Accounting and auditing firms are being inundated with continuing change in the profession - new accounting and auditing standards, ever-changing technology, and soon, compliance with new Quality Control standards that are just around the corner. In a continuing effort, to make sense of this all and help you prioritize your organizations efforts, this article will focus on one of the more significant and new aspects of the quality control standards, Risk Assessment. How important is it to perform a Risk Assessment? What are the aspects of this that make it difficult for firms to document how they have complied with the new QC standards?
Before we dive in, let us catch up on some new developments surrounding quality control/management that have happened over the last month.
Latest Developments on the International Front
After issuing its exposure draft in 2019, the IAASB 1 finally approved ISQM 1 2 – the long-awaited revised quality management standards for firms on the international stage 3 . Although the effective date for implementation is December 2022, we are aware that some firms are already gearing up and are starting to use the standard to improve their audit quality. The wheels are in motion and the countdown clock is starting to tick for all firms out there that are involved in international engagements.
Meanwhile on this side of the pond…what is the PCAOB thinking?
In our previous articles, we have discussed how the PCAOB’s Quality Control concept release was going to use the then Proposed ISQM 1 as the starting point for a future PCAOB quality control standard, but the PCAOB would also include additional aspects that address US-specific rules and regulations. In a recent speech 4 , Board Member Jurata stated “as you all know, we issued a [Quality Control] concept release last year, we elicited comment. And we are moving forward with the proposing stage, so that will come out in the next 12 to 18 months.” So that’s 12 to 18 months just to get to the proposing stage. Add on some time for a proposed standard comment period as well as to finally issue the standard and then allow time for implementation, and we are talking about that being several years away.
Now if that “best case scenario” timeframe does not give you pause to reflect; Board Member Brown is also having some misgivings. In a recent statement 5 , he raised concern that although the Board is going down an appropriate path of updating the profession’s QC standards, the regulator is keeping in place the remaining legacy standards that were adopted by the PCAOB on an interim basis back in 2003. He went on to state “the need to revise these out-of-date interim standards has become even more pressing with the PCAOB's ongoing consideration of changes to the standards governing quality control (QC) systems at audit firms. …Given the dated nature of these interim standards, this objective could establish a low bar that does not ensure the quality of audits expected by investors and the public.”
So, there we have it. Two different viewpoints from the regulator who is responsible for implementing a quality control standard akin to ISQM 1. We have no visibility as to actual progress, however reading the tea leaves and based on these comments from Board Members Jurata and Brown, it seems like there is still a lot being hammered away behind the doors on K Street.
Risk Assessment
However, leaving all this politics aside, the ISQM 1 standard has been approved (with the equivalent PCAOB QC standard forthcoming). Firms must start considering how they are going to comply and understand the effort involved in implementing both the ISQM 1 standard as well as the PCAOB QC standard. As discussed in previous articles, there are many ways to perform a risk assessment and many ways to document a risk assessment. We are going to walk through an example of a quality control objective in the Independence area and raise the types of considerations that need to be made when performing a risk assessment analysis. Factors to consider as part of a risk assessment include (1) identify and assess risk, (2) select and implement controls to mitigate risks identified, and (3) periodically review the controls in place to ensure the risks have been mitigated to an acceptable level. One of the more common methods to do this is by determining “what could go wrong” (WCGW).
Let us take the following Independence-related issue regarding impermissible non-audit services. An example WCGW is: The Firm fails to be independent in accordance with SEC Rule 2-01 due to an affiliate firm having performed impermissible non-audit services. Using this WCGW, in the table below we have laid out a suggested risk assessment:
By just going through this simple example, it is evident that very soon firms will be spending a lot of time and effort to comply with the new quality standard. We have already started performing work for firms who are trying to get ahead of the curve and resolve issues and discrepancies before it is too late. December 2022 seems like it is a long time away, however before you know it, the compliance deadline will be upon us.
Geoff Dingle, JGA Managing Director, works with PCAOB-registered accounting firms helping them identify, develop, and implement opportunities to improve audit quality. With over 20 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Geoff has extensive experience in audits of ICFR and firms’ systems of quality controls. Prior to the PCAOB, he worked on audits in various industries at Deloitte in Atlanta and Durban (South Africa).
1 International Auditing and Assurance Standards Board
2 International Standard on Quality Management 1
3 ISQM 1 is awaiting approval by the Public Interest Oversight Board, a global group of regulators that oversees the International Federation of Accountants
4 Recorded session of “Forum for Auditors of Small Businesses and Broker-Dealers", posted on PCAOB website on October 19, 2020.
5 “Statement Regarding the PCAOB’s Revised Research and Standard-Setting Agendas: Reducing Credibility, Accountability and Confidence in the Financial Reporting Process” by J. Robert Brown, October 13, 2020.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084