As children, we all heard the story of the boy who cried wolf. Leaving the sheep and wolves aside, what happens when the audit regulator continues to cite the same auditing standards year after year in its firm inspection reports? Does the PCAOB’s message lose its effectiveness? Does the public become like the townspeople who eventually stop listening or responding?
Did you know that there are currently over 50 auditing standards that have been issued by the PCAOB? 55 to be precise. On top of that there are other various rules over ethics and independence, quality control standards, and attestation standards. Some of the auditing standards are only five paragraphs, such as AS 1010 – Training and the Proficiency of the Independent Auditor while other standards are 98 paragraphs long with as many as three appendices such as AS 2201 – An Audit of Internal Control Over Financial Reporting That is Integrated with An Audit of Financial Statements.
Wow. That’s a lot of guidance and presents so many opportunities for audit deficiencies. And yet, surprisingly, the PCAOB seems to take issue with many of the same auditing standards year after year after year.
After analyzing the PCAOB’s common findings, we decided to perform our own analysis of PCAOB inspection reports to evaluate the evolution of those reports over time and the nature of the findings described by the PCAOB. Perhaps not surprising, we found many of the same themes that the PCAOB self-reported. However, what was surprising is that approximately 77.8% of the PCAOB’s findings can be boiled down to just a couple auditing standards (AS 2201, AS 2301, AS 2501, AS 2810) and within those standards, the PCAOB seems to generally cite just a couple paragraphs. Add in two more standards (AS 1105 and AS 2315) and you have now accounted for approximately 90.6% of all deficiencies.
The Process
To start, we began by analyzing the general evolution of firm inspection reports. Understandably, early on in its formation, the PCAOB was growing and adapting as it learned what it meant to be an audit regulator. The early reports morphed almost every year. Earlier reports were organized by issue while later reports came to be organized by issuer. Sometimes the reports varied between the detail for Big Four and those for the small and mid-tier firms. Early on, there was no specific citation of auditing standards. In fact, auditing standards were not specifically referenced in the public reports until 2014.
The PCAOB continued to modify reports over time and then with the entirely new Board appointed in 2018, the entire report changed. The inspection reports became more uniform, more condensed, and provided some context for readers to understand how to interpret the results, such as historical inspection results so that readers could understand quality trends.
To do our analysis specifically, we took the information from all domestic inspection reports published from 2017 (after the PCAOB codified the old standards) through July 7, 2021. In Part 1 of the inspection reports, we then counted each time an auditing standard was cited (one reference to a standard equates to one deficiency, regardless of the number of paragraphs referenced). Then we began to aggregate and analyze the data.
The Findings
Let’s take a closer look at the findings and what they indicate:
AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statement (35.8%)
Surprise, surprise. Deficiencies in testing over internal controls have been a challenge since the onset of Sarbanes-Oxley. Over the last couple years, there seem to be more and more concerns related to auditor’s testing over management review controls (MRCs), but this has been the case since 2013 when the PCAOB released SAPA 11 with specific guidance over MRCs. Yet, teams continue to struggle with identifying controls to address relevant assertions, testing completeness and accuracy over information used in controls, and sufficiently testing the design and operating effectiveness of controls. What this means is that in almost 20 years since the onset of SOX, the industry still struggles to “get it right.”
AS 2301 The Auditor’s Responses to Risks of Material Misstatement (17.5%)
The PCAOB references a number of different paragraphs within this standard, but the general issue boils down to the fact that engagement teams fail to design and execute procedures sufficient to address the risk of material misstatement. Some of the guidance is very prescriptive; for instance, for significant and/or fraud risks, auditors must perform a test of detail (no exceptions). For all relevant assertions, engagement teams must perform substantive procedures (no exceptions). However, the overall design of the audit is inherently based on risk. Applying significant, professional, auditor judgment, engagement teams must determine the nature, timing and extent of testing to be performed, taking into account both controls and substantive procedures. The PCAOB’s findings with respect to AS 2301 calls into question the auditor’s ability to apply judgment and effectively design audits to address the risks of material misstatement. Considering how foundational risk assessment is to the overall execution of the audit, this finding carries a lot of weight.
AS 2501 Auditing Accounting Estimates, Including Fair Value Measurements (15.5%)
Again, no surprise here. The continued findings involving estimates is perhaps what spurred the PCAOB to issue new guidance in a revised AS 2501 standard. But let’s be honest, that standard didn’t really change the guidance significantly. It really condensed AS 2501, AS 2502 and AS 2503 into one main standard, but the meat and bones of the audit procedures expected to test management estimates did not drastically change. Despite the continued focus over auditing estimates, firms across the industry are failing to sufficiently audit these areas.
AS2810 Evaluating Audit Results (9.0%)
Scanning through our findings, the deficiencies related to AS 2810 tended to fall into two main areas. First, engagement teams failed to sufficiently consider contradictory evidence. This means that teams did not sufficiently document or dispose of information that might have contradicted management assertions or engagement team conclusions. Second, auditors failed to perform sufficient procedures to conclude on specific accounting considerations and whether financial statements were appropriately presented. Both of these findings are alarming considering audits are designed to act as a check on management. So, to think that auditors are not considering contradictory evidence would inherently call into question the purpose of an audit. In addition, audits are designed to ensure that the financial statements are fairly stated (including presentation and disclosure, which is predicated on accounting considerations). So, to think that auditors are failing to sufficiently audit accounting considerations, again, makes us wonder, what is the audit actually accomplishing?
Other Considerations
As the table shows, there were, of course, other audit areas that are cited. And this is certainly not a complete picture of the PCAOB’s findings. This analysis represents only Part I findings, or in other words, findings that mean the auditor’s opinion is not supported. For instance, a PCAOB comment over audit committee communications would not necessarily jeopardize the audit opinion and so these types of comments have traditionally only been disclosed in Part II of inspection reports, which are private, unless a firm fails to pass remediation. Only recently with the new report format, Part I B discloses some of these findings. As well, this analysis does not take into account clean inspection reports where no Part I issues were identified.
It is worth noting however, of all inspection reports published from 2017 to 2021 (to-date) approximately 58% of firms have at least one deficient audit. That means more than half of the industry is failing in the eyes of the PCAOB. Whoa!
So What Does it All Mean?
Taking a step back, what does the data mean or suggest? For us, it raises several questions:
Not only is it the same deficiencies, but looking at reports published from 2017 through 2020, there are more and more deficiencies being cited per inspection report. That’s not a positive trend. We think the industry overall would agree that the PCAOB has brought about significant change and audit quality has improved from the turn of the century. But have we reached a plateau? What will it take to tackle these recurring issues? And is the PCAOB merely crying wolf in citing the same standards year over year over year without taking action to effectuate change? Give it enough time and people stop listening when it’s the same message and there’s no change. What will happen then when the PCAOB finally spots an actual wolf and identifies a truly egregious audit issue?
Dane Dowell, CPA
is
a Director at Johnson Global Accountancy who works with PCAOB-registered accounting firms to help them identify, develop, and implement opportunities to improve audit quality. With over 12 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Dowell has extensive experience in audits of ICFR and has worked closely with attorneys in the PCAOB’s Division of Enforcement and Investigations. Prior to the PCAOB, he worked with asset management clients at PwC in Denver, Singapore, and Washington, DC.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084