Nearly one-quarter of audits are deficient with respect to audits of internal control over financial reporting (PCAOB AS 5) based on recent PCAOB inspection reports. That’s based on the 2015 inspection of the annually inspected firms by the PCAOB. The PCAOB reviewed audit procedures performed in 321 audits. Seventy-five (23.4%) noted an audit deficiency related to AS 5, more than double the deficiencies noted for any other auditing standard.

However, the statistics are even more telling when comparing the number of audit deficiencies related to PCAOB AS 5 as compared to the total number of audit deficiencies noted. During their 2015 inspection cycle of the annually inspected firms, the PCAOB noted a total of 439 audit deficiencies. A whopping 182 (41.4%) related to AS 5, more than triple that of any other auditing standard!

Top 5 Specific Audit Areas with AS 5 Deficiencies

Based on our review of the 2015 PCAOB inspection reports, the following audit areas had the most deficiencies noted related to AS 5 (in order of frequency):

1. Revenue, including accounts receivable, deferred revenue, and allowances
2. Inventory and related reserves
3. Business combinations, including contingent consideration
4. Impairment of goodwill and intangible assets
5. Loans, including the allowance for loan losses

Example Finding

Let’s review an actual finding noted in one of the inspection reports to gain a better understanding of the issue.

The Firm selected for testing a control consisting of reviews of the issuer’s revenue disclosures. The Firm’s procedures to test this control were limited to inquiring of one of the control owners and inspecting initials on the quarterly disclosure checklist as evidence that a review had occurred. The Firm also pointed to its testing of the accuracy of the issuer’s disclosures, but these procedures did not directly test the control. The Firm’s testing did not include ascertaining and evaluating the nature of the review procedures that the control owners performed.

This finding relates to deficiencies in applying the following paragraphs of PCAOB AS 5:

Testing Design Effectiveness

AS 5, paragraph 42 states:

The auditor should test the design effectiveness of controls by determining whether the company’s controls, if they are operated as prescribed by persons possessing the necessary authority and competence to perform the control effectively, satisfy the company’s control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements in the financial statements.

Testing Operating Effectiveness

AS 5, paragraph 44 states:

The auditor should test the operating effectiveness of a control by determining whether the control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively.

Integration of Audits

AS 5, paragraph B9 states:

To obtain evidence about whether a selected control is effective, the control must be tested directly; the effectiveness of a control cannot be inferred from the absence of misstatements detected by substantive procedures. The absence of misstatements detected by substantive procedures, however, should inform the auditor’s risk assessments in determining the testing necessary to conclude on the effectiveness of a control.

Testing Controls – A Worldwide Problem

Audit deficiencies related to internal controls are not just confined to the United States. Within their report on 2016 inspection findings, the International Forum of Independent Audit Regulators (IFIAR) noted that 18% of the inspected audits of public interest entities (PIEs) had at least one finding related to internal control testing.

With respect to the findings related to internal control testing, by far the most noted finding was a failure to obtain sufficient persuasive evidence to support reliance on manual internal controls.

Other findings noted in the IFIAR report related to internal control testing included:

• Failures to sufficiently test controls over, or the accuracy and completeness of, data or reports produced by management;
• Failures to test sufficiently information technology general and application controls;
• Failures to adequately assess the appropriateness of placing reliance on the work of others; and
• Failures to appropriately adjust testing as a result of ineffective controls or to sufficiently evaluate the severity of control deficiencies.

Preview of 2016 Inspection Results

Don’t expect audit deficiencies related to PCAOB AS 5 to go away any time soon! Based on preliminary 2016 inspection results of the annually inspected firms, the PCAOB continues to see significant deficiencies in the audit work for internal control over financial reporting (ICFR).

Despite improvement in some areas of ICFR audits, such as the evaluation of control deficiencies and testing controls over the accuracy and completeness of system-generated data and reports used in the performance of controls, the PCAOB continues to identify deficiencies related to testing of the effectiveness of controls that include a review element.

According to a speech by Helen Munter, Director, Division of Registration and Inspections, at the 2016 AICPA Conference on SEC and PCAOB Development, “some auditors did not sufficiently evaluate the procedures performed by management, including the criteria management used to identify matters for investigation and the steps involved in investigating and resolving such matters.” According to Ms. Munter, a root cause of deficiencies related to audits of ICFR may be due to a lack of understanding by auditors as to the extent of procedures and evidence that needs to be obtained when they test controls with a review element.

Conclusion

Learn from others’ mistakes! Tighten up the audit procedures and documentation related to management review controls, especially in the specific audit areas noted in this post. Increase the scrutiny of internal work paper reviews. Provide additional training to engagement teams. Don’t be a statistic! 

Disclaimer 

This post is published to spread the love of GAAP and provided for informational purposes only. Although we are CPAs and have made every effort to ensure the factual accuracy of the post as of the date it was published, we are not responsible for your ultimate compliance with accounting or auditing standards and you agree not to hold us responsible for such. In addition, we take no responsibility for updating old posts, but may do so from time to time.