TACC608 - Auditing and Assurance Research Assignment on ANZ Bank Risks

This report analyzes key audit matters at ANZ Bank, a core banking organization with assets and liabilities in customer loans, deposits, and foreign currency. The report focuses on two primary audit risks: Provision for Customer Remediation and IT Systems and Controls. The analysis of Provision for Customer Remediation explains the potential impact on financial statements, including the risk of misstatement and the importance of accurate estimations. It also details auditing procedures, such as identifying affected account balances and understanding the business's processes, to verify the accuracy of provisions. The second part of the report addresses IT Systems and Controls, emphasizing the importance of a robust IT infrastructure in the banking sector. It explores potential impacts of IT failures, like data breaches, on the financial statements and outlines auditing procedures. These procedures include understanding the IT systems through charts, analyzing control procedures, and potentially conducting third-party audits to assess the system's strengths and weaknesses. The report emphasizes the auditor's role in assessing and mitigating these risks to ensure the reliability and credibility of the financial statements.

TACC608 - Auditing and Assurance
Research Assignment - Major Audit Risk Areas

Audit
Executive summary
Our area of study is a banking organization namely ANZ which is a core banking
organization and has its assets and liabilities in the form of customer loans and deposits. The
Bank ANZ also has foreign currency assets and derivatives. The company has more than one
exposure in different countries which means that they are dealing with different governmental
rules and regulations. Also, they need to convert their books of accounts as per the country
currency. The company database has numerous client data both financial and nonfinancial
which is very confidential and any leakage of the same can be very harmful to the reputation
of the bank.
The ANZ Bank has a large number of employees who use complex IT networks and are
always prone to loss of database and network, hacking of systems, physical damage, theft,
loss due to fire, water or any unknown reasons beyond control. So the banking sector requires
safety from all the above problems and hazards some of which are inherent while others are
uncontrollable. These all need to be controlled in case the company needs to grow and
develop. So the auditor needs to draft an audit program to specifically control these risks.
This assignment covers study about the two key audit matters namely Provision for Customer
Remediation and IT Systems and Controls. It explains the potential impacts of these audit
risks on the financial statements of the bank and also the audit procedures recommended for
verifying the balances of the accounts that are potentially impacted by such risks.
2

Audit
Contents
Introduction...........................................................................................................................................4
Key audit matters:.................................................................................................................................4
 Provision for customer remediation..............................................................................................4
 IT systems & controls.....................................................................................................................6
Conclusion.............................................................................................................................................8
References.............................................................................................................................................9
3

Audit
Introduction
There has been immense growth and changes in the activities of the business thereby
emphasizing the need for more transparency and information. The available information
should be free from the errors thereby stressing the need for a proper audit report and process.
The company needs to have an adequate framework that will lead to proper disclosure and
adherence to the relevant policies (Matthew, 2015). It is thereby imperative that the auditing
work should ensure a high standard of reliability, as well as credibility. The practice of
misstating the financial statements has been on the increment and this is the main reason why
there has been a downfall of many big corporate like HIH, Lehman Brothers, Satyam, etc.
Hence, assessment and identification of the audit risk are crucial to the task of the auditor and
this has been studied in the light of ANZ Bank. The report stresses the two main audit matter
that is provided for customer recommendation and IT system and control.
Key audit matters:
 Provision for customer remediation
The provision for Customer Remediation means that the ANZ bank makes aside provisions
for compensating its customers about any past matters or events which were associated with
the services or products provided by the bank to the customers. While making provisions for
customer remediation, the management has to use its best estimate about the cost of settling
such compensation amounts. The main issues that are considered include the number of
affected customers, the average amount of refund per customer, the cost related to
remediation per customer, etc. The amount of claim and its timing can`t be predicted
precisely. In case the bank faces any hacking or forgery, the bank might receive a legal notice
to make good a loss so the bank is constantly under pressure to avoid such situations. Hence,
it is very difficult to estimate the exact actual amount of provision to be made. The bank shall
try to lower the provision amount so that profits are not affected while the auditor has to
check the correctness and adequacy of the provisions (Gay & Simnet, 2015).
Potential Impact on Financial Statements-
The Provision created for Customer Remediation by the bank for the year ended 30th
September 2018 was $556m which included $115m as opening balance, $525m as provisions
4

Audit
made during the year, $(60)m as provisions used during the year & $(24)m as unused
amounts reversed during the year. It is very important to make accurate or close to accurate
provisions as the main objective behind making such provisions is to absorb the financial
shock that may occur to the company if there are compensations to be paid to the customers
for any uncertain event (ANZ, 2018). The audit risk is that the provision may be misstated or
misestimated in the financial statement by the managers. If the provision is underestimated, it
will lead to increased profitability and hence will show increase future cash flow position of
the banking company (Balla, Rose & Romeo, 2012). On the contrary, if the provision is
overestimated, it will reduce the profits and also the taxes on the profits. Both ways are
lucrative for the managers as the aim of managers is to show a good position in the financial
position of the bank. Further, it shall reduce the number of liabilities in the Balance Sheet of
the Bank by $556m, thereby increasing the networking capital which shall create a good
picture of the financial position of the bank (ANZ, 2018). The company makes provisions in
such a way that the company can cover a reasonable amount of risk and also not create a
burden on its profits (Anderson, 2010). These are the potential impacts on the financial
statements of the company in case of misstatement or incorrect estimation or deliberate
manipulation of the figure of provision for customer remediation.
Auditing procedures
The auditor needs to first have an idea of the business and its procedures to get an idea as to
what account balances are impacted due to the possible audit risk. So the primary activity is
to identify the possible affected account balances. The Auditor should formalize his auditing
procedures after identify the account balances which may be affected (Anderson, 2010). The
provision of Loss loans can only be done after classifying loans into retail and corporate
loans, Property Hypothecation, Loan tenures, past Loan tracks and financial profiles of the
borrowers. For example, An auditor comes to know about customer/Vendor suit or a possible
future suit against a bank regarding a breach of a clause in the contract signed with the bank,
Now the Auditor needs to read the agreement signed first and understand the impact of the
clauses on the company (Baldwin, 2010). The company may also have to defend its case even
if not guilty, while if once it is established that the bank is guilty of breaching the clause, it
becomes important to raise the provision amount and keep the funds ready to pay the
customer. The profit balances will have to take a hit in case of provision amount is to be
raised. The bank can be sued and it may also affect the share prices of the bank so the Auditor
has to fully disclose the effect of the suit in his auditor report also. It is also important for the
auditor to understand clauses in other agreements affecting other account balances as well.
5

Audit
The account balances affected are Customer balance, Debtor & Creditor balances and
Contingent Liabilities (ANZ, 2018).
The company leverage can be affected if the provisioning is done on a higher basis so the
management should engage its auditors to create provisions. The shareholders are interested
in the financial operations of the Bank and want a clear picture of company operations. The
auditor has to disclose the possible outcomes and its impact on the shareholders and should
not come under management influence to hide any future events (Deloitte, 2014). An Auditor
is an independent person who shall carefully verify the customers claim and try to cover them
with the provisions and fully disclose them in the Auditors report. Higher provisioning also
affects loan distribution, Bill discounting and other investments (Hoffelder, 2012).
 IT systems & controls
This area of Key Audit matter is more of an operational area and non-financial too. It is the
core of the banking sector as entire banking activity is automated and all the functioning of
the banking sector is distributed over networking. The ANZ bank it network is complex and
vast, distributed across the country and holds vital data of its customers. The Bank formulates
its IT policy and IT infrastructure, uses, Hardware to be used, access rights and many more
operational functions. The control features installed by the ANZ bank is the prima facia
check over the IT environment. The banking sector hires the best in class professionals to
manage and run its IT systems (ANZ, 2018). The failure of IT network or its components
may lead to a big loss to the company. So to safeguard this area is a very important issue.
Any hacking or potential Loss may lead to loss of customer base and outflow of funds from
the Banking Company (KMPG, 2019). Further, if there are errors in the software being used,
it may lead to errors in report generation as well. The potential accounts to get impacted
include Debtor and Creditors Accounts, Depreciation Account, Provision accounts, Fixed
Assets, etc.
The Auditor before drafting its audit procedures should understand the IT systems through
charts and diagrams and clearly understand the flow of the Data. The entire process of
receiving the data until the processing and reaching its endpoint should be well understood to
audit the same. The control procedure implemented by the bank is to be well analyzed and
test checked by the Auditor as well to mention their adequacy (Geoffrey, Joleen, Kelli &
David 2016). The Bank must have a backup plan in case of an IT failure to resume its
6

Audit
services in the shortest period. It is not possible to provide a solution to all the future IT
failures but it is possible to have a backup plan in place if any failure or problem arrives
(FRC, 2014).
Auditing procedures
The IT network and its components are the lifelines of the banking sector. The bank ANZ
can`t operate a single day even without the IT environment. The auditor is not an IT expert
hence he has to take help of IT experts to understand the IT systems and its impacts in case of
failure. What he can understand is the possible outcomes in case of IT failure. The employees
use these IT systems process and record these transactions. The customers are granted access
and transaction rights to their accounts which are prone to public internet which is prone to
hacking (FRC, 2014). The point of impact can come from anywhere and anytime and maybe
a disaster as well for the Bank. A well-equipped team of experts must be employed round the
clock to manage the IT systems. The Auditor may also conduct a third party Audit to
understand the weaknesses and strengths of the IT systems (Manoharan, 2011). The Access
rights given to the employees are to be reviewed time to time so that any possible lapses may
be known to the banks. This Audit risk affects banking as a whole and not on account
balances level. Any outsider with a mal intention to harm the Banking operations may enter
the IT system through remote locations by hacking the networks (ANZ, 2018). He may copy
the data, delete, alter or steal customer database/Funds or do anything unauthorized or illegal.
So the Bank has to always be careful with these types of event. The bank should use the latest
types of technology, software, and antivirus to avoid these problems. The Audit team should
be trained with the Softwares used and its functioning so that they can find the loopholes
(CPA, 2018).
For example: In the case of Hacking or Failure of the bank IT network, The entire data and
all account balances get venerable to manipulation and alteration. The Hacker tries to either
steal customer funds or transfer funds or on the other hand, may copy databases to enter
customers’ accounts. So it is difficult to say that what may happen. The Auditor should check
that what things and events are covered by Insurance cover and amount of claims in case of
Loss. The IT systems should be secured through various levels of security. Every Log in
should be supported by a message sent to the customers (CPA, 2018). Any unauthorized
access should be detected by the system and an alarm or any activity must be raised to stop
the access to the accounts.
7

Audit
Conclusion
The requirement for business information has enhanced with the due passage of time and
with some of the major downfalls in the past few decades, the focus on the auditors has
increased to a tremendous extent. It needs to be noted that the audit risk is inherent in the
system and hence, the quality of the audit process will help in driving the organization. Banks
are exposed to risk because of areas like internal control, loan provisions, asset quality, etc.
thereby, in-depth analysis and assessment are needed to ensure that no material misstatement
happens and any potential error can be informed to the management quickly.
Whatever be the key Audit Matter, the primary controls are to be placed by the ANZ
Management itself. The auditor can only suggest rectification measures because Auditor
cannot participate in the day to day operations. One of the Control features is to have an
Internal Audit department which reports every significant matter to the ANZ Management.
The Statutory Auditor can be helped immensely if he is provided with the Internal Auditor
report. The Auditor has to disclose all the significant details along with the Audited financials
of the Bank.
8

Audit
References
Anderson, A.W. 2010, A practical approach to understanding audit risk, Account-Ability
Plus, viewed 29th September 2018,
<https://www.kscpa.org/writable/files/AndersonAuditExpress/apracticalapproachtounderstan
dingauditrisk.pdf>.
ANZ 2018, ANZ 2018 annual report & accounts 2018, viewed on 29 September 2019
<https://www.anz.com/content/dam/anzcom/shareholder/anz_2018_annual_report_final.pdf>
Baldwin, S 2010, Doing a content audit or inventory, Pearson Press.
Balla, E., Rose, M. and Romero, J. 2012,Loan loss reserve accounting and bank behaviour,
Economic Brief, The Federal Reserve Bank of Richmond, viewed 29th September 2018
<https://www.richmondfed.org/~/media/richmondfedorg/publications/research/
economic_brief/2012/pdf/eb_12-03.pdf>.
CPA 2018, The Evolving role and exposure of Audit Committees, viewed 29th September
2018 <https://www.cpaaustralia.com.au/~/media/corporate/allfiles/document/professional-
resources/auditing-assurance/evolving-roles-of-audit-committees.pdf?la=en
Deloitte 2014, Internal audit in the financial services industry focus areas for thematic and
targeted reviews in 2014, viewed 29th September 2018
<https://www2.deloitte.com/content/dam/Deloitte/in/Documents/financial-services/in-fs-
internal-audit-in-FSI-noexp.pdf>.
Financial Reporting Council [FRC] 2014,Audit quality thematic review: The audit of loan
loss provisions and related IT controls in banks and building societies, viewed 29th
September 2018 <https://www.frc.org.uk/Our-Work/Publications/Audit-Quality-Review/
Audit-Quality-Thematic-Review-The-audit-of-loan-lo.pdf>.
Gay, G. and Simnet, R 2015, Auditing and Assurance Services, McGraw Hill
Geoffrey D. B, Joleen K, K. Kelli S. and David A. W 2016, Attracting Applicants for In-
House and Outsourced Internal Audit Positions: Views from External Auditors. Accounting
Horizons vol. 30, no. 1, pp. 143-156, doi:10.2308/acch-51309
Hoffelder, K 2012, New Audit Standard Encourages More Talking. Harvard Press.
KMPG 2019, How Advanced Technologies May Improve Audit Quality, viewed on 29
September 2019 < https://www.forbes.com/sites/insights-kpmg/2019/03/04/how-advanced-
technologies-may-improve-audit-quality/#237f95885632>
Manoharan, T.N 2011, Financial Statement Fraud and Corporate Governance, The George
Washington University.
9

Audit
Matthew, S. E 2015, Does Internal Audit Function Quality Deter Management Misconduct?.
The Accounting Review, vol. 90, no. 2, pp. 495-527, doi: 10.2308/accr-50871
10