Internal Audit & Controls

The PCAOB publicly released one new inspection report for Deloitte & Touche S.p.A. (Italy) and expanded two previously issued reports for Eide Bailly LLP and Seligson & Giannattasio CPAs PC after the firms failed to remediate identified quality control deficiencies within the 12-month grace period. This action signals the PCAOB's continued enforcement of transparency requirements under Rule 4009(d) and highlights ongoing audit quality concerns at the named firms.

ASIC has released Consultation Paper 391 proposing a new framework for accessing company and officeholder information on the companies register, balancing transparency with privacy and security concerns. Compliance teams at firms that rely on register data for due diligence, KYC, or AML purposes should review the proposed access tiers, as changes to residential address and date-of-birth availability could materially affect verification processes from mid-2027 onward.

ASIC secured a criminal conviction against Kristian Convery, a permanently disqualified SMSF auditor who continued to perform audits and falsified 47 audit reports using another auditor's credentials without consent. The case demonstrates ASIC's willingness to pursue criminal prosecution—not just civil penalties—against individuals who breach disqualification orders, underscoring the importance of robust auditor verification controls for firms engaging SMSF audit services.

The Financial Reporting Council has revised two UK standards covering the use of external experts, tightening the rules around how auditors and assurance practitioners judge the people whose specialist work they rely on.

Saudi Arabia’s Capital Market Authority has approved new requirements for the accounting firms that audit entities under its supervision, tightening the rules around who performs the work, how firms control its quality and what they must do when a regulatory inspection finds problems.

The PCAOB has revised QC 1000 just months before the new quality control standard is due to take effect, removing several requirements and giving audit firms more flexibility over how their quality control systems are structured, evaluated and documented.

Enterprise risk management has reached the top of the audit committee’s priority list. AI governance is not far behind, though the people charged with overseeing it are considerably less certain they have the machinery in place to do the job.