Annex – Areas and issues for the communication between competent authorities and auditors

This Annex provides a non-exhaustive list of areas and issues on which information could be shared between the competent authorities and auditors of a credit institution or auditors collectively, as appropriate, when applying these guidelines. The issues listed below are grouped by subject matter, irrespective of the provider of information.

External environment and risk profile of the credit institution

• a. Risk assessment and scope: the competent authority’s and the auditors’ assessments in light of the external environment and the credit institution’s performance, business model, corporate structure, risk concentration and risk appetite (including any changes of thereto).
• b. Changes in regulation.
• c. Changes in accounting and auditing standards.
• d. Macroeconomic developments affecting the credit institution’s industry.

Corporate governance and internal controls

• a. Culture, philosophy and operating style of the governing body of the credit institution (including quality of corporate governance and concentration/sharing of power amongst the members of the governing body).
• b. Suitability of the credit institution’s members of the management body, the senior management or the members of the audit committee, or a body performing equivalent functions within the credit institution on significant matters related to financial reporting and control functions (including the implementation of structural internal changes of management and organisational restructuring processes).
• c. Role of the audit committee, or a body performing equivalent functions within the credit institution, in the supervision of the financial reporting process.
• d. Quality of the relationship of the audit committee, or a body performing equivalent functions within the credit institution, with the auditors.
• e. Observations on internal controls (for example the auditors’ opinion on the description, included in the corporate governance statement in accordance with Article 20 of Directive 2013/34/EU²² , of the main features of the credit institution's internal control and risk management systems in relation to the financial reporting process, governance effectiveness, the control environment, the application and monitoring of controls, the quality of key control functions, and IT systems), the results of the internal control tests performed by the auditor and their consequences for the audit approach (for example their impact on the extent of performance of direct verification and the use of experts in the statutory audit).
• f. Significant deficiencies in internal control processes (for example material control weaknesses identified in the credit institution’s financial reporting processes) and the auditors’ observations on matters that are significant for the responsibilities of the members of the credit institution’s management body, senior management or audit committee, or the members of a body performing equivalent functions within the credit institution, in overseeing the strategic direction of the credit institution or the credit institution’s obligations related to its accountability. This may include, where relevant, the auditor’s observations on the effectiveness of the internal audit function, risk management function and compliance function (including the assessment of fraud risks, especially due to weaknesses in internal controls).

Ability of the credit institution to continue as a going concern

• a. Assessment of the risks related to the continuous functioning of a credit institution, including capital adequacy risks (such as credit, market and operational risk and minimum requirement for own funds and eligible liabilities, or MREL), large exposures, leverage, liquidity and funding risks.
• b. Observations on any areas of potential reputation risk and risk from non-compliance of the credit institution with relevant legal requirements (including material actual or potential litigation and legal disputes).

Audit approach

• a. Materiality in planning and performing the statutory audit.
• b. Use of external experts in the statutory audit.
• c. Use of internal auditors’ work in the statutory audit.
• d. Application of accounting policies and changes to them.
• e. Sources of potential management bias.
• f. Areas of significant risk identified.
• g. Specific work undertaken by the auditor on particular transactions (which may have also required the use of experts).
• h. Significant difficulties encountered during the statutory audit (including disagreements between auditors and members of the credit institution’s management body, senior management or audit committee, or members of a body performing equivalent functions within the credit institution).
• i. Circumstances that have led to a significant change in the audit planning.

Financial statements, valuation of assets and liabilities and disclosures

• a. Views and judgements on key risk areas and assumptions, including significant transactions and valuations (for example in the areas of estimation of loan loss provisions and valuation of financial instruments).
• b. Accounting practices and areas encompassing a significant degree of estimation uncertainty (for example the areas of estimation of loan loss provisions and valuation of financial instruments).
• c. Critical accounting estimates and indications of management bias:
• i. where a credit institution consistently uses valuations that exhibit a pattern of optimism or pessimism within a range of acceptable valuations or other indications of possible management bias, or
• ii. where a credit institution undertakes transactions to achieve a particular accounting or regulatory outcome, such that the accounting or regulatory treatment is technically acceptable, but it obscures the substance of the transaction.
• d. Misstatements in the financial statements (corrected and uncorrected) identified during the statutory audit and the auditors’ evaluation of them.
• e. Adequacy and reliability of disclosures in financial statements in light of statutory reporting requirements and risks, transactions, judgements and assumptions discussed in current and previous meetings.

Audit report and auditors’ communication with the credit institution’s management body, senior management or audit committee, or a body performing equivalent functions within the credit institution, on significant matters related to financial reporting and control functions

• a. Audit report referred to in Article 10 of Regulation (EU) No 537/2014.
• b. Additional report to the audit committee referred to in Article 11 of Regulation (EU) No 537/2014.

The main findings of the audit procedures carried out and conclusions

• a. Issues identified during the statutory audit and communicated to the credit institution’s management body, senior management or audit committee, or a body performing equivalent functions within the credit institution, such as deficiencies in internal control that in the auditors’ professional judgement merit management’s attention.
• b. Significant issues which have been intensely discussed with the credit institution’s management body, senior management or audit committee, or a body performing equivalent functions within the credit institution.

Supervisory assessments and actions

• a. Supervisory measures imposed on a credit institution.
• b. Issues arising from recent institution-specific supervisory risk assessments and reviews (such as during the supervisory review and evaluation process, or SREP²³ ).
• c. Results of thematic reviews and peer-group reviews performed by the competent authority across the credit institution’s industry.
• d. Observations arising from a credit institution’s regulatory reporting, including regulatory capital.
• e. Compliance with relevant legal and prudential requirements.

Others

• a. Issues discussed in previous years and meetings, if deemed to be still relevant.
• b. Issues related to the appointment, change, dismissal or resignation of the auditor appointed to perform the statutory audit.
• c. Additional matters arising from the statutory audit, such as matters arising from existing or new requirements provided for in Union or national law.
• d. Feedback on the quality of the communication between competent authorities and auditors and ways to improve communication.

²² Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19).

²³ EBA guidelines (EBA/GL/2014/13) issued in accordance with Article 107(3) of Directive 2013/36/EU.