A significant deficiency in internal control over financial reporting will not automatically constitute a critical audit matter that auditors will have to disclose under a new auditing standard, but it could suggest auditors will disclose a CAM related to the underlying accounting.
That’s the word from the Center for Audit Quality regarding how auditors will interpret a new rule from the Public Company Accounting Oversight Board that requires auditors to begin disclosing CAMs in audit reports beginning in mid-2019 for the largest companies. The new rules tell auditors they must identify those matters communicated to audit committees involving material accounts or disclosures that involved especially complex, challenging, or subjective auditor judgment.
Internal controls themselves are not accounts or disclosures, the CAQ points out in a resource meant to help audit committees and investors better understanding the pending new auditor disclosures. As such, internal controls are not subject to consideration by auditors as potential CAMs, the CAQ says.
“However, a significant deficiency could be among the principal considerations that led the auditor to determine a matter is a CAM,” the CAQ says. As an example, if a significant deficiency tipped the scale for the auditor in deciding that revenue recognition was a CAM, “then the auditor could describe the relevant control-related issues over revenue recognition in the broader context of the CAM without using the term ‘significant deficiency.’”
The CAQ released the publication to help explain to audit committees and investors the challenges that will be associated with the new auditor disclosures under the new auditor’s reporting model. Auditors are already complying with the earliest required changes to the audit report, which involve a tenure disclosure on each engagement and other less critical changes to the form and content of the standard auditor’s report.
The CAQ report addresses what it has found to be the most frequently asked questions about the new CAM disclosures in particular, not the least of which is whether a significant deficiency will automatically be identified as a CAM. The report also addresses, for example, how CAM disclosures will affect the communication between the auditor and audit committee. It shouldn’t have any effect, the CAQ says, despite concerns that some have raised that audit committees may be shy to raise questions with the auditor for fear it will increase the potential universe of CAMs.
The CAQ also tackles what types of matters will rise the level of CAM disclosure in most organizations. CAMs will related to significant risks, the CAQ says, but that doesn’t mean every significant risk will automatically become a CAM. “Not every significant risk involves especially challenging, subjective, or complex auditor judgment,” the CAQ says.
CAMs will only relate to the current period, the CAQ says, as the standard does not require auditors to address prior periods. It also addresses one of the questions often raised during the proposal and comment period about whether the disclosure would put auditors in the position of disclosing original information about the company.
The standard specifically says auditors are not expected to provide any information that companies have not already provided, but it doesn’t preclude the possibility. The Securities and Exchange Commission has said, the CAQ notes, that such situations are expected to be rare.