Remediation in a World of Repeat Findings: PCAOB Guidance for the Remediation Process
Geoffrey Dingle • April 13, 2023
It has been more than 20 years since the formation of the PCAOB. Over time, the inspections process has transformed and along with it, the reporting and remediation processes. In February of 2023, the PCAOB published its Spotlight: Additional Insights on the Remediation Process. In light of the new guidance as well as considering the fact that the new quality management standards will require all audit firms (international or domestic, public or private company audits) to remediate both engagement and firm-level deficiencies, it’s clear that there is a renewed emphasis on the remediation process within the industry.
The spotlight provides much of the same information previously released through various publications, such as the PCAOB Staff Guidance from November 2013, which highlights the main considerations that the Board reviews when evaluating the effectiveness of remedial efforts. Specifically, the Board reviews the following criteria:
- Change: Is the remedial action a change from the current quality control (QC) system? In what ways?
- Relevance: Does the action specifically address the deficiency? Both in terms of subject but also in terms of causal factors? Design: Is the remedial action, as designed, appropriate to address the QC failures?
- Implementation: Was the remedial action implemented in the remediation period?
- Execution and Effectiveness: How effective was the remedial action? How does the auditing firm evidence that?
While we’ve touched on many of these items in previous remediation articles, let’s explore some of the new insights from the February 2023 Spotlight below:
Repeat Criticisms
Most firms have at some point probably had some sort of repeat finding. For many, the EQR deficiency seems to recur in every inspection report, but I imagine many firms are also seeing repeat findings in ICFR (think of management review controls or MRCs) and estimates, two of the most commonly cited deficiencies for many years running now. When firms have repeat findings (i.e. same or similar deficiencies in consecutive inspection reports), the PCAOB critically assesses the remedial actions to understand how these actions will resolve the issue. We like to use the word “incremental.” How is the remedial action incremental, or “meaningfully different” in the words of the PCAOB. For instance, if you develop and deliver a training on auditing estimates, but then have a repeat finding in your subsequent inspection report, the PCAOB will challenge whether another training is an effective remedial action. The question will be asked “how is that additional training meaningfully different to what was delivered previously?” What other incremental actions could be implemented to address the criticism? We’ll delve more into training later, but the point is that just because a remedial action was considered effective in the past does not mean it will be considered effective today. And if it was truly effective in the past, why then is there a deficiency today?
Root Cause Analysis
This leads well into the next concept: root cause analysis. If you are seeing repeat findings in your inspections, it’s an indication that the root cause for the deficiency has not yet been addressed OR there could also be a new root cause that requires specific attention. The new quality management standards require firms to perform a root cause analysis. A thorough root cause analysis helps firms to understand the causal factors contributing to the overall deficiency. From these causal factors, the firm can then appropriately design remedial actions. Think of it like going to the doctor; a doctor could prescribe medications to treat symptoms, but a root cause will direct the doctor in how to prescribe the right medication to treat the causal illness and thereby eliminating all symptoms.
Firms need to start performing robust root cause analyses to understand what is giving rise to the deficiencies. The PCAOB warns that there may be multiple causes so don’t jump to the most obvious conclusion. If you don’t address all causal factors, while you may be able to pass remediation, you risk having the deficiency occur yet again and the remediation process will only get more stringent.
As well, while root cause analysis is typically focused on deficiencies (negative audit quality), the PCAOB has indicated that many firms are starting to perform root cause analyses for “clean” audits (positive audit quality) so as to identify what worked well. These success factors could be fodder for new remedial actions implemented at a firm-wide level.
Training
Training is the most common remedial response we see in the industry. And that makes sense; awareness is certainly the first step in driving change. However, after 20 years of inspections and remediation, training is proving less effective given the number of recurring deficiencies.
When the PCAOB evaluates the sufficiency of training for remediation purposes, it considers the following:
- Is the training specifically tailored to the company? Does the training speak to the specific deficiency? At what level of granularity? Buying an off-the-shelf training that summarizes the requirements of AS 2501 is different than engaging a consultant with audit expertise to specifically design a tailor-made training on AS 2501, pulling in PCAOB inspection results, identifying common PCAOB failures, and crafting case studies from the firm’s specific findings.
- What is the format of the training? Live webinars and in-person trainings are typically viewed as more effective than e-learning self- studies.
- Who is delivering the training? What are the qualifications and experience of the presenters?
- Who is the audience and how was participation monitored/enforced? The PCAOB generally expects that firms identify their target audience. However, if the training is covering something such as inventory observations, it probably makes sense that all staff levels attend the training since the procedures are typically performed by more junior associates and by the time a manager is reviewing, it might be too late to effectuate real change (we rarely go back to perform a second inventory count). How does the firm ensure those absent from the training get “caught up?” Even if the firm offers a make-up session or records the training for future reference, there’s an implicit attitude when only 50% attend live and the rest make-up the training later. It’s an indication of tone-at-the-top and a lack of regard for the importance of that training. Training that is designed for remediation should be attended by all required professionals; truants should be the exception.
- Is there a post-course knowledge check? Is the course CPE eligible? Both factors elevate the significance of the training. Post-course knowledge checks are especially important as they help evidence knowledge retention, which helps demonstrate the effectiveness of the remedial action (i.e. refer to the five criteria above). We’ve seen firms fail remediation because they didn’t do knowledge checks, so don’t underestimate its significance.
Guidance and Tools
The other most common remedial action is the development of new guidance and tools/templates to guide teams through various auditing requirements. We’ve helped numerous firms develop templates for auditing ICFR (or even more specifically, auditing management review controls), auditing estimates, evaluating CAMS, etc. When evaluating the sufficiency of tools and templates, the Board considers the following:
- Design of the tool: Does the template pull guidance directly from the standard? Does it specifically address the deficiency cited in the inspection report?
- Effective date: When was the guidance/tool implemented and effective?
- Required use: When is the template applicable? Is it required in all circumstances? Generally, the PCAOB will expect tools to be required to be used on all audits where there is potential for a failure.
- Communications: How was the guidance/tool communicated within the firm? Again, tone at the top matters. Did the firm provide any education around the guidance / templates?
- Implementation and monitoring: How did the firm go about implementing the tool? Were there required consultations in the first year? Were there targeted inspections to ensure teams are complying with the new guidance and/or effectively completing the templates?
Subsequent Inspections
We have started to see an acceleration of inspections and many clients are being inspected every two years instead of every three years as they were accustomed to. Considering that PCAOB reports are sometimes issued a year or more after the inspection and by the time you add another year for the remediation process, many firms are now being inspected while they still have open remediation periods. So, what’s the big deal? It means that the PCAOB will be in the midst of evaluating the effectiveness of remedial actions while also performing a subsequent inspection. Results of that subsequent inspection could have a direct impact on the remediation assessment.
The Board did clarify that a subsequent inspection finding is not automatically a failure. Rather, the PCAOB looks to see how proactive the firm is in monitoring and addressing known deficiencies. As well, the PCAOB looks to see whether there were multiple actions to address a deficiency or just one and how broad the remedial actions were (i.e. training over inventory estimates vs. training over all accounting estimates). Finally, there’s this concept of continual improvement. If a firm had six ICFR findings in one inspection report, but only had one ICFR finding in the subsequent inspection, that could be a sign of improvement. Of course, it’s always facts and circumstances specific and numbers can be deceiving. If there was only one audit with ICFR, then one finding would result in a 100% hit rate. If there were eight integrated audits and only one with an ICFR deficiency, that tells a different story.
The point is, be aware of the timelines and understand that the results of PCAOB inspections will impact any open remediation assessments. This is why it’s important to understand root causes and map remedial actions to causal factors. While a firm might have ICFR deficiencies recur in multiple inspection periods, if the firm can identify different root causes and thus different remedial actions, it helps demonstrate how and why the firm responded as it did.
The point is to acknowledge subsequent inspection findings and incorporate them into your remediation response, demonstrating how the firm has analyzed the results, what they are proactively doing to address the new findings and how the results impact (or do not impact, and why) any open remediation responses.
Timing and Dialogue
Finally, we can’t emphasize this enough, but start dialogue in the 12-month remediation period early! In its letter that accompanies inspection reports, the PCAOB has now indicated that it expects firms to initiate a dialogue within 60 days of receiving the report. Remember, the remediation period only lasts for one year and firms need to demonstrate how their remedial actions fulfilled the five criteria during that time; this means, demonstrating the effectiveness of remedial actions which often is validated through internal firm monitoring procedures which take time!
Start the conversation early. Explain the intended remedial responses. Begin implementing the actions and continue dialoguing with the PCAOB to understand their concerns or feedback. Firms are able to have as many conversations as they would like with the PCAOB remediation staff during the one-year timeline, but each submission and review takes several weeks for the PCAOB and PCAOB feedback sometimes requires changing course or entirely altering the intended actions. Allow time to modify your response without being rushed.
Understandably, some remedial actions will take longer than a year to fully implement and/or see the improvement. That doesn’t mean wait until the last minute to implement. In these circumstances, break down your response into milestones to demonstrate progress and help define various measures of success.
Key Takeaways
- Consider how remedial actions are incremental and “meaningfully different” from previous remedial actions, especially if there are repeat findings.
- Start performing root cause analyses and build the results into your remediation response.
- Ensure training is designed appropriately. Consider content modification, expertise of the presenters, delivery methods, target audience, and don’t overlook knowledge checks (an effective tool to demonstrate effectiveness).
- Design robust new tools and templates and intentionally communicate the new requirements.
- Consider results of subsequent inspections and specifically address them in your remediation response. Some results may indicate a need to perform additional actions. Some results may indicate a nuanced finding that tells a different story.
- Start early! Engage in dialogue and keep the process moving.
WASHINGTON, D.C.: Johnson Global Advisory (JGA) has published a new third edition guide examining the key considerations faced by public company auditors during their PCAOB inspections. Drawing experience as audit and audit regulation experts and advisors to firms worldwide on all aspects of audit quality improvement, the JGA team has authored NAVIGATING PCAOB INSPECTIONS: Understanding the Inspection Process from Start to Finish.
Firm and Engagement Metrics: Getting a Head Start By: Shanett Edwards-Morton, JGA Director Introduction As regulatory requirements in the accounting profession continue to evolve, accounting firms are facing new challenges in ensuring compliance with quality management standards. One of the most significant changes comes with the adoption of the PCAOB’s QC 1000 and the associated Firm and Engagement Metrics requirements , which aim to increase transparency and accountability within the auditing process. These new requirements are set to provide critical data on a firm’s operations and other factors that can inform audit quality, including partner involvement, workload distribution, and other factors. In this article, we’ll explore the challenges and opportunities firms face as they begin collecting the information necessary for firm and engagement metrics. We’ll also provide actionable steps that, in concert with implementation of QC 1000 / ISQM 1 / SQMS 1, firms can take to ensure they’re ready for compliance, with a focus on the key areas highlighted in recent industry discussions. 1. Quality Management Implementation: Bridging Internal and External Requirements Key Insights: A major challenge shared by our clients was the distinction between internal quality management (QM) processes and external regulatory requirements. Firms are finding it difficult to ensure that the information they provide to regulators will be complete and accurate. The requirement to report accurate and non-misleading information to external parties under QC 1000 , such as firm and engagement level metrics necessitates a shift in how firms view and manage data internally. Action Items for Firms: Ensure Data Accuracy : Firms must evaluate their quality management system to ensure they are designed to meet the requirements for accurate and non-misleading information. This is crucial as QC 1000 requires firms to communicate data to external parties that is accurate and complete. Implement Data Tracking Systems : Develop systems to track and report data, ensuring that the information provided to external parties, including regulators aligns with quality management objectives. This may require new systems or modifications to existing systems. Evaluate Communication Processes : Firms should focus on improving or implementing communication processes to ensure that all external communications, especially those with regulators, meet the high standards of accuracy and clarity mandated by QC 1000. 2. Comparability of Metrics Among Accounting Firms Key Insights: The introduction of standardized firm and engagement metrics is designed to increase comparability and accountability across accounting firms. This allows regulators, investors, and stakeholders to evaluate firms based on consistent data. However, there are concerns about how these metrics might influence firm selection by audit committees and whether these metrics alone tell the full picture to accurately represent audit quality. Action Items for Firms: Adopt Standardized Metrics : Firms should ensure that their reported metrics align with the prescriptive guidelines outlined in the adopted Firm and Engagement Metrics Rule. This includes applying the defined roles in a consistent manner (such as engagement partners and managers) and calculating metrics consistently across all engagements. Prepare for External Scrutiny : Be aware that these metrics may not only be scrutinized by regulators but also by audit committees and investors. Firms should ensure that they are accurately capturing and reporting their metrics to avoid misrepresentations. Monitor AI Usage in Audits : Consider how AI tools may impact workload calculations and the measurement of audit hours. As AI becomes more prevalent in auditing , firms may need to report on the extent of its use, which could influence workload metrics. 3. Potential Implications of Reporting Metrics Key Insights: While firm and engagement-level metrics can provide valuable insights, there are potential risks to firms that are likely to emerge. These include the possibility that the metrics may inadvertently point to root causes of issues in the inspection process, particularly regarding workload and capacity challenges. Additionally, these metrics – coupled with inspection report findings - may influence how audit committees select firms, potentially providing a skewed representation of audit quality. Action Items for Firms: Use Metrics Internally for Root Cause Analysis : Firms should utilize firm and engagement level metrics as reported, when performing internal root cause analysis , identifying potential problems in workload distribution or staffing levels before they escalate. Evaluate the Impact on Firm Selection : Be mindful of how these metrics might affect firm selection. Firms should aim to demonstrate the full context behind their metrics to avoid misinterpretations that could impact their reputation. Balance Metrics with Qualitative Insights : Firms should complement quantitative metrics with qualitative insights, ensuring a comprehensive picture of their audit quality is presented to external stakeholders. 4. Engaging Stakeholders in the Use of Metrics Key Insights: One concern we have heard was the uncertain use of metrics by investors and other stakeholders. While the objective of the PCAOB in the rule-setting process was for investors and audit committees to analyze these metrics, it’s unclear how much weight they will place on the data in making decisions about firms’ audit quality. In the planning process, firms can take charge and shape stakeholder use and effectiveness of the use of firm and engagement metrics shared publicly. Action Items for Firms: Engage with the Investor Community : To better understand how investors will use the metrics, firms should engage more actively with the investor community. This could include attending shareholder meetings and investor calls to gain insights into what data investors prioritize when evaluating audit quality. Increase Transparency in Reporting : Firms should be transparent in explaining the context and methodology behind their metrics, helping the clients, audit committees and other stakeholders understand the full context to make informed decisions. Ensure Data Relevance : Firms should ask their clients whether the data currently being reported is sufficient, and whether additional data points might be necessary to better assess audit quality and reliability. 5. Getting Started with QC 1000 and Firm Metrics Key Insights: As firms begin implementing QC 1000 and collecting firm and engagement level metrics , they face the challenge of ensuring their existing systems are capable of tracking and reporting the required data. Many firms may need to redesign or enhance their internal controls to capture the necessary information accurately. Action Items for Firms: Align QC 1000 with Firm and Engagement Level Metrics Reporting : Firms should carefully review QC 1000’s requirements and align them with the firm and engagement level reporting requirements. Focus on the information and communication component, ensuring that data is collected and reported accurately and consistently. Evaluate Current Systems : Firms should assess whether their current systems are capable of tracking metrics such as workload and audit hours. If systems are lacking, firms should plan to either redesign or implement new controls to capture this data accurately. Implement Real-Time Monitoring : Firms should adopt real-time monitoring tools that allow them to proactively manage workload issues and other potential risks. This ensures that data is captured and analyzed continuously, improving overall quality management. Be Agile and Proactive : QC 1000 requires firms to monitor metrics and adapt to emerging issues. Firms should adopt an agile approach to quality management, ensuring that metrics are not just reported at the end of the period but are actively managed throughout the year. Conclusion: Preparing for the Future of Quality Management and Firm Metrics The new QC 1000 and firm and engagement level metrics requirements can represent a significant shift in how accounting firms track, report, and manage audit quality. By adopting these standards, firms can improve transparency, enhance accountability, and demonstrate their commitment to high-quality audits. However, the implementation of these new requirements will require careful planning and investment in both systems and processes. Firms that act now to align their systems with QC 1000, engage with stakeholders, and monitor their metrics in real-time will be better positioned to meet regulatory expectations and enhance their market reputation. As the industry moves towards more data-driven decision-making, firms that prioritize accuracy, transparency, and continuous improvement will be the leaders in delivering quality audits. For more information, please contact your JGA audit quality expert .
Key Takeaways from the 2024 AICPA SEC/PCAOB Conference: What It Means for Your Firm In December 2024, the AICPA SEC/PCAOB Conference in Washington D.C. brought together leaders from the SEC, FASB, and PCAOB to discuss critical developments in the accounting profession. The conference focused on fostering audit quality, improving the resilience of capital markets, and addressing ethical challenges. Below are the key takeaways from the conference speeches most relevant to you, including insights from Paul Munter, SEC Chief Accountant, Erica Williams, PCAOB Chair, Christina Ho, PCAOB Board Member, and Mark Uyeda, SEC Commissioner, and what these developments mean for the accounting firm clients we serve. 1. Munter’s Remarks on Upholding Independence Key Points: In his speech, Paul Munter, SEC Chief Accountant, emphasized the importance of maintaining auditor independence to preserve market integrity. Munter stressed that independence should be seen as a core professional standard, not just a compliance requirement, and urged auditors to foster a culture of skepticism and integrity. He called on auditors to ensure they challenge management when necessary to detect fraud and ensure accurate financial reporting. What This Means for Firms: The points are reminders to keep independence and objectivity at the forefront of engagement teams, despite the new technical complexities (e.g. PE deals), and general lowering our guard around these obligations: ways to continue to demonstrate this important across the firm system of QC are: 1. Reinforcing independence policies and ensure continuous training and monitoring; 2. Encouraging a skeptical mindset within audit teams to prevent ethical lapses; 3. Ensuring firm-wide commitment to independence, especially in long-term client relationships or where conflicts may arise. 2. PCAOB Chair Williams on Improvements in Deficiency Rates, and new standards Key Points: PCAOB Chair Erica Williams shared significant positive news, highlighting improvements in the aggregate deficiency rate at the largest audit firms. She attributed this progress to the firms’ increased efforts to enhance audit quality, including better risk assessment procedures and heightened transparency in reporting. Williams emphasized the importance of maintaining this momentum in order to build trust and credibility in the profession and the capital markets. Williams also discussed the newly adopted QC 1000 , the quality control standard that mandates firms to have comprehensive quality control systems to ensure that they meet PCAOB and SEC standards. She noted that this standard is designed to provide reasonable assurance that audit firms have the necessary controls in place to perform high-quality audits consistently. Additionally, she emphasized the critical role of the SEC in passing firm engagement metrics , which will help ensure that audit firms are held accountable for the quality of their engagements and provide investors with more detailed insight into firms’ performance. What This Means for Firms: Implement QC 1000 : Firms should begin preparing for the adoption of QC 1000 by reviewing and strengthening their own quality control systems. Ensure that these systems are robust enough to guarantee compliance with PCAOB and SEC standards and can provide reasonable assurance of consistent audit quality. Focus on Firm Engagement Metrics : If the SEC passes firm engagement metrics, firms will need to ensure they have clear, accurate data on their engagements, performance, and quality measures. Preparing now for these metrics will help firms stay ahead of the regulatory curve and demonstrate their commitment to transparency and high-quality audits. Enhance Risk Management and Quality Control : Firms should continue refining their risk-based audit approaches, focusing on stronger internal controls, and implementing transparent reporting practices. Continuous improvement will ensure the firm stays in line with both regulatory expectations and industry best practices. 3. PCAOB Board Member Christina Ho on Collaboration to Advance Audit Quality and Market Resiliency Key Points: In her speech, Christina Ho, Board Member of the PCAOB, stressed the need for genuine collaboration among regulators, auditors, and firms to advance audit quality and improve the resiliency of capital markets. This collaboration is essential to address emerging challenges, such as increasing regulatory expectations and the complexities of global markets. Ho highlighted that this collective effort is crucial to maintaining strong, transparent financial reporting and ensuring that audits remain effective and reliable, particularly as financial markets evolve. What This Means for Firms: Engage with regulators : Actively participate in consultations and industry forums to stay ahead of regulatory trends. Foster collaboration : Encourage open communication between audit teams, clients, and audit committees to ensure alignment on regulatory expectations. Adapt to global market changes : Firms must remain agile and ready to respond to the shifting dynamics of both domestic and international markets, ensuring that their audit processes remain resilient and effective. 4. SEC Commissioner Mark Uyeda on Crypto, and PCAOB’s Future Key Points: In his keynote, SEC Commissioner Mark Uyeda discussed the SEC's evolving role in the accounting and auditing of cryptocurrencies, noting that crypto is currently being accounted for and audited through enforcement activities. He stressed the need for greater clarity in crypto accounting and auditing standards. Uyeda also discussed the future of the PCAOB, stating that "all options are on the table." What This Means for firms: Crypto Accounting and Auditing : Firms need to stay abreast of emerging standards and enforcement actions in crypto accounting. As regulations evolve, firms must be prepared to adapt their auditing and reporting practices accordingly. Take a look at positions from other regulators or standard setters (e.g. CPAB), to inform what sufficient procedures looks like. PCAOB’s Future : The potential restructuring of the PCAOB may affect how audits are overseen in the future. Firms should monitor developments closely and assess the impact on their operations and regulatory compliance, and firm strategy. 5. Ethical Considerations and Audit Quality Throughout the conference, both SEC and PCAOB leaders emphasized the need for ethical leadership in the accounting profession. Lapses in ethics, whether intentional or inadvertent, can severely undermine trust in auditors and in financial markets. The speeches underscored the responsibility of firm leaders to uphold high ethical standards and ensure that these values are embedded in their teams’ daily practices. What This Means for Firms: Promote ethical leadership across all levels of the firm, ensuring that ethical considerations are integrated into every stage of the audit process. Invest in ongoing ethics training to reinforce the importance of upholding integrity and objectivity. Implement early detection mechanisms for identifying potential ethical lapses, ensuring timely corrective action. Conclusion: Positioning Your Firm for Success The 2024 AICPA SEC/PCAOB Conference provided crucial insights into the current and future landscape of the accounting profession. By focusing on audit quality, independence, collaboration, and ethical leadership, firms can not only meet regulatory requirements but also strengthen their reputations as trusted professionals in the marketplace. For JGA’s clients, the key takeaway is that maintaining robust quality control systems, engaging in ongoing dialogue with regulators, and staying ahead of emerging trends such as crypto accounting are critical strategies for ensuring continued success in a dynamic regulatory environment. For more information, reach out to your JGA audit quality expert.
WASHINGTON, D.C., OCTOBER 1, 2024 - Johnson Global Advisory (JGA) is announcing the formation of its Strategic Leadership Council (SLC) , an initiative aimed at bolstering the firm's strategic direction and reinforcing its commitment to industry-leading advisory services. The Council, composed of executives from diverse sectors within the audit quality stakeholder ecosystem, will provide insights into the JGA leadership on industry trends, strategic decision-making, and growth opportunities. Kathleen M. Hamm, Greg Jonas, and Dave Sullivan are the first appointees to the SLC. Kathleen M. Hamm has an extensive background in financial regulation, control infrastructures, and risk management, particularly relating to fintech and cybersecurity. Her previous role as a Board Member of the Public Company Accounting Oversight Board (PCAOB) highlights her leadership in regulatory transformation and strategic policy development. "Joining JGA’s Strategic Leadership Council allows me to leverage my experience to further the Firm's mission in these transformative times," remarked Hamm. Greg Jonas is an independent consultant on auditing and business reporting matters. He served as Director of the Division of Research and Analysis at the PCAOB from 2012-2016. In addition to roles as a financial analyst at Morgan Stanley and Moody’s Investors Service, Greg spent 23 years at Arthur Andersen, serving in various roles supporting its global audit practice. “JGA serves a vital role in improving audit quality for the benefit of auditing firms and investors. I look forward to contributing to the firm’s success.” Dave Sullivan, a seasoned executive known for his strategic insight in audit quality and risk management, has over 35 years of experience from Deloitte. His leadership in global audit quality initiatives make him a pivotal addition to the council. "I look forward to collaborating with my fellow council members to propel JGA to new heights," stated Sullivan. The SLC will meet quarterly, advising JGA’s leadership team on critical business opportunities and challenges, ensuring the Firm remains at the forefront of industry innovation and strategic excellence. The first meeting of the SLC was held on Friday November 1, 2024, at JGA's Washington D.C. office. “I am proud to welcome Kathleen, Greg, and Dave to our new Strategic Leadership Council,” said Jackson Johnson, JGA President and Founding Shareholder. “Their collective expertise will be instrumental in guiding our strategic initiatives and ensuring that JGA continues to set high standards our clients expect in this sector.” About Johnson Global Advisory JGA partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB staff, JGA professionals are enthusiastic and practical in their support to firms in their audit quality journey. We accelerate opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporates solutions which navigate those standards. JGA is committed to helping the profession in amplifying quality worldwide.
Johnson Global Advisory (“JGA”) is pleased to announce Joe Lynch, Shareholder and Managing Director, will speak on a panel at the 40th Annual SEC Reporting & FASB Forum. This panel will summarize the activities of the PCAOB including: Gain insight on the amendment to PCAOB Rule 3502 Governing Contributory Liability Understand the amendments addressing aspects of audit procedures that involve technology-assisted analysis of information in electronic form Recite new requirements for lead auditor’s use of other auditors Enumerate the new requirements of QC 1000, “A Firm’s System of Quality Control” Recall the guidance of the new auditing standard “General Responsibilities of the Auditor in Conducting an Audit” Anticipate the New Standard, “The Auditor’s Use of Confirmation” Learn about the proposal to replace existing auditing standard related to an auditor’s use of substantive analytical procedures Understand the PCAOB’s proposals on public reporting of standardized firm and engagement metrics and the PCAOB framework for collecting information from audit firms Anticipate the Proposed New Standard on Amendments to PCAOB Auditing Standards related to a Company’s Noncompliance with Laws and Regulations Gain insight on the PCAOB’s 2024 Inspection Priorities Learn about other Standard-Setting and Research Projects Click here to register and learn more About Johnson Global Advisory Johnson Global partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB and SEC staff, JGA professionals are passionate and practical in their support to firms in their audit quality journey. We accelerate the opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporates solutions which navigates those standards. JGA is committed to helping the profession in amplifying quality worldwide. Visit www.johnson-global.com to learn more about Johnson Global.
In September 2024, the PCAOB released a spotlight on auditor independence, highlighting critical observations from inspections (the “Spotlight”). As we react to these findings at JGA, we emphasize the importance of understanding these key themes and translating them into actionable solutions for our clients. 1. Audit Committee Pre-Approval of Services A persistent issue remains regarding the pre-approval of audit and non-audit services by audit committees. Too often, we see audit teams commence work prior to the date necessary engagement letters signed by the audit committee. This practice not only undermines compliance but also risks auditor independence. Actionable Insight: To mitigate this risk, firms should ensure that no work begins until the audit committee has pre-approved the engagement. Implementing an all-inclusive engagement letter that details all services—including consent and comfort letters, as well as quarterly reviews —will streamline the process and enhance compliance. 2. Independence Representations and Compliance Testing The Spotlight indicates an increase in the issuance of comment forms related to independence representations, particularly concerning personal independence compliance testing. A notable concern is the cutoff risk for new hires; for instance, if an independence representation is conducted annually in June, a new hire added in September may not be confirmed as independent. Actionable Insight: Firms should adopt a more frequent compliance representation and testing schedule—ideally quarterly or semi-annually—and ensure that new hires are included in these independence confirmations. This practice can help maintain independence throughout the audit engagement. Another best practice is to obtain independence representation from each new hire prior to commencing any work. Sometimes, we observe engagement partners stumble to respond on how they ensure all team members are independent of the issuer. Some firms require documenting individual team members independence reaffirmations within the issuer audit file while other firms rely on firm wide independence reaffirmations. In latter case, JGA recommends engagement partners should document that they checked that i) each team members’ independence representations had no exceptions and properly filed in the firm wide repository and ii) restricted list include this issuer. 3. Monitoring Restricted Entity Lists The spotlight highlights that smaller firms often circulate their restricted entity lists annually, which can lead to cutoff risks with new clients. This underscores the importance of continuous updates to the restricted list. Actionable Insight: Firms should verify independence based on an updated restricted entity list at the time of any new client engagement. Regular updates and confirmations of independence for new clients are essential to mitigate risks. Also, best practice is to obtain independence representations for each prospective audit client during client acceptance procedures. This practice along with new hire practice mentioned above would substantially bridge the gap between periodic firm wide independence reconfirmation processes. 4. Independence Policies The Spotlight notes that many smaller firms lack detailed written policies for monitoring independence. This gap can lead to inconsistencies in compliance and potential independence violations. Actionable Insight: JGA recommends that all firms, especially smaller ones, develop comprehensive written policies that detail how they monitor independence. This should include procedures for individual engagement independence certifications, ensuring all engagement team members have signed off on the firm-wide independence representation. The policy should outline regular independence testing procedures, including the nature, timing, frequency, and scope of these tests. This should encompass self-assessments of investment portfolio reviews for all partners, as well as independent testing of these reviews by an external consultant or HR personnel, including a sample of other audit staff. Policy should also provide guidance to all personnel on what to do in case of self-identified independence violations. Sometimes in attempt to self-cure the violation personnel may unintentionally exacerbate the issue. So, emphasize on promptly reporting independence violations over trying to self-cure them is very important. 5. Indemnification Clauses Indemnification clauses were particularly noted in foreign firms’ engagements, which can complicate compliance with U.S. requirements. It is crucial for firms to avoid creating conflicting terms across different engagement letters. Actionable Insight: Firms should use separate engagement letter templates for public company audits that strictly adhere to U.S. requirements. If an audit involves local statutory purposes, maintaining the most restrictive requirements across all engagements for the same client is advisable to ensure compliance. We note that most of the time it is not practicable to separate number of hours spent on local statutory audit while doing PCAOB audit. So, we strongly advise to remove any language that may be construed as indemnification of auditor liability from all engagements with SEC issuer audit clients. 6. Inclusion of Contractors in Independence Monitoring The oversight of contractors in the audit process can lead to lapses in independence compliance. The Spotlight suggests that many firms may not fully account for these individuals. Actionable Insight: Firms must obtain annual independence representations from all contractors before they commence work. Such independence representations should cover all period the contractors perform their work. This proactive measure will help ensure that independence is maintained throughout the audit process. Conclusion This spotlight on auditor independence serves as a crucial reminder of the ongoing challenges and the need for vigilance in compliance. At JGA, we are committed to bridging the gap between regulatory expectations and practical solutions. By implementing these actionable insights, firms can enhance their quality control systems, ensure compliance with respective standards and rules, and ultimately foster greater investor confidence. For personalized guidance on how to address these issues in your practice, reach out to your JGA Audit Quality Expert, or contact: Jackson Johnson, CPA President & Founding Shareholder jjohnson@jgacpa.com Farkhod Ikramov, CPA Director fikramov@jgacpa.com
The SEC’s recent approval of PCAOB’s QC 1000 standard marks a significant shift for accounting firms. QC 1000 aims to enhance the quality control (QC) systems of registered firms, with scalability based on firm size and complexity. The response from the industry, including our team at JGA, highlights both the challenges and opportunities that this change will present. This Alert outlines JGA's reaction to QC 1000 and discusses what it means for our clients. JGA commented on the proposal; you can read our position on the proposal here . During the SEC Open Commission Meeting on September 9, 2024, several notable points were raised regarding QC 1000. JGA’s review of the meeting and our team’s subsequent discussions focused on key risks with this change, such as the implementation challenges and effort, but also noted some positives regarding the potential for improved audit quality and opportunities to improve processes and managements insights. Our Main Takeaways Implementation Challenges QC 1000 requires all registered firms to design a system for compliance, even if they do not perform audits of issuers or broker-dealers. This is a significant concern, as firms may need to design systems for hypothetical scenarios, leading to confusion and unnecessary costs. Around 60% of firms will need to design frameworks they may not use. The standard imposes a higher level of rigor compared to existing QC standards, and firms may face difficulties aligning their systems with the new prescriptive requirements. Hester Peirce, one of the SEC Commissioners, cited these challenges as reasons for her opposition, echoing concerns from many smaller firms. Considerations Regarding Effort The design-only requirement (without immediate operational implementation) introduces additional costs for firms, particularly in smaller firms or those that do not handle issuer audits. Paul Munter, SEC’s Chief Accountant, acknowledged that firms could face increased costs, particularly those related to additional personnel, training, and system design. Scalability and Continuous Improvement On the positive side, JGA sees QC 1000 as a framework that, while complex, offers scalability based on firm size. This presents an opportunity for firms to improve audit quality continuously, which is likely to enhance their standing in the marketplace. While some firms might not feel immediate benefits, especially those focusing on non-issuer audits, the overall emphasis on audit quality in capital markets aligns with the long-term interests of many firms. Confidentiality Concerns The content of the new QC forms required under QC 1000 may raise concerns about confidentiality. While some protections are in place, firms must remain cautious about the sensitivity of the information included in these forms. What This Means for Our Clients For our clients—primarily accounting firms that must adopt QC 1000—the implications are multifaceted. Increased Compliance Burden: Clients will need to overhaul or redesign their QC systems, which will incur both time and financial investments. The 60% of firms that Commissioner Peirce mentioned, which are only hypothetically impacted by the standard, must still dedicate resources to comply, even if their actual use of QC 1000 remains limited. Cost of Implementation: Smaller firms will likely face disproportionately high costs as they align their systems with QC 1000's rigorous requirements. JGA recommends that clients assess their current QC systems and consider phased approaches to implementation where feasible. Partnering with external consultants or firms with QC expertise may help mitigate some of these costs. Training and Education Needs: Significant training will be necessary to ensure that teams understand and comply with QC 1000’s requirements. JGA encourages clients to begin training key personnel now, particularly those involved in quality control and compliance, to ensure a smooth transition. Scalability and Competitive Advantage: For firms able to navigate the transition successfully, there is the potential for a competitive advantage in the market. The emphasis on continuous improvement in audit quality could position firms as leaders in audit services, attracting clients who prioritize regulatory compliance and high-quality audits. Future Regulatory Scrutiny: The new standard may invite closer scrutiny from regulatory bodies like the PCAOB, particularly as it relates to the design of QC systems. Firms should expect more frequent inspections, and the robustness of their QC systems may become a key focus. Client Communication: JGA advises that firms begin communicating with their clients about the upcoming changes and the steps they are taking to ensure compliance. Transparency in this process will help maintain trust and demonstrate proactive management of regulatory changes. Conclusion QC 1000 represents both a challenge and an opportunity for our clients in the accounting sector. While the increased costs and implementation challenges are concerning, the scalability and focus on audit quality could yield long-term benefits. JGA recommends that firms take a strategic, proactive approach to compliance, balancing the immediate burdens with the potential to improve service quality and client satisfaction. As the landscape evolves, we will continue to monitor developments and provide guidance to ensure our clients remain compliant and competitive in this changing regulatory environment. Please reach out to your JGA audit quality expert, or contact: Joe Lynch, CPA, CITP Managing Director & Shareholder jlynch@jgacpa.com Shanett Edwards-Morton, CPA Director sedwards-morton@jgacpa.com
On July 25, 2024, the PCAOB released the Annual Report on the Interim Inspection Program Related to Audits of Brokers and Dealers (PCAOB Release No. 2024-009) which provides (i) information about its 2023 inspections approach, (ii) a summary of the 2023 inspections observations, (iii) a description of good practices that may be effective to address those scenarios; and (iv) reminders for firms of the requirements of certain PCAOB standards. The PCAOB observed higher deficiency rates in examination, review, and audit engagements, which it described as a cause for significant concern . The PCAOB report overall noted at least one deficiency was observed in 70% of the 103 audit engagements reviewed, which marked an increase from the 58% deficiency rate observed in 2022. As has been the trend we've seen over the last couple of years, when supporting clients going through inspection. We, at JGA, have seen the rigor of the inspection process increase, particularly in the areas of revenue, journal entry testing and increasingly, audit committee communications and independence-related matters. The PCAOB’s report outlined an increase in the deficiency rate that was primarily driven by the increase in the number of inspections performed of firms that have not been previously inspected and the increase in the deficiency rate in audit engagements observed at the largest audit firms reviewed. From our perspective, firms that have not been previously inspected are typically smaller practitioners and they may not be aware or prepared for the rigor of an inspection. The PCAOB identified an increase in the deficiency rate in examination engagements of compliance reports. Some deficiencies noted, among others, were around the lack of obtaining a sufficient understanding of the financial responsibility rules and planning the examination engagement by obtaining a sufficient understanding of broker-dealer processes. We have observed this statement expressed over the years and it is the root cause of many inspection findings. We have also seen this issue surface when providing in-flight reviews of audits for our clients. When we see this issue in our practice monitoring engagements, we encourage firms to provide their audit professionals with training around identifying, evaluating and testing relevant controls at their clients. The PCAOB report outlines that revenue deficiencies increased to 48% from 34% in 2022. As seen in previous years, as it relates to the audits of broker-dealer financial statements, the PCAOB noted the highest deficiency rate around firms’ responses to the risk of material misstatement for revenue. The PCAOB identified deficiencies around testing the accuracy of the amount of revenue recorded, including accuracy of inputs that determine revenue, across all revenue sources indicated in the annual report. Our clients have the most success in avoiding these issues by spending the time up front during the risk assessment process and performing detailed walkthroughs of the revenue cycle. The annual report also identified various other areas of deficiencies noted in the 2023 inspection cycle. One area to note is that for the first time, auditor independence was presented separately in the report and the PCAOB noted instances of deficiencies around non-compliance with PCAOB Rule 3526. This could be an indication of the increased focus by the PCAOB on independence-related matters. The PCAOB also observed an increase in deficiencies related to auditor communications with audit committees. Additionally, the report highlighted deficiencies identified around the monitoring of firms’ accounting and audit practice and indicated that some firms did not perform annual internal inspections. Through our work, we’ve noticed a direct correlation between inspection deficiency rates, and a loosely defined or poorly defined internal inspection program. As the expectations haven’t changed around this, we encourage firms to take a look at their internal inspection programs to ensure they specifically cover BD audits and have tailored procedures specific to the risks in a BD audit. Similar to previous reports, for certain areas, the PCAOB has also provided good practices and reminders as illustrative examples that firms may find effective in addressing various scenarios. These include, but were not limited to, good practices related to evaluating service organization reports and the scope of services covered and reliance on evidence in SOC 1 reports. JGA has provided objective, independent feedback to firms, in real-time as engagement teams perform audit procedures around SOC 1 report evaluation and reliance. In addition, we have found that in-depth training sessions to firms on how to evaluate reports on service organization controls have ensured that all engagement team understand the risks around SOC 1 evaluation, especially in areas related to significant risks and what regulators are looking for in an adequate evaluation. We encourage firms to thoroughly read the annual report and explore ways in which the good practices outlined in the report can be used in their audits going forward.
The recent PCAOB spotlight on the integration of GenAI into audits and financial reporting highlights several key observations. GenAI integration is primarily in the early stages, with larger global network firms leading in deployment, mainly for administrative tasks and research activities. There is significant ongoing investment in GenAI tools, often through third-party partnerships, to assist in summarizing accounting policies and performing risk assessments. Data privacy and security are also major concerns, with some firms implementing safeguards to protect confidential information. The PCAOB emphasizes that human involvement remains crucial, with GenAI augmenting but not replacing human auditors. Supervision and review processes ensure accountability for GenAI-assisted work. However, risks related to the reliability of GenAI outputs, and the auditability of source data are noted, with firms developing specific instructions to improve consistency and accuracy. Among preparers, GenAI is used to draft internal documents and assist in repetitive processes, with human supervision ensuring the accuracy and reliability of these outputs. At JGA, our perspective based on our interactions with our clients aligns with the PCAOB's observations while offering critical insights. We have heard from our peers and concur that the current use of GenAI enhances efficiency in tasks such as data extraction, document review, workflow automation, and compliance monitoring. JGA supports the investment in GenAI, highlighting the use of machine learning to predict areas where engagement teams are likely to encounter issues based on historical data allowing for quality control measures. Expert systems are also being utilized to suggest whether to accept a new client based on similar cases and outcomes from other engagements. Emphasizing the need for specific controls, JGA concurs with the importance of data privacy and security to ensure data integrity, address biases, and ensure accuracy. Additionally, as firms prepare to implement the new QM standards into their QC process, it is important that firms recognize that the use of GenAI should be included in its risk assessment evaluation. While supporting the crucial role of human judgment, we agree with the importance of careful supervision of AI outputs to maintain high audit quality and compliance with regulatory requirements. Acknowledging the risks associated with GenAI, we encourage firms to implement transparent and explainable AI models to mitigate biases and inaccuracies. Ultimately, auditors should continue to evaluate and conclude on the relevance and reliability of data used in the conduct of the audit. Finally, we agree that GenAI should not be seen as a tool that minimizes or removes the auditor's responsibility for providing reasonable assurance on financial statements. GenAI should not be seen as a tool that minimizes or takes away the responsibilities of the partner signing the audit opinion - at the end of the day, the engagement partner still has the ultimate responsibility that the audit opinion provides reasonable assurance that the financial statements are fairly presented. In conclusion, JGA underlines a cautious yet optimistic approach to integrating GenAI in audits, emphasizing robust controls, human oversight, and continuous investment to enhance audit quality and compliance. The extent and use of GenAI is going to continue to grow all around the globe in every industry and profession. And this is true for the auditing profession as well. Leadership of firms must continue to embrace the continued use of GenAI but do so making sure they are identifying and evaluating risks related to the use of GenAI. For further insights on using technology in your audits, read our recent JGA Advisor article on JGA Team Perspectives: System of Quality Management – Using Technology in Your Practice and Audits . Also, feel free to reach out to us with questions at any time.
The PCAOB continues to emphasize the importance of quality control (QC) systems and intends to continue to focus on this area in its future inspections. Proposed PCAOB quality control standard QC 1000, A Firm’s System of Quality Control and Other Amendments to PCAOB Standards, Rules, and Forms , would replace current PCAOB quality control standards in their entirety. QC 1000 would require registered firms to implement and operate QC systems to execute policies and procedures developed to address quality risks, monitor operation of the policies and procedures, and take remedial actions when the policies and procedures are not operating effectively. It includes a requirement for firms to perform root cause analysis (RCA) of all quality control deficiencies and design and implement timely remediation actions. Firms should consider both internal and external inspection findings as part of monitoring. In addition, the IAASB and AICPA have adopted quality management standards, so firms are required to implement new processes to ensure their internal quality controls comply with the new requirements. Jung Lee, JGA Director, works with audit firms worldwide to improve their audit quality and navigate audit and QC regulatory requirements. “In general, the number of comments and enforcement actions from the PCAOB have increased significantly in the last three years, and this trend is not only at the PCAOB, but also other local audit regulators worldwide. Audit deficiencies are costly, time-consuming, and will increase regulatory scrutiny in future inspections,” Lee said. “There has been a general uptick in the level of enforcement activity, and regulators point to QC failures in the monitoring process as a contributing factor.” In April 2024, the PCAOB Staff issued a Spotlight: Root Cause Analysis—An Effective Practice to Drive Audit Quality . The PCAOB notes that RCA has been shown to be an effective practice to drive audit quality; rather than simply detecting and remediating audit deficiencies, by “focusing more on assessing underlying root causes of a deficiency…the deficiency can be effectively addressed and ultimately eliminated.” “The Spotlight shares observations from PCAOB inspections and how firms’ RCA has helped them address repeat or persistent inspection findings,” Lee stated. See more in JGA’s Alert, PCAOB Staff Report Shares Observations on How Root Cause Analysis Can Drive Audit Quality .” Continued Preparedness Planning With respect to their system of quality management, firms need to prepare to initially adopt QC standards and then must continue to evaluate them to remain in compliance year-after-year. The steps a firm should take are cyclical, starting with initial risk assessment and gap analysis, RCA and remediation, annual evaluation and testing of the SQM, and ongoing monitoring. Practice monitoring, a component of SQM – which includes pre/post issuance reviews -- ensures that a firm’s system of quality control provides reasonable assurance that the firm and its personnel comply with professional standards and the reports issued by the firm are appropriate. “We work with firms on remediation after PCAOB inspections and pre-issuance reviews,” said Jackson Johnson, JGA President and Shareholder. “In post inspection services, we assist firms with root cause analysis of identified audit deficiencies. RCA is the underpinning of a sound QC system, and proper root cause analysis helps ensure that deficiencies are remedied.” Remediation After Inspection Frequent areas of concern noted in RCA (the first step in remediation) include lack of proper firm methodology and training, technical knowledge and competence, personnel management, engagement considerations, and supervision and review (including due care). There are often multiple root causes contributing to one deficiency, so it is important for firms to continue to dig in and ask “why.” Remediation of all identified deficiencies will likely require firms to create new QC processes. Root cause of inspection deficiencies often relates to training. “The PCAOB normally recommends a very tailored, precise training related to the area of audit deficiency noted,” Lee said. “An example is the need for a specific training on testing for proof of delivery as part of performance obligations, but firms often offer a general training on revenue recognition under ASC 606. We can help clients obtain customized, tailored training solutions, both internal and external to the firm.” To supplement training, JGA has found that practice aids and templates help firms to ensure audit quality. “An example of a practice aid is a template for journal entry testing with considerations noted in AS 2401, paragraph 61, addressing issues auditors should watch out for when reviewing the criteria used for identifying journal entries as part of fraud procedures. We can review the methodology included in client-prepared templates or create them for clients. The PCAOB asks for templates as a form of remediation of deficiencies,” Lee said. “We help firms with practice monitoring including pre- or post-issuance reviews,” Lee added. “This way, someone outside of the firm’s engagement team or National Office can monitor the performance at both the firm SQC and engagement levels.” Pre-issuance Reviews Having an objective review of an audit before the audit opinion is signed and the audit report is issued (sometimes called an “in-flight review”) is a preventative control that allows firms to get ahead of deficiencies before an inappropriate opinion is issued. “Nothing is more important than a good quality audit, and we work with firms in lock step to help them prevent or minimize deficiencies,” Johnson said. “In this way, there is a more immediate impact on audit quality, because firms can make changes in real time during the current audit rather than waiting until the next audit to see if the issue is fixed.” “We are effectively performing real-time inspections and identifying deficiencies the PCAOB may find. JGA staff were former leaders of PCAOB inspection teams, so we look at audit engagements the same way the PCAOB staff does,” Lee adds. Crucial areas the PCAOB focuses on are planning, audit procedures, and completion. JGA walks with firms in each of these and considers what can go wrong in each. “An example of in-flight for accounts receivable will entail how the firm selected the items to confirm, including the use of sampling and whether it was a stratified sample. In addition, we look at frequent areas of PCAOB findings, including revenue recognition and accounting estimates,” Lee said. “We help firms apply both a preventative and detective approach to identify and remediate their audit quality concerns, which helps them gain insight into their system of quality control and how they perform their audit engagements,” Johnson said. “This not only helps them navigate the requirements of the new quality control standards but also will help them with the PCAOB inspection process and regulatory compliance overall.”
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084
