What ACRA's inspections find, and how to avoid it.

ACRA inspects in two ways. Engagement inspections under the Practice Monitoring Programme (PMP) review selected audits signed by a public accountant against the Singapore Standards on Auditing and other requirements. Quality control inspections review the audit firm's system of quality management against SSQM 1 and SSQM 2; ACRA has had statutory powers to carry these out since 1 July 2023.

Public accountants and engagements are picked on risk, using factors such as the public accountant's capacity, the complexity of the engagement and the public interest involved. In the non-listed segment, the inspectors are generally from ISCA, working under ACRA's oversight. Engagement findings go to the Practice Monitoring Sub-Committee, which recommends an outcome to the Public Accountants Oversight Committee. Quality control findings go to the Registrar of Public Accountants and then to the PAOC (Firm Level).

As of 31 March 2024, ACRA regulated 732 accounting entities and 1,232 public accountants.

• Listed companies' segment: 18 firms and 440 public accountants.
• Non-listed companies' segment: 714 firms and 792 public accountants. This is where most small and mid-sized practices sit.

From April 2004 to March 2024, 18% of inspections in the listed segment ended with remedial actions or sanctions. In the non-listed segment the figure was 42%. ACRA reads the gap as a sign of uneven audit quality across the profession.

A finding is about the audit work: a procedure fell short, or the file does not support the judgement made. It is not a verdict that the accounts or the opinion were wrong.

ACRA ranks the audit quality themes with the most engagement findings each year. Accounting estimates led in each of 2022, 2023 and 2024.

• 2024: accounting estimates, including fair value measurement; the auditor's report; group audits; fraud risk assessment (new); business combinations (new).
• 2023: accounting estimates; group audits; going concern; the auditor's report; completeness of liabilities.
• 2022: accounting estimates; group audits; the auditor's report; revenue recognition; going concern.

The common gaps were in how management's key assumptions were challenged: not understanding whether management intends and is able to carry out its plans, too little corroborating evidence, contradictory evidence not considered, and indicators of management bias (such as a change in method or assumptions from last year) not looked at. On the data, the relevance and reliability of management's information was not evaluated, and historical and forward-looking information were not both considered.

The areas affected include unquoted investments and investment properties at fair value, impairment of goodwill, intangibles and property, plant and equipment, impairment of receivables, and revenue and foreseeable losses on contracts recognised over time.

In practice: look back at last year's estimates against what happened, corroborate the key assumptions with evidence from outside management, run a sensitivity analysis, evaluate any expert's work, and check events after the year end. Where a custodian or fund manager's valuation is relied on, assess its objectivity and method.

Findings included required content left out of the report, such as the reference to the consolidated or separate financial statements in the opinion, paragraphs on the auditor's and the directors' responsibilities, and reporting on other legal and regulatory requirements for subsidiaries the same auditor audits. Others were about the opinion itself: too little assessment behind the type of opinion, and an unclear basis for a modified opinion.

ACRA also points to emphasis of matter and other matter paragraphs, prior-year qualifications that are still unresolved, and a parent that does not consolidate its subsidiaries. A later change, after the report: since 6 May 2026, the auditor's report must also name the public accountant primarily responsible for the audit.

In practice: check every report against SSA 700 to 720 and ISCA's sample reports before it is signed, and record why the type of opinion is right.

Group auditors did not understand the group, its components and the component auditors well enough to plan, did not set group or component materiality, or gave component auditors unclear instructions. On review, they did not evaluate whether the component auditors' evidence was enough and kept in the group file, or whether component figures were adjusted for differences in framework, policies or year end.

In practice: apply SSA 600 (Revised), in force for periods beginning on or after 15 December 2023, with its risk-based scoping. Where access is a problem, the auditor of a Singapore parent company that must prepare consolidated financial statements has a right of access to its subsidiaries' records, and to explanations at the parent's expense, under section 207(6) of the Companies Act.

The findings concerned significant transactions outside the normal course of business. Auditors did not understand transactions that looked unusual for the entity, or did not evaluate whether a missing business rationale pointed to fraudulent reporting, for example dealings with previously unidentified related parties or on terms unusual for the industry.

In practice: use data analytics to find unusual transactions, vary procedures from year to year, put experienced people on the judgemental areas, and revisit the risk assessment when new information appears.

Auditors did not assess whether an acquisition was a business or an asset purchase, did not understand the sale and purchase agreement (acquisition date, consideration, contingent consideration), or did not get enough evidence on intangible assets the acquiree had never recognised. In many cases management used the acquiree's carrying amounts as the fair values of the net assets acquired.

In practice: identify the acquisition date by when control passed, challenge the purchase price allocation and any expert behind it, and check the FRS 103 or SFRS(I) 3 disclosures.

From ACRA's quality control inspections:

• Risk assessment: quality objectives missing from the system, and quality risk ratings not applied consistently with the firm's own framework.
• Governance and leadership: no visible commitment to quality, with repeat breaches by the same people not reflected in appraisals or discipline; a monitoring and remediation leader with other roles in the system and no safeguards against reviewing their own work.
• Ethics: a high rate of personal independence breaches, and independence policies (non-assurance services, fee levels, overdue fees, rotation) not monitored.
• Acceptance and continuance: an incomplete corporate family tree that led to a breach, and approvals not obtained under the firm's policy.
• Resources: training not designed well, and new technology put into use without adequate testing.
• Engagement performance: files not assembled on time, and engagement quality reviews that were not robust.
• Monitoring: testing plans that missed key responses, testers relying on staff declarations without evidence, and root cause analyses that stopped at symptoms, such as blaming a lack of supervision, instead of finding what caused it.

These are Nebis's suggestions, drawn from the findings above.

1. Review your own files against the five themes before an inspector does, starting with estimates.
2. Check each auditor's report against the standards before signing, including the named partner.
3. Set an archive deadline shorter than 60 days, with reminders and a lock on the due date.
4. Test personal independence declarations against evidence, not just collect them.
5. Make the engagement quality reviewer's work visible: scope, timing and what was challenged.
6. When a finding arises, ask why it happened until you reach a cause you can change.

In the Nebis workspace, AI prepares and the firm's people review and sign. Each drafted answer carries its reasoning and the evidence it relies on, and item-level schedules show every item tested. Going concern, modified opinion and significant-risk conclusions get a second check by a different AI model before review. The report cannot be signed until the engagement quality review is complete, and the archive deadline is counted from the report date.

The audit workspace · EQR module · SSQM module