An Overview Of Recent Trends In PCAOB Inspection Reports

Transcription

1 Portfolio Media. Inc. 860 Broadway, 6th Floor New York, NY Phone: Fax: An Overview Of Recent Trends In PCAOB Inspection Reports Law360, New York (August 23, 2013, 11:54 AM ET) -- The Sarbanes-Oxley Act of 2002 requires accounting firms that audit public companies to register with and be subject to periodic inspection by the Public Company Accounting Oversight Board. The act mandates annual PCAOB inspection of registered accounting firms that provide audit reports for more than 100 issuers (the Annual Firms ), while firms providing audit reports on no more than 100 issuers are subject to board review once every three years. Regardless of the frequency, the PCAOB issues a two-part report on each inspection it performs ( Inspection Reports ). Part I of the report describes the inspection procedures and summarizes the results of the inspected firm s audit engagements, including audit deficiencies, if any. Part II contains additional detail, which may include a discussion of potential defects identified in the auditing firm s system of quality control. Quality control criticisms remain nonpublic so long as the firm addresses the alleged deficiencies within 12 months. Otherwise, the quality control criticisms are made publicly available.[1] Given the number of initiatives undertaken by the PCAOB and the volume of Inspection Reports issued each year, even diligent practitioners find it difficult to stay informed of key trends and findings. Toward that end, this article first provides an overview of the activities of the PCAOB since May of Second, it discusses our analysis of the PCAOB Inspection Reports issued in calendar years 2011, 2012 and 2013 on eight Annual Firms. Finally, it highlights trends in Inspection Reports of the Big Four firms i.e., Deloitte & Touche LLP, Ernst & Young LLP, KPMG LLP and PricewaterhouseCoopers LLP. Specifically, our review focuses on the PCAOB s allegations of failures among the Big Four firms to obtain sufficient audit evidence to support their opinions on financial statements. Recent PCAOB Trends and Initiatives There have been several developments, both external and internal to the PCAOB, that impact how the board approaches its responsibilities for the oversight of public accounting firms. Below, we summarize some of the recent initiatives influencing the PCAOB s audit inspections. Brokers and Dealers. The Dodd-Frank Act assigned the PCAOB responsibility to oversee the audits of brokers and dealers registered with the SEC. In 2011, the board began interim inspections pursuant to this new obligation. Per the PCAOB, there were approximately 4,400 brokers and dealers that filed audited financial statements with the SEC for fiscal years ended in 2011 and approximately 800 firms that audited them.[2] This legislative development, therefore, substantially expanded the oversight role of the PCAOB. The board issued its first summary report on the interim inspections of audits of SEC-

2 registered brokers and dealers in August 2012, identifying numerous deficiencies in the audits of 10 inspected firms. ICFR Audits. In December of 2012, the PCAOB issued a report regarding deficiencies in audits of Internal Control over Financial Reporting ( ICFR ) observed through its 2010 inspections of domestic Annual Firms. The PCAOB found that, in 46 of the 309 integrated audits inspected in 2010 (15 percent), the firm had failed to obtain sufficient audit evidence to support its audit opinion on the effectiveness of ICFR. Of these 46 audits, the firm also failed to obtain sufficient audit evidence to support the financial statement audit opinion in 39 cases. Expressing concern with the number and significance of deficiencies identified in firms audits of internal control, the PCAOB concluded that firms need to conduct more thorough analyses of internal control, the risks of material misstatement, and the root causes for these types of deficiencies.[3] Firms Failing to Address Quality Control Criticisms. As noted above, Part II of the Inspection Report may include a discussion of potential defects in the audit firm s systems of quality control that remains nonpublic so long as the firm addresses the alleged defects to the PCAOB s satisfaction within 12 months. Since the inception of the PCAOB, several Part II portions have been disclosed, mostly for smaller accounting firms and certain international affiliates of Annual Firms.[4] However, in October 2011, the PCAOB for the first time made public a portion of Part II for Deloitte & Touche.[5] In subsequent periods, portions of Part II were also made available for PricewaterhouseCoopers and Ernst & Young.[6] Public release of Part II criticisms for leading firms will likely continue given the PCAOB s emphasis on holding inspected firms accountable for improving audit quality. Professional Skepticism. The PCAOB is placing increased scrutiny on auditors use of professional skepticism in audits, having continued to identify deficiencies regarding the consistency and diligence with which auditors apply such skepticism.[7] In December 2012, the PCAOB issued a Staff Audit Practice Alert regarding this topic, to stress to auditors the appropriate application of professional skepticism throughout the audit process.[8] Deficiencies in PCAOB Inspections of Audits Performed by Annual Firms Each PCAOB Inspection Report presents findings from its investigation of audit engagements. For each selected audit, the PCAOB reviews the financial statements and the SEC filings of each issuer, and identifies areas of audit work that it deems higher risk. The PCAOB then inspects the audit working papers and interviews the engagement team about these areas. If the Board s risk-based assessment identifies audit deficiencies that exceed a certain significance threshold in the audit work it reviews, those deficiencies are summarized in the public portion of the Board s inspection report. [9] Beginning with reports for inspections performed in 2009, the PCAOB has released information regarding the total number of issuer audits reviewed and the number of those audits exhibiting a deficiency. The rate of audit deficiency implied by these two measures, although a simple statistic, has nonetheless been a revelation to the profession. Were one to equate a PCAOB-cited deficiency with an actual audit deficiency, the Inspection Reports indicate that a sizeable percentage of reviewed audits exhibit some type of deficiency.[10] The results by year for eight of the Annual Firms are as follows: BDO USA: 24 percent in 2009 (8 audits with alleged deficiencies out of a total of 33 issuers reviewed), 26 percent in 2010 (8 out of 31) and 39 percent in 2011 (9 out of 23).

3 Crowe Horwath: 15 percent in 2009 (2 out of 13), 62 percent in 2010 (8 out of 13) and 62 percent in 2011 (8 out of 13). Deloitte & Touche: 21 percent in 2009 (15 out of 73), 46 percent in 2010 (26 out of 57) and 42 percent in 2011 (22 out of 52). Ernst & Young: 9 percent in 2009 (5 out of 58), 21 percent in 2010 (13 out of 62) and 36 percent in 2011 (20 out of 55). Grant Thornton: 13 percent in 2009 (5 out of 39), 37 percent in 2010 (15 out of 41) and 43 percent in 2011 (15 out of 35). KPMG: 13 percent in 2009 (8 out of 60), 23 percent in 2010 (12 out of 52) and 23 percent in 2011 (12 out of 52). McGladrey & Pullen: 21 percent in 2009 (4 out of 19), 47 percent in 2010 (9 out of 19) and 50 percent in 2011 (8 out of 16). PricewaterhouseCoopers: 12 percent in 2009 (9 out of 76), 39 percent in 2010 (28 out of 71) and 43 percent in 2011 (26 out of 60). The number and rate of alleged audit deficiencies vary by firm and by year, but no firm or year is without concern. Average rates of alleged deficiency range from a low of 9 percent, for Ernst & Young inspections in 2009, to a high of 62 percent, for Crowe Horwath inspections in 2010 and The data appear to indicate that average rates of alleged deficiency have been growing. Overall, and on average, the data indicate that approximately 15 percent of the 371 inspected audits in 2009 contained some type of audit deficiency. While fewer issuers were inspected by the PCAOB in 2010 and 2011 (346 and 306, respectively), the average deficiency rate in each of those years was more than twice the 2009 result averaging 34 percent and 39 percent, respectively, across all eight firms. Given the risk-based approach to examination adopted by the PCAOB, the observed deficiencies are therefore in the targeted areas of audit work typically deemed higher-risk by the PCAOB work that is arguably more susceptible to identification of audit failures. Still, it is the higher-risk audit areas that should have received heightened attention by the Annual Firms and, conversely, one might expect that such work would be less susceptible to findings of audit deficiencies by the PCAOB. We caution against drawing conclusions regarding the overall quality of any particular audit firm based on this deficiency statistic, as there is subjectivity and judgment in both the audit process and the PCAOB reviews of the audits.[11] Still, the results cannot be dismissed. As the data show, certain firms clearly had a lower rate of cited deficiencies than others. That being said, the specific audit deficiencies identified by the PCAOB are numerous and varied, and we do not address them in detail here. The reader is encouraged to review the Inspection Reports of the PCAOB for additional insight. Big Four Audits Demonstrating Failures to Perform Sufficient Audit Procedures We have reviewed the detailed comments provided by the PCAOB to the Big Four firms in their 2010

4 and 2011 Inspection Reports. Collectively, these Inspection Reports identify 159 issuer audits containing alleged audit deficiencies. We have sought to identify and understand concentrations in the criticisms cited by the PCAOB, particularly with regard to alleged failures by the firms to obtain sufficient appropriate audit evidence to support their opinions on the financial statements.[12] Our analysis necessarily involves judgment, and reasonable minds may disagree as to our characterization of any particular audit failure or its impact on related trends. Also, it should be noted that the groups we describe are not necessarily mutually exclusive, as a particular audit deficiency may align with more than one category of failure. Lastly, our understanding of any alleged audit failure necessarily depends upon and is limited to the information provided by the PCAOB. Overreliance on management representations. The audit deficiencies described by the PCAOB included numerous occurrences in which the Big Four firms were criticized for overreliance on representations by management. Approximately 30 percent of the deficiencies cited in the 2010 reports, and 40 percent in the 2011 reports, featured criticism of an audit because the procedures relied too heavily (or exclusively) on inquiry, conversation, representations or documentation provided by management when the auditor should have sought additional corroborative evidence. Generally speaking, auditing standards recognize that the quantity of audit evidence needed is affected by the risk of financial misstatement (the greater the risk, the more evidence is likely to be required) and also by the quality of such audit evidence. Therefore, in our opinion, the prevalence of findings of audit failures attributable to overreliance on management assertions in the higher-risk areas that are the focus of the PCAOB inspections is particularly troubling. Failure to perform appropriate substantive procedures. When an auditor determines that a risk of material misstatement at the assertion level is significant, the auditor should perform audit procedures that are specifically responsive to the risk. However, the PCAOB noted numerous failures on the part of the Big Four firms to design or perform appropriate procedures on accounts, transactions, or financial statement disclosures that the Board deemed to have been material or significant. The specific deficiencies cited were numerous and varied, but in the most general sense, involved basic errors in the design and execution of audit tests performed on material transactions or balances. The simplicity, yet severity of the deficiencies described in the Inspection Reports speak for themselves. In hindsight, these failures seem preventable with appropriate planning, supervision and review. Reliance on insufficiently tested issuer controls. The PCAOB identified numerous occurrences of audit failures in which the auditor allegedly failed to obtain or document audit evidence regarding the operating effectiveness of the controls in the period. This type of deficiency was cited in over 20 percent of the issuer audits, although there was a high degree of variability across the Big Four firms. (For one firm in one year, perhaps as much as two-thirds of the PCAOB-identified deficiencies entailed this type of audit failure.) Reliance on insufficiently understood information. In designing substantive audit procedures, the auditor considers, among other factors, the reliability of data and reports on which the audit testing is based. With regard to the Big Four firms, the board found that about 40 percent of the issuers with identified audit deficiencies involved inappropriate reliance on reports, methods or assumptions that the auditor failed to understand or sufficiently test.

5 The PCAOB observed in these instances that the auditor could not adequately demonstrate an understanding of the integrity, reliability, or accuracy of the information on which it relied. In certain cases, the Big Four firms were criticized for failing to assess the professional rigor of other auditors or third-party sources that supplied evidence upon which they relied. Failure to update audit procedures after interim field work. For certain of the Big Four firms, there was a high percentage of audit deficiencies found in which the auditor failed to update its audit testing between an interim date of field work and the issuer s year end. In some instances, the auditor failed to obtain updated information regarding important model inputs; in others, the auditor failed to include in the audit testing transactions after the preliminary field work. The PCAOB also highlighted instances in which the design of the audit procedures to update findings was deemed insufficient or in which the auditor placed inappropriate reliance on potentially stale thirdparty information. In perhaps the worst-case scenario, the PCAOB noted situations in which the auditor simply failed to perform any year end procedures on significant accounts or transactions. Failure to update audit procedures or testing to reflect additional or contradictory evidence. The auditor is required to exercise professional skepticism a questioning mind and critical assessment of audit evidence. [13] It is troubling, therefore, when deficiencies cited in the PCAOB reviews include circumstances where the PCAOB determines the auditor failed to sufficiently evaluate or respond to evidential matter that came to its attention. In the 2010 and 2011 Inspection Reports, it appears that about 40 percent of the allegedly deficient audits reviewed included at least one observation that the auditor had failed to evaluate and respond to audit evidence appropriately. The specific criticisms and the causes vary throughout the reports, but, in general, they suggest a lack of diligence by the auditor, a lack of supervision, or a lack of appropriate skills. The alleged deficiencies include failures to recognize or evaluate contradictory evidence, to examine significant differences between auditing expectations and findings, and to respond adequately to indicators of fraud risk. Occasionally, the auditor was criticized by the PCAOB for failing to respond to audit information by appropriately modifying the nature, timing and extent of procedures. Failure to employ sufficiently precise analytical procedures. The PCAOB identified various deficiencies related to auditors alleged failure to employ analytical procedures that were sufficiently precise to provide a necessary level of assurance or to detect a material misstatement in the financial statements. Often, the cited deficiency pertained to a flaw in the design of the audit procedures themselves. Another common theme, however, was the auditors failure to follow up appropriately on unexpected variances; in some such cases, the PCAOB noted that the only information sought by the auditor to understand the difference was an explanation from management. That being said, our analysis of the PCAOB reviews found wide variability in the degree to which such deficiencies were identified among the Big Four firms. While only 5 percent of one firm s cited deficiencies in a given year involved flawed analytical procedures, such issues accounted for almost 40 percent of the deficiencies observed at another Big Four firm. Conclusion Our summary of the PCAOB Inspection Reports is intended to provide an overview of the audit areas that the board has emphasized as likely involving heightened levels of audit risk and of the alleged deficiencies in audit procedures and controls testing that it has identified among leading audit firms.

6 While we believe that the PCAOB s findings are informative, we caution against placing too strong an emphasis on any particular discussion of alleged deficiencies. It is important to remember that all of the faults cited by the PCAOB in the Inspection Reports are but a small subset of the nearly innumerable accounting transactions, pieces of audit evidence, consultations and judgments considered by the large registered accounting firms in any given year. Oftentimes, the deficiencies cited by the PCAOB ultimately resulted in no changes to the auditor s opinions or to the financial statements constituting their subject. Nevertheless, we believe that the information in the PCAOB Inspection Reports provides a compelling reminder of the auditing risks, both perennial and emerging, that require from accounting professionals continuing technical focus, audit vigilance and professional skepticism.[14] By Elizabeth Kroger Davis and L. Joe Moravy, Finance Scholars Group Elizabeth Davis and Joe Moravy are managing directors of Finance Scholars Group, a national financial and economic consulting firm, and are based in the firm's Chicago office. Both are former partners of major accounting firms. The authors would like to recognize Gary Stahlberg and Julia Berson of FSG for their assistance with this article. The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice. [1] See PCAOB, Firm Inspection Reports, [2] PCAOB Release No (Aug. 20, 2012), at i. [3] PCAOB Release No (Dec. 10, 2012), at i-ii. [4] See PCAOB, Firms that Failed to Address Quality Control Criticisms Satisfactorily, Reports/Pages/FirmsFailedToAddressQCSatisfactorily.aspx. [5] PCAOB Release No A (May 19, 2008), at 16. [6] PCAOB Release No A (Mar. 25, 2009), at 9; PCAOB Release No A (Aug. 12, 2010), at 12; PCAOB Release No A (July 2, 2010), at 9. [7] See, e.g., Jeannette M. Franzel, PCAOB, Protecting Investors by Seizing the Opportunity to Strengthen Audit Quality, (Jan. 18, 2013). [8] See PCAOB Staff Audit Practice Alert No. 10 (Dec. 4, 2012). [9] PCAOB Release No (Aug. 15, 2012), at 2. [10] The PCAOB cautions that the frequency of deficiencies identified in the reviewed audits does not necessarily represent the actual frequency of deficiencies throughout the firm s practice. [11] See PCAOB Release No (Nov. 8, 2011), at 2.

7 [12] This article does not address ICFR deficiencies among the Big Four firms, since such findings are the subject of another recent report by the PCAOB. See PCAOB Release No (Dec. 10, 2012). [13] PCAOB, AU Section 230, Due Professional Care in the Performance of Work, available at at 7. [14] The complete article with further discussion of deficiencies is available at Inspection-FINAL.pdf. All Content , Portfolio Media, Inc.