AS 2410 sets the auditor's duty for related parties in an issuer audit. Its objective is to obtain sufficient appropriate audit evidence to determine whether related parties and relationships and transactions with them have been properly identified, accounted for and disclosed in the financial statements (paragraph .02). It follows the same arc as AU-C 550 for nonissuers: understand, assess, respond, evaluate disclosure, communicate. This article walks that arc, then lists where the standards differ. For the AICPA approach in full, see related party transactions audit under AU-C 550 and the AU-C 550 standard page.
The definition of "related parties" for an issuer comes from the SEC's requirements for the company, not from the auditing standard (footnote 1). AU-C 550 defines a related party as one defined as such in GAAP (.10).
What must the auditor understand first?
Paragraph .03 requires procedures, in conjunction with the risk assessment procedures of AS 2110, to understand the relationships and transactions that might reasonably be expected to affect the risks of material misstatement. That includes the nature of the relationships and the terms and business purposes (or lack of them) of the transactions. Three sets of procedures follow.
The company's process (.04). In conjunction with understanding internal control over financial reporting, the auditor understands the process for identifying related parties and transactions, for authorizing and approving transactions with them, and for accounting for and disclosing them.
Inquiries (.05 to .07). The auditor inquires of management about the related party names for the period, including changes; background on each; the nature of the relationship, including ownership; transactions entered into, modified or terminated, with their terms and business purposes; why a related party was used instead of an unrelated one; transactions not authorized under policy; and exceptions granted and why. The auditor also inquires of others within the company who are likely to have knowledge (.06), and of the audit committee or its chair about their understanding of significant relationships and transactions and whether any member has concerns (.07).
Communication (.08 and .09). Engagement team members receive the names of related parties and the nature of the relationships and transactions. A lead auditor does the same for a referred-to auditor and inquires about what the referred-to auditor knows.
How are the risks assessed and answered?
Paragraph .10 requires identifying and assessing risks of material misstatement associated with related parties, including whether the company has properly identified, accounted for and disclosed them. Paragraph .11 requires responses that address those risks.
The note to .11 ties in the fraud standard: for a related party transaction that is also a significant unusual transaction, such as a significant one outside the normal course of business, the auditor also follows AS 2401 paragraphs .66 to .67A, evaluating whether its business purpose suggests it may have been entered into to engage in fraudulent financial reporting or conceal misappropriation of assets.
Transactions required to be disclosed or that are significant risks
For each related party transaction that must be disclosed or is a significant risk, paragraph .12 requires the auditor to:
- read the underlying documentation and evaluate whether its terms are consistent with explanations of the business purpose
- determine whether it was authorized and approved under company policy
- determine whether exceptions to policy were granted
- evaluate the financial capability of the related parties for significant uncollected balances, loan commitments, supply arrangements, guarantees and other obligations
- perform other procedures needed for the assessed risks
The note to .12 allows testing a selection of transactions from each aggregation when the framework permits aggregated disclosure. Paragraph .13 requires procedures on intercompany balances as of concurrent dates, even if fiscal years differ.
How does the auditor test completeness?
Paragraph .14 states that evaluating whether the company properly identified its related parties involves more than assessing the company's process. The auditor tests the accuracy and completeness of the parties and transactions identified, using the information gathered during the audit, and reads minutes of meetings of stockholders, directors and committees, or summaries of recent actions.
Appendix A gives the signals and sources. Examples of information that could indicate previously undisclosed parties include buying or selling at prices that differ significantly from market, sales with unusual terms such as unusual return rights or extended payment, interest-free borrowing or lending with no fixed repayment terms, occupying premises or receiving services with no consideration, loans to parties without ability to repay, guarantees outside the normal course, and round-trip transactions. Sources include SEC filings, the company website, confirmation and lawyer responses, tax filings, invoices from advisors, internal audit reports, conflicts-of-interest statements, shareholder registers, contracts with management, whistleblower program records, executive expense reimbursements and organizational charts.
Worked example
A company paid $240,000 during the year to a consulting firm for services quoted by two other firms at $90,000 each. The invoice sits among advisor invoices the auditor reads. The price is $150,000 above market, which is 2.67 times the quotes, and matches the first indicator in Appendix A.
| Step | What the auditor does | Paragraph |
|---|---|---|
| Recognize the signal | Price differs significantly from market | Appendix A, .A2 |
| Go beyond management | Compare with Appendix A sources: conflicts-of-interest statements, shareholder register, executive expense reimbursements | .15 |
| If a relationship exists | Ask management about it and about other transactions with the party; evaluate why it was not disclosed | .16a and .16b |
| Share and extend | Tell the team and any referred-to auditor promptly; assess need for additional procedures to find other transactions | .16c and .16d |
| Test the transaction | Read the contract; check approval and exceptions to policy; assess the party's financial capability | .12 |
| Reassess | Evaluate effect on ICFR; reassess risk and perform more procedures; evaluate whether nondisclosure indicates fraud or an illegal act | .16f |
| Communicate | Previously undisclosed party and unapproved or lacking-purpose transactions go to the audit committee | .19 |
Paragraph .15 says that procedures to determine whether an indicated party exists should extend beyond inquiry of management. If the auditor identifies a fraud or illegal act indicator, responsibilities under AS 2401.79 to .82, AS 2405 and Section 10A of the Securities Exchange Act apply (.16f(iii)).
What about disclosure and arm's-length statements?
The auditor must evaluate whether related party transactions have been properly accounted for and disclosed, including whether the statements contain the information essential for fair presentation (.17). For the accounting side, see our ASC 850 worked examples.
If the statements say a transaction was on arm's-length terms, the auditor determines whether the evidence supports or contradicts the statement. If sufficient evidence cannot be obtained and management does not modify the disclosure, the auditor expresses a qualified or adverse opinion (.18).
What must the audit committee hear?
Paragraph .19 requires communicating the auditor's evaluation of the company's identification of, accounting for and disclosure of related parties, and other significant matters, including previously undisclosed parties or transactions, significant transactions not approved under policy, significant ones where policy exceptions were granted, any arm's-length statement and the evidence for it, and significant transactions that appear to lack a business purpose.
How does AS 2410 differ from AU-C 550?
| Topic | AS 2410 | AU-C 550 |
|---|---|---|
| Definition | Looks to SEC requirements | GAAP definition (.10) |
| Process understanding | Process for identifying, approving, accounting and disclosing (.04) | Controls to identify, authorize and approve (.15) |
| Governance inquiry | Audit committee or its chair (.07) | Those charged with governance, unless all are involved in managing (.16) |
| Significant unusual related party transactions | Note to .11 points to AS 2401.66 to .67A | Treated as significant risks (.20) |
| Procedures on disclosable or significant-risk transactions | Includes policy exceptions and financial capability (.12) | Read contracts, evaluate business purpose, terms, accounting and disclosure, obtain evidence of authorization (.26) |
| Undisclosed parties | Procedures beyond inquiry of management (.15); six listed steps including ICFR (.16) | Determine whether circumstances confirm (.24); six listed steps (.25) |
| Arm's-length statement | Qualified or adverse opinion if unsupported and not modified (.18) | Obtain sufficient appropriate evidence (.27) |
| Documentation | No documentation paragraph | Names of related parties and nature of relationships (.30) |
Sources
- PCAOB, AS 2410, Related Parties, paragraphs .01 to .19 and Appendix A: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2410
- AICPA, AU-C Section 550, Related Parties, paragraphs .10, .15, .16, .20, .24, .25, .26, .27 and .30: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error