A scope limitation exists when the auditor cannot perform a procedure that the auditor considers necessary to obtain sufficient appropriate audit evidence. The limitation may be caused by circumstances (a fire destroyed the records, a foreign entity’s auditor will not share working papers) or by management (management refuses to allow the auditor to perform the procedure).
The distinction between circumstantial and management-imposed limitations is one of the most consequential in audit reporting, because the cause of the limitation changes the auditor’s assessment of the risk, the auditor’s range of responses and the likely impact on the opinion.
Why management-imposed limitations are different
When circumstances prevent a procedure (the records were destroyed, the third party is uncooperative, the timing prevented attendance at a count), the limitation is unfortunate but explainable. The auditor performs alternative procedures, assesses whether the alternative evidence is sufficient and modifies the opinion only if the alternative procedures cannot close the evidence gap.
When management prevents a procedure, the dynamic is fundamentally different. The auditor must ask: why is management preventing me from verifying this? The possible answers range from benign (management believes the procedure is unnecessary, the information is commercially sensitive, the management considers the request disproportionate) to alarming (management does not want the auditor to discover what the evidence would reveal, the balance is misstated and the evidence would confirm it, the transaction involves fraud and the supporting documents would expose it).
The auditor cannot determine, without performing the procedure, which explanation applies. But the auditor can and must consider whether the limitation affects the assessment of management integrity, which in turn affects the reliability of every other representation management has made.
SA 705 treats management-imposed limitations with particular seriousness. If a scope limitation is imposed by management and the auditor cannot obtain sufficient appropriate evidence through alternative procedures, the auditor must:
Communicate with those charged with governance. The audit committee must know that management has imposed a limitation on the audit. The committee’s response (requiring management to remove the limitation, accepting the limitation with an explanation, or siding with management) informs the auditor’s next step.
Request management to remove the limitation. The auditor formally requests that the limitation be lifted. If management complies, the procedure is performed and the evidence gap is closed.
Assess whether alternative procedures can provide sufficient evidence. If management will not remove the limitation, the auditor determines whether other procedures (analytical review, corroboration from independent sources, inquiry of other parties) can compensate. In most cases of management-imposed limitations, alternative procedures are insufficient because the limitation was imposed precisely to prevent the type of verification that alternative procedures attempt to replicate.
Modify the opinion. If the limitation cannot be removed and alternative procedures are insufficient, the opinion is modified: qualified (if the possible effects are material but not pervasive) or disclaimer (if the possible effects could be material and pervasive).
Consider resignation. SA 705 contemplates that, in certain circumstances, the auditor may consider withdrawing from the engagement if management imposes a limitation that the auditor considers unacceptable. This is the most extreme response and is reserved for situations where: the limitation is fundamental to the audit (the auditor cannot form any opinion without the restricted evidence), the governance response is inadequate (the audit committee does not require management to remove the limitation), and the auditor concludes that continuing the engagement would associate the auditor’s name with financial statements the auditor cannot verify.
Practical examples
Example 1: Management refuses to allow receivable confirmations. The auditor plans to send confirmation requests directly to the company’s top 20 debtors to verify receivable balances. Management instructs the auditor not to contact customers because “it will damage the customer relationship.” The receivable balance is Rs 15 crore, representing 30% of total assets.
The auditor’s assessment: the receivable is material. Direct confirmation is the primary procedure for verifying receivable balances. Management’s stated reason (customer sensitivity) may be genuine, but the auditor cannot independently verify receivable balances without contacting the debtors. Alternative procedures (examining subsequent receipts, reviewing invoices and delivery documents, analytical review of the receivable ageing) provide some evidence but are inherently less reliable than direct confirmation because they rely on the company’s own records rather than independent third-party verification.
If the alternative procedures are insufficient to close the evidence gap and the receivable is material (which at 30% of total assets, it is): qualified opinion (if the auditor believes the possible effects are confined to receivables and are not pervasive) or disclaimer (if the receivable is so large relative to the financial statements that the inability to verify it makes the financial statements as a whole unverifiable).
The management-imposed nature of the limitation adds an additional dimension: why does management not want the auditor to contact the debtors? If the debtors would confirm balances lower than the company’s records show, the receivable is overstated. If the debtors do not exist, the receivable is fictitious. The refusal, by itself, does not prove misstatement. But it prevents the auditor from ruling it out, which is exactly why the opinion must be modified.
Example 2: Management refuses to provide board minutes. The auditor requests the minutes of all board meetings during the year to identify significant transactions, commitments, contingencies and governance decisions. Management provides minutes for 8 of the 12 meetings. For 4 meetings, management states: “The minutes are not yet finalised.” Three months after the year-end, four sets of minutes remain “unfinished.”
The auditor’s assessment: board minutes are a primary source of evidence for significant transactions, related-party approvals, litigation disclosures and post-balance-sheet events. The inability to review 4 months of board minutes creates an evidence gap across multiple financial statement areas (not confined to a single balance). The gap is potentially pervasive because the unreviewable minutes may contain information relevant to any balance or disclosure.
The opinion: if the missing minutes relate to a period where significant transactions occurred (the auditor knows from other sources that the company completed a major acquisition in one of those months), the limitation is material and potentially pervasive, warranting a disclaimer. If the missing minutes relate to routine meetings with no significant transactions (the auditor has verified from other sources that no major decisions were taken), the limitation may be material but not pervasive, warranting a qualified opinion.
Example 3: Management restricts access to a subsidiary’s records. The group auditor requests access to the accounting records and working papers of a subsidiary whose results are consolidated into the group financial statements. The subsidiary is in a different jurisdiction. The subsidiary’s management (appointed by the parent’s promoter) restricts access, citing “local confidentiality regulations.”
The auditor’s assessment: if the subsidiary is material to the group (it represents a significant proportion of group revenue, assets or profit), the inability to verify its results creates a material evidence gap. If the subsidiary is so material that its results drive the group’s financial position (representing, say, 60% of group net assets), the gap is both material and pervasive.
The opinion: the group auditor cannot opine on consolidated financial statements that include a material subsidiary whose results are unverified. The opinion is qualified or disclaimer, depending on the subsidiary’s relative significance. The “local confidentiality regulations” explanation does not change the conclusion: the auditor’s obligation is to obtain sufficient evidence, not to accept reasons why the evidence is unavailable.
What audit committees must do
When the auditor reports a management-imposed scope limitation, the audit committee has a governance obligation to:
Understand why management imposed the limitation (the stated reason and the committee’s own assessment of the actual reason).
Require management to remove the limitation unless the committee independently concludes that the limitation is justified (which is rare, because the audit is performed on behalf of the shareholders, not on behalf of management, and management does not have the authority to restrict an audit that the shareholders have mandated).
Assess whether the limitation raises concerns about management integrity (a management that restricts the auditor’s access is a management that may be concealing something the shareholders have a right to know).
Communicate with the auditor about the committee’s assessment and the committee’s decision, documented in the committee minutes.
An audit committee that accepts a management-imposed scope limitation without challenge is failing its oversight responsibility. The committee represents the shareholders. The audit is conducted for the shareholders. Management does not have the right to limit the audit, and the committee should not permit it.
Northrop Management advises audit committees on scope limitation assessment, governance obligations and the processes that ensure the audit is conducted without inappropriate restrictions.
[email protected] | +91 92899 25657