Internal Audit & Controls

ASIC has released Consultation Paper 391 proposing a new framework for accessing company and officeholder information on the companies register, balancing transparency with privacy and security concerns. Compliance teams at firms that rely on register data for due diligence, KYC, or AML purposes should review the proposed access tiers, as changes to residential address and date-of-birth availability could materially affect verification processes from mid-2027 onward.

ASIC secured a criminal conviction against Kristian Convery, a permanently disqualified SMSF auditor who continued to perform audits and falsified 47 audit reports using another auditor's credentials without consent. The case demonstrates ASIC's willingness to pursue criminal prosecution—not just civil penalties—against individuals who breach disqualification orders, underscoring the importance of robust auditor verification controls for firms engaging SMSF audit services.

The Financial Reporting Council has revised two UK standards covering the use of external experts, tightening the rules around how auditors and assurance practitioners judge the people whose specialist work they rely on.

Saudi Arabia’s Capital Market Authority has approved new requirements for the accounting firms that audit entities under its supervision, tightening the rules around who performs the work, how firms control its quality and what they must do when a regulatory inspection finds problems.

The PCAOB has revised QC 1000 just months before the new quality control standard is due to take effect, removing several requirements and giving audit firms more flexibility over how their quality control systems are structured, evaluated and documented.

Enterprise risk management has reached the top of the audit committee’s priority list. AI governance is not far behind, though the people charged with overseeing it are considerably less certain they have the machinery in place to do the job.

For an accounting firm auditing companies under the supervision of Saudi Arabia’s Capital Market Authority, an inspection will no longer necessarily end when the regulator leaves the room. The CMA Board has approved amendments to the Rules for Registering Auditors of Entities Subject to the Authority’s Supervision, tightening requirements around professional qualifications, quality management, regulatory inspections and transparency. The amendments take effect from the date of their publication.