Welcome to the second market scan from the IAASB's Disruptive Technology team. Building on our previous work, including the Innovation Report created with Founders Intelligence and discussed at the January 2021 IAASB meeting, we will issue a Market Scan focusing on topics from the report approximately every two months. Market Scans will consist of exciting trends, including new developments, corporate and start-up innovation, noteworthy investments and what it all might mean for the IAASB.

In this Market Scan, we explore API Access to External Data Sources for Enriched Analysis, which falls under Accessing Information & Data, because establishing a method for obtaining relevant and reliable external data that can be used in an audit has the potential to reshape the audit process.

We cover:

• What an API is and why it is important?
• The latest exciting developments on this topic are, including Open Banking
• Possible implications for the IAASB

What is an API and why is it important?

An API or Application Programming Interface is a set of defined rules that explain how computers or applications communicate with one another. They enable companies to open their application’s data and functionality to external third-party developers, business partners and internal departments within their companies. APIs use standardized requests that in turn return standardized outputs or responses.

APIs have been around as long as computers; modern day “web APIs” grew in use with the advent of social media platforms, like Facebook and Twitter. However, it was Amazon that created a fundamental shift in how digital resources are accessed with founder and CEO Jeff Bezos’ famous API mandate, issued in 2002. This manifesto requires all Amazon development teams to “expose their data and functionality through service interfaces”. 

From “What Is an API: Concept and Architecture Types Explained on Real-Life Examples” at Cleveroad.com. See additional resources at the bottom of this email for more.

From an audit and assurance perspective, there are three key areas where APIs can be leveraged.

1. Enabling access to entity data (such as general ledger or sub-ledger data) for the purposes of inquiry or extraction.
2. Enabling access to entity-specific third-party data such as bank transactions.
3. Enabling access to audit-relevant external information sources, such as macroeconomic or industry-specific data.

 1.    Access to entity data

In our last Market Scan: Data Standardization, we wrote about the exponential growth in available data that could be used in an audit as well as the challenges of obtaining standardized data and the use of common data models. The initial step in the data acquisition process may involve using an API to request the required data from the entity’s accounting system. Over the last five years, there has been growth in investment in this area both from within accounting firms and from third party vendors of data extraction, transformation and load (ETL) technology such as Engine B, Validis, Inflo, Galvanize and Workiva.

 2.    Access to entity-specific third-party data

This is the key area of potential disruption to the audit and assurance industry. Being able to directly access entity-specific third-party data, such as bank transactions, by using open banking APIs could revolutionize how audit evidence is obtained, particularly when connected with entity data and other relevant external information sources. Mandates such as the Second Payments and Services Directive in Europe, which required banks to open their payments infrastructure and customer data to third parties, have supported the growth in open banking. It is now a global initiative with 87% of countries having some form of Open Banking API. Below are details of some countries that use open banking, including where driven by government regulation.

From “Trailblazers and latecomers: open banking around the world” at GoCardless.com

3.    Access to audit-relevant external information sources

Use of external information sources is commonplace in an audit. By using APIs, information can be obtained in a standardized format, which makes it easier to use, for example, in analytical procedures.

The benefits of APIs may include increased speed and access to data from varied independent reliable sources. Additionally, when coupled with other technology, such as robotic process automation, it can facilitate efficiencies in routine audit activities, such as using company registry information to identify related parties. Many audited entities seeking to leverage these benefits are using APIs within their IT environment to support business operations.

Alongside the significant growth in prevalence of APIs comes concerns about security and management of data. The UK and Australian governments have both issued API data standards and continued attention from governing bodies is likely. 

Recent noteworthy developments in API access

This section is designed to provide examples of recent developments that may signal future disruption in this area. It is not a complete list of all activities in the field of API access. For a reminder of Key Venture Capital and Investment terms please refer to the previous Market Scan.

 1. Open Banking experiences rapid growth

I. Fintech start-ups are shaking up the banking industry

There are a number of very active fintech start-ups developing APIs that allow easier sharing of financial data. Prominent examples around the world include:

• Plaid, a San Francisco-based startup building technology platforms to connect applications to users’ bank accounts, has raised US$735m in funding with a latest US$425m Series D backed investors such as Andreessen Horowitz and Silver Lake. Acquisition by Visa was blocked by the US Department of Justice on the grounds that it would limit competition in the payments industry. Plaid was one of the first companies to create what is called a unified API—a single API that connects to over 11,000 financial institutions.
• Tink and Truelayer, both based in Europe offer platforms and products to support open banking integration in applications. Tink was recently acquired by Visa.
• Open banking has also gained traction in Asia with early-stage start-ups like Hong Kong-based Finverse, which has an ambitious goal to enable open banking throughout the Asia-Pacific region.

Additionally, there are start-ups serving the financial services industry with APIs providing access to payroll, insurance and credit data to support targeting of appropriate financial products to businesses. This is an area of significant growth and one to watch for future audit and assurance implications.

II. Recognition grows of the impact of Open Banking on Assurance services

• Confirmation.com (part of Thomson Reuters) has provided audit confirmation services for nearly 20 years and recently completed a three-month pilot to test open banking, which received positive feedback from pilot audit firms.
• Circit is a rapidly growing Dublin-based fintech startup launched in 2017 that provides a platform supporting confirmation requests, transaction verification, PBC client collaboration and document signing. It names banks, “big four” and mid-tier audit firms amongst its clients.

2. External Information Sources Related Activity

I. US PCAOB issues guidance on external information sources

In October 2021, the US Public Company Accounting and Oversight Board (PCAOB) issued staff guidance highlighting the importance of appropriately evaluating the relevance and reliability of information from an external information source that an auditor plans to use as audit evidence. The publication gave a number of examples and factors to consider. It notes that, “Advancements in technology in recent years have improved accessibility and expanded the volume of information available to companies and their auditors from traditional and newer external sources.”

II. Growth in data platform providers to support access to external data sources

• People Data Labs raised US$45m in Series B funding to enable expansion of data products to support fraud detection and risk mitigation. The San Francisco-based company builds APIs that enable their clients to leverage vast datasets to build people profiles and records as well as power predictive modeling, drive artificial intelligence and build new tools. The new funding, announced in November 2021, will enable the company to expand its data products to support fraud detection, risk mitigation and insurance underwriting.
• Demyst raised A$33m and announced plans to issue an IPO. Demyst is an external data deployment company that works with banks, insurers and fintechs providing operationalized access to external data sources through a secure data platform.

What might this mean for the IAASB?

Access to quality data is at the heart of enabling technological transformation within the assurance profession. APIs represent a key route to success. The availability of accessible, standardized data created by APIs builds opportunities to improve finance functions, enhance audit quality, and radically streamline the audit process.

The increasing accessibility of entity-specific third-party data, such as entire populations of bank transactions that have been made possible by Open Banking APIs, may present a need to envision how this will reshape the audit process—particularly in regard to obtaining audit evidence.

The growing use of web APIs within entity core operations, across many industries, from retail to banking, may lead to web APIs becoming relevant to financial statements preparation and, therefore, auditors’ risk assessment procedures. Jurisdiction-specific guidance may help auditors better understand and assess how entities are managing the risks related to using APIs available in their jurisdiction.

Finally, the quantum of external data sources available to auditors presents an additional challenge of assessing the relevance and reliability of these data sources—and perhaps a need to address these matters centrally.

Useful links/articles

API Basics

• What is an API and how does it work? (In plain English) - YouTube (7 min video)
• What Is an Application Programming Interface (API) | IBM
• What Is an API and How Does It Work? (cleveroad.com)

Accounting Profession insights

• What Impact Will Open Banking Have on Accounting? | INAA
• How third-party information can enhance data analytics | Deloitte Insights

Other perspectives

• Not All API Companies are the Same: the 4 Types | Datamation
• Open banking has evolved — what’s next? And who are the players to watch?| Sifted

Funny story

• These Parents Built a School App. Then the City Called the Cops | WIRED UK

What do you think about this bulletin?

Please take the time to fill out our quick survey to let us know your thoughts about this bulletin, how it can be improved and what you would like to hear about going forward.

What next?

Our next Market Scan bulletin will be distributed in February 2022.

The International Auditing and Assurance Standards Board (IAASB) today released further conforming and consequential amendments to the IAASB’s standards resulting from the new and revised quality management standards, which were released in December 2020. The conforming amendments remove actual or perceived inconsistencies between the IAASB’s suite of standards and the quality management standards. This allows the IAASB’s full suite of standards operate in conjunction with each other and without confusion, which is especially crucial given the importance of firm-level quality management to the consistent performance of quality engagements.

The standards covered in today’s release do not include the International Standards on Auditing (ISAs). Conforming and consequential amendments to the ISAs were finalized and released in December 2020 alongside the quality management standards.

The conforming amendments to the IAASB’s International Standards become effective as of December 15, 2022.

The Conforming and Consequential Amendments to the IAASB’s Other Standards as a Result of the New and Revised Quality Management Standards are the limited amendments to the IAASB’s suite of standards in response to the quality management standards. The amendments address any actual or perceived inconsistencies between the quality management standards and the full suite of IAASB standards to ensure that all the standards operate in conjunction with each other without conflict.

The International Auditing and Assurance Standards Board (IAASB) approved a new work plan, A Public Interest Focus in Uncertain Times, during its December 2021 meeting. Pending approval by the Public Interest Oversight Board (PIOB), anticipated in early April 2022, the work plan will guide the IAASB’s work in 2022 and 2023, reflecting the IAASB Strategy for 2020-2023.

Sustainability and environmental, social, and governance (ESG) assurance are a prominent addition to the new work plan and will see increased time and resourcing for 2022–2023. In addition, the new work plan highlights candidate topics in the Audit and Review space (e.g., responding to assessed risks of material misstatement and the impact of technology on various standards) that the IAASB will consider for a further project to commence in 2023. A key focus will remain the progression and completion of projects underway at the start of 2022, including audits of financial statements of less complex entities, audit evidence, going concern, and fraud.

“Based on the increasing global attention, and urgency, around sustainability/ESG reporting and the assurance thereof, the IAASB is dedicating additional capacity and resources to this workstream. We are committed to acting with a sense of urgency, building off our existing platform of assurance standards that are already used worldwide,” according to IAASB Chair Tom Seidenstein. “Our collaboration with others and an expedited information gathering phase will allow us to determine the precise scope and timing of our efforts so we take the right action to meet the growing public demand.”

“While we’re awaiting PIOB approval, we want our stakeholders to know what is on our program for this year and 2023, and be able to plan accordingly,” said IAASB Technical Director Willie Botha. “The initiatives and projects in our work plan, especially sustainability/ESG assurance, are those our board believes currently are the most pertinent public interest issues to address in ensuring the continued credibility and confidence in our work as global audit and assurance standard setter.”

Extended External Reporting Guidance Renamed

To help stakeholders more readily identify and understand available guidance for assurance of sustainability/ESG reporting, the IAASB agreed to rename a key piece of guidance. The newly renamed Non-Authoritative Guidance on Applying ISAE 3000 (Revised) to Sustainability and Other Extended External Reporting Assurance Engagements was originally released in April 2021. It responds to key stakeholder-identified challenges commonly encountered when applying International Standard on Assurance Engagements 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information to such engagements.

About the IAASB
The International Auditing and Assurance Standards Board develops auditing and assurance standards and guidance for use by all professional accountants under a shared standard-setting process involving the Public Interest Oversight Board, which oversees the activities of the IAASB, and the IAASB Consultative Advisory Group, which provides public interest input into the development of the standards and guidance. The structures and processes that support the operations of the IAASB are facilitated by the International Federation of Accountants (IFAC). For copyright, trademark, and permissions information, please go to permissions or contact permissions@ifac.org.

The IFAC-IAASB less complex entities survey—part of the IAASB’s consultation on audits of financial statements of less complex entities—is open until January 14. While the IAASB encourages all interested stakeholders to respond to the consultation in writing, the survey provides a way to participate and provide feedback that is less time and resource intensive. The survey is available in English, French and Spanish by clicking the language selector in the survey’s top right corner. Survey responses will be analyzed by the IAASB alongside all other feedback and help shape the final standard; individual survey responses are confidential.

For additional information on the IAASB’s proposed new standard for audits of less complex entities, which was issued in July for a six-month consultation, visit iaasb.org/less-complex-entities.

The IFAC-IAASB less complex entities survey—part of the IAASB’s consultation on audits of financial statements of less complex entities—is open until January 14. While the IAASB encourages all interested stakeholders to respond to the consultation in writing, the survey provides a way to participate and provide feedback that is less time and resource intensive. The survey is available in English, French and Spanish by clicking the language selector in the survey’s top right corner. Survey responses will be analyzed by the IAASB alongside all other feedback and help shape the final standard; individual survey responses are confidential.

For additional information on the IAASB’s proposed new standard for audits of less complex entities, which was issued in July for a six-month consultation, visit iaasb.org/less-complex-entities.

As technology advances and the world becomes more complex, the professional accountant’s skills and competencies, underpinned by ethics and recognizing their public interest responsibility, are critical in navigating new challenges and opportunities and ensuring trust in the profession. To help professional accountants and stakeholders better understand these topics, the Chartered Professional Accountants of Canada (CPA Canada), the Institute of Chartered Accountants of Scotland (ICAS), the International Ethics Standards Board for Accountants (IESBA), and the International Federation of Accountants (IFAC) have released Technology is a double-edged sword with both opportunities and challenges for the accountancy profession, the second in a four-part thought leadership series examining the professional accountant’s role in a new technological era.

The publication examines the impact of rapid technological change and the importance of ethical leadership from the lens of the professional accountant. It also provides practical guidance to both professional accountants and professional accountancy organizations.

Technology is a double-edged sword with both opportunities and challenges for the accountancy profession follows Complexity and the professional accountant: Practical guidance for ethical decision-making, the first publication in the series, and builds off a collaborative exploratory paper and global roundtable event called Ethical Leadership in an Era of Complexity and Digital Change, which CPA Canada, ICAS and IFAC jointly hosted earlier in 2021. The third and fourth publications in the series will focus on identifying and mitigating bias and mis-/disinformation, and mindset and enabling skills.

The publication is available on the IFAC Knowledge Gateway and the IESBA’s webpage Technology: Ethics & Independence Considerations.

###

About CPA Canada
Chartered Professional Accountants of Canada (CPA Canada) works collaboratively with the provincial, territorial and Bermudian CPA bodies, as it represents the Canadian accounting profession, both nationally and internationally. This collaboration allows the Canadian profession to champion best practices that benefit business and society, as well as prepare its members for an ever-evolving operating environment featuring unprecedented change. Representing more than 220,000 members, CPA Canada is one of the largest national accounting bodies worldwide. cpacanada.ca

About ICAS
The Institute of Chartered Accountants of Scotland (ICAS) is the global professional body for Chartered Accountants. We educate, examine and lead, enabling excellence whilst always working for the wider public good. All 23,000 ICAS members have earned our world-class CA designation of Chartered Accountant, the qualification that’s shaped an international business community spanning industries and continents, full of local heroes and corporate leaders. And we continually foster the bonds between our members, so CAs at all stages of their careers can learn from shared experience and connect their ambitions to success. For further information please visit – icas.com.

About IESBA

The International Ethics Standards Board for Accountants (IESBA) is an independent global standard-setting board. The IESBA’s mission is to serve the public interest by setting ethics standards, including auditor independence requirements, which seek to raise the bar for ethical conduct and practice for all professional accountants through a robust, globally operable International Code of Ethics for Professional Accountants (including International Independence Standards) (the Code).

About IFAC

The International Federation of Accountants (IFAC) is the global organization for the accountancy profession dedicated to serving the public interest by strengthening the profession and contributing to the development of strong international economies. Comprised of 180 members and associates in more than 130 countries and jurisdictions, IFAC represents more than 3 million accountants in public practice, education, government service, industry and commerce.

Over four decades, IFAC has represented the global profession and supported the development, adoption, and implementation of international standards that underpin the contributions of today’s global accountancy profession. IFAC has maintained a long-term approach to building and strengthening a global accountancy profession that supports transparent, accountable, and sustainable organizations, financial markets, and economies.

This paper is the second of four thought leadership pieces that build on a collaborative exploratory paper and global roundtable event held jointly with Chartered Professional Accountants of Canada (CPA Canada) and the Institute of Chartered Accountants of Scotland (ICAS), entitled Ethical Leadership in an Era of Complexity and Digital Change. The exploratory paper, a summary of the event, and an on-demand recording are available here.