PCAOB Inspection Data: Shifting Standards, Shifting Insights

Angst runs deep in the compliance and audit community over a steady, five-year climb in inspection deficiency rates for the largest audit firms, with regulators and the audit profession alike conceding that deficiency rates need to change direction.

So how did we get here? And more importantly, how do we turn around the ship?

Although inspection findings are not a clear indicator of whether audit performance across the profession is getting better or worse, they underline the need for improvement enough that all parties involved want to find some way to remedy the situation.

First, the history. The Public Company Accounting Oversight Board has been performing audit inspections as a means to bring improvements to audit performance since shortly after the board was created under the Sarbanes-Oxley Act to regulate the profession. The board began with limited inspections on the Big 4 in 2003 and has been refining its inspection approach ever since.

“There was a learning process in the first couple of years,” says Dan Goelzer, a founding member of the PCAOB who served as interim chair before departing in 2012. Inspections initially focused on aspects of a particular engagement, and inspectors gradually refined their ability to target where they were most likely to find problems. “It’s been an evolution of the regulator,” Goelzer said. “Once you identify a topic where the board may feel that firms’ practice is generally out of sync with auditing standards, then you start looking for those areas in audits.”

“As we have grown, we have gained more experience and are able to look at more and more risky parts of the audit. We are able to zero in on what’s more important in any given year and any given audit.”
Helen Munter, Director of Registrations and Inspections, PCAOB

Over the years, inspectors have focused on certain issues based on what was happening with standards or the business environment, audit experts say. Fair value, for example, became a big focus in audit inspections circa 2009, when the financial crisis made fair-value accounting so urgent, Goelzer says. Internal controls over financial reporting became an inspection focus after the board was pressured to replace its initial standard on internal control audits (Auditing Standard No. 2) with a new, more risk-focused approach (Auditing Standard No. 5) in 2007.

“Internal control over financial reporting didn’t even exist as an element of the audit in the first couple of years of PCAOB inspections,” Goelzer says. “And even after it did, it wasn’t looked at closely for at least the first two, three, four years of internal control auditing.” Today, in contrast, compliance with AS5 is one of the most commonly cited problems in inspection reports.

Inspection focus also has shifted as the board has issued other new standards, says Dee Mirando-Gould, senior technical director at consulting firm MorganFranklin and a former associate chief auditor at the PCAOB from 2008 to 2011. “The PCAOB has put out a lot of new standards in the last several years, and every time a standard is effective, inspectors are going to be focused on how well auditors have implemented that new auditing standard,” she says. “So you’re going to see deficiencies around certain standards in the first few years.”

The board also has refined its method for selecting audits for inspection. The selection process isn’t random; rather, inspectors target the highest risk areas of the highest risk audits, looking for problems. “We learn more every year about how to refine and make a little more sophisticated our risk-based approach to selection,” says Helen Munter, director of registration and inspections at the PCAOB. “As we have grown, we have gained more experience and are able to pinpoint more and more risky parts of the audit. We are able to zero in on what’s more important in any given year and any given audit.”

That might be one explanation for why audit deficiency rates are rising—from a low of 15 percent in 2009 (the first year the PCAOB provided data that enabled calculation of a rate), to 34 percent in 2010, 38 percent in 2011, and 42 percent in 2012. The rate leveled off somewhat by 2013 at 43 percent.

CHANGES STILL AHEAD

Below, CW’s Tammy Whitehouse explores what steps the PCAOB is taking to refine its inspection process.
The PCAOB is taking a variety of measures to continue to refine its regulatory approach and possibly report more about audit inspection findings, which advocates say would help investors and audit committees better understand and use inspection reports.
The board has acknowledged the long delay in when it completes its inspection work and final reports are made available to the public. Although the PCAOB has stepped up the pace somewhat, the delay is still a problem, says Lorraine Malonza, director of accounting advocacy and financial research at Financial Executives International.
The PCAOB recently published the last of its 2013 inspection results, long after firms have already prepared for and perhaps even completed their 2014 year-end audits. In some cases, reports are issued in time for year-end audit planning, but barely, she says. “This really stretches everyone’s time and effort for something that that could have been better dealt with in the middle of the year when you are writing your year-end audit work procedures.”
The board is considering other measures to provide more insight, such as general summary reports (the board calls them “Rule 4010” reports) about the board’s own root cause analysis of audit failures, says Helen Munter, director of registration and inspections for the PCAOB.
The board also changed its terminology in inspection reports to soften the language around its findings that deserve to be called out by inspectors. In prior years, reports made often mention of audit “failures” because auditors missed important steps or procedures to properly support their audit opinions. In more recent reports, however, the PCAOB has begun calling its findings “deficiencies.” PCAOB member Jay Hanson called attention to the language, believing readers of inspection reports equated audit failures with restatements.
That has raised debate over just how severe audit findings really are. Munter says anything appearing in “part 1” of a PCAOB inspection report has already “made the cut” as a problem serious enough that the firm issued an audit opinion without adequate evidence. Other audit observers say they could benefit from knowing more about the seriousness of deficiencies, much the way internal control reporting distinguishes between material weaknesses and significant deficiencies.
“It’s very difficult to ascertain if a firm had a deficiency in documentation or had a real audit failure,” says Malonza. “What does an audit failure or an audit deficiency mean? Should they restate? It’s the same complaint we hear over an audit opinion that is only a pass-fail with no surrounding color.”
Cindy Fornelli, executive director of the Center for Audit Quality, agrees some insight into how findings relate to one another would be helpful to audit committees. “This is something we see other jurisdictions doing,” she says. “I do think it would give audit committees and investors and even the audit firms and the engagement teams themselves a bit more flavor if there were some way to delineate the severity of deficiencies.”
—Tammy Whitehouse

Some audit observers have pondered whether the inspection process would better represent what’s happening with audit performance across the profession if audits were selected for inspection more randomly, says Joe Carcello, executive director of the corporate governance center at the University of Tennessee and a past member of the PCAOB’s Standing Advisory Group. “The board’s reaction has been to have a sample size large enough to have statistically valid conclusions, it would have to be pretty big,” he says. “That would siphon resources away from audits with problems. Firms would have less of a mandate to improve because problems would never have been identified in the first place.”

The real question that occurs to auditors every time they face a new inspection cycle is whether, as inspectors shift their focus and refine their selection process, they also raise the bar in terms of performance expectations.

Auditors believe they do. The PCAOB denies it.

“The bar has been raised,” says Gaylen Hansen, a partner with regional firm EKS&H and a former PCAOG SAG member. “Expectations have increased.” Referring to the five-year rise in deficiency rates, he says: “I can’t believe the firms are doing less today than they were doing five years ago. This is visible and public information, and they are under a lot of pressure. I just don’t believe it would happen.”

Alex Schillaci, national managing partner of inspections for Deloitte & Touche, is more diplomatic. “That’s a hard one to answer,” he says. “I do think they’ve helped us raise our focus on quality. Having an external party you know is going to be looking over your shoulder does help. We continue to raise the bar on quality.” As firms have dealt with issues each year, “we raise the bar on ourselves,” he says.

Phil Wedemeyer, an audit committee member for Atwood Oceanics and a former auditor and staff member at the PCAOB, says he believes the bar rose particularly on internal controls. “The number of control deficiencies around internal controls jumped pretty dramatically,” he says. “I personally believe that was a change in PCAOB policy. “Somewhere in the last three to four years, their approach to inspecting internal controls changed in an undefined manner.”

Munter says while the board refines its selection process, it has not raised its performance expectations. “It’s important to understand that the bar has not moved in how we judge a finding,” she says. “Audit work might improve, yet still result in an audit opinion that is not appropriately supported. We’ve seen some evolution in the audits performed but deficiencies are still too high.”

PCAOB Chairman James Doty has addressed that question publicly as well. In December, Doty said: “The standards are the standards. The audit procedures are the audit procedures. They’ve been there for a long time. If we’re better at finding where are auditors not doing their job, we’re not raising the bar. We’re refining where the audit firms need to address their efforts.”