On April 25, 2023, GAAP Dynamics co-facilitated a webinar, Get Ready for PCAOB Inspections and Peer Reviews, with former PCAOB inspectors Helen Munter and John Fiebig, founders of ADIGEO Consulting, a consulting firm focused on improving audit quality and helping firms defend their good work to regulators, plaintiffs, and public opinion. We had 162 people attend the webinar. Attendees were evenly split between preparers and auditors. The purpose of this post is to provide a summary of the webinar and to answer the questions asked by participants. If you missed the webinar, check out the recorded, simulated live version .

We started the webinar by talking about audit deficiency rates of the annually inspected firms (currently at 26% based on the 2021 inspection), including a discussion of the reasons between the gap in deficiency rates of the Big 4 and non-Big 4 firms which has been growing wider over the past several inspection cycles. This sparked the following questions from participants:

Why does the PCAOB do investigations?

It’s a requirement by law. The Sarbanes-Oxley Act authorizes the PCAOB to inspect registered firms for the purpose of assessing compliance with certain laws, rules, and professional standards in connection with a firm’s audit work for public company and broker-dealer clients.

Under the Sarbanes-Oxley Act and as explained in detail in Rule 4003 of the Board’s rules, the PCAOB annually inspects registered accounting firms that regularly provide audit reports for more than 100 issuers, while those that regularly provide audit reports for 100 or fewer issuers are inspected at least once every three calendar years, with a few limited exceptions as specified in Rule 4003.

What is considered a deficiency?

If a deficiency is included in a PCAOB inspection report, it means that the audit firm did not obtain sufficient appropriate audit evidence at the time it issued its audit report to support its opinion that:

• The financial statements were presented fairly, in all material respects, in accordance with the applicable reporting framework; and/or
• The issuer had maintained, in all material respects, effective internal control over financial reporting (“ICFR”).

Inclusion of a deficiency in an inspection report – other than those deficiencies for audits with incorrect opinions on the financial statements and/or ICFR – does not necessarily mean that the issuer’s financial statements are materially misstated or that undisclosed material weaknesses in ICFR exist. 

We then dove into the specific auditing standards leading to many of the deficiencies including:

• Risk assessment and the related auditor response
• Auditor requirements surrounding internal controls
• Due professional care and professional skepticism
• Supervision and review
• Accounting estimates

During these sections, the following questions were asked by participants:

As said, low risks still are risks, and they should be resolved, but what if management accepts the low risk due to immateriality? What’s your recommendation for a situation like this?

Management's risk assessment is separate from the auditor's risk assessment. As such, we (the auditors) would also need to agree with management that the transaction, balance, or disclosure is immaterial, both quantitively and qualitatively, and looked at both individually and in the aggregate. It is important to remember the definition of materiality. Misstatements, including omissions, are material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

According to the SEC’s Chief Accountant, Paul Munter, in a statement given in March 2022, he noted that a fact is material if there is “a substantial likelihood that the…fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” In the statement, he goes on to say:

A materiality analysis is not a mechanical exercise, nor should it be based solely on a quantitative analysis. Rather, registrants, auditors, and audit committees need to thoroughly and objectively evaluate the total mix of information. Such an evaluation should take into consideration all relevant facts and circumstances surrounding the error, including both quantitative and qualitative factors, to determine whether an error is material to investors.

If the auditor concludes it's immaterial, then inherently there is no risk of material misstatement. If the auditor concludes the balance is material, then the auditor assesses the overall risk of material misstatement and that could result in a very low risk. That risk assessment then impacts the nature, timing, and extent of our audit procedures. Therefore, if the risk is very low, we might be able to get away with very minimal substantive procedures.

Remember that auditors must always perform substantive procedures for all relevant assertions for all significant accounts. Also, be sure to document your risk assessment, including your conclusion of immateriality, in the work papers!

If your QC is an outside contractor, should you communicate this to the audit committee?

We weren’t sure what the questioner meant by “QC,” although we assumed it related to quality control. If you are using an outside contractor as the Engagement Quality Reviewer (EQR), then the answer is “yes,” you should communicate this to the audit committee, just as you would if you utilize other auditors and/or specialists. However, if the firm is hiring QC specialists to help the firm with the new quality control standards (ISQM / SQMS), then this is part of a greater conversation that you would have with the audit committee on what the firm is doing to increase audit quality, but it would not necessarily be required to be communicated directly to them.

The SEC has specialized rules for small companies (SRC rules, non-accelerated filers, EGCs). In a similar spirit, why doesn't the PCAOB recognize the inherent differences between the largest global audit firms and smaller audit firms? They are very different.

It could be argued that the PCAOB already makes concessions for smaller audit firms. In general, the PCAOB inspects each firm either annually or triennially (i.e., once every three years). If a firm provides audit opinions for more than 100 issuers, the PCAOB inspects them annually. If a firm provides audit opinions for 100 or fewer issuers, the PCAOB, in general, inspects them at least triennially. Also, even for the annually inspected firms (those auditing more than 100 issuers), the PCAOB selects fewer audits from smaller firms as compared to Big 4. For example, here are the number of audits selected related to the 2021 inspections of the annually inspected firms:

1. Deloitte (54)
2. PwC (56)
3. EY (56)
4. KPMG (54)
5. RSM (17)
6. BDO (30)
7. Grant Thornton (31)
8. Crowe (17)
9. Moss Adams (14)
10. Marcum (25)
11. Cohen & Co. (9)
12. WithumSmith+Brown (17)

I pulled up a few of the most recently issued inspection reports for triennially inspected firms, and many of them only had 1-2 engagements subject to inspection procedures. So, it appears the PCAOB is making some concessions for smaller firms. That said, firms need to be aware that auditing SEC registrants does come with an increased level of scrutiny (and costs)!

In a similar comment/question, this participant talked about a PCAOB proposal issued in March 2023, which, among other things, proposes to shorten the time auditors have to finalize their documentation:

Latest proposal to accelerate finalization of workpapers from 45 to 14 days suggests technology enables this. Smaller firms do not have the budgets for / adoption rates of technology that the Big 4 and larger nationals have. Why not differentiate by size of firm, size of registrant?

First, some background. AS 1215 currently states:

Prior to the report release date, the auditor must have completed all necessary auditing procedures and obtained sufficient evidence to support the representations in the auditor’s report. A complete and final set of audit documentation should be assembled for retention as of a date not more than 45 days after the report release date (“documentation completion date”).

As noted by the questioner, the PCAOB is proposing that the documentation completion date be accelerated to 14 days, noting that the growing “use of electronic workpapers facilitates more efficient performance and review of audit procedures and enables auditors to assemble a complete and final set of audit documentation in less time than a paper-based environment.”

Now and in the future, the auditor is required to complete all necessary auditing procedures, review those procedures, and obtain sufficient appropriate audit evidence prior to the report release date. The period between the report release date and the documentation completion date (archive period) allows the auditor to assemble the complete and final set of audit documentation. This period is not for performing additional audit test work, nor completing all the necessary reviews. The PCAOB believes accelerating this timeline “would enable the Board to potentially begin the inspection process sooner after completion of an audit, which could enhance investor protection, ultimately enhancing investor confidence.” They also note that the SEC has accelerated the filing deadlines for registrants.

In its proposal, the PCAOB notes:

In addition, the 45-day period may increase the risk of improper alteration of audit documentation. Specifically, a lengthy period to finalize audit documentation may reduce firms’ incentives to proactively complete all necessary auditing procedures, review those procedures, and collect sufficient appropriate audit evidence prior to releasing the audit report, as required under AS 12.15.

The proposal is still outstanding. Therefore, we recommend you submit a comment and voice your concern.

What is a reasonable percentage of partner time to total hours on an engagement?

Great question that, unfortunately, I don’t have an answer to, but I would love to know! But, if I had to give an answer, I would give the best one in all of accounting/auditing…it depends! Factors like the size and complexity of the company, number of significant or unusual transactions, and current market environment would all impact this ratio.

This question took me back a few years to the notion of audit quality indicators (AQIs). Back in 2015, the PCAOB released a Concept Release on AQIs. Also, the Center for Audit Quality (CAQ) has been at the forefront of the movement to develop quantitative and qualitative metrics regarding the audit – commonly referred to as audit quality indicators (AQIs) – that could be used to better inform audit committees about key matters that may contribute to the quality of an audit.

In January 2019, the CAQ published their Audit Quality Disclosure Framework to assist firms that publish audit quality reports. Such reports provide a window into how the firm promotes and measures audit quality. Here’s an example of some of the AQIs recommended in this report that, based on my review of the most recent audit quality reports published by the Big 4 firms, were disclosed:

• Governing board (or equivalent) composition, including diversity mix
• Description of committee(s) responsible for overseeing audit quality
• Average annual voluntary turnover rate (expressed in percentages) by staff level with insight into how the firm monitors turnover
• Average hours worked in excess of standard workweek by staff level
• Percentage of total audit hours performed by specialists (such as information technology, tax, and valuation)

In fact, during my review of the audit quality reports, I noted that the Big 4 firms disclosed the vast majority of the AQIs recommended by the CAQ report, with one notable omission…

Leverage ratios of audit-related hours for audit team member expressed in percentages (e.g., partner to staff, manager to staff), or percentage by staff level compared with total audit hours.

Oh well!

We then talked about how “the GAAP is back,” looking at those audit areas with frequent deficiencies. No surprise that revenue, and related accounts, is a repeat offender. Interesting that the most noted deficiency related to the financial statements was that firms “did not sufficiently evaluate the appropriateness of the issuer’s accounting method or disclosure for one or more transactions or accounts.” As we’ve said since our inception in 2001, you cannot audit what you don’t understand, which is why firms hire us to train their professionals in U.S. GAAP, IFRS, and audit!

We ended the webinar by talking about PCAOB “hot spots” including:

• Audit evidence
• Compliance matters
• Independence
• Remediation

We then asked participants the question: “Are PCAOB audits getting harder?” Here are some of the responses:

Yes!!! Much harder!

Yes, it’s getting harder. It seems like there is intense scrutiny on everything!

I'm a fairly new auditor, I'm not sure if it's getting harder, but there certainly is a lot to consider and keep track of.

Yes, it’s getting harder on both the auditor and the auditee. Part of the difficulty is rolling out controls and additional activities to keep up and ensure compliance is met in a feasible way with the existing company resources.

From an auditee perspective, the changes in “expectations” is a key driver to increases / stagnant number in annual deficiencies. Essentially new concepts and focus areas not looked at in previous years.

These sentiments were echoed in a CAQ report Perspectives on Management Review Controls: Challenges and Solutions – Insights from a Qualitative Study of the Issues published in November 2020.

Inspections will get harder and more challenging. PCAOB recognized the overall trend continuing shortage in accountants / auditors in general (particularly the ones with experience) and how potentially this may impact overall audit quality.

This participant must have read the recent PCAOB Spotlight document issued in April 2023 noting that the PCOAB is aware of firms’ hiring challenges and onboarding/training staff in a remote environment. We summarize this PCAOB Spotlight document in this post.

Thanks to all the participants who attended the webinar! A vast majority of them enjoyed the webinar and found it a worthwhile investment of their time as evidenced by these comments:

Excellent, excellent, excellent!! I really liked it! Thanks!

The presenters were very engaging and made the discussions very interesting. Thank you!

I love the practical examples given and the way that the webinar is done in layman's terms that even a first year would be able to understand.

Many of you wanted us to provide detailed examples and/or go a bit deeper into the various topics (sounds like there’s an appetite for future webinars / training). Admittedly, we probably already bit off a bit more than we could chew as several respondents noted that the webinar felt rushed at the end and we ran a bit over the allotted 1.5 hours. Points noted and we will take all your qualitative comments on board for future webinars.

If you’d like to discuss tailored accounting or audit training for your firm, we’re here to help!

About GAAP Dynamics  

We’re a DIFFERENT type of accounting training firm. We don’t think of training as a “tick the box” exercise, but rather an opportunity to empower your people to help them make the right decisions at the right time. Whether it’s U.S. GAAP training, IFRS training, or audit training, we’ve helped thousands of professionals since 2001. Our clients include some of the largest accounting firms and companies in the world. As lifelong learners, we believe training is important. As CPAs, we believe great training is vital to doing your job well and maintaining the public trust. We want to help you understand complex accounting matters and we believe you deserve the best training in the world, regardless of whether you work for a large, multinational company or a small, regional accounting firm. We passionately create high-quality training that we would want to take. This means it is accurate, relevant, engaging, visually appealing, and fun. That’s our brand promise. Want to learn more about how GAAP Dynamics can help you? Let’s talk!

Disclaimer  

This post is published to spread the love of GAAP and provided for informational purposes only. Although we are CPAs and have made every effort to ensure the factual accuracy of the post as of the date it was published, we are not responsible for your ultimate compliance with accounting or auditing standards and you agree not to hold us responsible for such. In addition, we take no responsibility for updating old posts, but may do so from time to time.