2008 Seminar for the Appointed Actuary Colloque pour l’actuaire désigné 2008

1. Canadian Institute of Actuaries L’Institut canadien des actuaires 2008 Seminar for the Appointed Actuary Colloque pour l’actuaire désigné 2008

2. Audits of Insurance Companies 26 September 2008

3. Agenda Introduction to Auditing Auditing Standards Auditor Oversight The Audit Process Specific Issues

4. Introduction to Auditing

5. Nature of Auditing Accumulation of evidence about ‘information’ in a systematic manner Evaluation of the ‘information’ against suitable criteria Expression of opinion in a written report to interested users who were not involved in preparing the information Performed by a competent, independent person

6. Need for Auditing Decision makers in the financial markets depend on reliable information Auditing reduces information risk Helps make capital markets efficient Stakeholders in an entity want to monitor management behaviour An audit is a cost-effective way to achieve this objective An audit can serve as a deterrent against fraud

7. Accountability Relationship in an Audit CICA Handbook Section 5025.07:

8. Objective of an Audit of Financial Statements CICA Handbook Section 5090.01: The objective of an audit of financial statements is to express an opinion whether the financial statements present fairly, in all material respect, the financial position, results of operations and cash flows in accordance with generally accepted accounting principles (GAAP).

9. Types of Audit Opinions Unqualified “Clean” opinion – No material misstatement Qualified “Except for” Either a departure from GAAP or scope limitation Adverse Financial statements are misleading Departure from GAAP Denial No opinion due to scope limitation (i.e. lack of evidence)

10. Professional Scepticism Foundation of the auditor’s role Understand possible conflict of interest between the auditor and management Objectively assess the risk of error Objectively evaluate the type and quality of evidence obtained Obtain corroborative evidence for management representations

11. Use of Specialists in an Audit Specialists are skilled in fields other than auditing and accounting (e.g., actuaries) Auditors may engage specialists to perform additional audit work or assist in making audit decisions (e.g., assessing pension liabilities) In these situations, auditors must Understand the specialist’s professional qualifications Understand methods and assumptions used by the specialist Evaluate the information provided Obtain corroborative evidence

12. Auditing Standards

13. Canadian Generally Accepted Auditing Standards (GAAS) The Canadian Institute of Chartered Accountants (CICA) is given the authority to set accounting and auditing standards by the Canada Business Corporations Act Auditing standards are Recommendations to guide auditors in fulfilling their professional responsibilities Include guidelines on auditor qualifications, evidence examination and reporting

14. International Standards on Auditing (ISA) ISAs for financial statement audits will be adopted for periods beginning on or after December 15, 2009 Canadian ISAs will be renamed Canadian Auditing Standards (CAS) and will constitute Canadian GAAS Most are consistent with the current Canadian standards

15. US GAAS In the US, the American Institute of Certified Public Accountants (AICPA) sets the generally accepted professional and technical standards for CPAs These apply to audits of US private companies, federal, state and local governments and non-profit organizations

16. PCAOB – Auditing Standards The Sarbanes-Oxley Act (SOX) became law in the US in 2002 after the fall of Enron It created a five-member Public Company Accounting Oversight Board (PCAOB) to oversee accounting firms that provide audit services for publicly traded companies The Board established auditing, quality control, ethics, and independence standards and rules to be used by registered public accounting firms Required by the SEC

17. PCAOB – Auditing Standards PCAOB adopted GAAS and ethical standards as developed by AICPA It also created more stringent rules in the area of auditor independence Developed detailed rules regarding audits on internal control over financial reporting integrated with an audit of financial statements

18. Auditor Oversight

19. PCAOB Conducts regular inspections of registered public accounting firms Portions of the report to the firm made public if firm does not address the Board’s criticisms/recommendations Can discipline firms that do not comply with its rules

20. CPAB The Canadian Public Accountability Board (CPAB) was created to oversee the auditors of public companies (similar to PCAOB) Tighten quality control of audit practice Conduct annual inspections of accounting firms – report to firms is confidential Public report on the results of these inspections is prepared discussing general issues Has the power to impose sanctions if fail to protect the public interest

21. Code of Professional Conduct Chartered Accountants are subject to the Rules of Professional Conduct Key Principles: Independence Confidentiality Integrity and Due Care Competence Adherence to GAAP and GAAS

22. Legal Liability Sources of legal liability Client - common law (negligence) Third party – common law (negligence) Provincial securities acts Criminal liability Fiduciary duty

23. The Audit Process

24. Planning Understand the Business Business environment Nature and composition of entity Business and financial statement risks Understand the IT Environment Complexity of the IT environment Extent to which the entity uses IT Assess Internal Control at Entity Level Components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring Evaluate Independence

25. Risk Assessment Identify fraud risks and determine response Identify risks with implications on financial statements: Overall factors (e.g., factors affecting the industry) Account-specific factors (e.g., complexity of transaction) Use professional judgement Affects nature, timing, and extent of audit procedures to be performed

26. Materiality CICA Handbook Section 5142.04: A misstatement or the aggregate of all misstatements in financial statements is considered to be material if, in the light of surrounding circumstances, it is probable that the decision of a person who is relying on the financial statements, and who has a reasonable knowledge of business and economic activities (the user), will be changed or influenced by such misstatement or the aggregate of all misstatements.

27. Materiality and Misstatements Misstatements arise from departures from GAAP and include inappropriate determination of estimates Misstatements may arise from error or fraud, or from the consequences of an illegal act The audit is planned with the objective of detecting misstatements that are quantitatively material to the financial statements Materiality is determined using professional judgement (unique to each client) AuG-41 suggests 5% of continuing income from operations

28. Understanding Significant Processes Identify significant processes that affect the significant account E.g., Actuarial Valuation process affects Policy Liabilities Identify sources and preparation of information that is disclosed in the financial statements Consider the entire flow of transactions from initiation through reporting Identify where data errors could occur

29. Perform Walkthrough Follow the ‘critical path’ for the process, from transaction initiation to reporting in the general ledger Requires making inquiries of company personnel It also requires obtaining copies of documents (e.g., screen prints, schedules, system reports) to document the flow of the transaction Confirm that controls have been put in place

30. Categories of Control

31. Test of Controls Select a combination of controls to test whether they have been operating effectively throughout the year Test of controls include procedure such as Inquiry of company personnel Inspection of physical evidence resulting from the performance of control (e.g., obtain reserve provision calculation schedule and look for evidence of review) Re-performance (e.g., recalculate reserve provision balance) Testing performed for selected samples

32. Substantive Procedures Procedures designed to obtain direct evidence on the information contained in the financial statements, including: Existence, completeness, accuracy and validity of data Reasonableness of estimates Extent of testing depends on risk assessment and reliance placed on controls Combination of Analytics (e.g., variance between current year and prior year) Detail testing (e.g., assess assumptions used in establishing the reserve provision)

33. Difference between Test of Controls and Substantive Procedures TEST OF CONTROL: Objective: to determine whether control is operating effectively Nature: involves making inquiries and re-performance Extent: depends on frequency of control and involves sampling Timing: testing begins before year-end (balance sheet date) Example: re-perform quality check over system inputs re new business SUBSTANTIVE PROCEDURE: Objective: to determine whether the information in the financial statements is reasonable Nature: analytics and detail testing Extent: depends on risk assessment and materiality Timing: may begin before year-end but completion after year-end Example: agree new business balance to source documents, such as contracts

34. Audit differences A difference between an amount in the financial statements and what the auditor believes should be the amount to be in accordance with GAAP An omission from the financial statements of an item required under GAAP Can arise as a result of an error, fraud, or judgemental difference (between auditor and management) The auditor will discuss the discovery of the difference with the appropriate company personnel

35. Difference between ERROR and Change in ESTIMATE ERROR: Unintentional Mathematical mistake Misapplication of GAAP Oversight or misuse of facts Example: Discount rate used in the pension liability calculation was incorrectly inputted as 15% rather than the authorized 5%. Difference in outcomes represents an audit difference. CHANGE IN ESTIMATE: Estimates are based on latest, most reliable information Change in estimate is a change related to new information or more experience Example: Long-term expected interest rate was estimated at 5%. However, change in economic conditions resulted in a revised estimate of 8%.

36. Communication of Results to Audit Committee Auditors are required to communicate certain matters to the Audit Committee, including: Fraud Possible illegal acts Identified material weaknesses in internal control Corrected and uncorrected non-trivial errors Other matters

37. Specific Issues

38. Specific Issues System Change Controls Sufficient and Appropriate Audit Evidence Documentation AUG 43

39. System Change Controls IT is used by various departments in an organization E.g., actuarial departments use automated valuation models, or set-up models in Excel Auditors identify, understand, walk through, test and evaluate controls related to IT when they plan to rely on applications used by the client Examine two aspects: Change Controls: only appropriately authorized, tested and approved changes are made to applications, databases, etc. Logical Access: only authorized personnel have access to data and applications Otherwise, risk exists that inappropriate changes are made, resulting in inaccurate disclosures in the financial statements

40. Sufficient and Appropriate Audit Evidence Quality and quantity of evidence allows the auditor to reach a conclusion: Whether control is operating effectively Whether the financial statement disclosure is reasonable Auditors are required to test the evidence obtained Completeness of data Accuracy of data When auditing estimates, need evidence on Assumptions used Methodology employed Appropriateness of conclusions reached

41. Appropriate “Support” Is evidence that helps the auditor to: Re-perform the control Perform analytical procedures Perform detail testing Comes from a “reliable” source: Reports generated by an application system tested by the auditors Prepared by an unbiased person, e.g., third party pricing vendor Reviewed by various people in the organization Examples: Reserve trending calculation with documented analysis and sign-off by reviewer Detailed memo explaining assumption used in the model and justification for the assumptions Report from Bloomberg supporting model input

42. Documentation Auditors document procedures performed and conclusions reached Auditors also keep copies of evidence obtained To assist in the audit process, Document the control was performed (e.g., write comments and sign off on the reserve calculation to indicate you reviewed it) Where feasible, keep source documents on file (e.g. file download from Bloomberg, calculations performed) In memo format, explain your changes to the valuation model

43. AUG 43Audit of Policy Liabilities of Insurance Companies Provides guidance on application of GAAS in the audit of policy liabilities Recognizes the complexity of this accounting estimate and need for specialized actuarial expertise Considers the following Use of actuarial expert on the audit team Role of appointed actuary Need for corroborative evidence

44. Questions?