The PCAOB’s continuing concern about audits and internal control over financial reporting
In August, Jeanette Franzel, a member of the PCAOB Board (i.e., not a staff member) made an interesting presentation to the Annual Meeting of the American Accounting Association.
You can read the text of her speech on the PCAOB web site.
From my reading (and while she states for the record that it is her personal opinion, I would be shocked if PCAOB staff were not aligned), here are the two main concerns:
- The rate of deficiencies identified by the PCAOB Examiners in the audits of the financial statements and internal control over financial reporting (ICFR) continues at about the same high level as in prior years, although some improvements have been noted. The Examiners found deficiencies in the documentation by the auditors of how they determined, for example, the level of precision in management review controls, or why they believed that they had identified the ‘right’ key controls.
- The level of restatements outpaces the level of disclosed material weaknesses. Ms. Franzel believes this merits study. This is also an area of concern to the SEC.
Ms. Franzel also talked about whether PCAOB inspections are leading the audit firms to increase fees. She acknowledged that she is hearing (including from me) that some audit teams are performing work that is not necessary if a top-down and risk-based approach is taken. She said:
At the same time, I’ve heard anecdotal accounts about auditors adding work that is potentially not value-added, while driving up audit fees, in response to PCAOB inspection findings. We’ve also heard that constructive and productive communication is sometimes lacking between auditors and audit clients, with the engagement teams simply telling an audit client that certain work must be done in a particular way “because of PCAOB inspections.”
I believe that there probably are some cases out there where auditors are doing too much work or not the right kind of work in an attempt to respond to or avoid a PCAOB inspection finding, and that communication between the auditors and clients on these matters has not been productive.
To the extent that this is happening, “we” collectively, including the firms, audit teams, issuers, and the PCAOB, need to get a handle on this, so that valuable audit resources are not being diverted from areas that are high risk.
My comment on this is that these audit teams who are not communicating are often unable or unwilling to show the registrant exactly what the PCAOB Examiners have said that is driving the need to perform the work. Frankly, as Ms. Franzel has acknowledge in other remarks, the audit firm has said told management that the Examiners required specific actions when the Examiners don’t provide that kind of detail in their guidance.
Coming back to the issue of why the level of disclosed material weaknesses is less than the level of restatements.
Ms. Franzel comes close to at least a part of the answer in a footnote:
Depending on the timing of the discovery of a misstatement in the financial statements or the announcement of a restatement, in some cases the issuer may be able to effectively remediate any related material weaknesses that could result in a clean audit opinion on ICFR in the year of the announced restatement.
Here are some things for all of us, including the PCAOB and SEC, to consider:
- The assessment of the effectiveness of ICFR is as of the end of the year. However, not only may the deficiency that led to the misstatement driving the restatement have occurred earlier in the year and been corrected, but it may have occurred in a prior year! At Maxtor, where I was CAE and also ran the SOX program, our financial reporting manager (Wai Lim) identified an error in tax-related accounting from a prior year. While we needed to restate, the ICFR issue was in that prior year. Our current ICFR was excellent: it identified a prior period error that had escaped the external audit firm in both prior and current years.
- Internal control does not provide perfect assurance, only reasonable assurance. Errors will occur because controls are performed by humans. When these errors are infrequent, if it is possible to say that the material misstatement was due to a rare mistake and that there is less than a reasonable possibility of a recurrence; it is possible to assess ICFR as effective. AS5 may correctly indicate that a material error is an indicator of a material weakness, but it does not say that it is automatically a material weakness – which would be incorrect.
- Registrants rarely disclose material weaknesses in ICFR or disclosure controls in their quarterly filings with the SEC (although required by §302 of SOX) – even though they have identified deficiencies that, if not remediated, may represent material weaknesses at the end of the year. I believe this is a problem meriting significant attention by the SEC and PCAOB. (The PCAOB because even though the external audit firm does not audit the quarterly financials, they are aware of controls that have failed during the year and have an obligation to comment when the filing contains misstatements.)
By the way, I recommend Francine McKenna’s post, where she focuses on external auditor performance.
I welcome your comments.