CSL Limited is an Australian-headquartered global biotechnology company whose operations include plasma-derived therapies, vaccines, and other medicines for serious and rare conditions. Its origins date to 1916 as the Commonwealth Serum Laboratories, and it was listed following privatization in the 1990s. The original paper focuses on audit evidence and the challenges of auditing a highly regulated biotechnology business. That focus remains appropriate, but an audit does not attempt to certify that every operation complies perfectly with every regulation or that management has eliminated all risk. The external auditor’s objective is to obtain reasonable assurance that the financial report is free from material misstatement, whether caused by fraud or error, and to issue an opinion based on sufficient appropriate audit evidence. For a company such as CSL, evidence must address complex estimates, multinational operations, inventory, revenue, research and development, acquisitions, intangible assets, regulatory exposures, tax, information systems, and the reliability of management’s controls.
Understanding CSL and Its Audit Environment
Audit planning begins with understanding the entity, its business model, governance, industry, accounting framework, internal control, and external environment. CSL operates across multiple jurisdictions and depends on scientific research, licensed products, plasma collection, manufacturing, cold-chain logistics, regulatory authorization, and intellectual property. Its 2024–25 annual report describes three principal businesses—CSL Behring, CSL Seqirus, and CSL Vifor—within a global medicines portfolio. This structure creates risks involving consolidation, foreign currencies, intercompany transactions, transfer pricing, product inventory, government regulation, and the valuation of acquired assets. Auditors should not treat “biotechnology compliance” as one broad checklist. They must identify which business processes and financial-report assertions could produce material misstatement.
Audit Risk and Materiality
Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. It is commonly considered through inherent risk, control risk, and detection risk. Inherent risk is higher where transactions or estimates are complex, uncertain, or susceptible to judgment. Control risk concerns whether the company’s controls prevent or detect and correct misstatements. Detection risk is the risk that audit procedures fail to identify a material error that exists. Materiality guides which misstatements could reasonably influence users’ decisions. An amount may be material by size, nature, or context. A smaller regulatory penalty, related-party transaction, or intentional misstatement may matter even when it falls below a simple numerical threshold.
Challenges in Gathering Audit Evidence
The original essay identifies resistance, access difficulties, and multiple compliance requirements. Those challenges are real, but evidence gathering is also complicated by scale and specialization. CSL’s transactions may be processed across shared-service centers, manufacturing sites, subsidiaries, cloud systems, and third-party providers. Scientific, actuarial, valuation, tax, and legal matters may require auditor specialists. Some evidence is generated electronically and depends on system controls. Management estimates may be supported by models rather than direct documents. Auditors must determine whether evidence is reliable, complete, relevant to the assertion, and sufficiently persuasive.
Sufficiency and Appropriateness
Sufficiency refers to the quantity of audit evidence, while appropriateness refers to its quality, including relevance and reliability. More documents do not compensate automatically for weak evidence. Evidence obtained directly by the auditor is generally more reliable than information supplied indirectly. External evidence can be stronger than internal evidence, though its reliability still depends on the source and method. Original records may be more reliable than altered copies. Internally generated reports become useful when auditors test the controls over their preparation and completeness. The amount of evidence required increases with assessed risk and decreases when evidence is especially persuasive.
Inspection of Tangible Assets
The original article describes physical evidence as inspection or counting of tangible assets. For CSL, observation of inventory may include raw materials, plasma, work in progress, finished medicines, and specialized supplies. The auditor can attend physical counts, inspect condition, perform test counts, trace items to records, and select recorded items to verify existence. Physical inspection provides evidence that an asset exists but does not by itself establish ownership, valuation, completeness, or saleability. An expired or obsolete product may be physically present yet overstated financially. Cold-chain and regulated inventory also require attention to quality status, release, quarantine, and destruction.
External Confirmations
External confirmation is a response obtained directly from a knowledgeable third party concerning information relevant to the audit. Bank confirmations can support cash, debt, security interests, and facilities. Customer confirmations may support receivables and terms. Lawyers can respond concerning litigation and claims. Custodians can confirm investments, while lenders and counterparties can confirm contractual balances. The auditor must control the confirmation process, including selecting recipients, sending requests, receiving replies, and following up on exceptions. Oral responses alone are usually less persuasive and should be documented and supplemented.
Documentation and Vouching
Inspection of documentation includes contracts, invoices, purchase orders, shipping records, board minutes, bank statements, regulatory correspondence, laboratory records where financially relevant, and accounting entries. Vouching generally starts with recorded transactions and traces them to supporting evidence, helping test occurrence. Tracing generally starts with source evidence and follows it into the accounting records, helping test completeness. The original paper treats documentation as three fixed categories, but audit procedures should be designed around assertions. A sale may require evidence of a customer contract, shipment or delivery, pricing, acceptance, and appropriate revenue recognition.
Observation
Observation involves watching a process or procedure performed by others, such as an inventory count, control activity, or security practice. It provides evidence about what occurred at the time of observation but may not represent normal behavior at other times. Employees may perform a control more carefully when watched. Auditors therefore combine observation with inquiry, document inspection, reperformance, and data analysis. In a manufacturing setting, observing a count or control does not replace testing the records produced throughout the year.
Inquiry
Inquiry involves seeking information from knowledgeable people inside or outside the organization. Auditors may interview finance staff, operational managers, scientists, legal counsel, compliance personnel, internal auditors, and the audit committee. Inquiry is essential for understanding processes, identifying unusual transactions, and assessing fraud risk. It is rarely sufficient alone because people may misunderstand, forget, minimize, or intentionally misrepresent facts. Important explanations should be corroborated with documents, data, or third-party evidence.
Recalculation and Reperformance
Recalculation tests mathematical accuracy, such as depreciation, interest, tax computations, earnings-per-share calculations, or inventory extensions. Reperformance involves independently executing a control or procedure originally performed by the company. For example, auditors may reperform an account reconciliation, access review, or calculation within a valuation model. These procedures provide direct evidence but must use complete and accurate source data. A perfectly recalculated model can still be wrong if its assumptions or inputs are inappropriate.
Analytical Procedures
Analytical procedures evaluate relationships among financial and nonfinancial data. Auditors may compare revenue with volume, gross margins by business, inventory with production, research expenditure with project activity, payroll with headcount, or current results with budgets and prior periods. Unexpected movements can indicate misstatement or a legitimate business change. Analytical procedures support planning and final review and may provide substantive evidence where relationships are predictable and data reliable. Complex biotech results often require disaggregated analysis because consolidated totals can conceal opposite trends among businesses or regions.
Revenue Recognition
Revenue can be a significant audit area because of product sales across countries, rebates, returns, discounts, government pricing, distributor arrangements, and cut-off near period-end. Auditors need to understand performance obligations, transfer of control, variable consideration, contract terms, and the completeness of deductions. Evidence may include contracts, invoices, shipping records, customer confirmations, subsequent cash receipts, credit notes, and sales data. Journal entries and unusual end-of-period transactions deserve additional attention because revenue is often presumed to carry fraud risk under auditing standards unless that presumption is rebutted appropriately.
Inventory and Cost of Sales
Biotechnology inventory may have long production cycles, strict storage requirements, regulatory release conditions, and expiration risk. Auditors test existence, costing, overhead allocation, net realizable value, write-downs, and cut-off. Evidence should address whether products are approved for sale, quarantined, damaged, obsolete, or subject to recall. Manufacturing variances and yields can reveal errors in costing. Third-party inventory requires confirmation or other procedures. Scientific quality records may affect financial valuation even though the auditor does not independently certify product safety.
Research and Development Expenditure
Research and development accounting requires classification and judgment. Research expenditure is generally expensed under applicable accounting rules, while development costs may be capitalized only when specified criteria are met. Auditors examine project approvals, technical feasibility, management intention, resources, probability of future economic benefits, and the ability to measure costs reliably. Management optimism can create bias. Scientific progress does not automatically prove commercial feasibility, and regulatory approval remains uncertain. Specialists and governance records may support the assessment.
Intangible Assets, Goodwill, and Impairment
Acquisitions can create goodwill, product rights, brands, customer relationships, and other intangible assets. Valuation relies on forecasts, discount rates, probabilities, market assumptions, and useful lives. Auditors test the identification and measurement of acquired assets and later assess impairment testing. Evidence includes acquisition agreements, valuation reports, board materials, budgets, external market data, historical forecast accuracy, and sensitivity analysis. Because small changes in assumptions can alter valuation materially, professional skepticism is essential. Management’s expert does not eliminate the need for the auditor to evaluate competence, capability, objectivity, methods, and data.
Regulatory and Legal Matters
CSL operates in a highly regulated environment involving product authorization, manufacturing quality, pharmacovigilance, competition, privacy, anti-bribery, environmental rules, and healthcare interactions. Auditors do not issue a general legal-compliance opinion, but noncompliance can affect provisions, contingent liabilities, impairment, going concern, or disclosure. Procedures may include inquiry of legal and compliance personnel, inspection of regulator correspondence, board and committee minutes, legal confirmations, whistleblower reports, and payments. Suspected noncompliance requires careful escalation under professional standards and law.
Information Technology and Cybersecurity
Financial reporting depends on enterprise systems, interfaces, access rights, automated controls, spreadsheets, and third-party services. Auditors evaluate relevant general IT controls over user access, change management, operations, backup, and interfaces. Weak access controls can undermine reliance on system-generated reports. Cyber incidents may affect operations, data integrity, privacy obligations, provisions, and disclosure. The external financial-statement audit is not a complete cybersecurity assessment, but cyber risk becomes relevant where it can produce material financial-report effects.
Global Operations and Consolidation
A group audit may involve component auditors in different countries. The group engagement team determines significant components, communicates scope, evaluates component-auditor competence and independence, reviews work, and obtains sufficient evidence for the consolidated opinion. Foreign currency translation, intercompany balances, transfer pricing, local statutory accounts, and different systems add complexity. Cooperation from management helps, but professional standards require evidence independent of management’s willingness. The original conclusion that the audit was “not challenging” because management cooperated understates the inherent complexity of a global biotechnology group.
Management Representations
Auditors obtain written representations from management concerning responsibility for financial statements, completeness of information, recorded transactions, estimates, fraud, and other matters. Written representations are necessary but do not substitute for other evidence. If management refuses a required representation, the auditor must evaluate the implications for integrity, audit scope, and the opinion. Cooperation is relevant, but assurance depends on corroborated evidence rather than trust alone.
Professional Skepticism and Independence
Professional skepticism means maintaining a questioning mind and critically evaluating evidence. It does not require assuming that management is dishonest, nor does it permit accepting explanations without support. Auditor independence is essential because financial-statement users rely on an opinion issued without management influence. Audit committees support independence through appointment, fee oversight, non-audit service review, and private communication with auditors. CSL’s annual report identifies Deloitte as auditor and discloses auditor remuneration, information relevant to governance and independence assessment.
Audit Conclusion and Reporting
After completing procedures, auditors evaluate identified misstatements, evidence, accounting policies, estimates, disclosures, going concern, and the overall presentation. The opinion may be unmodified or modified through a qualified opinion, adverse opinion, or disclaimer depending on the issue. Key audit matters may communicate areas of significant auditor attention but do not constitute separate opinions on those matters. The audit provides reasonable, not absolute, assurance. Fraud involving collusion, management override, falsified documents, or sophisticated concealment may remain difficult to detect.
Conclusion
Auditing CSL Limited requires more than collecting physical evidence, confirmations, documentation, and observations. The auditor must understand a multinational biotechnology business, assess material risks, evaluate controls, test transactions and estimates, and combine evidence from several sources. Important areas include revenue, inventory, research and development, intangible assets, impairment, regulation, information systems, tax, legal matters, and consolidation. Management cooperation improves access but does not remove audit complexity or replace independent verification. A high-quality audit is built on sufficient appropriate evidence, professional skepticism, specialist knowledge, clear documentation, and communication with those charged with governance.
References
Auditing and Assurance Standards Board. (2025). Australian Auditing Standards.
CSL Limited. (2025). Annual Report 2024/25.
International Auditing and Assurance Standards Board. (2023). Handbook of International Quality Management, Auditing, Review, Other Assurance, and Related Services Pronouncements.
Cite This Work
To export a reference to this article please select a referencing stye below:
Academic Master Education Team is a group of academic editors and subject specialists responsible for producing structured, research-backed essays across multiple disciplines. Each article is developed following Academic Master’s Editorial Policy and supported by credible academic references. The team ensures clarity, citation accuracy, and adherence to ethical academic writing standards
Content reviewed under Academic Master Editorial Policy.
