With the Public Company Accounting Oversight Board putting the screws to external audit firms to get tougher on internal controls, it was only a matter of time before that pressure was passed on to the companies they audit.
It appears that time is here, as internal auditors and audit committee members say they are feeling the squeeze.
“It stands to reason that if the PCAOB is finding reasons to be critical of the work external auditors have done in controls or financial reporting, the auditors would place expectations on the company and turn to internal auditors to provide additional support,” says Hal Garyn, vice president of the Institute of Internal Auditors. “Anecdotally, that's what we're hearing.”
The PCAOB has delivered a steady stream of criticism to all major audit firms in their inspection reports during the past two years, calling for more audit evidence, more documentation, and more skepticism and scrutiny around a variety of audit areas.
It has paid even closer attention to the audit of internal controls. In a special report published in December, the board said it found problems with the audit of internal control over financial reporting in 15 percent of all the audits it checked in its 2010 inspection cycle, and 22 percent in its 2011 inspections. The board also drew a link between internal controls and financial statements, noting that 85 percent of the time when it found problems with the audit of internal controls there were also problems with the financial statement audit. According to the PCAOB's interpretation, that means auditors are giving assurance that financial statements are sound when they haven't done enough audit work to reach that conclusion.
Audit firms have had plenty of notice about the PCAOB's concerns about internal control audits. The PCAOB December report was based on inspections of 2009 financial statements, and the firms hear through the inspection process where the board has concerns with specific audits. “A lot has already happened in response to the latest report,” says Sara Lord, a partner with the National Professional Standards Group at audit firm McGladrey, the only major firm willing to talk about their response. “It's fair to say that across all firms, the accuracy, completeness, and reliability of data has received renewed focus the last few years.”
Still, the PCAOB's attention on internal controls is starting to spill over to the audit process in ways companies are starting to notice more recently. “It started last year,” says Louise Peabody, a partner with regional audit firm Watkins Meegan, which assists many public companies with Sarbanes-Oxley Act compliance. “But they've been a lot more focused now this year. We're not seeing it with just one firm, but a number of them. They're asking similar questions and requiring documentation along similar lines.”
>> Subscribe | Try a risk-free 10-day trial subscription to Compliance Week and enjoy a host of benefits.
Psst, Pass it On
Audit committee members, Dennis Beresford and Phil Wedemeyer, are hearing the presentations from audit firms explaining how they plan to approach controls differently going forward. “They're basically saying they're being responsive to the findings in the inspection reports, and that's increasing the work,” says Wedemeyer, a retired Grant Thornton auditor. Beresford said he's hearing from external auditors that they know the PCAOB is looking carefully at internal controls, and so auditors will be giving it more attention as well.
Wedemeyer expects auditors to spend more time creating flowcharts of processes and transactions to identify potential sources of misstatement. “Under auditing standards, you have to have an understanding of the flow of transactions as a basis for setting the scope of audit work,” he says. “The PCAOB has formed a view that a lot of audits are not sufficient in documenting the flow of transactions, so the firms are moving to flowcharting.”
“In some areas, external auditors are just not sure what's going to satisfy the reviewers. They're not always clear on what's needed or not needed.”
Auditors will also be asking more questions and performing more documentation on the skills and qualifications of individuals within the company who perform various control activities. As an example, Wedemeyer says, most control systems have some kind of reconciliation procedure, such as reconciling a bank account to a master account. Typically, auditors accept the qualifications and the details of the reconciliation without a great deal of questioning, he says. “The board now is saying they think auditors should get into the detail of who did the reconciliation and how that person performed the reconciliation,” he says. “If you rely on a review of the reconciliation as a control, you ought to talk to the person who does it and determine what they do when they review it.”
Peabody says she sees plenty of that kind of activity on the ground. “They're doing a lot more detailed documentation of procedures and inquiries they've made,” she says. Internal auditors likely do not perform documentation to the level of detail that external auditors are now demanding, she says, because they work more closely on a daily basis with the processes. “They want to document the knowledge and experience of the people who are doing the processes,” she says. “When you've worked with the finance staff for several years, you know their experience. You don't write that up every time you test something.”
According to Peabody, consensus is still very much developing on what external auditors need to do to gain the PCAOB's approval during inspections. “In some areas, external auditors are just not sure what's going to satisfy the reveiwers,” she says. “They're not always clear on what's needed or not needed.”
Still to be determined is who will pay for the additional time auditors will spend as a result of the PCAOB's call for more work. “It's not clear whether they expect to be paid for it or not,” says Wedemeyer. Beresford says it hasn't been addressed with his audit committee either. Peabody says she estimates the work she is doing on an internal audit basis on behalf of her clients has increased by roughly 10 percent.
“Establishing or creating more audit evidence means doing more work, and that means incurring more cost,” says Garyn. “The cost needs to be shifted somewhere. The cost is absorbed either by paying for it directly with the external audit costs going up, or by absorbing it internally as the company does more documentation and more work.”