and procedures designed to provide it with reasonable assurance that: (a) Appropriate consultation takes place on difficult or contentious matters; (b) Sufficient resources are available to enable appropriate consultation to take place; (c) The nature and scope of such consultations are documented; and (d) conclusions resulting from consultations are documented and implemented.
8.0 8.1 8.2 Objectives Description of Control Environment WP ref Self- assessment FRC assessment 8.3 8.4 8.5 8.6 The firm should establish policies and procedures for dealing with and resolving differences of opinion within the engagement team, with those consulted and, where applicable, between the engagement partner and the engagement quality control reviewer.

Conclusions reached should be documented and implemented.
The firm should establish policies and procedures requiring, for appropriate engagements, an engagement quality control review that provides an objective evaluation of the significant judgements made by the engagement team and the conclusions reached in formulating the report.
Such policies and procedures should: (a)Require an engagement quality control review for all audits of financial statements of public interest entities; (b) Set out criteria against which all other audits and reviews of historical financial information, and other assurance and related services engagements should be evaluated to determine whether an engagement quality control review should be performed; and (c) Require an engagement quality control review for all engagements meeting the criteria established in compliance with subparagraph (b).
The firm’s policies and procedures should require the completion of the engagement quality control review before the report is issued.
The firm should establish policies and procedures setting out: (a) The nature, timing and extent of an engagement quality control review; (b) Criteria for the eligibility of engagement quality control reviewers; and (c) Documentation requirements for an engagement quality control review Objectives Description of Control Environment WP ref Self- assessment FRC assessment 8.8 8.7 The firm’s policies and procedures should address the appointment of engagement quality control reviewers and establish their eligibility through: (a) The technical qualifications required to perform the role, including the necessary experience and authority; and (b) The degree to which an engagement quality control reviewer can be consulted on the engagement without compromising the reviewer’s objectivity.
Policies and procedures on documentation of the engagement quality control review should require documentation that: (a) The procedures required by the firm’s policies on engagement quality control review have been performed; (b) The engagement quality control review has been completed before the report is issued; and (c) The reviewer is not aware of any unresolved matters that would cause the reviewer to believe that the significant judgements the engagement team made and the conclusions they reached were not appropriate.
9.0 Monitoring 9.1 The firm should establish policies and procedures designed to provide it with reasonable assurance that the policies and procedures relating to the system of quality control are relevant, adequate, operating effectively and complied with in practice.

Such policies and procedures should include an ongoing consideration and evaluation of the firm’s system of quality control, including a periodic inspection of a selection of completed engagements.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 9.2 9.3 9.4 The firm should evaluate the effect of deficiencies noted as a result of the monitoring process and should determine whether they are either: (a) Instances that do not necessarily indicate that the firm’s system of quality control is insufficient to provide it with reasonable assurance that it complies with professional standards and regulatory and legal requirements, and that the reports issued by the firm or engagement partners are appropriate in the circumstances; or (b) Systemic, repetitive or other significant deficiencies that require prompt corrective action.
The firm should communicate to relevant engagement partners and other appropriate personnel deficiencies noted as a result of the monitoring process and recommendations for appropriate remedial action.
The firm’s evaluation of each type of deficiency should result in recommendations for one or more of the following: (a) Taking appropriate remedial action in relation to an individual engagement or member of personnel; (b) The communication of the findings to those responsible for training and professional development; (c) Changes to the quality control policies and procedures; and (d) Disciplinary action against those who fail to comply with the policies and procedures of the firm, especially those who do so repeatedly.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 9.5 Where the results of the monitoring procedures indicate that a report may be inappropriate or that procedures were omitted during the performance of the engagement, the firm should determine what further action is appropriate to comply with relevant professional standards and regulatory and legal requirements.

It should also consider obtaining legal advice.


9.6 At least annually, the firm should communicate the results of the monitoring of its quality control system to engagement partners and other appropriate individuals within the firm, including the firm’s chief executive officer or, if appropriate, its managing board of partners.

Such communication should enable the firm and these individuals to take prompt and appropriate action where necessary in accordance with their defined roles and responsibilities.
Information communicated should include the following: (a) a description of the monitoring procedures performed; (b) the conclusion drawn from the monitoring procedures; (c) Where relevant, a description of systemic, repetitive or other significant deficiencies and of the actions taken to resolve or amend those deficiencies.
10.0 Working Papers 10.1 The firm has established working paper retention policies that meet any specific standards required by local or relevant international laws and regulations and market conditions and that keep working papers: o Confidential o The property of your firm o Safe from loss or theft o Safeguarded from unauthorized access or destruction.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 10.2 The firm’s working paper retention policy has been communicated and personnel are aware of the requirements regarding the retention of working papers to support engagement deliverables.

10.3 The firm has procedures in place, dealing with requests by clients, other firms or third parties for access to the firm’s working papers.

These procedures include obtaining legal advice before the release of any document.
10.4 The firm has effective procedures in place to prevent removal of relevant and supporting documentation (e.g.

work papers, files, emails, diaries, etc.)

or destruction of documentation without prior consultation with legal counsel, irrespective of the standard retention policy in the event that a claim might arise against the firm.
11.0 Complaints and Allegations 11.1 The firm should establish policies and procedures designed to provide it with reasonable assurance that it deals appropriately with: (a) Complaints and allegations that the work performed by the firm fails to comply with professional standards and regulatory and legal requirements; and (b) Allegations of non-compliance with the firm’s system of quality control.
11.2 The firm has in place procedures to deal with partners who are alleged or proven to be guilty of professional misconduct.

IFRS 12.0 12.1 The firm has established a process to obtain and disseminate its policy and guidance on IFRS and to consult externally when required.

All partners and professionals allocated to IFRS engagements have access to IFRSs and support.
Objectives Description of Control Environment WP ref Self- assessment FRC assessment 12.2 The firm has an appropriate training program for partners and professionals requiring knowledge of IFRS.

The training program is provided on a sufficiently frequent basis.
12.3 Where IFRS is not the applicable financial reporting framework (eg US GAAP or UK GAAP), ensure that the signing partner has undergone a recognized accreditation exercise to ensure that the partners meet the training and experience requirements.