CMW23 v Companies Auditors Disciplinary Board

LEGISLATION 13 The Board is established under Pt 11 of the Australian Securities and Investments Commission Act 2001 (Cth) (ASIC Act). Section 204 of the ASIC Act provides "[t]he Disciplinary Board has the functions and powers conferred on it by or under the corporations legislation". "Corporations legislation" is defined in s 5(1) of the ASIC Act to mean the ASIC Act and the Corporations Act. 14 Section 1292 of the Corporations Act relevantly provides the following: 1292 Powers of Board in relation to auditors (1) The Board may, if it is satisfied on an application by ASIC or APRA for a person who is registered as an auditor to be dealt with under this section that, before, at or after the commencement of this section: (a) the person has: (ia) contravened section 324DB; or (i) contravened section 1287A; or (iaa) failed to comply with a condition of the person's registration as an auditor; or (ii) ceased to be resident in Australia or New Zealand; or (b) the person either: (i) has not performed any audit work during a continuous period of not less than 5 years; or (ii) has not performed any significant audit work during a continuous period of not less than 5 years; and, as a result, has ceased to have the practical experience necessary for carrying out audits for the purposes of this Act; or (a) the person has failed, whether in or outside this jurisdiction, to carry out or perform adequately and properly: (i) the duties of an auditor; or (ii) any duties or functions required by an Australian law to be carried out or performed by a registered company auditor; or is otherwise not a fit and proper person to remain registered as an auditor; by order, cancel, or suspend for a specified period, the registration of the person as an auditor. … (9) Where, on an application by ASIC or APRA for a person who is registered as an auditor to be dealt with under this section, the Board is satisfied that the person has failed to carry out or perform adequately and properly any of the duties or functions mentioned in paragraph (1)(d), or is otherwise not a fit and proper person to remain registered as an auditor the Board may deal with the person in one or more of the following ways: (a) by admonishing or reprimanding the person; (b) by requiring the person to give an undertaking to engage in, or to refrain from engaging in, specified conduct; (c) by requiring the person to give an undertaking to refrain from engaging in specified conduct except on specified conditions; and, if a person fails to give an undertaking when required to do so under paragraph (b) or (c), or contravenes an undertaking given pursuant to a requirement under that paragraph, the Board may, by order, cancel, or suspend for a specified period, the registration of the person as an auditor. (10) The Board's powers under subsection (9) may be exercised in addition to, or in substitution for, the exercise of the Board's powers to cancel or suspend a registration under subsection (1). 15 "Registered company auditor" is defined in s 9 of the Corporations Act to mean a person registered as an auditor under Pt 9.2 of the Act. It was not disputed before the Board, and is not disputed on this application for judicial review, that at all relevant times the applicant was a registered company auditor. 16 Section 324AE of the Corporations Act provides for a "professional member" of an audit team. It states: 324AE Meaning of professional member - audit team If an individual auditor, audit firm or audit company conducts an audit of a company or registered scheme, a person who is any of the following is a professional member of the audit team for the audit: (a) a registered company auditor who participates in the conduct of the audit; (b) a person who participates in the conduct of the audit and, in the course of doing so, exercises professional judgement in relation to the application of or compliance with: (i) accounting standards; or (ii) auditing standards; or (iii) the provisions of this Act dealing with financial reporting and the conduct of audits; and (c) a person who is in a position to directly influence the outcome of the audit because of the role they play in the design, planning, management, supervision or oversight of the audit; (d) a person who recommends or decides what the lead auditor is to be paid in connection with the performance of the audit; (e) a person who provides, or takes part in providing, quality control for the audit. 17 Section 324AF of the Corporations Act provides for a "Lead Auditor" and "Review Auditor" in respect of the audit of a company or registered scheme. It states: 324AF Meaning of lead auditor and review auditor Lead auditor (1) If an audit firm or audit company conducts an audit of a company, registered scheme or registrable superannuation entity, the lead auditor for the audit is the registered company auditor who is primarily responsible to the audit firm or the audit company for the conduct of the audit. Review auditor (2) If an individual auditor, audit firm or audit company conducts an audit of a company, registered scheme or registrable superannuation entity, the review auditor for the audit is the registered company auditor (if any) who is primarily responsible to the individual auditor, the audit firm or the audit company for reviewing the conduct of the audit. 18 Section 336(1) of the Corporations Act provides that the Auditing and Assurance Standards Board (AUASB) may, by legislative instrument, make auditing standards. Under s 336(3), the standards apply "to financial reports in relation to … periods ending after the commencement of the standard". 19 Section 324AF was introduced by the Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004 (Cth) (CLERP Act). The CLERP Act also introduced s 336 of the Corporations Act, which provides for auditing standards to have legislative force. 20 ASA 220 was the standard at the time of the FY18 Audit, which applied to that audit by reason of s 336(3) of the Corporations Act. ASA 220 does not refer to the office of "Review Auditor" but, instead, is structured around the concept of an "engagement quality control review" undertaken by an EQCR. 21 Paragraph 7 of ASA 220 defined the terms "engagement quality control review" and "engagement quality control reviewer' as follows: (b) Engagement quality control review means a process designed to provide an objective evaluation, on or before the date of the auditor's report, of the significant judgements the engagement team made and the conclusions it reached in formulating the auditor's report. The engagement quality control review process is only for audits of financial reports of listed entities and those other audit engagements, if any, for which the firm has determined an engagement quality control review is required. (c) Engagement quality control reviewer means a partner, other person in the firm, suitably qualified external person, or a team made up of such individuals, none of whom is part of the engagement team, with sufficient and appropriate experience and authority to objectively evaluate the significant judgements the engagement team made and the conclusions it reached in formulating the auditor's report.

THE BOARD'S DETERMINATION 22 It was an agreed fact before the Board that as the applicant had been appointed as the EQCR for the FY18 Audit in accordance with ASA 220, "[t]herefore, [the applicant] was the 'review auditor' in respect of the FY18 Audit under s 324AF(2) of the Act". The Board therefore noted at [3] of its Determination that pursuant to s 324AF(2) of the Corporations Act and [220(7)(c)] of ASA 220, the applicant was the Review Auditor and the EQCR for the FY18 Audit, which the Board defined together as "Review Auditor". 23 In these reasons, I will refer to the term defined in s 324AF(2) as "review auditor", and use "Review Auditor" (as defined by the Board to encompass both the roles of "review auditor" and EQCR) when discussing the Determination. 24 The focus of the Board's enquiry was the applicant's role as the Review Auditor. The Board set out the statutory question before it at [13] as follows: Whether the Panel of the Board who heard this matter (The Panel, we) are satisfied that within the meaning of S 1292(1)(d)(ii) [the applicant] as Review Auditor failed to carry out or perform adequately and properly the duties and functions of Review Auditor in the FY18 Audit. 25 The Board considered as a preliminary jurisdictional matter whether the relevant duties and functions that applied to the applicant as Review Auditor in the FY18 Audit were confined to those outlined in ASA 220 because s 1292(1)(d)(ii) refers to "duties … required by an Australian law". 26 At [22], the Board regarded it as settled that s 1292(1)(d)(ii) is to be read as referring to duties independently of "functions required by an Australian Law to be carried out by a registered company auditor". It considered that such a construction did not confine the meaning of the word "duties" to those required by an Australian law and "permits as relevant the testing of performance against the relevant professional standards and codes that do not have legislative force". Thus, the Board considered the applicant's firm's audit manual (Audit Manual) to be relevant to the identification of the duties which were required by s 1292(1)(d)(ii) to be carried out or performed adequately and properly. 27 The Board considered the scope of its jurisdiction at [24]−[50]. At [26], the Board stated: Whether a registered auditor has performed duties and functions adequately and properly within S 1292(1)(d)(ii) 'is to be judged by [the Panel] ...making an evaluative or subjective determination.' The benchmark against which the relevant conduct is to be tested is 'proper professional practice' and 'professional standards'. In the circumstances of each case, it is for the Panel to assess what the relevant professional practice or professional standards are and whether they have been met. (Citations omitted.) 28 ASIC advanced four contentions before the Board in support of its application that the applicant failed within the meaning of s 1292(1)(d)(ii) of the Corporations Act to properly carry out or perform the duties or functions required by Australian law of a registered company auditor. Each contention identified the applicant's role as review auditor as the basis for enlivening the Board's jurisdiction under s 1292. 29 It is evident from the Board's decision that it proceeded on the basis that only a registered company auditor could undertake the role of a Review Auditor and that, as a consequence, the duties and functions required to be adequately performed by a registered company auditor pursuant to s 1292(1)(d)(ii) applied. 30 The Board identified the applicable duties and functions as those set out in ASA 220 and the Audit Manual. 31 The applicant challenges the Board's assumption that a Review Auditor must be a registered company auditor. The applicant contends that the application before the Board was founded entirely upon matters that arose by virtue of his role as an EQCR for the purpose of ASA 220, rather than any duty or function that could be said to attach to the applicant because he was also the review auditor.

AGREED MATTERS 32 The Board set out the matters agreed between the applicant and ASIC from [83]−[111] of its Determination. Some of these agreed matters, and other matters on which the applicant conceded in his submissions in these proceedings, are set out below. 33 The applicant was a registered company auditor at all relevant times. 34 The applicant accepts that he was appointed as the EQCR for the FY18 Audit in accordance with ASA 220 and therefore he was the "review auditor" in respect of the FY18 Audit, as that term is defined by s 324AF(2) of the Corporations Act. 35 The applicant accepted that, as an Australian Auditing Standard made by the AUASB pursuant to the power conferred on it by s 336 of the Corporations Act, ASA 220 imposes duties and functions on an EQCR as an Australian law for the purposes of s 1292(1)(d)(ii) of the Corporations Act. 36 The FY18 Audit was the third annual audit of the financial reports of the company's consolidated entity in which the applicant had acted as the EQCR.

THE PROPER CONSTRUCTION OF s 1292(1)(d)(ii) OF THE CORPORATIONS ACT

5.1 Submissions 37 In essence, the applicant's case is that the application before the Board was founded on the applicant's performance of the role of EQCR for the FY18 Audit. The applicant contends that an EQCR may be, but is not required to be, a registered company auditor. According to the applicant, the only duties or functions imposed on him were those imposed by reason of his role as an EQCR. The functions and duties attaching to the role of an EQCR are not those of a registered company auditor simply because the person undertaking the role of an EQCR happens to be a registered company auditor. 38 Section 1292(1)(d)(ii) does not give the Board power to regulate the conduct of a person who happens to be a registered company auditor in all fields of endeavour in which that person might otherwise be subject to duties imposed by an Australian law. 39 The applicant highlights that ASIC's application was made on the basis of s 1292(1)(d)(ii), being the duties and functions required by an Australian law to be carried out or performed by a registered company auditor, not subs (d)(i) which relates to the duties of an "auditor" simpliciter. 40 The applicant contends that for the Board to enliven its jurisdiction to exercise its power pursuant to subs (d)(ii), it must satisfy the prerequisite of identifying a particular Australian law which requires a duty or function to be exercised only by a person who is a registered company auditor. 41 The applicant relies on similar interpretations which were adopted in respect of the (then equivalent, but now repealed) provisions of s 1292(2) of the Corporations Act dealing with liquidators, in Re Heesh and Companies, Auditors, and Liquidators Disciplinary Board (2001) 37 ACSR 198 at [9(a)] (per Deputy President J Block), Dean-Willcocks v Companies, Auditors, and Liquidators Disciplinary Board (2006) ACLR 698 at [25] (per Tamberlin J) and Gould v Companies, Auditors, and Liquidators Disciplinary Board (2009) 79 ACSR 648 at [4] (per Lindgren J). 42 ASIC maintains that s 1292(1)(d)(ii) entails a two-step process. The Board was required to: (1) identify the "duties or functions" under consideration; and (2) determine whether the relevant duties or functions had been carried out or performed adequately. 43 ASIC submits the first step was (at least before the Board) agreed; the relevant duties or functions were those of a review auditor and EQCR. The Board correctly identified that it was concerned with the adequacy of performance by a Review Auditor (consisting of both a review auditor and EQCR, as defined by the Board) as it understood that term. Further, ASIC points out that the applicant accepts that: (a) a review auditor must, by virtue of s 324AF of the Corporations Act (an Australian law), be a registered company auditor; (b) the applicant was a registered company auditor at all relevant times; and (c) the applicant was both a review auditor and an EQCR for the purposes of the relevant audit. 44 ASIC contends that these matters are sufficient to enliven the Board's jurisdiction under s 1292(1)(d)(ii). 45 ASIC further submits that the second step was a matter for the Board and did not affect jurisdiction. Once the relevant duties or function (here, of a Review Auditor) were identified as the subject of the Board's consideration, and where those duties or functions were required to be discharged by a registered company auditor under s 1292(1)(d)(ii), it was for the Board - and not the Court on judicial review - to determine what constituted the adequate and proper carrying out or performance of the particular duties and functions of the Review Auditor. In advancing this point, ASIC draws attention to the observations of Tamberlin J at [25]-[26] in Dean-Willcocks (discussed below) in relation to the analogous position for registered liquidators. 46 ASIC submits that the Board's task is not to determine whether a specific provision of legislation has been breached. The task is broader and more evaluative in nature, which requires the Board to subjectively consider whether the registration of the auditor should be cancelled or suspended for a specified period under s 1292(1), or to impose some other disciplinary or corrective action under s 1292(9).

5.2 Consideration 47 In Albarran v Members of the Companies Auditors and Liquidators Disciplinary Board (2006) 151 FCR 466 (Albarran Full Court), Emmett, Allsop and Graham JJ provided the following explanation at [44] and [49]-[50] in relation to s 1292(2)(d) (which at the time was a relevantly identical analogue of s 1292(1)(d) in respect of a "registered liquidator"): [44] The exercise of power under s 1292(2)(d) does not turn on the Board being satisfied as to a legal standard. It may be that the failure to carry out and perform a relevant duty or function is an offence. However, that is not what the Board is called upon to determine by the terms of s 1292. The question of the adequacy and propriety of the carrying out or performance is to be judged by the Board by making an evaluative or subjective determination. Having made that evaluative or subjective determination, the Board will consider whether the rights of the registered liquidator as to the future are to be changed by the exercise of the power under s 1292(2) in the light of all the considerations before it that are considered relevant. … [49] The consequence of the satisfaction of the Board that the person has failed to carry out or perform adequately or properly his or her duties in the past (which may or may not involve examination of, or conclusions as to, facts which, if found, would amount to an offence) is to enliven the power to take one of the steps provided for by s 1292(2) and (9). The exercise of that power might depend on other considerations considered by the Board beyond the question of past failure to perform duties. If steps are taken, they may alter or end an existing legal right for the future. If they do, that can be seen as no more than a change to the right, the potential for which change was immanent within the original grant of the right. The distinction between deciding whether a legal right created by the statute should exist in the future, and deciding what legal rights or obligations in fact exist is fundamental. [50] The function of the Board is not, as was submitted, to find (as an exercise of deciding present rights and obligations in the above sense) whether an offence has been committed and, if so, to inflict a punishment therefor. It is, as we have said, to assess whether someone should continue to occupy a statutory position involving skill and probity, in circumstances where (not merely because) the Board is satisfied that the person has failed in the performance of his or her professional duties in the past. Messrs Gould and Albarran say that punishment or a penal or harmful consequence is finally inflicted on the person consequent upon the finding of the committal of an offence prescribed by law. That is not what s 1292(2) says the function of the Board is. It is not, in substance, what the Board does. 48 In Dean-Willcocks, the Board found that it was permissible to have regard to professional standards in deciding whether the relevant office (in that case, of registered liquidator) had been "adequately and properly" carried out or performed. This was on the basis that it said it was "artificial to confine 'duties' to matters expressly arising under an Australian law because there existed a large number of matters governing proper professional practice not dealt with by specific statutory prescriptions": see Dean-Willcocks at [13] (per Tamberlin J). That analysis turned, in part, on the language of "adequately and properly" in the chapeau of subs (d) in s 1292. 49 The applicant in Dean-Willcocks, who was a registered liquidator, contended that professional standards were irrelevant to the question of whether the Board had jurisdiction under s 1292(2)(d)(ii) because professional standards were not "duties or functions required by an Australian law to be carried out or performed by a registered company liquidator". Tamberlin J dealt with this contention at [21]−[34]. 50 Relevantly, at [26], his Honour said: There is nothing in the language of s 1292(2)(d)(ii) which excludes regard to professional standards and codes when deciding whether the performance is a proper and adequate exercise of the office. The reference to "proper" and "adequate" invites the testing of performance against a relevant standard or benchmark of performance. The interpretation advanced for the applicant, in my view, is too narrow in requiring the identification of a specific duty directly imposed by legislation. The level of performance called for is that of "adequacy". The standard is that the duty must be performed "properly". The provision is designed to enable a board representative of the commercial and accounting communities to consider whether the function has been adequately and properly carried out. To assess this, it is permissible, in my view, to have regard to the standards operative in the relevant sphere of activity. (Emphasis added.) 51 This reasoning was endorsed by the High Court in Albarran v Companies Auditors and Liquidators Disciplinary Board (2007) 231 CLR 350 at [20]−[21], where Gleeson CJ, Gummow, Hayne, Callinan, Heydon and Crennan JJ referred to the emphasised passage above and said: That reasoning of Tamberlin J should be accepted as indicative that the function performed by the Board in the present cases was not the ascertainment or enforcement of any existing right or liability in respect of an offence and the punishment for an offence. 52 In the same judgment at [29], the High Court endorsed the following statement (of the Full Court in the judgment that was the subject of the appeal): If one takes the exercise of power here - that is to terminate or suspend a right or status, created by statute, by reference, in part, to past conduct - it can be readily accepted that a court might do this or an administrative tribunal might do this. This is not a power which is inherently judicial. The character of the Board, the undoubted bringing to bear by the Board of professional standards (with the knowledge of which its members can be taken to be imbued), an absence of an assigned task of deciding a controversy between parties as to the existence or not of present mutual rights and obligations of those parties upon the application of the law to past events, the exercise of an evaluative and discretionary power in the protection of the public as to whether a person is fit and proper to continue to hold a position of importance provided for by the statute, all combine to give the conclusion that the conferral on the Board of the power in s 1292 is not judicial. (Emphasis added.) 53 Re Vouris; Epromotions Australia Pty Ltd and Relectronic-Remech Pty Ltd (in liq) (2003) 47 ACSR 155 also concerned the conduct of a registered liquidator in his capacity as an administrator. Mr Vouris had chaired a second meeting of creditors of a company under s 439A of the Corporations Act (his authority to "preside" arising under s 439B). He purported to adjourn the meeting without the creditors' consent. ASIC charged him with failing to seek the consent of the meeting to adjourn, on the basis that failure was inconsistent with the "duties or functions required by an Australian law to be carried out or performed by a registered liquidator". Campbell J said at [100] and [103]: [100] It is possible for someone to fail to carry out or perform adequately and properly the duties and functions of being an administrator, even if it is not possible to point to some particular statutory provision which has been breached. For example, if an administrator had sent to creditors a report which dealt with each of the topics listed in s 439A(4), but which expressed opinions which were based upon an investigation or a process of reasoning which fell below proper professional standards, a charge of breach of s 1292(2)(d)(ii) of the Corporations Law could be made out. … [103] Whether Mr Vouris fell below acceptable professional standards in not seeking the consent of the meeting to adjourn (assuming, without deciding, that the proper way of viewing his behaviour is that he did not in substance seek the consent of the meeting to adjourn) is not solely a matter of law. It is a question the answer to which is influenced by evidence about appropriate professional standards. If this court were to seek to answer the question, it would undermine the exercise by CALDB, a specialist tribunal, of the functions which parliament has conferred upon CALDB. The conducting of an administration sometimes requires the administrator to weigh up the relative advantages of speed, efficiency and cheapness, on the one hand, and thoroughness on the other - a time when an administrator has to decide how hard he should urge creditors to adjourn a meeting is such an occasion. And questions of professional standards, as well as the "business judgment" test for breach of duty now contained in s 180(2), are relevant to whether the balance has been struck within the range of responsible professional decision-making. 54 In Goodman v Australian Securities and Investments Commission (2004) 50 ACSR 1, ASIC brought a proceeding before the Board against an auditor. The Board made a preliminary ruling that the conduct alleged against the auditor came within the terms of s 1292(1)(d)(i). The applicant sought judicial review and alleged that, as the relevant conduct concerned a breach of auditing standards, the Board did not have jurisdiction under either s 1292(1)(d)(i) or (ii) to consider the matter. Branson J held at [19] that the ADJR Act did not permit review of the Board's ruling. Her Honour also considered, in the alternative, whether the Board lacked jurisdiction. In doing so, she made the following observations (at [26]-[27]): The question of whether the applicant failed to carry out or perform adequately and properly that duty or function is not a pure question of law. The words "adequately" and "properly" incorporate notions of judgment. The relevant judgments call for consideration to be given to accepted professional standards: see Re Vouris; Epromotions Pty Ltd and Relectronic-Remech Pty Ltd (in liq) (2003) 177 FLR 289; 47 ACSR 155 at [103]. The task of determining the relevant accepted professional standards is a task within the expertise of the board. The accepted professional standards may be found by the board to be set by, or alternatively reflected in, published Auditing Standards - notwithstanding that the Auditing Standards have no direct statutory significance. For the above reasons I reject the contention of the applicant that, in considering whether the applicant carried out or performed adequately and properly the duty or function of reviewing TSG's financial report for the half-year ended 31 December 1999, the board is not entitled to consider Auditing Standards. 55 These cases establish that, in applying s 1292(1)(d)(ii), there must first be a duty or function that is required by an Australian law to be carried out by a registered company auditor. Once that duty or function is identified, the second step is for the Board to consider whether the duty or function has been adequately and properly carried out or performed. During that second stage, it is not necessary to be confined by Australian law; a broader, evaluative enquiry that takes into account professional standards and guidelines is permitted: Albarran Full Court at [45] (per Emmett, Allsop and Graham JJ). 56 I consider that s 1292(1)(d)(ii) required the Board to undertake a three-step process: (a) identify whether the applicant in performing the role of review auditor or EQCR was performing a role that was required to be undertaken by a registered company auditor, and if so; (b) identify the "duties or functions" required by an Australian law to be carried out or performed by a registered company auditor; and (c) make an evaluative or subjective determination of whether the relevant duties or functions had been carried out or performed adequately and properly. 57 Only the first step goes to the Board's jurisdiction and will be considered below.

WAS THE APPLICANT'S ROLE REQUIRED TO BE UNDERTAKEN BY A REGISTERED COMPANY AUDITOR?

6.1 "review auditor" 58 The applicant maintains that the Corporations Act imposes only very limited obligations on a "review auditor", all of which relate only to conflicts and rotation requirements. The Act does not contain any provision equivalent to s 307A expressly requiring a person within the definition of "review auditor" to conduct an engagement quality control review, or any other specified kind of review, or to conduct the review in accordance with the Auditing Standards. 59 The applicant submits that no "office" attaches to the role of a review auditor and instead the phrase is a label which attaches to a particular person (if any) fulfilling the description as contained in s 324AF(2) of the Corporations Act. 60 ASIC submits that this proposition presents a false dichotomy. Where, in the words of s 324AF(2), there is a "registered company auditor (if any) who is primarily responsible to the individual auditor, the audit firm or the audit company for reviewing the conduct of the audit", that person is the review auditor. ASIC considers that it is plain from the language of s 324AF(2) of the Corporations Act that irrespective of whether the role of review auditor is an "office" or a "label", all that must be established is that a review auditor is a function required to be carried out by a registered company auditor and that the role is not devoid of content. Once that is established, it is for the Board to decide whether a person has carried out or performed the duties and functions of a review auditor adequately and properly. 61 Accordingly, ASIC maintains there is no error in the Board's assumption that "Review Auditor" is an "office". 62 In order to determine the duties and functions of the Review Auditor for the relevant audit, the Board considered the ASAs and the Audit Manual. Here the relevant audit was of the financial report of a listed entity and so: (1) ASA 220 required that an engagement control review be conducted by the EQCR, being a person or team who is suitably qualified and is not part of the audit engagement team; and (2) the Audit Manual required that a Quality Control Review be conducted by the Quality Control Review Partner, being a Partner who is knowledgeable of relevant specialised industry practices, as well as applicable rules and regulations. 63 Section 324AF (set out above) provides the meaning of "lead auditor" and "review auditor". The applicant relies on the words "(if any)" after "registered company auditor" in the definition of "review auditor" to distinguish that from a "lead auditor" who must be a registered company auditor. It says that the words "(if any)" indicate that a review auditor may be, but does not need to be, a registered company auditor. I disagree. 64 The definition of "lead auditor" only applies where an audit firm or audit company conducts an audit. In the case of "review auditor", the definition contemplates a situation where an audit is conducted by an individual auditor, as well as an audit firm or audit company. Only an audit of a company, registered scheme or superannuation entity conducted by an audit firm or audit company has a lead auditor. In the case of an individual auditor conducting an audit (who will themselves be a registered company auditor as per s 324BA), there may well not be another registered company auditor who can act as the review auditor. The "(if any)" would be relevant to that situation, which is not contemplated in the definition of "lead auditor". That is, the words "(if any)" in s 324AF(2) refers to a situation where there is a lead auditor of an audit but no review auditor because the lead auditor is an individual, not a firm or a company. The words "(if any)" are not intended mean that a review auditor may be, but does not need to be, a registered company auditor. 65 I consider that in the case where there is a review auditor for an audit, the definition in s 324AF does not contemplate any other persons other than a registered company auditor filling the role. Therefore, the function of review auditor must be carried out by a person who is a registered company auditor.

6.2 "Engagement Quality Control Reviewer" 66 Having found that a review auditor under the Corporations Act must be a registered company auditor, it is unnecessary to deal with whether an EQCR must be a registered company auditor. That is because, as I will explain below, the applicant accepts that he was a review auditor for the FY18 Audit and therefore the board's jurisdiction under s 1292(1)(d)(ii) was enlivened. However, I will make a few brief observations about the role of EQCR as the parties addressed this in detail. 67 I do not consider that an EQCR must be a registered company auditor. 68 Neither ASA 220 nor any other Australia law requires that an EQCR be a registered company auditor. The role is also not referred to in the Corporations Act. ASIC accepts that there is no express requirement in any law or professional standard that an EQCR must be a registered company auditor but contends that it is possible to infer from the relevant standards that it is "likely" that an EQCR will be a registered company auditor. That is a very different proposition to a legal requirement that an EQCR must be a registered company auditor. 69 All that ASA 220 requires is that an EQCR is a "suitably qualified external person with sufficient and appropriate experience and authority to objectively evaluate the significant judgments the engagement team made and the conclusions it made". The engagement team will likely include registered company auditors. Therefore, I consider that in many, perhaps most, cases the EQCR will be a registered company auditor. However, it is possible that the role could be undertaken by someone suitably qualified with sufficient experience who is not a registered company auditor, such as a recently retired registered company auditor. 70 That conclusion does not help the applicant. The applicant was the EQCR and the review auditor for the FY18 Audit and therefore this case can be resolved entirely on the basis that the applicant was a review auditor, which is a role that is required to be undertaken by a registered company auditor.

DID THE BOARD HAVE JURISIDCTION? 71 The authorities have made clear that the primary meaning of "jurisdiction" in a legal context is the "authority to decide": CGU Insurance Ltd v Blakeley (2016) 259 CLR 339 at [31] (per French CJ, Kiefel, Bell and Keane JJ), citing Minister for Immigration and Multicultural and Indigenous Affairs v B (2004) 219 CLR 365 at [6] (per Gleeson CJ and McHugh J). 72 In Minister for Immigration and Multicultural Affairs v Yusuf (2001) 206 CLR 323, McHugh, Gummow and Hayne JJ explained at [82] the nature of jurisdictional error (by reference to Craig v South Australia (1995) 184 CLR 163 at 179 (per Brennan, Deane, Toohey, Gaudron and McHugh JJ) as follows: It is necessary, however, to understand what is meant by "jurisdictional error" under the general law and the consequences that follow from a decision-maker making such an error. As was said in Craig v South Australia, if an administrative tribunal (like the Tribunal) "falls into an error of law which causes it to identify a wrong issue, to ask itself a wrong question, to ignore relevant material, to rely on irrelevant material or, at least in some circumstances, to make an erroneous finding or to reach a mistaken conclusion, and the tribunal's exercise or purported exercise of power is thereby affected, it exceeds its authority or powers. Such an error of law is jurisdictional error which will invalidate any order or decision of the tribunal which reflects it". "Jurisdictional error" can thus be seen to embrace a number of different kinds of error, the list of which, in the passage cited from Craig, is not exhaustive. Those different kinds of error may well overlap. The circumstances of a particular case may permit more than one characterisation of the error identified, for example, as the decision-maker both asking the wrong question and ignoring relevant material. What is important, however, is that identifying a wrong issue, asking a wrong question, ignoring relevant material or relying on irrelevant material in a way that affects the exercise of power is to make an error of law. Further, doing so results in the decision-maker exceeding the authority or powers given by the relevant statute. In other words, if an error of those types is made, the decision-maker did not have authority to make the decision that was made; he or she did not have jurisdiction to make it. Nothing in the Act suggests that the tribunal is given authority to authoritatively determine questions of law or to make a decision otherwise than in accordance with the law. 73 The applicant accepts that he was the review auditor for the FY18, albeit that he assumed that role by virtue of being the EQCR. A review auditor as defined by s 324AF(2) is a role required to be undertaken by a registered company auditor. That is sufficient to engage the Board's jurisdiction - that is, authority to decide - whether the registered company auditor appointed as review auditor performed adequately and properly as a review auditor. 74 The Board proceeded on the basis that it had jurisdiction under s 1292(1)(d)(ii) of the Act because the applicant was a "Review Auditor", a term defined to include his role as EQCR and review auditor. The Board did not misunderstand s 1292(1)(d)(ii) and correctly understood its jurisdiction conferred by that section. 75 Once the Board's jurisdiction was enlivened, it was entirely a matter for the Board to determine the applicable duties and functions and evaluate whether they had been properly carried out: Dean-Willcocks at [13] and [26] (per Tamberlin J). Determining the scope and nature of those duties and functions of the review auditor was entirely a matter for the Board, as was the weight to be given to the various matters before it: Minister for Aboriginal Affairs v Peko-Wallsend Ltd (1986) 162 CLR 24 at 41 (per Mason J (as his Honour then was)). Any error the Board may make about the scope of the duties and functions of a registered company auditor will not be jurisdictional. 76 In having regard to those ancillary matters, the Board did not err in its finding that the applicant failed to adequately and properly carry out an evaluation of whether the proposed FY18 Audit Report was appropriate. That was entirely a matter for the Board which was entitled to make a subjective evaluation according to the relevant professional standards: Albarran Full Court at [44]; Dean Willocks at [26]. 77 The applicant seeks to distinguish Dean-Willcocks on the basis that it dealt with the predecessor to s 1292, which concerned registered liquidators. Tamberlin J, following the earlier decision of Campbell J in Re Vouris, held that all the duties and functions of an administrator appointed under Pt 5.3A of the Corporations Act were relevant duties and functions (under the equivalent provision relating to registered liquidators) because only a registered liquidator could be appointed as an administrator. 78 The applicant says that those authorities can be distinguished on the basis that: (a) the duties and functions of an administrator arise solely from, and by reason of, a person's appointment to that office. Put another way, a registered liquidator does not have those duties or functions unless or until they are appointed an administrator; and (b) the duties and functions of an administrator are exclusive to that office - no-one who is not an administrator possesses them or can carry them out. 79 The applicant contends that therefore the Board had no jurisdiction conferred upon it by s 1292(1)(d)(ii) to make orders in respect of the performance by the applicant of the role of "engagement quality control reviewer" in relation to the FY18 Audit. 80 The applicant's argument, in essence, is that he was only the review auditor because he answered that description by happenstance. That is, he did not undertake the role of review auditor as a standalone role but was only performing that role by virtue of being appointed as the EQRC. An EQCR is not required to be a registered company auditor and therefore he rejects that the duties and functions he was performing for the FY18 Audit were those "required an Australian law to be carried out or performed by a registered company auditor". 81 ASIC submits that this interpretation must be rejected as it relies on a misunderstanding of the jurisdiction that was exercised by the Board. ASIC submits that the disciplinary powers provided in s 1292 support the public purpose of ensuring adherence to high standards in the auditing profession, which, in turn, is critical to the proper functioning of the corporate sector, the financial system, and the capital markets. The auditor of a listed company requires that a review auditor perform their role to a proper and adequate standard to ensure a proper degree of scrutiny over the conduct of the audit engagement. In that context, ASIC submits that s 1292(1)(d)(ii) should not be given a narrow reading or remit such that the Board does not have jurisdiction over a person who is only performing functions required by law to be performed by a registered company auditor by virtue of holding another role. 82 I agree with ASIC's contention. All that is required for the Board to have jurisdiction is that by reason of s 324AF(2) the review auditor must be a registered company auditor. The applicant accepts that he was the review auditor for the FY18 Audit. It is irrelevant that he was only the review auditor by virtue of first being an EQCR. The applicant was performing the role of review auditor and therefore the Board had power to assess whether he was performing the function of review auditor properly and adequately.

CONCLUSION 83 For the reasons given above, the Board did not make a jurisdictional error in exercising its power under s 1292(1)(d)(ii) of the Corporations Act on the basis that the applicant, in his role as review auditor (as defined in s 324AF) for the FY18 audit, failed "to carry out or perform adequately and properly … any duties or functions required by an Australian law to be carried out or performed by a registered company auditor". 84 Accordingly, the amended application be dismissed. The applicant must bear the first respondent's and second respondent's costs. I certify that the preceding eighty-four (84) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Rofe.