Internal controls over financial reporting (ICFR) audits are seeing an increase of audit failures related to the technology aspect of the controls. PCAOB inspection reports issued in 2020 and 2021 show audit teams continue to struggle with scoping, understanding, and concluding on the underlying systems supporting financial reporting transactions.
Related:
The Inevitability of Integrated Audits
Most business processes have the support of powerful applications and processing for companies of all sizes. Technology is empowering the smallest companies with sophisticated ERPs that have fantastic reports, dashboards, application configurations to prevent errors, and real-time transaction processing. These advancements for companies have caused resource and skill gaps for the firms that audit them. In addition, these advancements have made many audits inefficient or ineffective unless they are performed through the systems with an integrated audit team knowledgeable in IT.
Related: Is it Just a Significant Deficiency? Evaluating Deficiencies in ICFR
Information technology general controls (ITGC) risks are conceptually difficult to maintain perspective when dealing with the audit conclusions. The knowledge of applications, operating systems and databases along with the potential impact to your audit, is often fragmented across several team members. Challenges with integrating the knowledge of technology along with audit is often illustrated when ITGC deficiency evaluations disrupt the whole audit process. Unfortunately, many of the recent PCAOB reports have examples of ITGC issues related to deficiency evaluations where engagement teams failed to properly respond to the risk, some even missed reporting of a material weakness.
So often teams fail to understand how information technology systems support the business transaction and financial reporting process. Audit teams that start these discussions, with IT audit, during the initial walkthrough and planning phases of the audit are set themselves up to reaching the conclusion that supports the audit opinion of the year-end filing.
With tight budgets and a high demand for resources that are in short supply, firms frequently ask us for advice on how to address these issues. Based on our work with firms, here are some of the components that we see making a big immediate impact on audit quality:
Establish a Base Audit Environment. Foundational elements of this integration include prepared team members, who openly collaborate in an objective way to avoid biases. Preparation relates to knowledge of the industry, accounting, or control area. Firm and engagement leadership must enforce meetings, logistics and other cross team discussions.
As tools take a new meaning during times of remote working, engagement team members have quickly adapted. Think of a base environment that maintains a few key elements:
Proactively and early integration of all team members. Audit firms with a top-down tone of integration, combined with the action of incorporating team members with different experiences and areas of expertise, will lead to a comprehensive understanding of the business cycles. These different areas can include understanding in technology, tax, using an industry specialist, and areas requiring judgement by those with specialized knowledge of a topic. A tactical example would be joint risk assessment discussion, including all IT auditors and specialist playing an active role in identifying and agreeing collectively on the “what could go wrongs” in the audit.
Conduct Joint Walkthroughs of the Process and Controls. We recommend both audit and IT team members perform the walkthrough and use a flow chart. Performing walkthroughs as a team with the IT auditors is an easy way to put these collaborative audit techniques into practice. IT audit members should be invited into all relevant meetings (challenge the status quo for what meetings are or are not relevant for the IT auditor). This becomes very clearly an issue when we review the engagement teams understanding of the flow of data. In our review of process narratives, we commonly see applications are discussed sporadically throughout the document. When this business process narrative is compared to the IT understanding document in a different part of the audit file the disjointed logic appears and gaps in the data lineage are confirmed. The use of a flow chart is recommended because it helps the team logically move from one step to the next in the process and incorporates all the people and systems along the process. Joint walkthroughs and collaborative documentation techniques are indicators of a comprehensive understanding.
Integration should be on-going in planning, quarterly work, company preparation, fieldwork, sign off, wrap-up, review, and reporting. Collaboration across skill sets brings out the best in the understanding of the collective team (including the firm).
The foundation of connecting with members of your team with deep knowledge in areas such as technology, eliminates some blind spots. Today technology is part of every process, so having team members with a passion and understanding of how company systems work is necessary.
Joe Lynch is a Managing Director at Johnson Global Accountancy who works with public and private companies, and public accounting firms to implement and integrate technology into financial processes and improve the audit integration of engagement teams which enhances financial reporting and audit quality. With over 17 years of experience in the auditing industries with a focus on technology, and over 6 years at the PCAOB as an Information Systems Inspection Leader. Joe has supported companies and firms with IT strategic initiatives ranging from implementing the strategic framework for technology departments to leading implementations of ERP and other systems.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084