CA Inter FM + SM

Related Party Transaction Audit Procedures Under CARO 2015 – Paragraph 3

As an auditor, handling loans given to related parties and deposits accepted requires systematic procedures to ensure identification, verification, proper accounting treatment, and adequate disclosure.

Identification of Related Parties and Transactions:
First, obtain a complete schedule of related parties from management, including directors, key management personnel, their relatives, and entities under their control or significant influence as per Accounting Standard 18 (Related Party Disclosures). Request management to provide a list of all related party transactions during the period, including loans given and deposits accepted.

For Loans Given to Related Parties:
Verify the authorization by reviewing Board minutes and resolutions approving the loans. Confirm the terms including principal amount, interest rate, repayment period, and security (if any). Test the accounting entries to ensure the loans are correctly recorded in the balance sheet. Verify that the interest income has been properly recognized in the profit and loss account. Check that loans comply with Section 185 and 186 of the Companies Act, 2013 regarding restrictions on loans to directors and related parties. Assess whether the loan terms are at arm's length rates or if any departure requires disclosure.

For Deposits Accepted from Related Parties:
Verify the authorization and approval by the Board, particularly under the deposit framework prescribed by the Companies Act. Review the terms including principal amount, interest rate payable, repayment schedule, and security offered. Test the accounting entries to confirm deposits are recorded as liabilities in the balance sheet and interest expense is properly recognized. Assess the company's financial position and compliance with rules governing acceptance of deposits.

Compliance and Disclosure Requirements:
Ensure all identified related party transactions are disclosed in the notes to accounts as per the requirements of Accounting Standard 18. The disclosure should include the nature of the relationship, amount, and terms of transactions. Verify that the related party transaction schedule attached to the financial statements is complete and accurate. Check that management has identified and disclosed any significant related party transactions that occurred during or after the year-end.

Reporting Considerations:
Report in the auditor's report under CARO 2015 regarding the adequacy of disclosures related to related party transactions. If there are any non-compliances with the Companies Act provisions or if disclosures are inadequate, these should be reported as matters of concern. Confirm that related party transactions have been properly identified and disclosed without any fraudulent or unauthorized transactions.

SA 230 – Audit Documentation: Final Audit File Assessment

Purpose and Definition
SA 230 requires auditors to assemble a final audit file on a timely basis after the date of the auditor's report. The final audit file represents a complete and organized compilation of all significant audit work performed, evidence obtained, and conclusions reached during the audit engagement. This ensures that the audit work is properly documented and accessible for quality review and regulatory scrutiny.

Timing Requirements
Under SA 230, the auditor must establish policies and procedures requiring the final audit file to be completed within a reasonable time after the date of the auditor's report. While the standard does not specify an exact timeframe, the completion should occur on a timely basis—typically within 60 days of the report date, though this may vary depending on firm size, complexity, and jurisdictional requirements. The objective is to finalize the file while audit details remain fresh and before the retention period commences.

Key Policies and Procedures
The firm should establish documented policies addressing: (1) Assembly responsibility—designating personnel responsible for gathering, organizing, and reviewing all audit documentation; (2) Completeness verification—ensuring all working papers, audit schedules, correspondence, risk assessments, and management representations are included; (3) File organization—arranging documents in a logical sequence (typically following audit program sections and risk areas); and (4) Quality review—conducting a final review to confirm all audit objectives were satisfied and documented.

Documentation and Retention Safeguards
Once the final audit file is assembled, SA 230 requires that after the date of the auditor's report, the auditor shall not delete or discard any audit documentation before the end of the retention period specified in the audit engagement or required by law. In India, the typical retention period is 7 years from the date of the auditor's report. Procedures must ensure that audit files are stored securely, access is controlled, confidentiality is maintained, and the documentation is retrievable during the retention period for regulatory examination or quality assurance purposes.

Practical Implementation
Firms should maintain detailed checklists for final audit file assembly, assign specific dates for completion, and establish quality control procedures to verify compliance. The policies should address whether physical or electronic storage will be used, backup procedures, and communication protocols if the file assembly process identifies missing documentation.

As per SA 240 – The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, fraud involving misappropriation of assets occurs when employees or others steal assets of the entity. Inadequate internal controls create opportunities for such misappropriation. Three prominent examples are as follows:

1. Embezzlement of Cash Receipts:
Where there is inadequate segregation of duties over cash handling and recording, an employee who both receives cash and maintains the books of account can divert cash receipts before they are recorded. For instance, a cashier may collect cash from customers but record the sale at a lower amount or not record it at all, pocketing the difference. Absence of independent reconciliation of receipts with records facilitates this fraud.

2. Theft of Physical Assets or Intellectual Property:
When there are no proper physical safeguards, periodic physical verification, or access controls over inventory, fixed assets, or data, employees may steal physical goods (e.g., inventory items, raw materials, or equipment) or misappropriate intellectual property (e.g., confidential customer data or proprietary software). For example, a store-keeper with unrestricted access to the warehouse and no periodic stock verification can systematically remove inventory without detection.

3. Payments for Goods or Services Not Received (Fictitious Vendors / Ghost Employees):
In the absence of adequate controls over the purchase-to-pay cycle or the payroll process, an employee may create fictitious vendors and raise bogus invoices, causing the entity to make payments for goods or services never received. Similarly, where there is no proper verification of the payroll master data, fictitious employees ('ghost employees') may be added to the payroll, and salaries disbursed to them may be siphoned off by the perpetrator. Inadequate authorization controls and lack of independent review of vendor master files or payroll records enable such misappropriation.

These three examples illustrate how weak internal control environments—particularly absence of segregation of duties, inadequate physical controls, and lack of independent oversight—significantly increase the risk of asset misappropriation as recognized under SA 240.