AU-C section 550, Related Parties, deals with the auditor's responsibilities for related party relationships and transactions in an audit of a nonissuer. Owner-managed entities often transact with owners, family members and affiliates outside any market discipline, and those transactions may not appear in the accounting system under a recognizable label. The accounting and disclosure requirements are in ASC 850. This page covers the audit side. See also related party transactions: audit and disclosure.
This page paraphrases the standard. Read AU-C 550 in AICPA Professional Standards before relying on any point here.
What is the objective of AU-C 550?
The auditor's objectives are to obtain an understanding of related party relationships and transactions sufficient to recognize fraud risk factors arising from them that are relevant to identifying and assessing the risks of material misstatement due to fraud, and to conclude whether the financial statements, insofar as they are affected by those relationships and transactions, achieve fair presentation or are not misleading. The auditor also obtains sufficient appropriate evidence about whether identified related party relationships and transactions have been appropriately accounted for and disclosed.
Why does the standard treat related parties differently?
Related party transactions carry specific risks. The terms may not reflect what unrelated parties would agree to. Management may structure them to achieve a result, such as shifting profit or hiding a loan to an owner. Related parties may also have an interest in the entity's reported results. For these reasons the standard asks the auditor to be alert for them throughout the audit, not only during a single test.
The standard also acknowledges that a transaction with a related party is not by itself wrong. The question is whether it is complete, accurately recorded, properly authorized, and disclosed as the framework requires.
What does the auditor do in risk assessment?
The risk assessment procedures under AU-C 315 include specific work on related parties.
- Engagement team discussion. The team discusses the susceptibility of the financial statements to material misstatement from related party relationships and transactions. This is usually folded into the fraud brainstorming under AU-C 240.
- Inquiries of management. The auditor asks about the identity of the related parties, including changes from the prior period, the nature of the relationships, and whether the entity entered into transactions with them during the period, and if so the type and purpose.
- Inquiries about controls. The auditor asks about the controls management has to identify, account for and disclose related party relationships and transactions, to authorize and approve significant related party transactions, and to authorize and approve significant transactions outside the normal course of business.
- Remaining alert. During the audit, the auditor stays alert, when inspecting records or documents, for arrangements or information that indicate related party relationships or transactions that management has not previously identified or disclosed.
Where do undisclosed related parties show up?
The standard lists records the auditor already reads that can reveal them. In practice, the usual places are:
- bank and legal confirmations
- minutes of shareholder and governing body meetings
- income tax returns and other filings
- entity ownership records and shareholder lists
- conflict-of-interest statements from officers and directors
- loan agreements, leases and guarantees
- vendor or customer lists where an unusual party carries large volume
- journal entries to owner or officer accounts, and unusual round-dollar or period-end entries
If the auditor identifies a related party or significant transaction that management did not identify, the auditor communicates it promptly to the engagement team, requests management to identify all transactions with the newly identified related party, asks why controls failed to identify it, performs appropriate substantive procedures, reconsiders the risk that other unidentified related parties exist, and evaluates the implications for the audit. If the nondisclosure appears intentional, that indicates a fraud risk.
How are significant related party transactions tested?
For significant related party transactions outside the entity's normal course of business, the auditor inspects the underlying contracts or agreements, if any, and evaluates whether:
- the business rationale, or lack of one, suggests the transaction was entered into to engage in fraudulent financial reporting or to conceal misappropriation
- the terms are consistent with management's explanations
- the transaction has been appropriately accounted for and disclosed under the framework
- the transaction has been authorized and approved properly
The auditor also obtains evidence that the transaction was properly authorized and approved. A loan to an owner approved only by that owner is a different matter from one approved by a board with the owner abstaining.
For other related party transactions, the auditor responds to the assessed risk of material misstatement with procedures relevant to that risk, using the same methods as for any other transaction, including confirmation and tests of details.
The arm's length assertion
If management has made an assertion in the financial statements that a related party transaction was conducted on terms equivalent to those prevailing in an arm's length transaction, the auditor obtains sufficient appropriate audit evidence about the assertion. Management usually cannot support that claim without comparables or independent pricing. If the auditor cannot obtain that evidence, the assertion is unsupported and the auditor considers the effect on the report. As a matter of practice, many firms ask management to remove the language from the notes, since ASC 850 does not require it.
Evaluating accounting and disclosure
The auditor evaluates whether the identified related party relationships and transactions have been appropriately accounted for and disclosed in accordance with the framework, and whether the effects of the relationships and transactions prevent the financial statements from achieving fair presentation or cause them to be misleading. Under ASC 850, disclosure normally includes the nature of the relationship, a description of the transactions, the dollar amounts, and amounts due from or to related parties and the terms of settlement. Check the notes against a GAAP disclosure checklist.
Written representations and communication
The auditor obtains written representations from management, and where appropriate those charged with governance, that they have disclosed to the auditor the identity of the entity's related parties and all the related party relationships and transactions of which they are aware, and have appropriately accounted for and disclosed them. If the financial statements assert arm's length terms, the representation covers that too. See AU-C 580.
Unless all of those charged with governance are involved in managing the entity, the auditor communicates significant matters arising during the audit in connection with related parties to them. Examples are the nondisclosure of related parties, significant transactions that lack a business rationale, and difficulties in obtaining information. AU-C 260 covers that communication.
What must be documented?
The auditor documents the names of identified related parties and the nature of the related party relationships. Beyond that, the file should show the risk assessment, the procedures performed, the evidence obtained about significant transactions, the evaluation of disclosure, and communications. See AU-C 230 audit documentation.
Common weaknesses in related party files
Practice checks, not requirements of the standard. Gaps to avoid:
- Related party inquiries limited to a single question in the representation letter
- No procedures to look for undisclosed related parties
- Owner and officer accounts not scanned for unusual activity
- Arm's length language left in the notes without evidence
- Disclosure checked for dollar amounts but not for terms of settlement
- No evidence of authorization for significant transactions
Related
- Related party transactions: audit and disclosure
- AU-C 315 risk assessment and SAS 145
- AU-C 450 evaluation of misstatements
- AU-C 580 written representations
- Management representation letter template
- GAAP disclosure checklist
Sources
- AICPA, AU-C Section 550, Related Parties
- FASB ASC 850, Related Party Disclosures
- AICPA, AU-C Sections 315, 240, 580 and 260
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error