Picking up from Part I of our series on PCAOB Inspections and Enforcement, the opening meeting officially kicks-off the inspection. Remember, first impressions matter, so don’t take it lightly.
Remote vs. On-Site Inspections
Historically, most PCAOB inspections were on-site at firms’ offices. Then the pandemic came and the PCAOB was forced to go entirely remote. Now, as we navigate life in a “post-pandemic” era, inspections are a hybrid of on-site and remote.
Our preference is for on-site inspections. In-person inspections allow for engagement teams to develop rapport with the inspection team and helps boost overall morale through teamwork. For on-site inspections, the firm will need to coordinate meeting rooms for the PCAOB; typically, one room for the inspection team to work in and then a separate break-out room for meetings. We also encourage engagement teams to find a conference room where they can spend the day working on responding to questions and strategizing together. Once the PCAOB is on-site, be sure to check in on the PCAOB Monday morning, introduce the team, provide internet logins and troubleshoot any logistical concerns. Based on public remarks from the Director of the Division of Registration and Inspections at the PCAOB, and based on our current work with firms worldwide, travel for inspectors to conduct in-person inspections has resumed, including for non-U.S. Inspections.
For remote inspections, the PCAOB conducts its meetings purely through conference calls; some teams will be on camera, while others just use conference calls. During remote inspections, it’s important to schedule meetings ahead of time and send out invites to the appropriate individuals. Engagement teams often coordinate follow-up meetings after each of the PCAOB meetings where the team can privately debrief the questions and concerns arising during the PCAOB meeting. As a note, just because the PCAOB is remote does not mean that the team needs to be remote; we encourage engagement teams to gather in the office as this collaboration makes the inspection process easier with real-time discussions and knowledge sharing. We have helped many teams through PCAOB inspections and have found that getting the engagement team together in-person is incredibly beneficial.
Inspection Week Meetings
Inspection week could be described as a series of meetings where PCAOB inspectors pose questions, the engagement team responds and over the course of a week of back and forth, the PCAOB closes out questions and narrows down its concerns. Early in the week, the meetings tend to be organized by focus area and can typically last anywhere from one to two hours. For integrated audits, the first couple meetings are often led by the engagement team and consist of walking through the relevant processes and controls for the selected focus area. Once the process is fully understood, the PCAOB will then move on to posing specific questions about the controls and substantive testing.
The inspection team usually consists of the Inspection Team Leader as well as a financial statement inspector for each focus area and/or issuer (depending on the size of the issuer) and one IT audit inspector to support the entire inspection. Because the impact of technology is so pervasive in audits, we encourage engagement teams to include the member of the engagement team that support the IT aspects of the work in the PCAOB inspection meetings.
At first, the PCAOB will have many questions. Some may be higher level questions around risk assessment while others may be very detailed as they go through each of the specific workpapers. To respond to questions, we encourage engagement teams to dialogue with the PCAOB. If the answers to questions are easy to answer (with confidence), conversation demonstrates knowledge and mastery of the audit file. However, it is always acceptable to write down questions and defer responding until the following meeting. If a question is unclear and/or you cannot understand the relevance of a question, it’s also perfectly acceptable to ask the PCAOB to clarify the question and provide more context around the risk.
Inspection meetings should be attended by the engagement partner and the senior manager/manager as well as any relevant national office representatives and/or PCAOB consultants. We’ve sat through hundreds of inspection meetings and while we don’t respond for the engagement team, we listen to the nature of the questions and then help interpret/translate the PCAOB questions to the team afterwards. Generally, the engagement partner should be doing the bulk of the talking during meetings. It is not critical for the EQR or for more junior staff to attend the meetings, unless they are needed to speak to some of the questions. That said, sitting through a PCAOB inspection can be a great learning opportunity, listening to the types of questions and understanding the PCAOB’s concerns.
At the end of each meeting, the PCAOB will typically ask to set up the following meeting where they will expect responses to the questions already discussed and will then pose additional questions on the same focus area and/or other focus areas.
Concurrent with the audit inspection meetings, the PCAOB will also have meetings with firm management (i.e. the CEO, audit quality leader, professional practice, etc.) to better understand the firm’s system of quality management. The PCAOB will sometimes request specific documentation to evidence/test the system of quality management as well.
Needless to say, the week is full of nonstop meetings.
Responding to Questions
After each inspection meeting, it is best practice for the engagement team to meet and debrief the open items; this is where working in an audit room collectively helps with knowledge sharing. Engaging a PCAOB consultant can significantly help teams with understanding the nature of each question and explaining the questioning in relation to the standards. PCAOB consultants also understand what is considered “fully responsive” to the risk; comprehensive responses can lead to a more efficient inspection, eliminating the back-and-forth.
Historically, most questions were posed orally during inspection meetings. However, we have started to see the PCAOB send emails with lists of questions, dependent upon the inspection team. Regardless, we recommend engagement teams type up all questions (if not already written up by the PCAOB) as well as responses so that they are clear and concise. Responses should be complete, accurate and fully responsive. There is no need to speak to “anticipated” issues or concerns. The PCAOB will ask additional questions if they have further concerns.
Many questions will also require teams to go back to the workpapers and research the work performed. Don’t underestimate the time it takes to respond. In an ideal world, teams would clear their schedules to allow for a dedicated focus on the PCAOB inspection.
If some questions take longer to research and respond, the team can indicate in subsequent meetings that it is still responding to specific questions. It’s important to note which questions are open at the end of each meeting.
Areas of Concern
Throughout the week, as questions are answered, the PCAOB will begin to narrow down the list of open items. When the PCAOB asks a follow-up question and/or asks the same question in a different manner, this is generally a good indication that the initial response did not fully address the inspector’s concerns and there remains a potential risk of material misstatement or non-compliance with the auditing standards.
By Wednesday, the PCAOB will typically have asked all its questions and the remainder of the inspection is a matter of responding and closing out concerns. By Thursday afternoon, the PCAOB should be able to provide an overview of its main concerns, if any. These concerns represent the areas where, barring any further information, the PCAOB is considering a comment form. This initial communication of concerns provides the engagement team another chance to review the workpapers and craft a response that explains how the engagement team responded to the risk and complied with the standards. The starting point for all these discussions is understanding the risk of material misstatement and making the direct linkage between the risk and the response.
The focus of the inspection is always on the documentation in the audit file. However, if there is other persuasive audit evidence (i.e. an analysis that was performed at the time of the audit but not included in the file), the PCAOB has considered the information. In these circumstances, it’s critical to be very clear what is documented in the file, what was performed at the time of the audit but not included in the file and what was performed currently during the inspection. Transparency is key.
When responding to areas of concern, the engagement team should consider what information is new and relevant. Sometimes providing a detailed overview of the entire audit approach with specific discussion around how each audit procedure/response addresses the PCAOB’s concerns can provide a clearer picture to the inspector and may be enough to resolve any concern. Responding with irrelevant information, or repeating information that has already been shared multiple times, rarely changes the mind of the inspection team. Again, leverage the national office and/or a PCAOB consultant to help respond to areas of concern.
Status Meeting and Comment Forms
Although the inspection is never technically closed until the report is issued, the status meeting serves as a chance for the PCAOB to share its assessment of concerns. This is not a time for discussion / rebuttal of the concerns; that is the purpose of the entire week of meetings. The status meeting is really a chance for the PCAOB to provide an overview of its scope and its findings that will result in a comment form.
Comment forms take some time to receive; some come within weeks and others take longer. The PCAOB has its own internal review process and occasionally, some comment forms are quashed. Prior to issuing the comment forms, inspectors may request copies of workpapers or have clarifying questions. These requests serve to ensure the comment form is complete and accurate.
Comment forms are broken down into four sections:
Firms have 10 days to respond to the comments, although extensions can be granted if requested. Once the firm submits its response to the comment form, the firm will not typically hear back from the PCAOB until the report is issued, which could be anywhere from one month to more than a year later.
While the inspection is now complete, firms still need to evaluate AS 2901 and AS 2905 considerations and develop a remedial plan for each specific deficiency. In addition, firms should consider root cause analyses (especially in light of the requirements of the new quality management standards) and firm-wide remedial actions. These actions aren’t required until report issuance when the remediation timeline commences, but we recommend starting early when the inspection findings are fresh and relevant.
As we said in Part I, don’t be afraid to reach out if you have questions. We’ve also created an inspections resource guide that goes into much greater detail and can serve as a navigation tool for engagement teams. You don’t have to go it alone!
Key Takeaways
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084