AFRC reprimands and fines Forvis Mazars CPA Limited HK$1.4 million and Grant Thornton Hong Kong Limited HK$2.32 million for widespread and systemic failures to archive files on a timely basis

The Accounting and Financial Reporting Council (AFRC) has sanctioned the two PIE audit firms Forvis Mazars CPA Limited (formerly known as Mazars CPA Limited)¹ (Mazars) and Grant Thornton Hong Kong Limited² (Grant Thornton) for widespread breaches of the 60-day archive requirement as well as deficiencies relating to their systems of quality control and management.
 

The AFRC has:

• publicly reprimanded Mazars and Grant Thornton;
• imposed a pecuniary penalty of HK$1,400,000 on Mazars and ordered Mazars to pay the AFRC’s investigation costs and expenses; and
• imposed a pecuniary penalty of HK$2,320,000 on Grant Thornton and ordered Grant Thornton to pay the AFRC’s investigation costs and expenses. 

Audit documentation is the primary means by which auditors evidence their compliance with auditing standards. Proper and complete documentation has a dual role in enhancing audit quality and reducing the risk of non-compliance with standards.
 

Audit documentation also provides the evidence by which both internal reviewers and external inspectors assess the quality of the work undertaken to support the auditor’s conclusions. Accordingly, audit documentation is of paramount importance for audits of all companies – PIE or otherwise. It is not a purely administrative task.

Archiving audit documentation on a timely basis is critical, as this ensures that audit documentation will not be improperly altered or tampered with after archiving, thereby preserving the integrity of audit documentation. Repeated failures to do so are indicative of a poor system of internal control at a firm and may cast doubt on the firm’s integrity.³

As a result of the AFRC’s inspections and subsequent investigations, Mazars and Grant Thornton have admitted breaches of HKSA 230⁴ in respect of 413 and 491 engagements respectively which had not been archived. The two firms also admitted breaches of HKSQC 1⁵ and HKSQM 1⁶, in that they failed to establish and implement effective policies and procedures which led to the widespread file archive breaches.
 

The sanctions reflect the widespread and systemic nature of the breaches of the above standards by Mazars and Grant Thornton, as well as their different degrees of cooperation. 

The AFRC has considered all the relevant circumstances, including the following:
 

• 96 of Mazars’ engagements had not been archived for over a year. Mazars was proactive in addressing its breaches, and kept the AFRC informed of its progress. Only one engagement had not been archived until after the AFRC’s investigation commenced.
• 303 of Grant Thornton’s engagements had not been archived for over a year, and out of these, 44 engagements had not been archived for over three years. Although Grant Thornton had submitted remediation plans in response to the AFRC’s inspection reports, 298 engagements were still not archived until after the AFRC’s investigation commenced.
• Mazars and Grant Thornton admitted their misconduct, accepted the AFRC’s disciplinary action in full, and reached an early settlement with the AFRC. 

Given Mazars’ cooperation, the AFRC exercised its discretion under the Guidance Note on Cooperation with the AFRC and reduced the pecuniary penalty by 30%.
 

Grant Thornton provided inaccurate data and information in relation to its breaches, including in response to the AFRC’s statutory requirements to verify and reconcile such data. As a result, Grant Thornton unnecessarily prolonged the investigation, resulting in the AFRC exercising its discretion and reducing the pecuniary penalty by only 10%.
 

Mr Denis Cheng, Head of Investigation and Compliance, and Ms Hester Leung, Head of Discipline, said:
 

“These cases are serious and of grave concern. Timely archiving of audit documentation is a fundamental duty of auditors and an essential element of audit quality. Firms must establish and maintain robust systems of quality management and controls, supported by sufficient and appropriate resources, to ensure due compliance with audit standards. Otherwise, it severely undermines the firm’s credibility and erodes public confidence in the profession. The AFRC recognises and values cooperation, and will exercise its discretion to reduce disciplinary sanctions according to the degree of such cooperation. Failure to cooperate is counter-productive and will result in more severe sanctions. We strongly encourage regulatees to pursue cooperation with due care and diligence during both the investigation and discipline stages.”
 

For details of the decision relating to Mazars, please refer to the Statement of Disciplinary Action.
 

For details of the decision relating to Grant Thornton, please refer to the Statement of Disciplinary Action. 

¹ Registration number: M0257.
² Registration number: M0446.
³ For further reading, refer to the AFRC’s publication titled “The Importance of Audit Documentation Integrity” published on 29 May 2024. 

⁴ Hong Kong Standard on Auditing 230 Audit Documentation.

⁵ Hong Kong Standard on Quality Control 1 Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements. 

⁶ Hong Kong Standard on Quality Management 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements.