Leaders of the auditing world are calling for a truce in the arguments between internal and external auditors over how much evidence external auditors should collect themselves while scrutinizing corporate finances and internal controls—and are calling on audit committees to intervene earlier as referees of those disputes.
That issue of how much external auditors can rely on the work of internal auditors was a running theme at the Institute of Internal Auditors’ national conference last week, prompting the IIA and the Center for Audit Quality to urge that corporate audit committees get more involved in planning how internal audit and external audit can cooperate and avoid unnecessary duplication of audit effort.
“As often happens, when the regulator speaks, perhaps in some cases there can be an overreaction,” Richard Chambers, president and CEO of the IIA, said.
The regulator in question is the Public Company Accounting Oversight Board. It spoke back in October 2013 through its Audit Practice Alert No. 11, which warned external auditors that their work on audits of internal control over financial reporting needed marked improvement. The PCAOB summarized inspection findings to call out numerous areas where inspectors found too many departures from professional standards, including reliance on the work of internal auditors.
The 25-page alert includes a few pages reminding auditors of their duty to consider risk when using the work of internal audit and to evaluate the competence and objectivity of internal auditors who performed any work that external auditors might rely on. “When using the work of others that provide direct assistance, the auditor should supervise that work, including reviewing the work, as well as testing and evaluating it,” the PCAOB wrote.
“Essential value will be lost if external auditors avoid internal auditors’ work or turn this process into a massive duplication effort.”
Jeanette Franzel, Member, PCAOB
Internal auditors say they have most definitely felt the consequences of that pronouncement. In an IIA survey to assess a variety of issues across the internal audit profession, 65 percent of internal auditors at public companies said they have experienced increased scrutiny from external audit as a result of the PCAOB’s guidance, and 55 percent said they are increasing the number of hours they devote to provide direct assistance to external auditors—essentially acting under external auditors’ orders.
STRATEGIC CONSIDERATIONS FOR INTERNAL AUDIT
Below is a list of starter questions put together by the IIA and Audit Executive Center for CAEs to pursue with their key stakeholders.
When collaborating on annual planning activities, do external audit and internal audit have a common understanding of what areas are deemed most risky from an ICFR standpoint? Is there clear agreement on an acceptable level of external audit’s reliance on the work of internal audit for these risky areas?
Does the audit committee have an understanding of where external audit is, and is not, placing reliance on the work of internal audit, and the rationale behind the reliance parameters?
Do internal audit and the audit committee clearly understand how external audit evaluates the competence and objectivity of internal audit?
If there are opportunities to enhance the competence of internal audit, are those opportunities being pursued?
If there are opportunities to enhance the perceived objectivity of internal audit, are those opportunities discussed?
Sources: IIA; Audit Executive Center.
Jeanette Franzel, a member of the Public Company Accounting Oversight Board, said at the IIA conference that the over-reliance problem was not nearly as pervasive in inspection findings as external auditors’ apparent response to Practice Alert 11 would suggest.
“Overall, our inspection results regarding the external auditor’s use of internal auditors’ work are relatively positive,” she said. “For the U.S.-based member audit firms of the six largest global networks, the number of audit deficiencies involving the external auditors’ use of internal auditors’ work is low overall. And it is low on a relative basis as well, when compared to other frequently cited deficiencies and to the total number of deficiencies identified through our inspections.”
Franzel said she is disappointed to hear anecdotal accounts of external auditors reducing or avoiding reliance on internal audit work to avoid an inspection finding. “Letting the pendulum swing too far is not a solution audit firms should be using to respond to PCAOB findings in this area,” she said. “Essential value will be lost if external auditors simply avoid the use of internal auditors’ work or turn this process into a massive duplication effort and check-the-box documentation exercise.”
Calming the Mood
The CAQ and IIA conducted roundtable discussions to try to air out the tension, says Cindy Fornelli, executive director of the CAQ. “The alert was not meant to be a new standard, but to clarify the PCAOB’s expectations of external auditor reliance on the use of internal audit’s work,” she says. “It became clear it may have inadvertently created tension between internal audit and external audit.”
A joint report from the IIA and CAQ says auditors vented at roundtable discussions that the PCAOB is looking for granularity, that the guidance has strained the relationship between internal and external auditors, and that management is irked over the “audit fatigue” of having its staff subjected to duplicative audit demands, not to mention the cost consequences. More than 60 percent of internal auditors in the IIA survey said their external audit fees are rising.
“It’s clear there are still some cases where external auditors are being particularly cautious, and perhaps just not relying on the work of internal audit at all, or asking for a lot of additional documentation to re-perform the work of internal audit, essentially,” Chambers says. “All of that creates tension between internal and external audit, and external audit fees going up creates angst with the audit committee and management in general.”
The solution that emerged from roundtable discussions, says the CAQ and IIA, is for audit committees to get more involved and for audit planning to be more coordinated and better communicated upfront. The audit committee, internal audit, and external audit should plan together how the work will be allocated, what templates will be used, and how walkthroughs will be performed to reduce duplication of efforts. “The audit committee can help coordinate internal audit’s time and resources and how those are going to be used by external auditors,” Fornelli says.
External auditors would welcome that conversation, says Sara Lord, a partner with McGladrey. “Everything can benefit from more communication,” says Lord, who has seen the tension on both sides through the firm’s external audit services as well as outsourced internal audit services. “Reach out sooner, and plan this together. What are your audit plans? Are you using sample sizes that are sufficient? Do you have enough coverage coordinated with our audit methodology? This can only benefit the risk structure of the company and assure effective use of resources.”
Peter Bible, a partner with audit firm EisnerAmper, says the tension represents a “pothole” in the continued evolution of auditing as a regulated profession. He worries the tension could harm the strides internal audit has made in recent years in becoming more elevated in corporate structures.
“I would hate to see this become a step backward for them,” he says. “If firms are less likely to rely on the work of internal audit and do the work themselves, that has a couple of outcomes—all bad. The audit fees go up, and management will start questioning why internal audit needs a large budget.”
Chambers doesn’t believe that’s an immediate concern. “There’s probably a healthy appreciation among management and audit committees that perhaps this has been an overreaction on the part of external auditors to the PCAOB’s guidance,” he says.
Lord says auditors are responding to the totality of standards and guidance, not any one piece of guidance. “As CPA firms, we’re responding to guidance issued by the PCAOB in the form of official standards as well as guidance given through the course of inspection,” she says. “It’s difficult to point to just one of those sources of guidance and say you overreacted to a certain piece without looking at it in total.”
No comments yet