When I work with engagement teams during PCAOB inspections, I often hear the same questions and comments throughout the inspection process: Does the PCAOB really expect me to test at that level of granularity? We’ve been working on improving testing for years; what will it take to satisfy the inspection team? This feels like they want absolute assurance. Isn’t an audit designed to achieve reasonable assurance?
Trust me, you’re not alone in your frustrations. In fact, many firms continue to struggle with very similar audit deficiencies and many of these deficiencies are recurring multiple years in a row. Which begs the question; how do we satisfy the PCAOB?
In October 2020, the PCAOB published its Staff Update and Preview of 2019 Inspection Observations detailing some of the PCAOB’s various updates including inspection transformation activities, observations around best practices, and recurring deficiencies identified from its 2019 inspection cycle. The findings summarize the results from inspections (typically) over 2018 fiscal year-end audits from firms of all sizes.
The PCAOB acknowledges that many of the deficiencies are “similar to those [the PCAOB] observed in prior years.” In fact, a brief review of past inspection observation reports dating back to 2015 shows that many of the 2019 themes are in fact “repeat findings.” Below is an analysis of the 2019 common deficiencies and a look at the historical context of these findings.
Revenue
Given the associated fraud risk, revenue is almost always an audit inspection focus area. In 2019, the PCAOB found numerous audit issues around the adoption of ASC 606. In 2018, the PCAOB also identified revenue as a common area of deficiencies though the nature of the findings were different, relating instead to testing of occurrence and sampling. Prior to 2018, the findings are not as specific in terms of focus area and thus revenue is not specifically identified.
Independence
The next 2019 theme identified by the PCAOB relates to independence. In its 2016 and 2017 inspection observations, the PCAOB also identified concerns involving auditor independence. This is consistent with my experience working with audit firms and difficulties ensuring all independence policies are complied with. The SEC continues to issue new guidance such as updated FAQs and even amendments to independence regulations (as recently as October 2020). It’s clear that independence has been a continued topic of conversation between auditors, clients and regulators. Why is independence so difficult to adhere too? Are the independence standards too precise or too vague? Complicated? Unnecessarily strict? Could it be that there are too many various sources of independence regulations, including SEC, PCAOB, AICPA, and possibly others depending on the jurisdiction of the issuer?
Accounting estimates
The 2019 inspections observations highlight the continued struggle firms face in auditing accounting estimates. Specifically, the PCAOB discusses difficulties auditing the allowance for loan losses (the qualitative factors used in reserve methodology) as well as estimates related to business combinations, such as auditing projections used to value acquired intangible assets. An accounting estimate is inherently uncertain and by its very nature, there is no one correct answer. Looking back at past findings, the PCAOB has identified deficiencies in auditing estimates since 2015. Wow – more than five years and still it’s a common theme.
In my experience working with firms, whether in performing lookback/in-flight reviews or supporting firms on PCAOB inspections, there are clearly cases where engagement teams fail to perform procedures over estimates. But I also have seen instances where firms have performed substantive procedures using the limited information that is available in the marketplace, or looking to historical trends to attempt to support cash flow projections and yet the PCAOB still takes issue.
Is the PCAOB being overly exigent in its expectations of audit firms? What is considered “reasonable assurance” when auditing an estimate that is inherently uncertain and impossible to conclude with exactitude? Does the PCAOB have an unrealistic expectation of what auditor’s should be doing to test these estimates? While the PCAOB amended AS 2501, Auditing Accounting Estimates, is that sufficient or should the PCAOB release additional staff audit practice alerts to clarify its expectations?
C&A
In 2019, the PCAOB found that firms failed to sufficiently test information for completeness and accuracy (C&A). This was a sub-finding of its overall auditing accounting estimates finding, but C&A of information (from a substantive perspective) has been a common PCAOB finding dating back to the 2016 inspections observation report. It was even mentioned in the 2015 report when the PCAOB was discussing its concerns around professional skepticism. Why is it that the audit industry can’t seem to remediate this deficiency?
I remember when I was at the firm, more than 10 years ago, there was such a thing as “standard reports” and completeness was often obtained just through tying schedules back to the trial balance. In observing PCAOB inspections recently, I hear questions challenging the assertion that there is such a thing as a “standard report” or asking for additional testing over completeness. While I understand the logic that yes, any report in today’s day and age can be modified given the widespread ability to alter systems, it feels as though the PCAOB’s interpretation of standard report has changed from more than 10 years ago. It seems the more we learn, including the PCAOB, the more we refine our expectations.
Is the PCAOB’s expectations of testing C&A morphing over time? Should the PCAOB release more specific guidance relating to the testing of C&A?
ICFR
Internal controls over financial reporting (ICFR) is a huge area unto itself and thus it’s no surprise that the PCAOB continues to find deficiencies within ICFR. However, there are three main topics that continue to surface:
Management review controls (MRCs): Again, since 2016, the PCAOB has specifically identified teams’ failures to sufficiently test controls that incorporate management review. In 2019, the deficiency specifically states that firms failed to test these controls at a level of precision that would prevent or detect material misstatement and failed to understand what constitutes an exception and how exceptions were resolved. This is hardly a new issue and while the 2016 inspection observation is the first report to specifically mention MRCs, the fact that the PCAOB issued SAPA 11 in October 2013 is a clear indication that this was an issue even as far back as 2013.
EQR
The final theme I want to touch on is the engagement quality review. This theme was called out specifically in the 2018 inspections observation report and has been a part of the PCAOB’s QC discussions in previous reports. Though not specifically discussed in the 2019 report, through my work supporting firms with PCAOB inspections in 2019 and working with firms on remediation of PCAOB inspection reports, the EQR is consistently attributed to engagement performance deficiencies. Even in 2020, we have seen the PCAOB issue comments specifically for EQR deficiencies. Again, there are certainly instances where the EQR should have identified blatant significant engagement deficiencies. However, there are also instances where the nature of the PCAOB finding is so specific, it begs the question, do we really expect an EQR to identify deficiencies at this level? The recurrence of the EQR deficiency is implicitly creating an expectation that EQR reviews should be significantly more detailed. Yet again, is the PCAOB being realistic here with its expectations?
Taking a step back, the PCAOB consistently identifies firms’ failures to perform sufficient procedures and highlights these deficiencies. Having worked as an inspection specialist at the PCAOB and now as a consultant supporting firms and helping improve audit quality, I can say firsthand that identifying failures in audits is easy. Helping firms remediate those failures is significantly harder when forced to apply theory and standards to actual practice. Things are always more complex than they appear. Perhaps the PCAOB needs to take a more holistic approach when assessing deficiencies and ask themselves, “realistically, what more could the firm have done?” If the PCAOB can’t tell me how to fix these issues in practical terms, it begs the question, does the PCAOB have a realistic expectation of audits and what it means to obtain reasonable assurance?
The fact that many of these deficiencies are spanning five or more years, also means that most firms, whether annually or triennially inspected, will see these deficiencies repeat in their inspection reports. Repeat findings require new, incremental remedial actions to address the deficiencies. When the EQR finding appears for its third or fourth time in a PCAOB inspection report, it seems to indicate that firms are not capable of remediating the deficiency. So, either the regulator needs to step in to provide additional help and guidance, or could it perhaps be an indication that the PCAOB’s standard is unattainable?
While I’m not here to excuse audit firms, I do think the PCAOB needs to reflect on its own practices and consider if additional guidance, including practical application, is necessary to drive improvement. Identifying the same deficiencies year after year and not providing significant new guidance is almost complicit in the audit industry’s failure to address these deficiencies. Instead of telling firms what they failed to do, should the PCAOB consider advising firms on how to remediate these issues?
Although the actual audit standards applicable to the deficiencies discussed above have barely changed, if at all, it feels as though the PCAOB’s expectations of what it takes to meet those standards is evolving and becoming more and more stringent. To have so many of these failures perpetuate year after year across firms of all sizes within the industry, I begin to wonder, just like everyone else, will the PCAOB ever be satisfied?
Dane Dowell
is a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, DC.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084