FIFTH TRIMROT FACTOR | RISK

What we Teach: “Assess the client’s risk profile and reputation thoroughly.”

Reality Check |  HBOS and KPMG, Thomas Cook and EY.

Think of a young accounting student, fresh from lectures that have just taught them that as auditors, their job is to challenge assumptions, sniff out risks, and where necessary, walk away. Students usually laugh when they hear the action as ‘resign’.

Go out into the big, wide world, and those ideals get quickly trampled underfoot by commercial pressures. The principle of Risk and integrity of the client should make the auditors sceptical and independent.

It seems that, in the presence of a big client, this factor gets killed.

What do international standards on auditing say?

ISA 315 puts it nicely: evaluate risks by viewing the client’s business, controls, and weaknesses. Financial instability or perceived aggressive accounting are some of the warning signals that require much closer scrutiny.

Simple, one would say!

Yet real life tells a different story where, in most cases, risk assessment is done as an afterthought.

Case Study: HBOS and KPMG (What Happens: Risk Ignored)

Before it sank in 2008, HBOS was awash with reckless subprime lending. KPMG should have been challenging and testing. It simply signed off the accounts, however, without a peep about the glaring risks.

The FRC censured KPMG for its failure to take any action on such reckless exposure by HBOS. Was it incompetence or the prestige of auditing such a prestigious client?

Case Study: Thomas Cook and EY

Thomas Cook had increasing debts against reducing cash flows, which in itself is a warning signal; every year, EY signed off on its accounts without any qualifications on its going-concern status.

In 2019 the FRC found that EY’s work lacked vigour and scepticism when Thomas Cook finally collapsed. Was the judgment of the long-client relationship blurred or did it only not want to challenge?

Why Risk is Ignored

Cut to the bottom line: here’s why auditors aren’t addressing risk.

Fee Addiction: High-risk clients come with premium fees; firms rationalize the risks, thinking it’ll all balance out with many more procedures. Spoiler: they rarely do!

Client Retention: Familiarity breeds complacency. Long-continuing relationships, such as EY’s with Thomas Cook, make auditors reluctant to challenge long-tenured clients. 

Time Pressures: Audits are hurried. It is reported that PwC spent a mere two hours finalising the audit of BHS. Two hours to review a company’s financial health? That is not auditing, but a joke says the UK Parliament Work and Pensions Committee report about audits of BHS. 

Lesson for the Future Auditors

Students are taught to treat risk assessment as sacrosanct. In the real world, it often happens that firms value only fees and deadlines over diligence. The onus of choice now lies with you-to stand up to the ideals of Risk and Client Integrity or to fall into line, joining the league of those who allowed profit to outweigh principle. Risk assessment is not optional; rather, it forms the backbone of trust in auditing. The profession cannot afford to lose its credibility.