## wp18199

## Source details

**Canonical URL:** [wp18199](https://www.imf.org/-/media/files/publications/wp/2018/wp18199.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2018/wp18199.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2018/wp18199.pdf.json)

---

### I. Overview and scope
- Focus: one element of central bank accountability and transparency — the annual external audit of the financial statements.
- Coverage: review of publicly available information on CBs’ websites, including audit reports and central bank legislation, covering 170 websites of the CBs listed in Annex 1.
- Corroboration: observations on best practice and audit quality issues are corroborated by findings of IMF safeguards assessments, which evaluate audit, governance and control practices, and aspects of legal structure and autonomy at CBs of members borrowing from the IMF.
- Organizational structure of the paper:
  - Section II: scope and objective of an independent audit of CB financial statements, including key stakeholders.
  - Section III: overview of matters that influence the legal design of an audit framework, and summary of audit provisions observed in CB legislation.
  - Section IV: key aspects of an effective audit mechanism, including the role of audit.
  - Annexes: summaries of key elements, monitoring group data, and profession reforms.

### Key findings on transparency and audit practice
- Publication and availability:
  - "Most CBs (83 percent) of the above population make their audited financial statements available on their websites."
  - Of 170 CBs websites, 141 had published audit opinions at September 30, 2017.
  - 29 CBs did not have audited financial statements readily available on their websites (about 17 percent of total CBs reviewed).
- Timeliness and completion:
  - "The timeliness of their publication has improved in recent years."
  - "Audit completion is generally timely and within statutory deadlines."
  - About half of CBs finalize audits on average within three months of financial year-end.
  - Three quarters of CBs finalize annual audits within six months of their financial year ends.
  - Audit completion within nine months: 79 percent of CBs.
  - Publication within nine months: 58 percent of CBs.
  - Majority of CBs (91 CBs) complete audits within their statutory deadline; 48 CBs report ahead of the deadlines.
- Audit standards and firm affiliations:
  - "Most of the published audit reports confirm the use of International Standards on Auditing (ISA; 64 percent)."
  - "70 percent of the CBs audited by internationally affiliated audit firms."
  - ISA explicitly required in CB laws in 15 percent of cases.
  - Of 170 CBs, 141 CBs had published audit opinions out of the total population of 170.
- Governance and oversight arrangements:
  - "CBs are adopting governance structures that embrace modern audit oversight through audit committees."
  - From reviews: Nearly half (80 of the 170 CBs) have an audit committee or similar audit oversight body.
  - Only 40 CB laws specifically required an audit committee.
  - Only 48 CB laws (28 percent) established audit rotation modalities.
  - Only 40 CB laws (24 percent) require the establishment of an audit committee.

### External audit objective, standards, and public expectations
- External audit purpose:
  - Independent auditor expresses an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework and whether they present fairly the financial position of an organization.
  - External auditors play a critical role in maintaining market confidence in the reported financial statements.
- Standards and convergence:
  - ISA are widely recognized as high-quality standards; issued by IAASB.
  - As of September 2017, 124 jurisdictions were using ISA or committed to using them in the future.
  - INTOSAI has converged its public sector financial audit guidelines with ISA; since 2010 these guidelines are reviewed annually to ensure consistency with ISA.
- Audit expectation gap:
  - The “audit expectation gap” arises when public expectations (e.g., detection of fraud, legal irregularities, or assurances on policy effectiveness) exceed the auditor’s mandate.
  - Under ISA, auditors opine only on the financial statements; management letters may report control weaknesses but auditors are not responsible for detecting all fraud or assessing policy effectiveness.
- IMF guidance:
  - IMF “Code of Good Practices on Transparency in Monetary and Financial Policies” (section 4.2) states:
    - “The central bank should publicly disclose audited financial statements of its operations on a preannounced schedule.”
    - “The financial statements should be audited by an independent auditor.”
    - “Information on accounting policies and any qualification to the statements should be an integral part of the publicly disclosed financial statements.”

### Stakeholders and interests in audited CB financial statements
- Parliament: legal compliance; votes on accepting annual report in some cases.
- Government: profit distribution; capital/recapitalization needs; indemnities for agreed policies; taxation (rare); balances and transactions with government.
- CB Board/Audit Committee & Employees: fiduciary responsibilities; Board approval of financial statements; audit oversight; audit letters to improve controls.
- General public: stewardship of public funds; heightened interest during policies like quantitative easing or ELA.
- Financial institutions/markets: impact of central bank money on monetary policy; foreign currency reserves as indicator of intervention capacity.
- International Financial Institutions: reliability of monetary data & statistics; donor/lender due diligence; IMF Safeguards Assessments.

### Legal frameworks and audit arrangements
- Common legal traditions and models:
  - Private law corporations—commercial audit norms apply.
  - Public law institutions—public audit norms apply and Supreme Audit Institutions (SAIs) perform audits.
- Three statutory approaches:
  - Exclusive commercial audit framework—CB subject to national or internationally accepted commercial audit framework to the exclusion of public audit.
  - Mixed system—statute recognizes elements of both public and commercial audit frameworks.
  - Delegated system—statute authorizes CB’s main decision-making body to determine the audit framework; this is the most common practice.
- Mixed system variants:
  - Parallel system—both a SAI and an independent external auditor are assigned, using respective audit standards.
  - Outsourcing system—SAI’s audit opinion is based on an opinion issued by an independent external auditor.
- Constitutional constraints:
  - Constitutional provisions recognizing SAIs may constrain exclusion or scope-limiting of public audits of CBs and affect SAI involvement in auditor selection/dismissal.

### Appointment, tenure, and safeguards for external auditors (observed patterns)
- Recommended components to safeguard audit quality and independence:
  - Experience in using international standards and applying them to complex financial institutions and/or CBs.
  - Multi-year appointments with a minimum mandate.
  - Auditor rotation rules (for firms or key audit partners).
  - Annual performance reviews with the ability to discontinue the audit contract for good cause.
- Appointing authorities vary: CB governance bodies (Board or Audit Committee), government (commonly Minister of Finance), shareholders or sole shareholder (the State), or the legislature (Parliament).
- Observed legal and de facto figures (from 170 laws as of September 2017):
  - A majority (157 CBs or 92 percent) of CBs have an audit requirement enshrined in CB law; the remainder (13 CBs or eight percent) were silent or law not readily available.
  - External auditors are predominantly (36 percent) appointed by the CB Board or a similar governance body (delegated system).
  - In IMF safeguards assessments population, the CB’s governance body assumes selection and appointment responsibility in 56 percent of cases (de-jure: 44 percent for the safeguards population; 36 percent for total group of CBs).
  - Appointments by government, President, shareholders, or Parliament account for about a quarter of cases; supranational appointments occur in the Eurosystem context.
- Legal provisions vs. practice on independence measures:
  - Only 48 CB laws (28 percent) established audit rotation modalities.
  - Only 40 CB laws (24 percent) require the establishment of an audit committee.
  - Only 15 percent of laws require the use of ISA, yet audit opinions refer to ISA in 64 percent of CBs.
  - Of the 27 CB laws that specifically state an ISA requirement, 21 were amended after 2008.
  - Of the 48 CB laws that had audit rotation requirements, the majority (30 cases) was amended over the last decade.

### Audit committees and audit oversight (Box 1 highlights)
- Role and responsibilities:
  - Oversight of internal and external audits, control systems, and financial reporting; some committees cover risk management and legal compliance.
  - Receive audit reports on financial statements and the management letter with observations on internal controls, financial reporting, and compliance.
  - Key responsibilities typically include auditor selection and rotation policies, ensuring auditor independence, review of performance and retention, and monitoring of audit findings and recommendations.
- Prevalence and trends:
  - Nearly half (80 of the 170 CBs) have an audit committee or similar audit oversight body.
  - Only 40 CB laws specifically required an audit committee, an increase from 30 CB laws reviewed in 2013.
- Interaction with SAIs:
  - Where a SAI audits the CB, audit committee mandates need adjustment to avoid conflict with SAI status and mandate.
  - SAIs may subcontract or share audit work with an independent external auditor and delegate audit oversight, including audit firm selection, to the CB and its audit committee.
  - Such arrangements may be formalized through a memorandum of understanding (MoU) between the SAI and the CB.

### Auditor independence: threats and safeguards (Box 1 and Box 3)
- Conceptual elements:
  - Independence of mind and independence in appearance.
- Categories of threats:
  - Self-interest, Self-review, Advocacy, Familiarity, Intimidation.
- Common circumstances that create threats:
  - Financial interest, significant gifts or excessive hospitality; family, personal, or employment relationships; long association of senior audit personnel; provision of non-audit services (bookkeeping, implementation of accounting systems, selecting accounting policies, valuation services); fees contingent on audit outcome or fees representing a large portion of auditor revenues.
- Typical IMF recommended provisions (examples):
  - Multi-year term appointments with rotation limits: “No external auditor shall be appointed consecutively for a cumulative period exceeding [five/seven] years, after which the audit firm/or the key audit partners shall be replaced.”
  - External auditors to have “full power to examine all books and accounts of the Central Bank and obtain all information about its transactions.”
  - External auditor reporting obligations to the Audit Committee on material weaknesses in internal controls relating to the financial reporting process.

### Empirical findings and key statistics (monitoring group and broader population)
- For 60 CBs under safeguards monitoring (as at September 2017):
  - Total CBs under monitoring: 60
  - Audit committees present: 42
  - ISA applied: 55
  - Audit firm affiliation — International: 51; Other: 9
  - Rotation requirement present: 48
  - Average rotation period (years) (total): 3.86
- Regional counts and averages (60 CBs):
  - AFR: No. of Central Banks 21; Audit Committee 18; ISA 21; International 19; Other 2; Rotation Requirement 20; Average Rotation Period 3.8; Average Risk Rating for External Audit Medium-Low
  - APD: No. of Central Banks 8; Audit Committee 3; ISA 8; International 7; Other 1; Rotation Requirement 4; Average Rotation Period 4; Average Risk Rating for External Audit Medium-High
  - EUR: No. of Central Banks 10; Audit Committee 8; ISA 10; International 8; Other 2; Rotation Requirement 9; Average Rotation Period 4.6; Average Risk Rating for External Audit Low / Medium-Low
  - MCD: No. of Central Banks 14; Audit Committee 11; ISA 10; International 11; Other 3; Rotation Requirement 11; Average Rotation Period 3.9; Average Risk Rating for External Audit Medium-Low
  - WHD: No. of Central Banks 7; Audit Committee 2; ISA 6; International 6; Other 1; Rotation Requirement 4; Average Rotation Period 3; Average Risk Rating for External Audit Medium Low / Medium-High
- Percentage indicators for the 60 CBs under monitoring:
  - Audit Committee presence 70 percent; ISA 90 percent; Audit Firm Affiliation International 85 percent; Other 15 percent; Rotation Requirement 80 percent.
- Percentage indicators for the 170 CBs (Section IV):
  - Audit Committee 47 percent; ISA 64 percent; Audit Firm Affiliation 70 percent.
- Timing and publication:
  - Review of 170 CB laws found 134 set a statutory deadline for financial reporting.
  - Most common statutory timeframe is three months or less after the financial year-end.
  - The majority of the CBs (115 out of 141 CBs that published their financial statements) had fiscal years ending in December.
  - Over the past four years, many CBs improved timeliness of publication and more than half publish within nine months of their financial year-ends.
  - A sizeable group of CBs (17 percent) lacked readily available audited financial results on their websites.

### External audit in IMF safeguards assessments: trends and root causes of elevated risks
- Coverage and trends (May 2010–September 2017):
  - 104 assessments covering 61 CBs.
  - Heightened risks for external audit observed in about a third of the assessments, covering 25 CBs.
- Root causes for elevated risks at the 25 CBs:
  - Weak audit firm capacity and deficient quality control processes resulting in non-compliance with ISA (17 CBs).
  - Deficient internal procedures for selection and appointment of auditors (14 CBs).
  - Weak audit mechanism despite involvement of a quality auditor (7 CBs).
  - Weak or lacking audit oversight by audit committees (20 CBs).
- Safeguards assessment outcomes:
  - Improvements in external audit mechanisms since 2010, including improved compliance with ISA and strengthened audit oversight through audit committees.
  - Assessments recommend strengthening committee mandates and enhancing expertise where deficient.

### Regulatory and professional developments (summary and implications)
- Reform focus areas:
  - (i) oversight of audit firms through independent audit regulators,
  - (ii) measures to safeguard auditors’ independence,
  - (iii) requirements for audit committees and their role in audit oversight,
  - (iv) functioning of the audit market,
  - (v) reporting and bridging the “expectation gap.”
- Independent audit regulators:
  - IFIAR comprises independent audit regulators from 52 jurisdictions.
  - Examples: PCAOB (United States); EU public oversight system effective 2016.
- Mandatory audit rotation:
  - Rotation mitigates familiarity threats; can be partner rotation or firm rotation.
  - Out of 151 CB laws reviewed, 40 included provisions on rotation of external auditors.
  - EU audit legislation effective 2016 includes a 10-year firm rotation with possible extensions; US lawmakers blocked mandatory audit firm rotation (House bill in July 2013 prohibited PCAOB from requiring firm rotation).
- Other reforms affecting audit practice:
  - 2016 EU reforms: restrictions on non-audit services; cap on fees for non-audit services at 70 percent of audit fees; mandatory tendering; enhanced audit committee roles; enhanced reporting requirements.
  - Revised auditing standards introduce Key Audit Matters (KAM) disclosure and enhanced communication with TCWG (ISA 701 applicability notes).
  - IFAC Code of Ethics provision: key audit partners on public interest entities should not serve for longer than seven years, with a cooling off period of two years.
- Jurisdictional reforms (selected examples):
  - Eurasian Economic Commission: unified audit standards and control plan (approved August 2016 draft).
  - China: March 2016 regulation changing rotation and tendering rules; top 15 CPA firms may be engaged up to 8 consecutive years for financial institutions under specified conditions.
  - Nigeria: proposed guidelines to require auditors to issue affirmative statements on internal control adequacy; rotation of audit partners from time to time.
  - South Africa: December 2015 rule requiring PIEs’ auditors’ reports to disclose the number of years audit firm has been the auditor.

### Conclusions and policy recommendations
- External audit as element of CB accountability:
  - Independent annual audit is enshrined in most CB laws.
  - Majority of CBs publish externally audited financial statements; notable improvement since 2000–2002.
- Good practices observed:
  - CBs implement international standards and governance practices such as audit committees.
  - External auditors for most CBs refer to international standards on auditing.
  - A significant number of CBs (70 percent) engage auditors with global networks and international affiliation.
  - Modern CB laws provide for establishment of audit committees and more detailed provisions on audit quality.
- Areas for improvement:
  - Transparency remains incomplete: 17 percent of CBs lacked readily available audited financial results on their websites.
  - Timeliness of publication can still improve for a subset of CBs.
- Recommended CB actions to safeguard audit quality:
  - Be proactive through adequate institutional arrangements.
  - Use international auditing standards and engage qualified auditors.
  - Establish robust audit policies that support audit quality and independence.
  - Ensure selection and appointment procedures give appropriate weight to technical requirements and expertise.
  - Implement measures to ensure audit independence, including rotation and limits on non-audit services.
  - Ensure governance structures provide for audit committees to oversee the audit process and CBs’ response to audit findings.
- Ongoing adaptation:
  - External audit will continue to evolve with changes in control systems reliant on technology and developments in financial reporting standards (particularly International Financial Reporting Standards).
  - External auditors, CBs, and audit committees will require sufficient capacity and adaptability to stay relevant and add value.

*Source: wp18199, IMF working paper content provided.*

### REFERENCES _____________________________________________________________________________________ 40

### I. OVERVIEW

### Objective and scope
- Focus: one element of central bank accountability and transparency — the annual external audit of the financial statements.
- Coverage: review of publicly available information on CBs’ websites, including audit reports and central bank legislation, covering 170 websites of the CBs listed in Annex 1.
- Corroboration: observations on best practice and audit quality issues are corroborated by findings of IMF safeguards assessments, which evaluate audit, governance and control practices, and aspects of legal structure and autonomy at CBs of members borrowing from the IMF.

### Key findings on transparency and audit practice
- Publication of audited financial statements:
  - "Most CBs (83 percent) of the above population make their audited financial statements available on their websites."
- Audit completion and timeliness:
  - "The timeliness of their publication has improved in recent years."
  - "Audit completion is generally timely and within statutory deadlines."
- Audit standards and firm affiliations:
  - "Most of the published audit reports confirm the use of International Standards on Auditing (ISA; 64 percent)."
  - "70 percent of the CBs audited by internationally affiliated audit firms."
- Governance and oversight arrangements:
  - "CBs are adopting governance structures that embrace modern audit oversight through audit committees."
  - "CBs use international standards and practices in the external audit area even in the absence of legal requirements."
  - "Recent legal amendments incorporate provisions supporting external audit quality and independence."

### Analytical emphasis
- Rationale: central banks have public mandates and are often entrusted with significant degrees of autonomy; therefore, to ensure democratic control and good governance, CBs are expected to be accountable.
- Implication: strengthening external audit arrangements and publication practices contributes to central bank accountability and transparency.
- Organizational structure of the paper: 
  - Section II explains the scope and objective of an independent audit of CB financial statements, including key stakeholders.
  - Section III provides an overview of matters that influence the legal design of an audit framework, along with a summary of audit provisions observed in CB legislation.

*Source: wp18199 - REFERENCES (excerpt) from the IMF working paper content provided.*

### Section IV describes key aspects of an effective audit mechanism, including the role of audit

### wp18199 - Section IV describes key aspects of an effective audit mechanism, including the role of audit

### External audit objective and role
- Purpose:
  - External audit: independent auditor expresses an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework and whether they present fairly the financial position of an organization.
  - External auditors play a critical role in maintaining market confidence in the reported financial statements.
- Standards and guidance:
  - ISA are widely recognized as high-quality standards for the performance of audits of financial information; they are issued by the International Auditing and Assurance Standards Board (IAASB).
  - As of September 2017, 124 jurisdictions were using ISA or committed to using them in the future.
  - INTOSAI has converged its guidelines for financial audits in the public sector with ISA; since 2010 these INTOSAI guidelines are reviewed annually to ensure consistency with ISA.
- Distinction from other audit types:
  - “External audit” in this paper refers to an independent financial audit of annual financial statements, distinct from internal audit, performance and public expenditure audits, forensic investigations, or agreed-upon procedures and other special-purpose engagements.
  - External audit scope is limited to financial statements and financial reporting risks for a defined period; internal audit continuously evaluates governance, risk management, and control processes and reports confidentially.
  - In risk frameworks, external audit is sometimes considered a fourth line of defense; current models provide three lines of defense with internal audit as the third line.

### Public expectations and the audit expectation gap
- Public perception and limitations:
  - The “audit expectation gap” arises when public expectations (e.g., detection of fraud, legal irregularities, or assurances on policy effectiveness) exceed the auditor’s mandate.
  - Under ISA, auditors opine only on the financial statements; management letters may report control weaknesses that cause material misstatements, but auditors are not responsible for detecting all fraud or assessing policy effectiveness.
- Central bank (CB) accountability context:
  - Central bank autonomy requires accountability; financial reporting is one element of CB accountability.
  - IMF “Code of Good Practices on Transparency in Monetary and Financial Policies” (section 4.2) states:
    - “The central bank should publicly disclose audited financial statements of its operations on a preannounced schedule.”
    - “The financial statements should be audited by an independent auditor.”
    - “Information on accounting policies and any qualification to the statements should be an integral part of the publicly disclosed financial statements.”
- Stakeholders with interest in audited CB financial statements (illustrative rationales):
  - Parliament: legal compliance; votes on accepting annual report in some cases.
  - Government: profit distribution; capital/recapitalization needs; indemnities for agreed policies; taxation (rare); balances and transactions with government.
  - CB Board/Audit Committee & Employees: fiduciary responsibilities; Board approval of financial statements; audit oversight; audit letters to improve controls.
  - General public: stewardship of public funds; heightened interest during policies like quantitative easing or ELA.
  - Financial institutions/markets: impact of central bank money on monetary policy; foreign currency reserves as indicator of intervention capacity.
  - International Financial Institutions: reliability of monetary data & statistics; donor/lender due diligence; IMF Safeguards Assessments.

### Legal frameworks and audit arrangements for central banks
- Audit framework types by legal tradition:
  - Private law corporations—commercial audit norms apply (e.g., corporations act).
  - Public law institutions—public audit norms apply and Supreme Audit Institutions (SAIs) perform audits (e.g., state entities audit act).
- Three common approaches for CB audit frameworks in statute:
  - Exclusive commercial audit framework—CB subject to national or internationally accepted commercial audit framework to the exclusion of public audit.
  - Mixed system—statute recognizes elements of both public and commercial audit frameworks.
  - Delegated system—statute authorizes CB’s main decision-making body to determine the audit framework; this system has become the most common practice.
- Mixed system variants:
  - Parallel system—both a SAI and an independent external auditor are assigned, using respective audit standards.
  - Outsourcing system—SAI’s audit opinion is based on an opinion issued by an independent external auditor.
- Constitutional considerations:
  - Constitutional provisions recognizing SAIs may constrain the exclusion or scope-limiting of public audits of CBs, and may affect SAI involvement in auditor selection/dismissal.

### Appointment, tenure, and safeguards for external auditors
- Key components to safeguard audit quality and independence:
  - Experience in using international standards and applying them to complex financial institutions and/or CBs.
  - Multi-year appointments with a minimum mandate.
  - Auditor rotation rules (for firms or key audit partners).
  - Annual performance reviews with the ability to discontinue the audit contract for good cause.
- Appointing authorities (statutory variations):
  - CB governance bodies (Board or Audit Committee), government (commonly Minister of Finance), shareholders or sole shareholder (the State), or the legislature (Parliament).
  - Supranational appointment type is noted for Eurosystem national central banks and ECB (independent external auditors recommended by ECB’s Governing Council and approved by Council of the European Union).
- Observed legal and de facto patterns (exact figures from analysis):
  - The analysis is based on 170 laws from CB websites and IMF CB Legislation Database as of September 2017.
  - A majority (157 CBs or 92 percent) of CBs have an audit requirement enshrined in CB law; the remainder (13 CBs or eight percent) were silent or law not readily available.
  - The party responsible for appointing the CB auditor is defined in most CB laws; external auditors are predominantly (36 percent) appointed by the CB Board or a similar governance body (delegated system).
  - In IMF safeguards assessments population, the CB’s governance body assumes selection and appointment responsibility in 56 percent of cases (de-jure: 44 percent for the safeguards population; 36 percent for total group of CBs).
  - Appointments by government, President, shareholders, or Parliament account for about a quarter of cases; supranational appointments occur in the Eurosystem context.
- Legal provisions vs. practice on independence measures (exact figures):
  - Only 48 CB laws (28 percent) established audit rotation modalities.
  - Only 40 CB laws (24 percent) require the establishment of an audit committee.
  - Only 15 percent of laws require the use of ISA, yet audit opinions refer to ISA in 64 percent of CBs.
  - Of the 27 CB laws that specifically state an ISA requirement, 21 were amended after 2008.
  - Of the 48 CB laws that had audit rotation requirements, the majority (30 cases) was amended over the last decade.

### Practical issues when SAIs are involved
- Safeguards to protect CB autonomy when SAIs audit CBs:
  - SAI remit should focus on financial statement audits or efficiency of management, excluding audit of effectiveness of CB public or monetary policies.
  - Clear definition of SAI parameters for scrutiny of CB policies and operations is necessary to shield CB from political and external pressure while preserving accountability.
- Mixed-system reconciliation:
  - Where both a SAI and a private external auditor audit the CB (parallel system), the legal framework should identify which audit opinion takes precedence for decision making (important for profit distribution schemes).
  - In outsourcing systems, the legal framework could require transparent disclosure of differences in audit reports (example: Tanzania CAG guidance to explain differences in 2009).

### IMF technical assistance recommendations (typical provisions)
- Recommended statutory or formal provisions to underpin audit quality, independence, and communication:
  - “The financial statements of the Central Bank shall, at least once a year, be audited in accordance with International Standards on Auditing by independent external auditors who shall be of good repute and have recognized experience in the auditing of major international financial institutions.”
  - “The Board shall appoint the external auditors upon the recommendation of the Audit Committee for a multi-year term. No external auditor shall be appointed consecutively for a cumulative period exceeding [five/seven] years, after which the audit firm/or the key audit partners shall be replaced.”
  - “The external auditor shall report to the Audit Committee on key matters arising from the audit and, in particular, on material weaknesses in internal controls relating to the financial reporting process.”
  - “The external auditors shall have full power to examine all books and accounts of the Central Bank and obtain all information about its transactions.”

*Source: wp18199, https://www.imf.org/-/media/files/publications/wp/2018/wp18199.pdf*

### Box 1: External Audit Provisions in CB Laws

### Box 1: External Audit Provisions in CB Laws

### Purpose and scope of the external audit mechanism
- The “external audit mechanism” supports quality audit and encompasses practices and procedures to ensure audit quality, independence, and accountability for audit results.21
- Main elements: oversight by an independent body (i.e., an audit committee), the external auditors, audit selection and rotation policies, and processes to ensure timeliness of audit completion and publication.

### Audit oversight and the role of audit committees
- Audit committees have increasingly become part of CB governance structures, following private-sector governance developments (OECD, Basel Committee).
- A typical audit committee: oversight of internal and external audits, control systems, and financial reporting; some committees also cover risk management and legal compliance.
- CB laws should ideally contain provisions on the audit committee and its oversight role as part of an overall audit framework.
- The audit committee is a stakeholder of the external audit process and receives:
  - audit reports on the financial statements;
  - the management letter with observations on internal controls, financial reporting, and compliance.
- Key responsibilities of the audit committee typically include:22
  - Auditor selection and rotation policies: internal policies typically give greater weight to technical expertise than to cost, establish multi-year mandates and rotation requirements.23
  - Ensuring auditor independence during the audit: monitoring independence throughout the auditor’s mandate, reviewing safeguards for independence, and reviewing all services provided by the auditor; may restrict non-audit services from an incumbent auditor.24
  - Review of performance and retention: annual evaluation of the external auditor, including assessment of qualifications and performance of audit partners and staff; quality and candor of communications; independence, objectivity, and professional skepticism.
  - Monitoring of audit findings and recommendations: receiving periodic reports from CB staff on implementation status of audit recommendations.

### Prevalence and trends in audit committee adoption
- From reviews of legal frameworks, Annual Reports, and safeguards experience:
  - Nearly half (80 of the 170 CBs) have an audit committee or similar audit oversight body.
  - Only 40 CB laws specifically required an audit committee.
  - Of the 151 CB laws reviewed in 2013, only 20 percent (30 CBs) specifically required an audit committee.
  - More central bank laws now require audit committees: an increase from 30 to 40 CBs, indicating a shift towards established corporate governance practices.25

### Interaction with Supreme Audit Institutions (SAIs)
- Where a SAI has responsibility for the CB audit, audit committee mandates need appropriate adjustment to avoid conflict with the SAI’s status and mandate.
- SAIs often have high institutional independence and may face capacity challenges to audit complex financial organizations like CBs; in such cases a SAI may subcontract to or share audit work with an independent external auditor and delegate audit oversight, including audit firm selection, to the CB and its audit committee.
- Such arrangements may be formalized through a memorandum of understanding (MoU) between the SAI and the CB.26

### Recommended audit committee provisions for CB legislation (typical IMF technical assistance recommendations)
- The Board shall appoint an Audit Committee.
- Members of the Audit Committee shall be appointed from among non-executive Board members.
- If no non-executive Board member has extensive accounting or auditing experience, the Audit Committee shall appoint at least one independent external expert with such experience; independence criteria example: the expert shall not have been a member of the Board or staff in the [three] calendar years preceding his/her appointment as member of the Audit Committee.
- Appointment and dismissal criteria for Audit Committee members and/or the expert should be aligned with those applicable to Board members.
- Audit Committee responsibilities shall include:
  - evaluate the overall effectiveness of internal control systems;
  - oversee the financial reporting process implemented by management;
  - recommend the appointment of external auditors, and the scope of external audits and other services;
  - periodically review the external auditors’ independence and performance;
  - meet with the external auditors to discuss their findings;
  - review with the external auditors the year-end financial statements;
  - oversee the internal audit function;
  - monitor compliance by the Central Bank’s Departments with findings and recommendations issued by the Chief Internal Auditor.
- The Board shall define the composition, and further responsibilities and duties of the Audit Committee in the Audit Committee Charter of the Central Bank.
- The Audit Committee may regulate its own proceedings.
- The Audit Committee shall periodically report to the Board.

### Auditor communication and professional standards
- Under ISA, auditors are required to communicate certain matters to TCWG (i.e., the Board or its audit committee), including:
  - the auditor’s responsibility in relation to the audit and confirmation of auditor independence;
  - planned audit scope and timing of the audit;
  - significant audit findings;
  - difficulties encountered in the audit;
  - deficiencies in internal controls of the audited entity.
- In a typical annual audit cycle, the auditor should seek at least two meetings with the audit committee — at the planning and concluding stages of the audit.

### Auditor independence: conceptual approach and common threats
- Independence comprises:
  - Independence of mind — permits expression of a conclusion without being affected by influences that compromise professional judgment.
  - Independence in appearance — avoidance of facts and circumstances that would lead a reasonable and informed third party to conclude the auditor’s integrity, objectivity, or professional skepticism has been compromised.
- Categories of threats to independence:
  - Self-interest threat;
  - Self-review threat;
  - Advocacy threat;
  - Familiarity threat;
  - Intimidation threat.
- Examples of circumstances creating threats:
  - Financial interest (direct or indirect), significant gifts or excessive hospitality;
  - Family, personal, or employment relationships;
  - Long association of senior audit personnel with an audit client, including lack of partner rotation;
  - Provision of non-audit services (some services such as bookkeeping, implementation of accounting systems, selecting accounting policies, or valuation services may be prohibited);
  - Fees contingent on audit outcome or when fees represent a large portion of the audit partner or firm business; fees that are too low for the scope of the audit.
- Source for ethical standards: “Code of Ethics for Professional Accountants” by the International Ethics Standards Board for Accountants of IFAC.

*Source: IMF technical assistance reports on central bank legislation and safeguards assessments.*

### Box 3: Auditors’ Independence

### Box 3: Auditors’ Independence

### Who Audits Central Banks?
- Review sample: 141 CBs with published audit opinions out of a total population of 170.
- International audit firms account for about 70 percent of the CB audits, comprising:
  - 94 audit opinions issued solely by an international firm (55 percent).
  - 19 joint audit arrangements which include an international firm (11 percent), presented within the co-sign group.
  - Eight audits subcontracted by the SAI to an international audit firm (4 percent).
- Regional observations:
  - Asia Pacific: less dominant use of international firms (21 percent).
  - Asia Pacific: greater use of SAIs (36 percent) compared to the general population.
- Use of auditing standards:
  - About 64 percent of CBs’ audit reports stated use of ISA.
  - ISA explicitly required in CB laws in 15 percent of cases.
  - Frequent use of ISA across regions, with dominant use in Africa and Europe.
- Drivers of ISA usage:
  - Internal CB regulations (by-laws, Charters, Board decisions) often provide for ISA.
  - External auditors subject to accounting and audit regulations in their jurisdictions that increasingly adopt ISA.
  - International audit firms base internal methodologies on ISA and commonly refer to them in audit reports.
- Market structure and dynamics:
  - International firms responsible for approximately 70 percent of CB audits in both 2013 and 2017 (including co-signing and subcontracting arrangements).
  - CBs periodically rotate audit firms; increase in co-signing partly due to engagement through joint audits.

### Transparency and Timeliness of Reporting
- Statutory deadlines:
  - Review of 170 CB laws found 134 set a statutory deadline for financial reporting.
  - Most common timeframe is three months or less after the financial year-end.
  - Remaining 34 CBs: no set date or no clear provision (no date category); “other” includes unclear dates (e.g., “as soon as possible after year-end”).
- Audit completion timing (based on published audit opinion dates):
  - About half of CBs finalize audits on average within three months of financial year-end (holding themselves to private sector standards).
  - Three quarters of CBs finalize annual audits within six months of their financial year ends.
  - European CBs lead in timely completion within three months.
  - Majority of CBs (91 CBs) complete audits within their statutory deadline; 48 CBs report ahead of the deadlines.
  - Common causes of late audit completion: late appointment of auditors, weak accounting controls requiring audit adjustments, difficulties obtaining audit evidence from third parties.
- Publication of audited financial statements:
  - Of 141 CBs that published audited financial statements as of September 2017, 64 percent (108 CBs) were specifically required to do so by their CB law.
  - 29 CBs did not have audited financial statements readily available on their websites (about 17 percent of total CBs reviewed).
  - Publication timeliness trends:
    - Most CBs publish within nine months.
    - Audit completion within nine months: 79 percent of CBs.
    - Publication within nine months: 58 percent of CBs.
  - Causes of publication delays: need to obtain government approval; combining publication with annual report preparation. Recommendation noted: delinking publication of audited financial statements from the annual report could improve timeliness and may require legislative amendments.
- Fiscal year timing note:
  - The majority of the CBs (115 out of 141 CBs that published their financial statements) had fiscal years ending in December.

### External Audit in IMF Safeguards Assessments
- Context:
  - External audit is one of five elements of CB governance and control assessed in IMF safeguards assessments (ELRIC framework: external audit, legal structure and autonomy, financial reporting, internal audit, internal controls).
  - Publication of annual financial statements independently audited in accordance with international standards is a key safeguards policy requirement.
  - Assessments examine selection and rotation of external auditors, audit quality, and auditors’ communication with governance bodies (board, audit committee).
- Trends in assessments:
  - Safeguards assessments show improvement in external audit mechanisms since 2010, including improved compliance with ISA and strengthened audit oversight through audit committees.
  - Historical risk ratings: elevated risks in the early post-policy years (2010–2005), continued relatively high risks in 2005–2010 due in part to evolving international standards; positive trend since 2010.
- Assessment coverage and findings (May 2010–September 2017):
  - 104 assessments covering 61 CBs.
  - Heightened risks for external audit observed in about a third of the assessments, covering 25 CBs.
- Root causes for elevated risks at the 25 CBs:
  - Weak audit firm capacity and deficient quality control processes resulting in non-compliance with ISA (17 CBs). Problems included verification of foreign reserves and obtaining assurances on IT systems; in some cases auditors accepted poor disclosures or failed to identify errors.
    - Majority of these firms lacked international affiliation; however, at six CBs firms with global networks also had ineffective quality assurance processes.
  - Deficient internal procedures for selection and appointment of auditors (14 CBs). Issues included untimely appointments, lack of requirements on audit capacity and experience in financial institution audits, and lack of safeguards for audit independence (multi-year mandates, rotation, limits on audit fees). In two cases assessments raised serious concerns about auditors’ independence.
  - Weak audit mechanism despite involvement of a quality auditor (7 CBs), due to weak selection policies, insufficient follow-up on audit recommendations, and protracted audit processes (late appointments, delayed completion).
  - Weak or lacking audit oversight by audit committees (20 CBs), contributing to higher risk profiles.
- Role of audit committees:
  - Safeguards assessments confirm the importance of audit oversight; effective audit committees correlate with favorable safeguards ratings for the external audit mechanism.
  - Assessments recommend strengthening committee mandates and enhancing expertise (including membership or use of experts in advisory capacity) where deficient.
- Outcomes:
  - CBs undergoing safeguards assessments have incorporated procedures into external audit mechanisms to ensure compliance with international standards, as evidenced by improving risk ratings and safeguards monitoring information.

*Source: wp18199 - Box 3: Auditors’ Independence (excerpt).*

### Annex 2 includes a summary of the key elements of the external audit

### Annex 2 includes a summary of the key elements of the external audit

### Overview of audit arrangements for CBs under safeguards monitoring
- Group size: 60 CBs as at September 2017.
- This group shows on average a higher use of international firms and standards, as well as the presence of audit committees, when compared to those observed in the general population.
- Audit rotation practices:
  - Rotation practices are present at most CBs.
  - Rotation practices are difficult to ascertain from publicly available information, unless specifically mentioned in the central bank law.
  - The average rotation period applied by the 60 CBs under safeguards monitoring is typically 3–4 years with a possibility of renewal, or five years with no immediate renewal.
  - These rotation periods are shorter than the current regulatory and professional requirements (Section VI), suggesting CBs are more conservative in their approach.

### VI. Regulatory and professional developments (summary)
- Reforms focus on:
  - (i) oversight of audit firms through independent audit regulators,
  - (ii) measures to safeguard auditors’ independence,
  - (iii) requirements for audit committees and their role in audit oversight,
  - (iv) functioning of the audit market,
  - (v) reporting and bridging the “expectation gap.”
- Reforms target entities of relevance to capital markets (i.e. listed companies and financial institutions) but will have a wider impact through internal policies at audit firms and new professional standards.
- Central banks (CBs) should stay abreast of these developments and consider their bearing on CB audit policies and the audit committee’s agenda.

### A. Independent Audit Regulators
- The traditional model of self-regulation has shifted in favor of the establishment of audit oversight regulators.
- Examples and functions:
  - United States: Public Company Accounting Oversight Board (PCAOB) created in 2002 to oversee audits of public companies.
  - EU: Legislation effective in 2016 requires Member States to establish a system of public oversight of auditors.
  - Functions of such bodies include registration of statutory auditors, adoption of standards on ethics, internal quality control, continuous education, quality assurance, and investigative and disciplinary systems.
  - These bodies conduct inspections of audit firms, which may provide a useful reference on audit quality for CBs and their audit committees in appointing and renewal decisions.
- The International Body of Independent Audit Regulators (IFIAR) comprises independent audit regulators from 52 jurisdictions.

### B. Mandatory Audit Rotation
- Rationale:
  - Rotation safeguards audit independence by mitigating familiarity threats arising from long auditor–client relationships.
  - Multi-year appointments are recognized as protecting auditors from pressures linked to annual re-appointments, but rotation is required to address familiarity threats.
- Forms of rotation:
  - Change of partners and key audit staff, or a change of firm.
  - Rotation of key audit partners is required under international standards.
  - In jurisdictions with relatively small audit firms, mandatory firm rotation (MFR) may be warranted and is often enshrined in central banking legislation.
- Current practice:
  - Out of 151 CB laws reviewed, 40 included provisions on rotation of external auditors.
- Debates in larger jurisdictions:
  - Supporters: rotation enhances independence and opens growth opportunities for smaller audit firms.
  - Opponents: rotation could hinder audit quality due to loss of institutional knowledge and risk of “opinion shopping.”
- Recent regulatory developments of significance:
  - United States: lawmakers blocked mandatory audit firm rotation. In July 2013, the House of Representatives approved a bill that prohibits the PCAOB from requiring public companies to change their audit firm on a regular basis.
  - EU: audit legislation that took effect in 2016 includes a requirement to change audit firms after 10 years. That period can be extended by up to 10 additional years if companies put the audit out for a tender, and by up to 14 additional years in joint audit arrangements. Member States have an option to shorten these periods.

### C. Other regulatory and standard-setter developments
- 2016 EU reform measures include:
  - Restrictions on non-audit services and prohibition of certain services.
  - A cap on fees from other non-audit services at 70 percent of the audit fees.
  - Mandatory tendering for audit appointments.
  - Audit committees’ role in the audit oversight process.
  - Enhanced reporting requirements for auditors in their reports and in communications with audit committees.
- Revised auditing standards aim to reduce the “expectation gap” by increasing focus on communication:
  - Enhanced communication with TCWG and more detailed and informative audit reports.
  - Audit reports now include a new section where the auditor highlights critical matters of importance in the audit (i.e., key audit matters).
  - Key audit matters (KAM) were previously communicated to TCWG; new requirements extend this to inclusion in the audit report for external stakeholders.
  - Matters likely to be reported include areas with significant difficulty during the audit and issues involving significant judgment (e.g., valuation issues or adequacy of disclosures).
- ISA 701 applicability notes:
  - ISA 701 applies to audits of financial statements of listed entities (required) and when the auditor otherwise decides to communicate KAMs (voluntary).
  - ISA 701 also applies when law or regulation requires communication of KAMs in the auditor’s report (e.g., for public interest entities - PIE).
  - Applicability to CB audits depends on local regulations, determination whether the CB is considered a PIE, and some CBs and their auditors may voluntarily disclose the KAMs.
- IFAC Code of Ethics provision:
  - Key audit partners on public interest entities should not serve for longer than seven years, with a cooling off period of two years.

### Empirical findings and key statistics (as reported)
- Aggregate and regional counts (Annex table for 60 CBs under monitoring):
  - Total CBs under monitoring: 60
  - Audit committees present: 42
  - ISA applied: 55
  - Audit firm affiliation — International: 51; Other: 9
  - Rotation requirement present: 48
  - Average rotation period (years) (total): 3.86
  - Regional averages and risk ratings:
    - AFR: No. of Central Banks 21; Audit Committee 18; ISA 21; International 19; Other 2; Rotation Requirement 20; Average Rotation Period 3.8; Average Risk Rating for External Audit Medium-Low
    - APD: No. of Central Banks 8; Audit Committee 3; ISA 8; International 7; Other 1; Rotation Requirement 4; Average Rotation Period 4; Average Risk Rating for External Audit Medium-High
    - EUR: No. of Central Banks 10; Audit Committee 8; ISA 10; International 8; Other 2; Rotation Requirement 9; Average Rotation Period 4.6; Average Risk Rating for External Audit Low / Medium-Low
    - MCD: No. of Central Banks 14; Audit Committee 11; ISA 10; International 11; Other 3; Rotation Requirement 11; Average Rotation Period 3.9; Average Risk Rating for External Audit Medium-Low
    - WHD: No. of Central Banks 7; Audit Committee 2; ISA 6; International 6; Other 1; Rotation Requirement 4; Average Rotation Period 3; Average Risk Rating for External Audit Medium Low / Medium-High
- Percentage indicators (for the 60 CBs under monitoring, percentages unless otherwise indicated):
  - Overall: Audit Committee presence 70 percent; ISA 90 percent; Audit Firm Affiliation International 85 percent; Other 15 percent; Rotation Requirement 80 percent.
  - Percentage for 170 CBs (Section IV) referenced: Audit Committee 47 percent; ISA 64 percent; Audit Firm Affiliation 70 percent.
- External auditors and standards (from figures and notes):
  - A significant number of CBs (70 percent) engage auditors with global networks and international affiliation.
  - Of 170 CBs websites, 141 had published audit opinions at September 30, 2017.
  - Timing of publication:
    - Over the past four years, many CBs improved timeliness of publication and more than half publish within nine months of their financial year-ends.
    - There remains a sizeable group of CBs (17 percent) for which the audited financial results were not readily available on their websites.
  - Figures show regional distributions for auditor appointment responsibility, types of external auditors (International Firms, Co-sign/Two opinions, Local Firm, SAI, No info), auditing standards applied (ISA, Local Auditing Standards, No Info), timing of audit completion (Within 3 months; 3-6 months; 6-9 months; More than 9 months; No information available), and age of published annual financial statements (Less than 9 months old; 9 to 21 months old; More than 21 months old; No info).

### Conclusions and policy recommendations
- External audit is an established element of CB accountability:
  - Independent annual audit is enshrined in most CBs laws.
  - The majority of CBs publish externally audited financial statements, a notable improvement since 2000–2002.
- Good practices observed:
  - CBs implement international standards and good governance practices such as audit committees.
  - External auditors for most CBs refer to international standards on auditing.
  - A significant number of CBs (70 percent) engage auditors with global networks and international affiliation.
  - Modern CB laws provide for the establishment of audit committees and set more detailed provisions on audit quality.
- Areas for improvement:
  - Transparency of audited results has increased but remains incomplete; 17 percent of CBs lacked readily available audited financial results on their websites.
  - Timeliness of publication can still improve for a subset of CBs.
- Recommended CB actions to safeguard audit quality:
  - Be proactive through adequate institutional arrangements.
  - Use international auditing standards and engage qualified auditors.
  - Establish robust audit policies that support audit quality and independence.
  - Ensure selection and appointment procedures give appropriate weight to technical requirements and expertise.
  - Implement measures to ensure audit independence.
  - Ensure governance structures provide for audit committees to oversee the audit process and CBs’ response to audit findings.
- Ongoing adaptation:
  - External audit will continue to evolve with changes in control systems reliant on technology and developments in financial reporting standards (particularly International Financial Reporting Standards).
  - External auditors, CBs, and audit committees will require sufficient capacity and adaptability to stay relevant and add value.

*Source: IMF Safeguards database and Annex 2 text (as provided).*

### Annex 4: Audit Profession Reforms

### Annex 4: Audit Profession Reforms

### Overview
- The external audit profession is undertaking reforms to safeguard integrity and enhance audit quality, with increased regulatory activity and a focus on accountability to users of financial statements and the public.

### Notable reforms by jurisdiction
- Eurasian Economic Commission (EEC)
  - The EEC is the permanent regulatory body of the Eurasian Economic Union, whose members are the Republics of Armenia, Belarus, Kazakhstan, and Kyrgyzstan; and the Russian Federation.
  - The EEC Board approved in August 2016 audit, reporting and accounting draft liberalization plans aimed at the creation of a common market for these two services.
  - By establishing a unified system of audit standards, audit quality requirements, and control over audit firms, the EEC hopes to achieve a higher level of trust and reliance on audit reports issued in its member countries.

- European Union (EU)
  - The EU adopted audit reforms in April 2014.
  - The provisions were applicable from the first financial year starting on or after 17 June 2016.
  - Reforms aim to enhance statutory audits in the EU by reinforcing auditors' independence and their professional skepticism towards the management of the audited company, in particular for public interest entities (PIEs).
  - Key measures include:
    - mandatory audit firm rotation for PIEs;
    - new requirements for audit committees relating to their oversight of the audit;
    - additional restrictions on the provision of non-audit services by the statutory auditor to their PIE audit clients;
    - new reporting requirements.

- China
  - In March 2016, the Ministry of Finance announced a new regulation changing the compulsory rotation period for some auditors of financial institutions as well as the related tendering requirements.
  - Under the new regulations:
    - the 5-year rotation period (3-year initial term plus 2 further years on the basis of a tender) introduced in 2010 will still apply to most audit firms;
    - financial institutions can now engage an auditor who ranked within the top 15 CPA firms in Mainland China for up to 8 consecutive years (5 years initial term and a 3-year extension – without the need for a tender but involving an internal process overseen by the audit committee).

- Nigeria
  - The Securities and Exchange Commission of Nigeria is considering new guidelines that will require external auditors to issue an affirmative statement on the adequacy and effectiveness of the internal control system of the company being audited.
  - This aims to strengthen corporate governance.
  - In addition to the current rule that stipulates change of external auditing firm after tenure of 10 years, companies shall now require external auditing firms to rotate audit partners assigned to undertake the external audit of the company from time to time to avoid familiarity.

- South Africa
  - In December 2015, the Independent Regulatory Board for Auditors enacted a new rule that mandates all auditors’ reports on annual financial statements of all PIE to disclose the number of years that the audit firm or sole practitioner has been the auditor of the entity (audit tenure).

### Key concepts and definitions (glossary excerpts)
- Audit opinions
  - Unmodified opinion: auditor concludes financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.
  - Modified opinion: necessary when (a) the auditor concludes the financial statements as a whole are not free from material misstatement; or (b) the auditor is unable to obtain sufficient appropriate audit evidence. Modified opinion includes a qualified opinion, an adverse opinion or a disclaimer of opinion on the financial statements (ISA 700 and 705).

- ELRIC framework
  - The framework used by the IMF to conduct safeguards assessments at member central banks.
  - ELRIC stands for (i) the External audit mechanism; (ii) the Legal structure and autonomy of the central bank; (iii) the financial Reporting framework; (iv) the Internal audit mechanism; and (v) the internal Controls system.

- Key audit matters
  - Matters that, in the auditor’s professional judgment, were of most significance in the audit of the financial statements of the current period.
  - Selected from matters communicated with those charged with governance to enhance transparency about the audit (IAS 701).

- Management Letter
  - The external auditor's written communication describing significant deficiencies in internal control identified during the audit to those charged with governance on a timely basis (IAS 265).

- Reasonable assurance
  - The level of confidence that the financial statements are not materially misstated that an auditor, exercising professional skill and care, is expected to attain from an audit.
  - An auditor cannot attain absolute confidence because of limitations of audit evidence, impracticality of examining all evidence and uncertainties as to the future (ICAEW).

- Supreme Audit Institution (SAI)
  - A public body of a state or supranational organization exercising, by virtue of law or other formal action, the highest public auditing function in an independent manner, with or without jurisdictional competence (INTOSAI Statutes, December 2016).

- Those Charged with Governance (TCWG)
  - ISA defines “those charged with governance” as the person(s) with responsibility for overseeing the strategic direction of the entity and obligations related to accountability; typically an audit committee or the Board.

*Source: Annex 4: Audit Profession Reforms, wp18199.*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2018/wp18199.pdf_