September 2006 – It was my first day working in public accounting. At lunch, I remember my firm relationship partner telling me how when he started at the firm everything was still done on paper. In an effort to modernize, the firm actually paid its associates extra if they volunteered to use a computer. Mind you, this was before the days of laptops, so using a computer meant carrying around a hefty desktop computer to all of your client sites. He actually had a dolly in his car to carry the computer around.
As technology improved, the public accounting industry began to embrace electronic workpapers and then began to utilize computer assisted auditing techniques. Now, we can’t imagine a time where audits were performed without laptops, email, electronic workpapers, data analytics, and replicating databases with cloud servers. It was an inevitable trend in the public accounting industry and firms sooner or later had to embrace information technology.
As operating companies embrace information technology, once manual processes are becoming ever-increasingly automated. Paper journals and ledgers have become excel spreadsheets. Inventory receiving and shipping has moved from labor-intensive operations to heavily automated processes. Today, I believe we are reaching a critical threshold where it will become impossible to perform an audit without some element of internal controls reliance.
While all public companies must have internal controls, currently, the requirement to perform an integrated audit is limited to public companies who meet certain criteria linked to revenue and market capitalization thresholds . The thresholds requiring an integrated audit are regulated by the SEC while the auditing standards are governed by the PCAOB. Most in the profession know that AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements is the “ICFR” standard.
RELATED: Accelerating Audit Quality for Unaccelerated Filers: Changes to the Thresholds
However, while not an explicit requirement, the PCAOB acknowledges that there are circumstances where substantive procedures alone are not sufficient and, in these circumstances, the engagement team should test controls. Specifically, AS 2301: The Auditor’s Responses to the Risks of Material Misstatement states this:
Also, tests of controls must be performed in the audit of financial statements for each relevant assertion for which substantive procedures alone cannot provide sufficient appropriate audit evidence and when necessary to support the auditor's reliance on the accuracy and completeness of financial information used in performing other audit procedures.
An example where this might apply is in the audit of an internet banner company where revenue is derived from “clicks” on banners. There is no tangible evidence that can be pulled to validate the clicks on a banner site. The company has to have effective controls, including controls over its systems, to capture a complete and accurate population for revenue. The engagement team cannot otherwise obtain comfort over completeness. In fact, it can’t even pull an “invoice” to evidence occurrence of revenue since it’s all online and intangible.
While this example may be unique, I believe we are beginning to enter a phase where all companies, public and private, are using information technology. “Companies no longer have to commit significant capital to have robust, technological accounting functions,” said Joe Lynch, JGA Managing Director. “With the advances in usability of ERP platforms, along with favorable cost models, modern systems allow smaller companies the ability to easily implement systems with robust accounting functions on a small month-by-month per user cost.”
The increasing integration of systems into the financial reporting process is progressing to such a great extent that it is becoming almost impossible to audit many companies without having controls over systems and information produced from those systems. The PCAOB has continued to iterate the importance of testing the completeness and accuracy of information used in an audit, regardless of whether it is an integrated audit or not. In fact, this is one of the PCAOB’s recurring inspection deficiencies that has been surfacing since 2016.
When engagement teams use information produced from a system, in simple terms, there are two options to test that data:
When talking about an AR aging, it may be easy enough to just manually test the report at year-end by tying the total balance per the AR aging report to the general ledger and then taking a sample of invoices and corroborating the aging bucket. Okay, easy enough. But what if there are 30 separate AR aging reports, one for each operating location. Is the engagement team going to manually test all 30 reports? Or would it be more efficient to test the controls around the systems and the reports? This is the dilemma facing audit firms.
Let’s leave AR aside and think about inventory for a traditional manufacturing company. Many of these companies have implemented ERP systems and other information technology to automate the sales and inventory processes. While some elements of inventory may be easy to test substantively, what about companies that use the system to track overhead or calculate purchase price variances or calculate price adjustments from standard cost to FIFO. A substantive test over these elements is getting increasingly complicated. The engagement team will need various reports from the system to perform the testing, but without controls, how is the team comfortable with the completeness and accuracy of these reports? Or what about inventory reserves? Many reserve analyses are based on inventory usage and consider factors such as last sale date, number of items sold in a year, or last purchase date. Without controls, how can a team conclude on the accuracy of these data characteristics. Yes, it may be possible to test substantively, but it becomes more and more complicated and the question of efficiency resurfaces: is it more efficient to test controls over the systems and the processes or do we do purely perform substantive procedures?
Though engagement teams may still be able to perform substantive tests, it is getting increasingly complicated and difficult because there is so much information and data coming from systems. Joe speaks from his own experience, “I have led numerous audit teams through the process of system mapping and consistently, as we trace the data lineage and the whiteboard fills up, the reality sets in on how the nature, timing, and extent of substantive testing needs to be increased because systems are out of scope.” As technology improves and more systems and processes are automated, audits are going to become more and more complex. Understanding systems will become increasingly more important and eventually, we will have no choice but to scope in systems for testing. In fact, IT is arguably becoming the most important element in an audit and a “simple IT failure” can dramatically impact and reshape an entire audit.
That’s all great, but what can I really do? The key is to start investing now in ICFR and technology competencies and capabilities.
Of course, when I say integrated audit, I don’t mean that firms are necessarily going to issue an opinion on ICFR. The requirement to issue an ICFR opinion is still regulated by the SEC. However, I think firms will begin to perform integrated audits, or partially integrated audits so that they can issue their opinions over the financial statement. Perhaps the integration of controls is only over significant accounts like revenue and inventory as other areas like accounts payable may still be easy to test substantively. Regardless, it is certain that, sooner or later, control testing will need to cover information systems, including ITGCs, automated controls, interfaces and reports and queries. The more prepared a company is, the better.
It used to be that integrated audits were just for public companies and I’ve heard plenty of firms tell me that ICFR doesn’t pertain to them since they only focus on private clients. That may be so, but just like public accounting firms inevitably embraced information technology in the execution of an audit, so too are firms going to be forced to embrace integrated audits, largely due to information systems and automation. It’s an inevitability that’s just a matter of time. So invest now, upfront, so you’re prepared when we reach that point; in a day of Moore’s Law, it’s sooner than we think.
Dane Dowell
is a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, DC.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084