Auditing related party relationships
The ISA 550 procedures for finding related parties and transactions management may not have disclosed, from inquiries and records to unusual journals.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
The list of related parties management gives the auditor is usually short: the directors, their spouses, perhaps a holding company. What it rarely includes is the property company owned by the managing director's brother, which leases the factory to the client at a rent nobody has compared with the market, or the supplier set up last year by the financial manager's cousin. The auditor will not find those by reading the list again.
Related parties are a particular risk because the normal pressures that keep transactions honest, two independent parties each looking after their own interests, may not apply. ISA 550 requires the auditor to understand the relationships and transactions well enough to recognise fraud risk factors and to conclude on the accounting and disclosure, while recognising that management is often the only source of the information.
Why related parties are a fraud risk
Related party relationships can be used to move value in and out of an entity without it looking unusual: sales to a related company at inflated prices near year end, loans to directors written off quietly, assets sold below value to a family member. ISA 550 notes that a related party exerting dominant influence over the entity is a fraud risk factor that the auditor must consider.
The engagement team discussion at planning should include how the statements could be misstated through related party relationships and transactions, and who in the client is in a position to arrange them.
Asking management and reading records
ISA 550 requires the auditor to inquire of management about:
- the identity of the entity's related parties, including changes from the prior period;
- the nature of the relationships;
- whether the entity entered into transactions with them during the period, and their type and purpose.
The auditor also asks about the controls management has to identify, account for and disclose related parties, and to authorise significant transactions with them and significant transactions outside the normal course of business.
Make the request specific and in writing. Through Achekam's RFI console, staff create, send and track requests for documents, answers and confirmations: a schedule of related parties and transactions, each director's other directorships and shareholdings, and any declarations of interest. A written answer is easier to hold management to than a remark in a meeting.
Then look for yourself. ISA 550 requires the auditor to remain alert, when inspecting records and documents, for arrangements or information that may indicate related party relationships or transactions management has not identified. Useful sources include:
- Minutes of shareholders' and directors' meetings.
- Bank and legal confirmations, which may reveal security given for others or matters involving related companies.
- The shareholder register and company registry records for the client and its directors.
- Tax returns and correspondence with authorities.
- Contracts and loan agreements, especially those with unusual terms.
- Legal invoices, which can describe the matters a lawyer handled.
Where the firm acts for other entities in the same group, Achekam's client group view lists clients under their parent group with each group's entities and engagement counts. It knows only what the firm has recorded, but it is a quick cross-check against management's list.
Unusual journals and transactions
Journal entry testing, required for every audit under ISA 240, is one of the better tools for finding undisclosed related party activity. In Achekam, staff load a whole-population journal extract as CSV and map its columns, and Achekam flags entries such as manual, weekend, after-hours and post-close postings for staff to select and test. The CSV itself is not stored; its hash and row count are.
Add related-party criteria to the selection: manual entries to directors' loan accounts or intercompany accounts, round-sum entries to suspense accounts, write-offs of receivables from parties connected with management, and entries posted after year end that change these balances. A manual journal at the weekend clearing a director's loan account is worth asking about however small it is. The same tools are used against revenue manipulation, as described in responding to the presumed fraud risk in revenue.
Significant transactions outside the normal course of business
When the auditor identifies a significant transaction outside the entity's normal course of business, such as the sale of a building, a loan to a new party or a large one-off consultancy fee, ISA 550 requires the auditor to ask management about its nature and whether related parties could be involved.
For significant related party transactions outside the normal course of business, the auditor inspects the underlying contracts, evaluates whether the business rationale, or lack of it, suggests fraudulent financial reporting or concealment of misappropriation, checks that the terms match management's explanations, confirms the transactions were authorised and approved, and checks that they are properly accounted for and disclosed. If management asserts that a transaction was at arm's length, the auditor needs evidence for that assertion.
If the auditor finds a related party management did not disclose, the team is told at once, management is asked to identify every transaction with that party, the auditor asks why controls failed to identify it, and the risk of other unidentified parties is reassessed. If the non-disclosure looks intentional, the auditor considers the implications for the whole audit, including the reliability of management's representations.
Those situations are sensitive and often contested. Staff can take a technical consultation from question to conclusion and closure, and record a difference of opinion with each party's position, escalation and resolution.
Evaluating the disclosure
Finally, the auditor evaluates whether related party relationships and transactions are properly accounted for and disclosed under the framework: IAS 24 for full IFRS reporters, Section 33 for IFRS for SMEs. The IFRS Foundation's page on IAS 24 explains the disclosures it requires so readers can see how related parties may have affected an entity's results and position. The preparer's side is covered in related party disclosures.
On the related parties work item, each procedure is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. Record the names of related parties identified, their source (management's list or the auditor's own work), the transactions found and the evaluation of the disclosure.
One habit for every audit
Search the company registry for every director of the client before fieldwork, and compare the companies you find with the client's supplier and customer lists. It takes little time and finds the relationships management did not think to mention.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
