On Friday, 21 September 2018 the Department of Trade and Industry published the draft Companies Amendment Bill 2018 for comment and comments closed on 20 November 2018. The following is a summary of the more significant changes proposed by the Bill. View PDF

Scope of auditor’s responsibility

The auditor is required to:

• Understand how the business uses IT and the impact of IT on the financial statements,
• Understand the extent of the company’s automated controls as they relate to financial reporting (including IT general controls that are important to the effective operation of automated controls and the reliability of company-produced data and reports used in the audit), and
• Use his or her understanding of the business’s IT systems and controls in assessing the risks of material misstatement of financial statements, including IT risks resulting from unauthorized access.

The immediate conclusion may be that cybersecurity risk is not an area that requires special audit attention, but auditors would consider, as part of the risk assessment process, an entity’s business risks in the audit of financial statements. Cyber incidents can result in financial consequences and therefore, have an effect on the financial statements.

Cybersecurity risk should therefore be considered in every financial statement audit. Auditors should consider and assess the impact of such risk to the financial statements and, where necessary, the extent of the audit response required to address the risk.

It is important to note that the auditor’s role is limited to the audit of the financial statements and does not encompass an evaluation of cybersecurity risks of the company’s entire IT platform but only focusses on systems and controls affecting information used in the compilation of these financial statements.

Risk consideration and assessment

Risk assessment is part of the financial statements audit process and is a key fundamental process which must be performed during the planning phase of every audit. The auditor is required to identify and assess the risks of material misstatement in the financial statements, through understanding the entity and its environment, including the entity’s internal control. With an in-depth understanding of the entity’s business and environment (this includes an entity’s IT
and cyber environment), it enables the auditor to identify the risks, and to design and implement appropriate audit responses to address those identified risks. The auditor should obtain an understanding of the IT general controls, evaluate their design and determine whether the controls that are relevant to the audit have been implemented.

The auditor should determine whether any of the risks identified (which could include cybersecurity risks) are, in the auditor’s judgement, significant risks that require special audit consideration. If information about a material breach is identified, the auditor would need to consider the impact on financial reporting, including disclosures, and any reporting obligation.

Re-Assessing Cybersecurity Risk Every Year

Changes in the risk environment and the ways in which businesses operate mean that business risks do not remain constant. In one year, cybersecurity risk may not have been identified as a key business risk that may result in risks of material misstatement, but this does not mean that the same will apply for the next year. Significant and rapid changes in information systems, incorporation of new technologies into production processes, or expansion of operations can bring about new cybersecurity risk.

Audit responses to risks identified

Where cybersecurity risks may result in risks of material misstatement at the financial statement level, the auditor should take appropriate steps to address these risks. This may include assigning more experienced staff or those with special skills such as IT specialists to the engagement, incorporating additional elements of unpredictability in the selection of further audit procedures to be performed and modifying the nature of audit procedures to obtain more persuasive and corroborative audit evidence.

The auditor would have to determine whether continued reliance can be placed on the IT dependencies/automated controls; consider the need to revise the initial risk assessment, and the impact to the nature, timing and extent of other planned audit procedures. The auditor would have to respond to the ineffective IT control environment by obtaining more extensive audit evidence from substantive procedures.

Audit responses to cyber attacks

Companies that fall victim to successful cyber-attacks may incur substantial costs and suffer significant damage. The auditor should:

• Understand the nature and cause of the incident, carefully consider the costs and any adverse consequences arising from the cyber incident, and evaluate the impact it may have on the financial statements.
• Assess the impact of the attack on the entity’s future revenue, potential litigation expenses, cybersecurity protection costs, etc and future cash flows, which may affect impairment assessments.
• Examine whether the breach may indicate going concern issues for the entity.
• Evaluate whether appropriate disclosures are included in the financial statements.
• Consider any other requirements to notify the appropriate authorities in case management has not made appropriate disclosures or considered the auditor’s recommendations.

The IASB has recently published its revised ‘Conceptual Framework for Financial Reporting’. The project was initiated in 2004 however due to a series of changed priorities and abandonment in 2010 followed by a phase by phase approach, the resultant framework does not constitute a substantial revision as was originally intended, but instead focuses on topics that were not yet covered or that showed obvious shortcomings that needed to be dealt with. The Board and Interpretations Committee will immediately begin using the revised Framework. It is effective for annual periods beginning on or after 1 January 2020 for preparers that develop an accounting policy based on the Framework.

The primary purpose of the Framework is to assist the IASB by identifying concepts that it will use when setting standards. The Framework is not an IFRS standard and does not override any
standard, so nothing will change in the short term. The revised Framework will be used in future standard-setting decisions, but no changes will be made to current IFRS. Preparers can use the
Framework to assist them in developing accounting policies where an issue is not addressed by an IFRS.

The Framework is structured into 8 chapters, however only chapters 1 to 7 were revised. Chapter 8 which discusses the concepts of capital and capital maintenance remains unchanged. The key
changes in the chapters are summarized below:

Chapter 1 – The objective of general purpose financial reporting

• This chapter notes that the objective of general purpose financial reporting is to provide financial information about the reporting entity that is useful to existing and potential investors, lenders and other creditors in making decisions relating to providing resources to the entity.
• This chapter also newly highlights increasing the prominence of stewardship in financial reporting emphasizing the need to provide information that is useful in making resource allocation decisions.

Chapter 2 – Qualitative characteristics of useful financial information

• This chapter reintroduces an explicit reference to the notion of prudence and states that the exercise of prudence supports neutrality. Prudence is defined as the exercise of caution when making judgements under conditions of uncertainty.
• Also new in this chapter is a clarification that faithful representation means representation of the substance of an economic phenomenon instead of representation of its legal form only.

Chapter 3 – Financial Statements and the reporting entity

• This chapter states that the objective of the financial statement is to provide information about an entity’s assets, liabilities, equity, income and expenses that is useful to users in assessing the prospects for future net cash inflows to the entity and in assessing management’s stewardship of the entity’s resources.
• The chapter notes that financial statements are prepared for a specific period of time and provide comparative information and under certain circumstances forward looking information. It also states IASB’s conviction that, generally, consolidated financial statements are more likely to provide useful information to users than unconsolidated financial statements.
• New to the Framework is the definition of a reporting entity, which might be a legal entity or a portion of a legal entity.

Chapter 4 – The elements of Financial Statements

The main focus of this chapter is on the definition of assets, liabilities, equities, income and expenses.

• Asset – A present economic resource controlled by the entity as a result of past events. An economic resource is right that has the potential to produce economic benefits
• Liability – A present obligation of the entity to transfer an economic resource as a result of past events.
• Equity – The residual interest in the assets of the entity after deducting all its liabilities.
• Income – Increases in assets or decreases in liabilities that result in increases in equity, other than those relating to contributions from holders of equity claims
• Expenses – Decreases in assets or increases in liabilities that result in decreases in equity, other than those relating to distributions to holders of equity claims

New is the introduction of a separate definition of an economic resource to move the reference to future flows of economic benefits out of the definition of an asset and liability. The expression ‘economic resource’ instead of simply ‘resource’ stresses that the IASB no longer thinks of assets as physical objects but as sets of rights. The definition of assets and liabilities also no longer refer to ‘expected’ inflows or outflows. Instead, the definition of an economic resource refers to the potential of an asset/liability to produce/to require a transfer of economic benefits.

Chapter 5 – Recognition and derecognition

• The Framework states that only items that meet the definition of an asset, a liability or equity are recognized in the statement of financial position and only items that meets the definition of income or expense are to be recognized in the statement of financial performance.
• However, their recognition is dependent on providing the users with:
  i) relevant information about the asset or liability and of any income or expense or changes in equity; and
  ii) a faithful representation of the asset or liability and of any income or expense or changes in equity.

The Framework also discusses the concept of derecognition. The requirements are driven by 2 aims:

• The assets and liabilities retained after the transaction or other event that led to derecognition must be presented faithfully; and
• The change in the entity’s assets and liabilities as a result of that transaction or other event must also be presented faithfully.

The Framework also describes alternatives when it is not possible to achieve both aims.

Chapter 6 – Measurement

• This chapter is dedicated to the description of different measurement bases such as historical cost, current value, fair value, value in use and current cost. It explains in detail about the information they provide and their advantages and disadvantages.
• Current cost is newly introduced in The Framework as it is widely advocated.
• The Framework also sets out factors to consider when selecting a measurement basis.

Chapter 7 – Presentation and Disclosure

The Framework states that the statement of profit or loss is the primary source of information about an entity’s financial performance for the reporting period and that only in ‘exceptional circumstances’ the Board may decide that income or expenses are to be included in other comprehensive income.

There are different interpretations as to when one should “discount” revenue or purchases. There are two totally different views – the first one being that discounting begins on the day after the recognition of a sale or purchase and the second one allows for the concept of “extended payment terms” beyond “industry norms”. Note: This does not apply to debtors or creditors.

This issue deals only with the initial identification of a financing component by sellers or buyers of goods in transactions that possibly contain financing elements. The assessment of whether the financing component should be separately identified and recognised – and the related determination of the sale and purchase price – should be performed on initial recognition at a contract or transaction level. This issue does not provide guidance for the application of transactions falling within the scope of IFRS 15.

Identification whether a transaction contains a financing element

The following should be considered in determining whether a transaction contains a financing element:

1. Differential pricing between the cash payment price and the price paid on deferred settlement terms;
2. Settlement terms deferred beyond industry norms and practice;
3. The date from which an entity is entitled to levy interest on overdue payments;
4. The existence of a transaction initiation process and credit assessment process;
5. Any collateral required for the transaction or payment;
6. A substantial amount of the transaction price is variable, the variability is outside the control of both parties, and the parties have decided to delay payment until a substantial amount of the variability is removed;
7. The business purpose for the different timing between delivery of the goods/ services and the payment; or
8. Volume of credit sales in relation to cash sales.

Example: View 1

Entity A sells goods to Entity B for R 1 000 on 30-day payment terms and expects payment in 30 days. Entity A does not charge its customers interest. Entity A has determined after considering qualitative factors that a financing element does not exist as the selling price will remain at R 1 000 at 30 days. Entity A should therefore recognise revenue for the sale of goods of R 1000. The following journal entry at transaction date is required.

At the transaction date: Entity A should record revenue at the fair value.

Account           Debit           Credit
Receivable      1 000
Revenue                                 1 000

Example: View 2

Entity A sells goods to Entity B for R 1 000 on 30-day payment terms and expects payment in 30 days. Although Entity A does not charge its customers interest, as a result of recent regulatory findings they have deemed it prudent to follow regulatory advice which is that discounting begins on the day after the recognition of a sale or purchase. If one assumes that the interest rate is 12% then it would be 1% for 30 days. The present value or sale price at initial measurement would be R 990 and the financing component would R10. Entity.

The following journal entry at transaction date is required.

At the transaction date: Entity A should record revenue at the fair value.

Account                                                                  Debit                Credit
Receivable                                                               990
Revenue (R1,000/1+[12%/365 days])                                              990
Receivable                                                                  10
Interest Received                                                                             10

Note: Neither view is right or wrong. It is important to verify each transaction by evaluating each of the 8 considerations as indicated as per “identification whether transaction contains a financing element” above.