Risk monitoring and control in Maltese audit forms : an assessment

Abstract

PURPOSE: This study assesses the different types of risk exposures borne by Maltese audit firms and ascertains how they monitor and control such risks, both on an engagement level and on a firm-wide basis. The outcomes of this study are then compared to findings of similar studies carried out in countries other than Malta. DESIGN: The objectives of this study were achieved by collecting and analysing quantitative data obtained through a questionnaire, based on foreign research, sent to all 38 Maltese registered audit firms. Semi-structured interviews were also conducted with six partners of different sized audit firms in order to gather qualitative data. FINDINGS: This study found that, in line with similar studies carried out overseas, audit risk and auditor's business risk are almost equally important in determining engagement process risk, while the client's business risk is less regarded by Maltese audit firms. This could be due to the fact that the latter risk is not controllable by the auditor. It also resulted that the most widely used and effective engagement process risk management strategies was the assignment of more experienced audit staff to the audit engagement. Moreover, lack of auditor competence is believed to be best mitigated through on-the-job training and experience programmes. Finally, Maltese audit firms believe that the most effective independence risk management strategies are internal firm quality reviews, well managed audit committees, annual independence confirmations and clear and robust independence rules. CONCLUSIONS: It was concluded that Maltese audit firms are relatively risk averse and very aware of their reputation. This research also determined that such firms are significantly less sensitive to going concern and solvency risk This study further concluded that as Maltese audit firm have and are accept more international clients, litigation is very likely to increase in the near future, even though they are very attentive in their work. Finally the study established that the big four firms have more formalised risk management policies and procedures and hence they are better equipped and more responsive to risk. IMPLICATIONS/VALUE: This study's conclusions and recommendations might encourage further research and developments in the area, particularly to account for a possible future increase in litigation risk and appropriate responses by local firms as well as to the reasons for the relative lack of importance given to going concern issues by local firms.