Meeting PCAOB Requirements for ICFR: Achieving Compliance with the Vaguest of Standards

At some point in our academic careers, we all encounter that one teacher for whom “good enough” was never good enough. For many in the audit profession, the Public Company Accounting Oversight Board (PCAOB) feels like the reincarnation of that impossibly difficult instructor. Especially for audit firms under inspection, their requirements can feel frustratingly vague and their standards unreasonably high.
Among the concerns that the PCAOB frequently raises in inspection reports, one of the most frequent critiques — and vaguest of standards — is around internal control over financial reporting (ICFR). In this area, PCAOB standards are so frustrating that a former Big 4 audit partner and regional PCAOB official bemoaned the situation in a 2016 article entitled, “The PCAOB Must Provide Better Guidance for ICFR.” In it, he wrote, “At a time when public company preparers and audit committees are sorely in need of more guidance regarding how the Public Company Accounting Oversight Board interprets its Auditing Standard No. 5, Internal Controls over Financial Reporting (“ICFR”), the only guidance the PCAOB has to offer corporate America is, ‘talk to your auditors.’ ” 1
At Johnson Global Accountancy, we specialize both in helping public companies and their accountants perform audits that withstand PCAOB scrutiny and, when PCAOB inspectors have raised concerns, we help them improve their work. In that role, we’re not surprised to see ICFR concerns near the top of the list for many of our clients.
This issue, and the PCAOB’s deep concern, has been haunting the audit profession for years. As early as 2013, the PCAOB issued an “alert” for auditors offering guidance around testing internal controls. 2 And just this year, it reemphasized these concerns in a report on the previous year’s inspections:
Internal Control over Financial Reporting
In many audits inspected, we observed deficiencies related to testing ICFR. Common audit deficiencies in this area included instances where: Auditors did not sufficiently test the design and operating effectiveness of controls that include a review element. We observed that auditors did not obtain an understanding or evaluate the activities performed and factors considered by the control owner when reviewing the reasonableness of certain estimates and assumptions.
- Auditors did not select controls for testing that address the specific risks of material misstatement. We observed that auditors did not obtain a sufficient understanding of whether the control addressed the assessed risk of material misstatement.
- Testing controls is critical to an audit as it is used to support the audit firm’s opinion of the effectiveness of ICFR in an integrated audit and to modify the nature, timing, and extent of substantive testing in financial statement and integrated audits. 3
Take special notice of the PCAOB’s focus on “understanding.” That’s why, in our work with audit firms, our guidance usually follows a simple yet consistent theme: it’s not enough to identify the issuer’s controls for a specific financial reporting process and test those controls.
In fact, you need to take it one big step further and look “under the hood.” You must understand if the controls are truly sufficient to assure the integrity of the underlying process. In other words, you can’t just check the box. You have to know what’s inside the box you’re checking.
Demonstrating this genuine understanding of underlying controls is a consistent focus in our work with engagement teams to identify potential audit deficiencies prior to the issuance of the financial statements. The challenge becomes most apparent when firms are testing more complex and/or subjective management review controls.
An example may help illustrate the point. For one pre-issuance review, we questioned the engagement team over a management review control in the revenue process. As we studied the issuer’s narrative describing the process, we couldn’t find any real discussion of how the control operated, nor what management’s review actually entailed.
So we probed deeper. Our questions included:
- How did the engagement team assess the design of the control without understanding the details of the actual control? In the control narrative, we found no real discussion of the control nor of management's review documented.
- How well did the engagement team understand the client’s decision-making process? For example, what was the controller’s expectation for the review control? What specific metrics/data points did the controller consider? Did the controller establish a threshold for investigation? When an item exceeded that threshold, what steps did the controller take?
- How did the audit engagement team ensure that the controller’s attributes, thresholds and investigations operated effectively? Did the engagement team reperform any of the controller’s reviews?
- The review control incorporated a "Cash Transaction Detail Report”. Did the engagement team test the completeness and accuracy of this report? If so, how?
Our thought-provoking questions — all of which find their basis in the PCAOB’s guidance cited above from six years ago — laid the groundwork for more conversations with the engagement team. Our inquiries challenged them to think more critically about the control, ensuring that they developed a sufficient understanding to appropriately judge the design of the control, and then thoroughly test its operating effectiveness.
Ultimately, our pre-issuance review empowered the engagement team to raise meaningful concerns and clarify key aspects of the control with the client. As a result, the engagement team improved the testing approach, and thus ensured the documentation and testing provided a level of understanding that met PCAOB expectations.
With the unrelenting scrutiny of the PCAOB looking over our profession’s shoulder, the era of shortcuts in the audit process is over. When it comes to ICFR, the answer is actually very simple. Don’t just skim over the surface. Instead, follow the full flow of transactions. To issue an unqualified opinion that withstands regulatory review, you must demonstrate a full understanding of all relevant risks, as well as the controls required to mitigate them.
1 https://www.complianceweek.com/the-pcaob-must-provide-better-guidance-for-icfr/2861.article
2 https://pcaobus.org/Standards/QandA/10-24-2013_SAPA_11.pdf
3 https://pcaobus.org/Inspections/Documents/Staff-Preview-2018-Inspection-Observations.pdf
Jackson Johnson is president of Johnson Global Accountancy, a public accounting and consulting firm with clients throughout the world. He works directly with PCAOB-registered accounting firms and other firms to help them identify, develop, and implement opportunities to improve audit quality.. He also works with public and private companies on various technical accounting and transactional matters. His experience includes nearly six years with the PCAOB, where he worked with small and medium-sized accounting firms throughout the world, including foreign affiliates of large international accounting firms, in the areas of firm quality control and ICFR audits of financial statements. Prior to the PCAOB, Johnson worked with public and private clients in a variety of industries at Grant Thornton LLP in Boston, Los Angeles, and Hong Kong.
Dane Dowell is a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, DC









