If you follow the PCAOB at all, you know that at the start of 2022, the SEC appointed a new Board led by PCAOB Chairwoman, Erica Williams. The Board has made it abundantly clear that they take inspections and enforcement seriously. In its April 2023 Spotlight: Staff Priorities for 2023 Inspections, the PCAOB indicated, “…[One] of the enhancements is the expansion of the number of public company audits [it will] select to review.” Similarly, in a September 2022 speech, Chairwoman Williams said, “As our strategic plan makes clear, this Board is approaching enforcement with a renewed vigilance.” Given the strong tone of the new Board and the fact that many new firms will be subject to PCAOB inspections as a result of the Holding Foreign Companies Accountable Act (i.e. audit firms issuing PCAOB opinions in the People’s Republic of China and Hong Kong), we thought it would be a good idea to do a little refresher on PCAOB inspections and enforcement. In this three-part series, we’ll focus on: 1) how to prepare for a PCAOB inspection, 2) what to expect during the inspection itself and 3) how the enforcement process works and what to do if subject to an inquiry. So, without further delay, let’s jump into how to prepare for an inspection.
Notice of Inspection
Typically, firms that audit 100 or more issuers are subject to annual inspections; firms that audit less than 100 issuers are subject to triennial inspections. Increasingly, the PCAOB is accelerating the inspection process for triennial firms depending on risk and historical inspection results. Regardless, every firm that is registered with the PCAOB and audits at least one issuer will receive either an email or a letter from the PCAOB notifying the firm of an upcoming inspection. This communication outlines many of the logistical matters including the anticipated timing of the inspection as well as the various data/document requests. We recommend that firms identify a “project manager” who acts as a point person for the PCAOB. This designee should manage all communication with the PCAOB until the actual inspection begins, at which time the inspection team will begin to communicate directly with the engagement teams. This project manager also manages most of the administrative elements of the inspection, coordinating meetings and dates and facilitating document requests and workpaper access. The initial inspection notification will also indicate the PCAOB Inspection Team Leader. Though PCAOB inspections are to be taken seriously, the process is more casual and the PCAOB understands that firms may have questions and clarifications needed along the way. The PCAOB Inspection Team Leader is the main contact at the PCAOB to help navigate that process and clarify any uncertainty.
Logistically, the most important first step is to confirm the dates of the inspection and the period under inspection (which the PCAOB will specifically identify). The PCAOB provides the anticipated dates, but the firm must check with its staff to ensure their availability during the inspection. The PCAOB does not typically modify the inspection dates, but if the firm has reasonable extenuating circumstances, it could request the PCAOB to change the inspection dates. Once the dates are nailed down, the rest is simply a matter of preparation. Note that depending on the size of the firm and the number of inspections being performed, the inspection may take place in one single week or may span multiple weeks.
The notification letter will provide firms with various data requests. The two most important requests include: a) the QC data request and b) the issuer information form.
Issuer Notification
Once the PCAOB receives the initial data requests, the Board will begin its process of issuer selection. As the PCAOB indicates in its 2023 Spotlight (referenced above), the Board uses a mix of random selections as well as risk-based issuer audit selections (i.e. issuers with restatements, financial institutions, large market capitalization, issuers with mergers and acquisitions, digital assets, etc.). Typically, two to three weeks in advance of the inspection, the PCAOB will then notify the firm of the issuers selected for inspection.
Along with notification of the issuers, the PCAOB requests additional information through the Engagement Profile which is a much more in-depth data request for the specific issuers selected for inspection. The information requested on the Engagement Profile varies and is largely dependent on the type of issuer selected for inspection. An integrated audit will request much more detailed information (i.e. controls identified and selected for testing for specific focus areas) for an integrated audit than for a non-integrated audit.
Once the issuers are finalized, the firm should begin coordinating early workpaper access with the PCAOB. This may be done through sending a laptop to the PCAOB or through setting up remote access for PCAOB inspectors. This is where the firm’s project manager can coordinate specifically with the PCAOB Inspection Leader and provide options based on the firm’s technological capabilities. The key with all things related to the inspection is communication. If there is any uncertainty, don’t hesitate to communicate with the PCAOB.
Prep Week
Workpaper Review
Just as the PCAOB inspectors are performing workpaper reviews in preparation for the inspection, so too should the engagement team be reviewing the workpapers during the week or two leading up to the inspection. Along with issuer notification, the PCAOB may inform the firm of specific focus areas ahead of the inspection but more often than not, the focus areas are shared with the firm during the opening meeting. If the team knows the selected focus areas, it should focus its efforts during prep week on those areas. If the focus areas are unknown, the engagement team should focus its preparation efforts on audit areas with significant/fraud risks (i.e. revenue), material new and/or complex accounting (i.e. new lease accounting standard or debt/equity classification), and significant subjectivity and/or judgment (i.e. accounting estimates). In addition, for broker-dealer audits, consider reviewing the net capital calculation and the exemption or compliance reports.
As a note, the PCAOB can always add additional focus areas during the inspection week. In addition, though not specifically considered a focus area, all teams should re-familiarize themselves with the planning, risk assessment and materiality considerations as well as audit findings (i.e. control deficiencies and corrected and uncorrected misstatements) as these are foundational to any audit.
We also encourage engagement teams to review recent PCAOB publications, like the April 2023 Spotlight which provides an overview of the PCAOB’s focus for the upcoming inspection cycle (i.e. fraud, risk assessment and internal controls, financial services, digital assets, mergers and acquisitions (including SPACs), use of other auditors, and other QC areas) as well as other publications like the December 2022 Spotlight: Staff Update and Preview of 2021 Inspection Observations which highlights the most common inspection findings from the 2021 inspection season.
Finally, through our work supporting firms, we have often found that in addition to engagement team review of the workpapers, firms benefit from an objective outside review. We’ve performed numerous pre-inspection workpaper reviews which help identify the “pain points” prior to the inspection so that engagement teams are better prepared to respond to the PCAOB.
Opening Meeting
The official kick-off of the inspection is the “Opening Meeting.” For integrated audits, the opening meeting is much more structured and teams often prepare a slide deck. For non-integrated audits, the opening meeting is much more informal (especially since focus areas are not typically known).
The opening meeting is the first impression and serves as an opportunity for the engagement team (led by the engagement partner who should be doing the majority of the talking) to demonstrate their knowledge of the audit and to walk the PCAOB through the overall audit approach. A successful opening meeting will introduce the engagement team, provide an overview of the issuer’s operations, detail risk assessment and scoping considerations, explain materiality, discuss use of others (other auditors and internal audit) and summarize overall audit findings. If the focus areas are known, the engagement team should also be prepared to walk through the internal controls and substantive approach for each of the focus areas. If the focus areas are unknown, while the engagement team will begin the meeting with a brief overview, the PCAOB will generally then lead the meeting by introducing the focus areas.
Often the PCAOB inspectors will have prepared questions for each of the focus areas. We recommend engagement teams take down the opening meeting questions and set up subsequent meetings during the inspection week to begin responding to the PCAOB’s concerns. Typically, after the opening meeting, we recommend collectively debriefing the questions and coming up with a plan for how to respond to each of the questions.
Engagement teams may choose to respond immediately to simple questions that are navigational in nature and/or that are easy to respond to (where there is no uncertainty), but know this: it is always acceptable to take a question down and respond in the following meeting. We’ll remind you in the next article as well, but the PCAOB does not expect an immediate response to each question. As a team, you are allowed to say, “Let me take that down and get back to you.”
That’s enough for Part I. As you can see, there’s a lot of moving pieces in a PCAOB inspection. Given we at JGA are all former inspectors, we understand the concerns and questions many firms have regarding the inspection process. Don’t be afraid to reach out if you have questions. We’ve also created an inspections resource guide that goes into much greater detail and can serve as a navigation tool for engagement teams. The moral is: you don’t have to go it alone!
Key Takeaways
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084