Why Auditors Scrutinise Related Party Transactions

A company sells crude palm oil to another company owned by its own major shareholder. Nothing on the invoice says whether that is an ordinary supply arrangement or the first step in draining value out of minority shareholders. The auditor’s job is to find out which — and that is exactly what International Standard on Auditing 550, Related Parties, is written for.

What counts as a related party in the first place?

ISA 550 paragraph 10 points to the definition in the applicable financial reporting framework, which in Malaysia is MFRS 124 Related Party Disclosures — the local equivalent of IAS 24, effective for annual periods beginning on or after 1 January 2012. Broadly, a related party is one that controls, is controlled by, or is under common control with the entity, together with key management personnel and their close family members.

The same paragraph defines the benchmark the whole exercise turns on. An arm’s length transaction is one conducted “as between a willing buyer and a willing seller who are unrelated and are acting independently of each other and pursuing their own best interests.” The worry with a related party is precisely that this independence may be missing.

Why single these transactions out?

Because they are the classic machinery of financial statement fraud. ISA 550 paragraph 2 is candid that many related party transactions are ordinary and no riskier than dealings with strangers. But the standard also warns that related party transactions may not be conducted under normal market terms, and that the relationships can present a greater opportunity for collusion, concealment or manipulation.

That is why paragraph 18 draws a bright line: the auditor must treat identified significant related party transactions outside the entity’s normal course of business as giving rise to significant risks — the highest tier of audit attention, requiring a specific response.

What does the auditor actually do?

ISA 550 sets out a ladder from routine inquiry to targeted testing. The table maps the main requirements.

Stage	What ISA 550 requires	Reference
Inquiry	Ask management for the identity of related parties, the nature of the relationships, and whether transactions occurred	Para 13
Understand controls	Understand how the entity identifies, authorises and approves related party transactions	Para 14
Stay alert	While inspecting records, watch for undisclosed relationships — bank and legal confirmations, board and shareholder minutes	Para 15
Assess risk	Treat significant transactions outside the normal course of business as significant risks	Para 18
Test the outliers	Inspect underlying contracts, evaluate business rationale for fraud, and obtain evidence of authorisation and approval	Para 23
Challenge assertions	Where management claims a transaction was at arm’s length, obtain sufficient appropriate evidence for that claim	Para 24
Get it in writing	Obtain written representations that all related parties and transactions have been disclosed and properly accounted for	Para 26
Report up	Communicate significant related party matters to those charged with governance	Para 27

The pivotal step is paragraph 23. For a significant transaction outside the ordinary course of business, the auditor inspects the contract, asks whether the business rationale — or lack of one — points to fraudulent financial reporting or concealed misappropriation of assets, checks that the terms match management’s story, and confirms the transaction was properly authorised.

Where does Bursa Malaysia add another layer?

Financial reporting and auditing are only two of three layers for a listed issuer. The third is corporate governance under the Bursa Malaysia Main Market Listing Requirements.

Layer	Instrument	What it governs
Disclosure	MFRS 124	What the financial statements must reveal about related parties and their transactions
Audit	ISA 550	How the auditor identifies, assesses and responds to the risk of misstatement
Governance	Bursa Chapter 10	When a listed issuer must announce, circularise or seek shareholder approval, with interested parties abstaining

Under Chapter 10, recurrent related party transactions of a revenue or trading nature are typically run through a shareholders’ mandate renewed at each annual general meeting, as paragraph 10.09 contemplates. A one-off related party transaction can, depending on its size measured by the percentage ratios in paragraph 10.02, require an immediate announcement, a circular to shareholders, and prior approval in general meeting — with the interested director or major shareholder barred from voting.

What should an investor look for in the notes?

Read the related party note against this checklist. Are the pricing terms stated, and do they claim to be at arm’s length — if so, on what basis? Are recurrent transactions covered by a current shareholders’ mandate? Did any transaction sit outside the ordinary course of business, and was it independently approved? Silence, vague “market terms” language, or a large balance owed by a director-linked entity are the signals ISA 550 is designed to surface.

What’s next

If a related party transaction looks material to your decision, trace it through all three layers: the MFRS 124 disclosure note, any Chapter 10 announcement or circular on the Bursa Malaysia website, and the audit opinion itself. To see how these dealings feed into the wider audit, read the statutory audit process and how the auditor forms an opinion; where a related party propped up a struggling business, going concern is the connected risk to check next.