EU Audit Legislation

1. EU Audit Legislation IESBA Meeting London January 12-14, 2015 Liesbet Haustermans Director – Deloitte

2. Agenda EU audit legislation – Overview Date of application Snapshot key provisions PIE definition Mandatory audit firm rotation Non-audit services: scope, timing and restrictions Non-EU controlled undertaking of EU PIE Territorial scope of prohibited NAS Other key points in legislation Member State options

3. Overview EU Audit Legislation • EP plenary vote and Council adoption – April 2014 • EU Audit Legislation: • Regulation N°537/2014 on specific requirements regarding the statutory audit of PIEs • Directive 2014/56/EC amending Directive 2006/43/EC on statutory accounts and consolidated accounts • Publication in Official Journal on 27 May 2014, in 24 languages, each language version has equal binding force. Application date: 17 June 2016 • Next steps: Member States to adopt legislation implementing options/secondary legislation completing the regulation/guidance

4. Overview EU Audit Legislation • European Commission FAQs published in June – very high level and September – some helpful points • EC organising Member State implementation workshops

5. Date of Application – Regulation and Directive Regulation comes into effect *Directive should be transposed in national law Adoption ofRegulation and Directive Entry into force Publication in Official Journal 16 June 2014 +20 Days +2 Years April 2014 27 May 2014 17 June 2016 * Except where mandatory firm rotation transitional measures apply.

6. EU Audit Legislation – Snapshot Key Provisions

7. EU Audit Legislation – Snapshot Key Provisions

8. PIE Definition Four categories of PIEs under the Directive article 2.13: • Entities with transferable securities listed on EU regulated markets (see http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2011:209:0021:0028:EN:PDF, as opposed to all markets in the EU) and governed by the law of an EU Member State • Credit institutions authorized by EU Member States authorities (i.e., banks whose business is to receive deposits or other repayable funds from the public and to grant credit) • Insurance undertakings authorized by EU Member State authorities • Other entities that a Member State may choose to designate as a PIE

9. Explanation Mandatory Audit Firm Rotation • Audit firm’s appointment for statutory audit of PIE to last for at least one-year term which is renewable • Maximum duration of audit engagement not to exceed 10 years, unless a Member State decides to extend rotation period to: • Maximum 20 years in case of public tendering, or • Maximum 24 years in case of joint audit • Member State has the option to elect a maximum duration of less than 10 years • Competent Member State authority (for instance audit oversight authority and/or securities regulator) may extend auditor appointment on an exceptional basis for a further two-year term • Four year cooling off period after the end of the statutory audit services before audit firm can undertake the audit of the entity again • PIE to perform a transparent audit tendering process with close involvement of audit committee when a tender does occur

10. Timeline for transitional measures (EC’s current interpretation) Mandatory Audit Firm Rotation Mandate in place < 11 years at entry into force and at least 10 years reached Mandate in place  11 years < 20 years at entry into force Mandate in place  20 years at entry into force Entry into force Effective Date But may be extended if Member State opts for extension 10 Years Publication in Official Journal Adoption of Regulation 9 Years 6 Years End End End End? 20 Days 2 Years April 2014 27 May 2014 17 June 2016 * 17 June 2020 17 June 2023 17 June 2024 16 June 2014 * EC interpretation (2 September 2014 letter): mandates of less than 11 years that have reached 10 year mark (or less if Member State opts to reduce the 10 year period) by the effective date must end by that date, except if Member State opts to extend. Such mandates that have not yet reached 10 year mark by the effective date must end when the 10 year mark is reached.

11. Non-Audit Services (NAS) – Scope • Audit firms and network members prohibited from providing certain NAS • Such NAS not to be directly or indirectly provided by the audit firm or network members to the audited PIE, its parent undertaking in the EU or its controlled undertakings in the EU • Article 2.7:‘network’ means the larger structure: • Which is aimed at cooperation and to which a statutory auditor or an audit firm belongs, and • Which is clearly aimed at profit- or cost-sharing or shares common ownership, control or management, common quality-control policies and procedures, a common business strategy, the use of a common brand-name or a significant part of professional resources;”

12. NAS – Scope • No definition in regulation of “parent undertaking” or “controlled undertakings” • EC September FAQs: • “parent undertaking” as defined in the Accounting Directive • “controlled undertaking” as defined in Transparency Directive

13. NAS – Timing • During a period covered by audited financial statements and until issuing of the audit report • Prior FY cooling-in period for one category of services: financial information internal control or risk management procedures or financial information technology systems • No transitional measures for NAS prohibitions: • Apply as from 17 June 2016 (EC September 2014 FAQ: will apply to the first financial year starting after the date of application) • Unclear what the impact is for cooling-in period – but general principle of non-retroactivity of EU legislation

14. List of Prohibited Non-Audit Services

15. List of Prohibited Non-Audit Services

16. List of Prohibited Non-Audit Services

17. List of Prohibited Non-Audit Services

18. List of Prohibited Non-Audit Services

19. List of Prohibited Non-Audit Services

20. List of Prohibited Non-Audit Services

21. List of Prohibited Non-Audit Services

22. List of Prohibited Non-Audit Services

23. NAS: Restrictions

24. Special regime for services by network member Non-EU Controlled Undertaking of EU PIE • Threats & safeguards approach, assessment by the statutory auditor • But:  deemed to impact independence, no mitigation possible: • Services that involve playing any part in the management or decision-making process of the audited entity • Bookkeeping and preparing accounting records and financial statements • Designing and implementing internal control or risk management procedures related to the preparation and/or control of financial information or financial information technology systems  all other services on NAS list: threats & safeguards approach

25. NAS: Territorial Scope of Prohibited NAS PIE – EU Member State A EC September FAQ: Lawof Member State wheresubsidiary is located, applies NAS special regime Sub* - Outside EU Sub* - EU Member State B *Non PIE

26. Other Key Points in Legislation • Audit committee (AC) and reporting • PIEs must have AC composed of non-executive members • Responsibility for auditor selection procedure – at least 2 choices and duly justified preference • More comprehensive report from auditor directly to the audit committee (incl. results of audit, declaration of independence, materiality, judgment explanations about events that may cast significant doubt on the going concern, significant deficiencies in the internal financial control system/accounting system, significant matters involving actual or suspected non compliance with laws and regulations or articles of association)

27. Other Key Points in Legislation • Audit procedures and reporting • Compliance with international audit standards • All statutory audits to have statement on any material uncertainty related to events or conditions that may cast significant doubt on ability to continue as a going concern • For PIEs only - description of the most significant assessed risks of material misstatement; statement that no prohibited NAS were provided; number of years in place

28. Other Key Points in Legislation • Other • Cooperation between EU Member State auditor oversight authorities - New Committee of European Auditing Oversight Bodies (CEAOB); composed of one member from each Member State and one member appointed by the European Securities and Markets Authority (ESMA) • Dialogue between regulators and auditors with shared responsibility for effective dialogue • Annual meeting between European Systemic Risk Board (ESRB) and auditors of global systemically important institutions - at least annual • European passport for the audit profession - key audit partner carrying out the audit to be duly approved as a statutory auditor in that other Member State • Prohibition of clauses limiting choice of auditor • Penalties – dissuasive penalties to apply to auditors and audit firms if statutory audits under EU law are not carried out in conformity with the Directive and Regulation (by member states) • Audit market – monitoring and reporting by competent authorities and competition authorities every 3 years, ultimately EC report to Council, ECB, ESRB and EP where appropriate

29. Member State options • The Regulation and Directive contain over 50 Member State options, including: • Expanding the PIE list • Reducing the length of the initial engagement period to less than 10 years • Extending the initial engagement period by a further 10 or 14 years (tender or joint audit) • Adding to the list of prohibited NAS • Establishing stricter rules setting out the conditions under which permitted NAS may be provided • Allowing the exception for valuation and certain tax services • Stricter rules on the fee cap • … • Exercising these options will lead to a patchwork of different regulation throughout the EU • Will be costly and complex for PIEs and the statutory auditor and audit firms to manage