Protecting the whistleblower

While there is much talk in Singapore about enacting laws to protect whistleblowers in general, to what extent are external auditors in Singapore required to whistleblow on companies they audit, based on current legislation and regulations; and to what extent are they protected? Joseph Alfred reports

Under the requirements of Singapore Standard on Auditing (SSA) 240, relating to The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements, if the auditor identifies any fraud involving managers or employees who have significant roles in internal control, and which concerns a material misstatement in the financial statements, he is required to report these matters immediately to those charged with the governance of the company. If the integrity or honesty of management, or those charged with governance, is doubted, the auditor is advised to seek legal advice on the most appropriate course of action. If it is a public company, the auditor would also have to consider the operation of Section 207(9A) of the Companies Act.

Under this section, an external auditor of a public company or its subsidiary must report straight to the Ministry of Finance if there is any reason to believe that a serious offence involving fraud or other dishonesty is being, or has been, committed against the company by its officers or employees. Though, this isn’t necessary if a report of the same offence has been sent to the Monetary Authority of Singapore (MAS), pursuant to any other written law.

A serious offence involving fraud or dishonesty is defined as an offence that is punishable by imprisonment for a term of two years or more, and the value of the property obtained or likely to be obtained by committing the offence is S$20,000 or more.

Reporting money laundering activities

Statement of Auditing Practice (SAP) 19 (relating to The Auditor’s Role and Responsibilities in relation to the Prevention, Detection and Reporting of Money Laundering) requires that any knowledge, or even suspicion of, drug money laundering must be reported by the auditor to the Commercial Affairs Department (CAD).

When auditing the financial statements of a regulated entity (for example, a bank), auditors have a statutory duty to report to the regulator matters of material significance to its function or other specified matters that come to the auditor’s attention in the course of his work. Any knowledge or suspicions of involvement of the company’s directors in money laundering, or of failure to comply with an applicable MAS guideline, would normally be regarded as being of material significance which would give rise to a statutory duty to report the matter to the regulator (in addition to any report to the CAD). In normal circumstances, auditors can assume that reporting to a regulator does not open them to a charge of tipping off. (A tipping off offence can arise when a disclosure is made to third parties which is likely to prejudice an ongoing money laundering investigation being undertaken by law enforcement authorities.)

Reporting financing of terrorism

The auditor, in carrying out his duties, is in a privileged position to review all the material financing transactions of a company. The Terrorism (Suppression of Financing) Act imposes a duty on any person who has information about any transaction, or proposed transaction, involving terrorist property to inform the police (or the CAD in the commercial context) immediately. Any person who knows or believes he has information which would prevent the commission of a terrorism financing offence, or which would secure the apprehension, prosecution or conviction of a person involved in a terrorism financing offence, will be required to immediately inform the police. Failing to do so may expose the person (in this case, the auditor) to a fine of up to S$50,000 or to imprisonment for a term up to five years, or both.

Reporting non-compliances with the law

Under Section 207(9) of the Companies Act, if an auditor is satisfied that there has been a breach or non-observance of any of the provisions of the Companies Act, and is of the view that the matter cannot be adequately dealt in his or her report, or by bringing the matter to the notice of the directors of the company or its holding company, he is required to report the matter in writing to the registrar at the Accounting and Corporate Regulatory Authority (ACRA).

Under SSA 250 (relating to The Consideration of Laws and Regulations in an Audit of Financial Statements), if an auditor suspects that members of senior management and board members are involved in non-compliance with any relevant laws, the auditor is required to report the matter to the next higher level of authority in the company - for example, the audit committee. If the auditor believes that the report may not be acted upon, even by the highest authority in the company, or is unsure of to whom to report the matter, he or she is advised to seek legal advice and give due consideration to the public interest.

SAP 5 (which relates to The Auditor’s Supplementary Report for Banks) highlights that the MAS requires auditors to report any non-compliance with the Companies Act or the Banking Act, without regard to materiality, so long as the non-compliance was observed during the course of the normal statutory audit, carried out under those acts.

The CAD has a Suspicious Transaction Reporting Office (STRO), which is in charge of receiving and monitoring suspicious transaction reports, including those relating to money laundering and terrorism financing. An auditor who suspects that a company or its officers has committed an offence of a commercial nature, especially one in contravention of the Companies Act or the Securities and Futures Act, can lodge a complaint with the department either in writing, addressed to the Director of the CAD, or in person, by making an appointment with a CAD officer. Alternatively, the auditor may lodge an on-line complaint at the following website: www.spf.gov.sg/epc/ePCLinks.html.

Reporting weaknesses in internal controls and uncorrected errors

Under SSA 240, the auditor should report to those charged with governance any failure by management to appropriately address identified material weaknesses in internal control.

Under SSA 260 (relating to Communications of Audit Matters with those Charged with Governance), the auditor is required to inform those charged with governance of any misstatements identified during the audit that remained uncorrected by the management.

Protection for auditors when they whistleblow

Under the various legislation and regulations discussed, the auditor’s duty of confidentiality to his client will not be considered as having been contravened if he reports the relevant matter to the minister, MAS, the CAD or ACRA in good faith. SAP 19 states that audit staff who report any suspicions of money laundering to an appropriate partner will be discharged of their personal reporting responsibility.

Section 42 of the Drug Trafficking (Confiscation of Benefits) Act (DTCBA) provides anonymity to those making reports. The protection relates only to reporting knowledge or suspicion of money laundering, and does not extend more widely - for example, to disclosure of audit working papers to an investigating officer. To avoid a breach of confidentiality, such further disclosure ought to be made only in response to a court order made under the DTCBA. Hence, in cases of doubt over the gravity of a particular matter, auditors are able to report suspicions of money laundering without the threat of subsequent legal action, even if on further investigation it is found that there was no offence.

Conclusion

Based on current legislation, there appears to be adequate protection for auditors when they whistleblow on their clients. If in doubt, the auditor is always advised to seek legal advice. Nevertheless, external auditors are still exposed to the risk that they may not be reappointed as auditors by a major client, particularly when suspicions do not materialise in any actual wrongdoing. To this extent, they share some of the disincentives that come with whistleblowing with other whistleblowers. As a professional, however, the auditor is expected to be objective, unbiased and decisive in reporting matters that may jeopardise the interests of shareholders, creditors and other stakeholders of the company being audited. Some practitioners have also complained about the high costs of obtaining legal advice. As a pre-emptive measure to incurring high legal costs, auditors should consider doing a thorough check of the risks relating to the prospective client before accepting any engagement.

Under Section 3.9 of ACCA’s Rulebook, covering the rules of professional ethics and conduct, ACCA practitioners undertaking audits are required to fulfil whistleblowing responsibilities. The above outline could serve as a guide on these responsibilities in the Singapore context.

Joseph Alfred is technical adviser at ACCA Singapore.