How to Audit Related Party Disclosures Under IAS 24 and ISA 550

Why related party work is the audit area most likely to be incomplete

RPT procedures sit at the intersection of two problems. The first is identification. You can’t audit a relationship you don’t know about. The second is disclosure. Even when the relationship is known, the FS note is often incomplete or boilerplate.

ISA 550.11 requires the auditor to ask management to identify all related parties and the nature of the relationships. But ISA 550 doesn’t stop at asking. ISA 550.14 to ISA 550.17 require the auditor to remain alert throughout the audit for information suggesting related party relationships or transactions that management hasn’t disclosed. That obligation runs from planning to completion.

In owner-managed entities (the majority of mid-tier audit clients in the Netherlands), the related party web is often extensive but informal. The director owns three companies personally. The spouse sits on the board of a supplier. A family trust holds the building the entity leases. None of these appear in the client’s related party schedule because the FD doesn’t think of them as “related parties.” They’re “the director’s companies.” IAS 24.9 disagrees.

What the AFM’s 2022 findings made clear: audit files lacked evidence of enquiry beyond management and lacked cross-referencing to KvK (Dutch Chamber of Commerce) extracts to verify corporate relationships. Files also lacked documentation of how the team stayed alert for undisclosed relationships during substantive testing. The procedures existed in the audit programme. Evidence of performing them didn’t exist in the file. My honest reaction when I first read the AFM findings was that they felt familiar in a way I didn’t like, because I recognised the shortcut in files I had signed off on myself.

Who counts as a related party under IAS 24.9

The IAS 24.9 definition is broader than most practitioners realise when applied to owner-managed structures.

IAS 24.9 (a) covers entities and persons with control or joint control over the reporting entity. The director who owns 100% of the shares is a related party. So is the director’s spouse, children, and any entity those family members control or jointly control ( IAS 24.9 (a)(i)). If the director’s adult son owns a construction company that provides services to the audit client, that construction company is a related party of the audit client. The son’s company may have its own auditor, its own financial controller, and its own view that no related party relationship exists. IAS 24 says otherwise.

IAS 24.9 (b) covers associates and joint ventures. If the audit client holds a 30% stake in another entity accounted for under IAS 28 , that entity is a related party. All transactions between the two require disclosure. This category is usually picked up correctly because the investment already appears on the balance sheet.

The categories that get missed in practice are IAS 24.9 (a)(vi) and IAS 24.9 (a)(vii). Key management personnel of the entity (or its parent) are related parties. So are close family members of those individuals. And any entity controlled, jointly controlled, or significantly influenced by those individuals or their close family members. A non-executive board member whose consulting firm invoices the audit client for advisory services generates a related party transaction. The board member is key management personnel under IAS 24.9 . The consulting firm is an entity controlled by that person. Both the compensation paid to the board member and the fees paid to the consulting firm require IAS 24 disclosure.

Post-employment benefit plans for the entity’s employees are also related parties under IAS 24.9 (a)(viii). For Dutch entities, this means the transactions between the entity and its pension fund (if a separate legal entity) are related party transactions. Teams frequently omit this because they think of pension contributions as an IAS 19 matter. IAS 19 governs the measurement. IAS 24 governs the disclosure of the relationship.

ISA 550 identification procedures that actually work

ISA 550.14 requires the auditor to perform specific procedures to identify related parties. The standard lists them. The gap in practice is that teams treat the list as a tick box exercise. The director’s RPT schedule appears reasonable. Waive further pursuit. I’ve watched this happen on engagements where the file passed review and nobody had touched the KvK.

Start with the KvK extract. For every director and board member of the audit client, obtain a KvK extract showing their other directorships and shareholdings. This takes five minutes per person on the KvK website and catches the most common undisclosed relationships in Dutch engagements. If the director is also the director of three other B.V.s, every transaction between those entities and your audit client is an RPT. Cross-reference the KvK extract against the GL for intercompany receivables, payables, revenue, and costs with any of those entities.

Second, review the GL for transactions with entities that share addresses, bank accounts, directors, or postal codes with the audit client. Run a simple GL search for any entity name that appears in both the accounts payable and accounts receivable subledgers, or for payments to entities registered at the same address as the client or its directors. These mechanical searches catch RPTs that the client’s schedule omits. They take 30 minutes and routinely produce results.

Board minutes and shareholder registers are the next source. ISA 550.15 requires inspection of both. For private companies, also inspect the shareholders’ agreement. Clauses requiring the entity to purchase goods from a shareholder-related supplier are related party arrangements by design, and they often predate the current FD’s tenure.

For entities with group structures, ISA 550.17 requires enquiry of the component auditor (if applicable) about related parties. ISA 600 group audit procedures intersect here. If the audit client has a parent company audited by another firm, ask that firm for the parent’s RPT schedule. Cross-reference it against yours. Differences indicate relationships that one side hasn’t identified.

Use the ciferi ISA 520 Analytical Review Calculator to compare management fee income or intercompany charges against prior years (PY). A sudden new revenue line, a new supplier appearing in the top 20, or an unusual receivable balance at year-end can each signal an undisclosed RPT. The analytical review creates the flag. ISA 550 tells you what to do with it.

Testing the arm’s length assertion

IAS 24.23 permits entities to disclose that RPTs were conducted on terms equivalent to arm’s length. But IAS 24.23 adds a condition that matters: the entity can only make this claim if it can be substantiated. Most entities make it. Few can back it up. My view is that the arm’s length assertion in owner-managed Dutch files is almost always unsubstantiated, and teams should default to removing it from the draft note until the client produces evidence, not the other way around.

Audit work frequently falls short here. The client states in the notes that “all transactions with related parties were conducted at arm’s length.” The auditor accepts the assertion. No testing. No comparison to market rates. ISA 550.23 requires the auditor to evaluate whether identified RPTs outside the entity’s normal course of business are appropriately accounted for and disclosed. If the client claims arm’s length terms, you need evidence.

For management fees charged between group companies, compare the fee to external benchmarks. If Bakker Holding B.V. charges its sub €360K per year for management services, what would an independent management consultancy charge for comparable services? Obtain market rate data, compare, and document the conclusion. The ciferi transfer pricing tool structures this benchmarking with CUP, cost-plus, TNMM, and resale-price methods and generates arm’s length documentation you can file directly. If no comparable exists (common for bespoke intercompany services), document that the arm’s length assertion cannot be substantiated and advise the client to remove it from the disclosure note. IAS 24.23 doesn’t require the assertion. It just permits it if supported.

Property leases and intercompany loans are easier to benchmark.

For property leases between related parties, compare the rent per square metre to independent market data for comparable properties in the same location. For intercompany loans, compare the interest rate to what the borrowing entity would pay an independent lender at the time the loan was originated. The ciferi Financial Ratio Calculator can benchmark the entity’s effective borrowing rate to help identify whether an intercompany loan rate is below market.

What IAS 24 requires in the disclosure note

IAS 24.18 requires disclosure of the nature of the related party relationship and information about the transactions and outstanding balances necessary for users to understand the potential effect on the financial statements. IAS 24.19 specifies minimum disclosures: the amount of the transactions, outstanding balances (including commitments), provisions for doubtful debts on those balances, and expense recognised during the period for bad or doubtful debts owed by related parties.

IAS 24.17 requires disclosure of key management personnel compensation in total, split by category: short-term employee benefits, post-employment benefits, other long-term benefits, termination benefits, and share-based payment. The split is mandatory. A single line “total key management compensation: €820K” fails IAS 24.17 .

For the WPs, build a related party matrix. Rows: every identified related party. Columns: nature of relationship ( IAS 24.9 paragraph reference), transactions during the year (by type and amount), outstanding balance at year-end, any provisions or write-offs, and whether the arm’s length assertion was made and substantiated. This matrix becomes the completeness test. Every row should trace to a disclosure in the IAS 24 note. Any row without a corresponding disclosure is a finding.

IAS 24.20 allows aggregation of similar transactions by type of related party, unless separate disclosure is necessary for understanding the effects on the FS. At firms like ours, Dutch owner-managed entities tend to over-aggregate. “Transactions with directors and their related entities: €1.4M” is insufficient if the €1.4M comprises €800K of management fees, €400K of property rent, €150K of loan interest, and €50K of vehicle use. Each is a different type of transaction with different terms. IAS 24.18 requires enough detail for users to understand each type.

Worked example: Bakker Holding B.V.

Client profile: Bakker Holding B.V. is a Dutch distribution company with €28M revenue, reporting under IFRS. The sole director, J.H. Bakker, owns 100% of the shares. Bakker also owns Bakker Logistics B.V. (a transport company) and a commercial property held in Bakker Onroerend Goed B.V. The client’s draft financial statements contain a related party note with one line: “Transactions with entities under common control: €680K.”

Practical checklist for your next engagement

Common mistakes

• Relying solely on management’s related party schedule without independent verification. ISA 550.14 requires the auditor to perform identification procedures beyond asking management. The AFM’s 2022 report specifically cited the absence of KvK cross-referencing as a recurring deficiency in Dutch audit files.
• Accepting the arm’s length assertion without substantiation. IAS 24.23 requires the assertion to be substantiated, not just stated. The FRC’s 2022-23 inspection findings noted that audit files frequently contained the client’s claim that transactions were at arm’s length with no supporting market data or benchmarking in the file.
• Omitting the key management personnel compensation breakdown. IAS 24.17 requires a split by benefit category. A single total line is a disclosure deficiency that appears in inspection reviews because it’s one of the easiest IAS 24 requirements to check.

Related content

• Related party transactions: ciferi’s glossary entry covers the IAS 24.9 definitions in full, including the close family member and key management personnel categories that produce the most identification gaps.
• ISA 520 Analytical Review Calculator: Use analytical review to flag unusual new revenue lines, new suppliers in the top 20, or receivable balances that may signal undisclosed related party activity.
• How to audit group structures under ISA 600 : Covers the group audit procedures that intersect with ISA 550 related party identification when the audit client sits within a wider corporate structure.

Related ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• IAS 24 , Related Party Disclosures: the source standard governing the identification and disclosure of related party relationships and transactions.
• ISA 550 , Related Parties: the audit standard requiring identification procedures, evaluation of accounting and disclosure, and obtaining audit evidence about related party relationships.
• ISA 500 , Audit Evidence: relevant for evaluating management representations about related party transactions.
• ISA 600 , Special Considerations – Audits of Group Financial Statements: governs the group audit procedures that intersect with ISA 550 for entities within wider corporate structures.