Jeremy Twomey writes: Billed as the most important change in data privacy regulation in over 20 years, and with its enforcement deadline of 25 May 2018 fast approaching, ensuring General Data Protection Regulation (GDPR) compliance has become a top priority for the majority of Irish businesses. Over the last year, the Institute has been helping its members to prepare for GDPR in a number of ways. For example, we have provided guidance via articles in recent issues of Accountancy Ireland, while in the last few weeks we have run a series of half day roadshows and courses in a number of towns and cities across Ireland. In addition, the Practice Consulting team has been busy preparing detailed practical guidance in this area, explaining what the changes resulting from GDPR will mean for accountants and their clients. This guidance will be available under the Knowledge Centre section of the Institute website, and is designed to answer the GDPR-related questions that members have contacted us on over recent months. While preparing this guidance, it became evident that a number of “myths” have developed over the last couple of years surrounding the implementation of GDPR. In this article, I am going to address a few of these and try to help you ensure that you do not fall foul of these, as you prepare to achieve GDPR compliance at your firm. Myth 1 - GDPR Compliance is a once off project to be achieved by 25 May With so much hype surrounding the regulation, one should remember it is not a once off event or test for compliance. Unlike planning for the Y2K deadline in 1999, GDPR preparation doesn’t end on 25 May; it requires ongoing effort. It’s an evolutionary process for organisations; 25 May is the date that GDPR will be enforced but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May of this year. GDPR will require ongoing governance of data, as organisations migrate to new systems or apply their customer data to new markets and trends. Initial compliance is the first heavy lift, but ongoing governance is the long-term reality! All entities falling under GDPR should endeavour to be fully compliant by the implementation day, although this may not be possible in all instances. In such circumstances it is important that you address the essential elements of compliance at your firm as soon as possible, and can demonstrate your ongoing efforts in this regard in a comprehensive documented plan of work. Myth 2 - GDPR is only for large firms, a small accountancy practice or company is not expected to have the time or resources to achieve compliance You will have to comply with GDPR, regardless of your size, if you process personal data. Small accountancy practices do not escape the demands of compliance. GDPR needs to be prioritised by all firms, regardless of size. The vast majority of businesses across Ireland are small businesses and it is important to remember these firms often process a lot of personal data, and their data protection reputation and liability risks are just as real as for larger entities. Myth 3 - With Brexit, entities located in the UK, including Northern Ireland, will not have to comply with GDPR GDPR will apply to all EEA countries and any individual or organisations trading with them. As it comes into force on 25 May 2018 (before the UK is due to leave the EU), UK individuals & organisations must ensure compliance with the new regime by then. The British government has confirmed that the UK’s decision to leave the EU following Brexit will not affect the commencement of GDPR. Post Brexit, it is envisaged that if a UK organisation or individual processes personal data, then they will have to do this in accordance with GDPR. To ensure that the UK will be GDPR-compliant post Brexit, the new Data Protection Bill (currently going through Parliament in London) incorporates all of the GDPR. Myth 4 - GDPR is a completely new approach to Data Protection It is vital to remember that GDPR builds upon the existing legislation in this area. It is an update, not a wholesale revision, to meet the changes in technology and data use over the last twenty years or so. As a result of these changes, consumers’ privacy and data were not by now as well protected as they could be. GDPR rectifies this by increasing the responsibility on organisations to use personal data appropriately and to hold it securely. Although GDPR is not a completely new approach, it is more stringent in its application and the fines for non-compliance have been considerably increased. This means that doing nothing is not an option, although GDPR does allow organisations to take a risk based approach, based on your size and circumstances. Many organisations struggle to assess where they should start in preparing for GDPR. It is helpful to remember that we have had data protection legislation in both the UK and the Republic of Ireland for a number of decades and therefore, firms who have taken data protection compliance seriously are already in good shape for beginning to meet GDPR’s increased compliance standards. Myth 5 - GDPR is just more bureaucracy and work for small firms, with no potential  benefits When legislation of this nature is announced, one can take either a positive or negative view of the task at hand. If you take a negative view, you will see GDPR as more bureaucracy and cost to your firm. If you take a positive view, on the other hand, you will view GDPR as a necessary strengthening of the rights of individuals, and indeed a potential  opportunity. As accountants position themselves as strategic advisers to clients, GDPR is also an opportunity for firms to demonstrate to clients that they can securely hold and process information in accordance with data requirements, and that protection of client data is a priority for the practice. As a result, clients are likely to see their accountants as trusted professionals with whom they can partner to drive their business forward. Therefore, being a leader in this area may enhance your practice and its reputation. In addition, as trusted business advisors to your clients, you must have sufficient knowledge of this new legislation to be able to provide sound advice. SMEs need to be ready when the new law comes into force, but they may struggle to know where to start. Chartered Accountants in practice can help these small businesses bridge the gap to GDPR compliance and, in the process, win new business. Myth 6 - Outsourcing GDPR compliance will be a quick fix for me and my firm There is no quick fix to GDPR compliance. No one piece of software or outsourced service provider is going to provide everything you need to comply with GDPR. For accountancy practices, GDPR will impact on how you manage and store data across your entire firm (e.g. client, prospective client, contact, supplier and staff data). You cannot outsource your responsibility for this information, and compliance with GDPR will require considerable time and preparation from all levels within your practice. With the implementation date of 25 May approaching quickly, it is important to start sooner rather than later on this. Myth 7 - GDPR only applies to Digital Processing Under GDPR, data processing covers both automated personal data and manual filing systems. Manual/paper records are included if they are part of a ‘relevant filing system’. This means papers stored systematically, for example, in a filing cabinet are probably included, but ad hoc paper files may not be. Members should ensure that they apply the same levels of diligence to paper records as they do digital records and that any decisions made regarding the lawful basis for processing, adhering to data protection principles and upholding data subjects’ rights include paper records held. Myth 8 - Under GDPR, accountants will only be seen as Data Processors and hence avoid much of the responsibility that falls on Data Controllers in this new regulation The UK Information Commissioner’s Office (ICO) has previously advised that it considers that an accountancy firm providing accountancy services acts as a data controller. The firm’s status as a data controller in relation to clients arises because the firm has flexibility over the manner in which it provides services to its clients and will not be simply acting on their instructions. In addition to this, the firm has its own professional responsibilities regarding record-keeping and confidentiality. Therefore, because an accountant “determines what information to obtain and process in order to do the work”, firms act as “controllers in common” with clients. Under GDPR, member firms will also be data controllers with regard to their firm data (e.g. employee information). If there is any doubt regarding your status as a processor or controller in relation to your firm’s activities, you should take legal advice. Going forward, firms will need to ensure that client terms and conditions reflect this reality, potentially extending engagement terms as appropriate. No doubt, for many accounting practitioners, much work remains to be done to fully meet GDPR compliance requirements. Between now and the end of May, firms new  to the process will need to examine their existing data processing, review their data protection policies, procedures & controls, and identify any gaps that need to be addressed. Following on from this, firms will need to implement any changes required in a structured documented manner to meet the needs of GDPR and continue to show full compliance long after the implementation date. The Institute will continue to assist members on your GDPR compliance journey, with ongoing updates to our available guidance in this area and, should you have a specific query in this area, please feel free to contact the Practice Consulting Team.

Conal Kennedy writes: In the past few years, accountants in practice have had to deal with a wave of change that has washed over them, including the new accounting frameworks in the UK and Republic of Ireland. In both jurisdictions, small and micro company regimes have been introduced which are generally welcome, but like any change in standards, can present challenges in just getting it right first time. In Practice Consulting we have given assistance and support to a large number of members and firms as they applied the new frameworks. Most of the firms that we have encountered have been successful in the transition process. However, we thought that you would be interested in a list of some of the more common issues that we have encountered, with a view to avoiding them, of course! OK, so here’s what we have observed… Directors’ remuneration disclosures. In ROI, including the directors’ remuneration information on the face of the profit and loss account does not mean it can be omitted from the abridged financial statements.  Section 353 of the Companies (Accounting) Act (‘2017 Act’) specifically requires this information to be included in the abridged financial statements filed with the CRO. Mixing and matching. Care should be taken when early adopting the ‘specified provision’ of the 2017 Act. For instance, we came across some ROI companies preparing statutory financial statements under the small companies regime but using the old abridging rules. Departure from FRS 102 or Company Law. This is expected to be rare and only to arise in very unusual circumstances.  We have seen instances where preparers departed from legislation or standards to account for relatively straightforward transactions and balances. Non-disclosure of critical accounting judgements and estimates. FRS 102, when applied in full, requires these to be disclosed in the notes to the financial statements.  Section 1A of FRS 102 encourages entities applying the small companies regime to disclose critical accounting judgements (but not estimates).  We have seen cases where these disclosures were omitted altogether, or where standard boilerplate wording was used, not reflecting the circumstances of the preparing entity. Connected entity or connected person loans. Under FRS 102, loans which are interest free or are low interest may be required to be classified as financing transactions and valued at the present value of future payments discounted at a market rate of interest if they are due after more than one year. This is a difficult area and some preparers have struggled to apply the accounting standard correctly. In some instances, a loan whose terms were undocumented was mistakenly treated as being due after more than one year. A loan whose terms are undocumented may be considered to be repayable on demand, notwithstanding the intentions of the parties to repay it over a longer period. The solution: if the loan is repayable on demand, then, unless there is an impairment issue, it should be carried at the original transaction price with no adjustment, and as an amount due in less than one year. In ROI, reference may also need to be made to the Evidential Provisions in Sections 236 and 237 of the Companies Act. See also the new concession applying to small entities for loans from persons who are within a director’s group of close family members (including the director), when that group contains at least one shareholder in the entity - for details, please see the Amendments to FRS 102 publication issued by FRC in December 2017 (this publication is also mentioned later in Technical Signpost). We hope that this article will prove useful in identifying issues. Naturally, it is not a comprehensive list in part because we have concentrated on errors which are completely new and particular to the new frameworks. The article has been written in general terms, and should be viewed as a pointer towards issues that may have been overlooked and should not be relied upon.

Conal Kennedy writes: For many years we in Practice Consulting have assisted members to buy, sell and merge their practices. During the recession years, and for some time afterwards, there was very little activity, but in recent times we have been receiving more enquiries and helping more practices. A firm with a recurring fee base has a value based primarily on its goodwill. It is usually preferable to arrange succession from within a practice, but in the absence of this, a sole practitioner approaching retirement age might consider realising the value of the firm by selling the goodwill to a growing practice. There are other circumstances where a practitioner may be interested in selling their practice. On the other hand, many practices have informed us of their intent to purchase, if an opportunity arises. In other cases practices may come together by way of acquisition or merger in order to pool resources and leverage the benefits of increased size and more diverse skillsets. Many mid-sized practices would be interested in offering a senior position or partnership to a dynamic sole practitioner. This possibility might be of interest to a member who has set up on practice relatively recently. The member has found that he or she has the ability to run a business and acquire clients, but the pressures of being entirely alone are just too much. This profession is a people business and in any deal, the human element is always crucial. More important than top line valuations is the ability to trust your counterparty, to establish open communication and a good working relationship. The value of a practice still tends to be based on a multiple of its fee income and the classic 1:1 ratio of recurring fees to practice value is the starting point of many conversations. That said, buyers and sellers should be aware of the changes and pressures arising in recent years due to market forces. The general skill shortage in the profession means that the staff of the practice may be the most important element in judging the inherent value of the practice. Specific purchasers may be interested in purchasing a niche practice with clients that fit specific criteria. There is any number of ways to structure the deal. If a capital sum changes hands, then this may be based paid in stages over time. There may be a clawback based on clients who do not transfer. Separate arrangements need to be made to deal with WIP and debtors that are outstanding at the date of transfer. In general every aspect can be varied by either party to suit the circumstances of the deal. Practice Consulting assists practices to come together. We work in complete confidence. If you are interested discussing any of the matters in this article, please contact Conal Kennedy Tel: 00 353 1 6377396 or Jeremy Twomey  Tel: 00 353 1 6373972.

Claire Percy writes: Members consistently tell us that “protecting and promoting the Chartered brand” is one of the key services that Chartered Accountants Ireland can provide to them. Often, this feedback relates to student recruitment and the continuity of the profession. However it is also critical in terms of helping consumers, employers and business decision-makers understand the value of choosing a Chartered Accountant. The Institute supports the brand year-long across all its services and through a range of promotional activities. This includes the annual brand advertising campaign, “Make Sure your Accountant is a Chartered Accountant”, which is currently running. The key message of the campaign is that businesses can have confidence in the training, standards and experience of Chartered Accountants in every sector. This “confidence” message is being carried across radio, press and online. This year, in order to maximise the local benefit to our firms and members nationwide, a number of regional innovations have been introduced, with regional press and radio in use alongside national outlets. In order to connect the advertising even more directly with our network of 1,500+ practices around the island, the campaign is also supplemented by a direct mail initiative. All firms should by now have received a pack containing two high-quality window vinyls for use on their offices windows or doors. The purpose of this is to promote visibility of the recently-refreshed Institute logo on the high street. This will help consumers link the advertising message to their own local Chartered Accountant – and create a “multiplier effect” that builds the confidence message for all members. The pack also provides access to co-branded marketing materials and gives links to download logos for use on firms’ own websites and promotional materials. There was also an online competition to win a table at this year’s annual dinner – simply by showing the Chartered logo in action. The design of this campaign was greatly assisted by the input of the Members in Practice committee and Strategic Communications committee. We are very keen to  hear wider feedback, and in particular may look at offering a more permanent signage option in future. Please take a look at www.charteredaccountants.ie/Brand for more information or to get in touch with feedback on the campaign or how we can assist you to make the Chartered brand work for your firm.  

The Professional Standards Department (PSD) Quality Assurance Team has recently compiled a list of common matters arising on audit and investment business inspection visits, which are set out below. Please note that, where PSD returns to firms that have had a relatively recent visit, it conducts follow-up procedures to ensure that the firm has taken action to address matters raised at the previous visit. Audit Inspections Financial  Reporting Firms need to perform audit procedures to evaluate whether the overall presentation of the financial statements, including the related disclosures, is in accordance with the applicable financial reporting framework which, in recent years, has been substantially changed by the introduction of FRS 100-105 and amendments to company law. PSD found that, for the most part, firms had adequately addressed the requirements of FRS 102 and, in RoI, the Companies Act 2014 (‘CA 2014’) through the use of checklists. However, non-application of FRS 102 by audit clients was sometimes not identified. Firms should ensure that their audit procedures to assess the appropriateness and completeness of disclosures are up to date for the relevant financial reporting regimes. Certain common omissions were identified: Statement of Changes in Equity or Statement of Cash Flows, where relevant; Significant judgements and key sources of estimation uncertainty in relation to amounts recognised in the financial statements (FRS 102 s8.6-8.7); Where relevant, material uncertainties related to events or conditions that cast significant doubt upon the entity’s ability to continue as a going concern (FRS 102 s3.8-3.9); The measurement basis (or bases) used for financial instruments and the other accounting policies used for financial instruments that are relevant to an understanding of the financial statements (FRS 102 s11.40); Disclosures relating to creditors required by CA 2014 Schedule 3, such as terms of payment/repayment and the rate of any interest payable on debts. (N.B.The specific FRS 102-related matters noted above relate to financial statements prepared in accordance with the full requirements of FRS 102 and may not be relevant to financial statements where the small/micro companies regime is applied.) International Education Standard (IES) 8 (Revised) IES 8 Professional Competence for Engagement Partners Responsible for Audits of Financial Statements (Revised) was issued by the International Accounting Education Standards Board (IAESB) in December 2014 and is effective from 1 July 2016. Its objective is to establish the professional competence that professional accountants develop and maintain when performing the role of an Engagement Partner. During an audit monitoring visit, the inspector will make enquiries to assess whether a firm is familiar with IES 8 (Revised), including consideration of the learning outcomes which are listed in Table A to the Standard. Firms can obtain a copy of IES 8 (Revised) at: http://www.ifac.org/system/files/publications/files/IAESB-IES-8.pdf Investment Business inspections Investment Business (IB) inspections carried out by PSD over the last few years had focused on firms holding IB1/IB2 authorisation. However, PSD is now conducting an increased number of IB inspections to firms holding all levels of IB authorisation, including a sample of firms holding IA1/IA2 authorisation. Firms should be mindful of, and ensure they address, the following  matters Investment business procedures (IBR 2.56) All authorised firms are required to establish and maintain adequate written investment business procedures. These should include managing conflicts of interest, maintaining ‘Chinese Walls’ and the consequences of breaching them, along with the handling of errors and complaints. A firm must adequately train its principals carrying on investment business and its employees using these procedures. Training (IBR 2.60) Authorised firms must make arrangements to ensure that principals and employees involved in investment business maintain an appropriate level of competence and comply with Institute CPD requirements. Firms authorised in Category IA2 and above must make arrangements to ensure compliance with the Central Bank Minimum Competency Code, which has recently been updated. A copy of the Code can be obtained on the Central Bank of Ireland’s website. Investment Business Compliance Review (IBR 2.58) An authorised firm must carry out an Investment Business Compliance Review (IBCR) at least annually. PSD found that, for some firms, an annual IBCR had not been carried out, or did not include a whole firm review, a review of accounting records and a sample of client files. Some IBCRs did not identify different types of IB advice provided by the firm or non-compliance with the IBRs. Corrective action was not always taken in a timely manner. Engagement letters (IBR 3.19-3.20) PSD found that some firms did not have an engagement letter in place, or the letter had not been agreed with the client prior to investment business advice being provided, as required by IBR 3.19 or did not include the minimum details required by IBR 3.20. Commission consent and disclosure (IBR 3.30-3.32) If a firm receives commission it must account to the client for that commission, and both the terms (%) of the commission and the amount (€/£) must be disclosed. In cases where the firm retains the commission, it must have the client’s written consent to do so. Consent to retain commission can be obtained in the client engagement letter. The Quality Assurance Committee views non-compliance with commission consent and disclosure requirements very seriously. Section 30 receipts (IBR 4.44-4.46) Firms must issue receipts when they receive client premiums or investment business clients’ money. Details of what must be included on the receipt are specified in IBR 4.45. Other matters Firms should ensure that they are aware of their category of IB authorisation and the limits of that category. Category IA2 is required to hold client premiums; Category IB2 is required to hold investment business clients’ money; and If handling or holding client premiums or investment business clients’ money, the firm must appoint an independent accountant and submit an independent accountant’s report to the Institute. Carrying on investment business, when not authorised to do so, is an offence under the Act. Firms may wish to review their category of investment business authorisation and assess whether it is suitable for their needs. Firms should refer to Schedule 1 to Chapter 1 of the IBRs for activities which may be undertaken under the various categories. For further details on the above matters, please look out for PSD’s forthcoming Regulatory Bulletin. For advice or support on the above matters, firms may contact, in strict confidence, the Practice Consulting Team, which is independent of the Professional Standards Department.

Michael McAllister writes: Chartered Accountants Ireland often receives requests from members for clarification on how to deal with confirmation requests from third parties, such as banks or other funders, concerning client matters. For example, a bank may request some form of confirmation regarding a proposed loan. Usually there is no obligation on accountants and auditors to provide the reports/assurances being sought, as they are not bound by arrangements between clients and third parties to which they were not party. However, accountants may come under pressure from lenders and funders, and wish to assist their clients wherever possible. The general principles that need to be applied when members are asked for these confirmation requests are set out in ‘Miscellaneous Technical Statement M39 – Reporting to third parties’ (M39). The main steps in the process that should be followed are: Determine who will rely on the accountants’ work and for what purpose; Consider the form of report requested by the third party; Agree the work to be performed and the form of report to be given; Agree appropriate terms of engagement; Perform the work; and Report. It is advisable that appropriate engagement terms are agreed at the commencement of the engagement for providing such reports, in order to avoid disagreements with the client or the third party regarding the form of the report that is needed, and to ensure sufficient time for the work to be completed and the report to be given. Confirmation requests often take the form of a standard form for the accountant to complete and sign. The Institute advises members to avoid signing such forms where they incorporate a broad and open- ended statement confirming the client’s ability and/or willingness to repay borrowings. Sometimes, the assurance being sought is of a legal nature, in which case it should either be a matter for the third party’s own lawyers, or contact should be made with the client’s legal advisers. Should you agree to provide any form of report to a third party, Appendix 2 of M39 provides some examples of types of wording or opinions that are “unacceptable”. Accountants are advised against using language such as “we certify”, “correct”, “accurate” or “we have ensured” since it implies a level of certainty which cannot necessarily be given. The Institute also advises against the use of words such as “we verify” or "certificate”. Notable other examples in M39 include “true and fair” opinions (other than with regard to the auditor’s opinion on financial statements), opinions that are open-ended or that are beyond the professional competence, knowledge and experience of the accountant. Appendix 2 also advises against providing qualifications to the report in a covering letter – such qualifications should be included in the main body of the report. The Representation & Technical Policy Department has recently issued TR 11/2016 ‘Third Party– Letters of Confirmation’ (which replaces IS 01/2005 ‘Bank of Scotland (Ireland) – Letter of serviceability’). This provides a pro-forma wording for a letter to a third party in connection with a request for confirmation that members may use instead of a standard form. It is confined to confirming some factual information that the accountant is in a position to stand over and may be amended to suit particular situations. Another common area is that of grant claims, the subject of ‘Miscellaneous Technical Statement M45 – Grant Claims’ (M45). The usual scenario is that a claim for payment under a previously approved grant must be accompanied by an independent accountant’s report. M45 highlights matters on which accountants cannot provide meaningful assurance, such as whether expenditure was incurred on an “arm’s length basis” or non-accounting criteria such as engineering specifications. Sometimes, the agency issuing the grant asks for confirmation on whether the expenditure claimed has been the subject of another grant claim. It is unlikely that the accountant will be in a position to provide such an assurance. M45 includes an example accountant’s report at Appendix C. The opinion is worded as follows: “Based on the procedures set out above, in our opinion, the statement of grant claim attached dated [date] is consistent with the records we inspected and has been prepared, in all material respects, in accordance with the requirements set out in the letter of offer or grant agreement dated [date]”. It should be noted that the opinion does not “certify” anything. Instead, it provides an opinion based on the conclusions of work carried out by the accountant, in accordance with the principles explained above. M45 also provides a recommended work programme and model terms of engagement. M45 was produced in conjunction with several agencies in the Republic of Ireland, but the principles set out therein should be applied to all accountant’s reports on grant claims. However, members should note that, for grant claims from Invest NI, ‘Information Sheet IS 02/2009 - Invest NI Grant Claims’ sets out a proforma engagement letter and several example pro forma reports. Reports to Invest NI should be worded in accordance with this document rather than M45. Members are advised to read the abovementioned documents in full, which are available on CHARIOT at www.charteredaccountants.ie