PCAOB ponders plateau, calls on firms to dig deeper

After several years of regulatory audit inspections and some incremental improvements along the way, audit firms are still turning out deficiency rates that raise alarm. And now recent allegations of fraud and conspiracy at one Big 4 firm suggest at least some auditors are still in denial over the demand for better outcomes.

Since 2010, inspection reports from the Public Company Accounting Oversight Board show major audit firms have turned out deficiency rates in the double digits, even approaching and exceeding 50 percent on a few occasions. Among the Big 4, the average deficiency rate peaked at 39 percent in 2013, then tapered to 35 percent in 2014 and 33 percent in 2015. Results for 2016 are not yet complete.

The PCAOB’s process for selecting audits for inspection intentionally searches for audits that are most likely to contain problems. The board never intended for its inspection reports to serve as scorecards for grading or ranking audit firms. Yet data on deficiencies provides a benchmark that can’t be ignored, even by members of PCAOB and audit firms, who have indicated in various ways that they are not yet satisfied based on the deficiency rates seen in recent years.

At a year-end national accounting conference, PCAOB member Jeanette Franzel said inspection results have improved across the system, with a reduction in both the percentage and severity of deficiencies identified in audits. But with deficiency percentages still in the 20s and 30s at Big 4 firms and in some cases higher in other annually inspected firms, regulators are beginning to worry about a “plateau” in improvements.

“This plateau may call for a renewed focus on firms’ quality assurance systems from the top down,” said Franzel, whose term on the board is nearly complete. Audit firms have dedicated significant resources to remediating audit deficiencies and improving quality control systems, she said, but her praise contained an important qualifier. “To varying degrees across the large firms,” she said, “we’ve seen improvements in tone at the top, coaching and support to audit teams, training, and monitoring of quality.”

“I can’t help but stand back a bit and say, like any good internal control, there has to be a cost-benefit relationship. While some might shoot me for saying this, I wonder if we are at the point of diminishing returns.”
Greg Wilson, retired consultant from PCAOB

To varying degrees, Franzel said.

That qualifier makes sense in light of recent allegations of fraud and conspiracy against former KPMG audit leaders who are accused of illegally obtaining and acting on PCAOB inspection information to subvert the inspection process.

Both the U.S. Department of Justice and the Securities and Exchange Commission have brought charges against six accountants—three career leaders at KPMG, two accountants who joined KPMG directly after departing the PCAOB, and one inspection staffer at the PCAOB. One of the six settled the charges while the other five are contesting the allegations.

"As alleged, these accountants engaged in shocking misconduct—literally stealing the exam—in an effort to interfere with the PCAOB's ability to detect audit deficiencies at KPMG," said Steven Peikin, co-director of enforcement at the Securities and Exchange Commission. "The PCAOB inspections program is meant to assess whether firms are cutting corners, compromising their independence, or otherwise falling short in their responsibilities. The SEC cannot tolerate any scheme to subvert that important process.”

The SEC enforcement orders and Justice Department indictments allege a multiyear process whereby audit leaders at KPMG recruited a PCAOB staff member to join the firm and share what he knew about the board’s plans to inspect KPMG. The documents describe use of illegally obtained information to beef up audit work papers in advance of inspections, and to alert partners whose audits would be inspected so they could focus more attention on those audits. Documents also describe the engagement of an outside consultant to employ data analytics in an effort to identify which audits would be selected for inspection.

While the charges focus on six individuals, federal authorities indicate that at least five other partners at KPMG appeared to have some knowledge of the use of illicit information, as well as an outside consultant. One of those partners is credited with taking suspicions to the firm’s general counsel, which launched an investigation that led to dismissals and self-reporting by the firm to authorities.

At the same year-end accounting conference, the PCAOB’s director of inspections, Helen Munter, spoke extensively about culture, which she said generally is “pretty good” at a number of firms. She also used some qualifiers, however.

“Some firms have explicit messaging that audit quality is the primary objective and support that messaging with significant actions,” said Munter. Some firms even expand accountability for quality beyond the lead engagement partner.

Some firms, Munter said, not all.

“We have seen other instances of mixed messages,” said Munter. “We have seen instances in which a firm does not hold partners in leadership or oversight positions accountable for negative quality events when appropriate, which may signify that there is not a firm-wide commitment to improving audit quality.”

Questions for audit committees to ask their auditors

In her remarks to audit firms, Helen Munter, director of inspections and registration at the Public Company Accounting Oversight Board, posed a number of questions to audit firms to consider how equipped they are to take audit quality improvements to the next level. Those same questions might prove useful for audit committees to explore with their external audit firms.
Does your firm have in place a system of quality control that provides it with reasonable assurance that its personnel comply with applicable professional standards and the firm's own standards of quality?
How do you know audits are being performed in a quality manner on a consistent basis? What are the controls you rely on? How quickly would someone coming to your organization understand those controls and be able to become part of that system? Does staff at all levels understand those controls?
Does your firm approach PCAOB inspection results by remediating individual problems or by addressing systemic issues identified through either internal or external reviews?
Does your firm exhibit a tone at the top that emphasizes the importance of the role of the audit to the financial markets – an attitude of serving the investor? Are you cultivating a culture where due care, including professional skepticism, is rewarded throughout the firm as part of a firm strategy?
Do you hold audit leaders, not just the lead engagement partner, accountable for audit quality? Engagement quality reviewers? Managing partners? Partners assisting in multi-location audits? Do you incorporate audit quality goals and metrics into partner performance evaluations?
Does the firm have policies in place to assure that they are assigning personnel with the technical expertise to successfully complete audits, providing necessary training, and advancing personnel with the appropriate qualifications?
How do you manage an engagement team’s workload to assure sufficient time is allocated to perform the audit? How do you assure your engagement quality reviews are allocated sufficient time and comply with standards?
What are your policies and procedures with respect to consultations with the national office? Are your audit teams encouraged to pursue consultations in complex or subjective areas? Are there barriers that prevent teams from seeking consultations?
How do you monitor the firm’s system of quality control? How do you identify and assess root causes of audit deficiencies where they are identified, either through internal or external reviews?
How do you assure compliance with auditor independence requirements?
How are you remediating deficiencies in the key areas commonly called out in inspections, including assessing and responding to risks of material misstatement, auditing internal control over financial reporting, and auditing accounting estimates, including fair value measurements?
Source: Helen Munter speech, AICPA Conference

Cindy Fornelli, executive director of the Center for Audit Quality, said in a written statement that public company auditors take inspection results “very seriously,” with firms devoting significant resources to understanding and remediating findings. The largest firms publish voluntary transparency reports, like Deloitte’s 2016 report, describing significant initiatives to improve audit quality, including the formation of advisory councils and investments in training and technology.

Jeff Burgess, national managing partner of audit services at Grant Thornton, said the firm has a “major focus” on audit quality. Grant Thornton is the only firm among the top six that would comment on inspection results. Grant Thornton’s reports generally have improved over the past few years, with a deficiency rate that peaked at 65 percent in 2012 but dropped to 24 percent in 2016.

“When I think about our own inspection results, I don’t think we’ve plateaued at all,” says Burgess. He says firms have addressed many of the issues that have been raised in inspection reports over the years, and now the issues are becoming more narrow.

“Over time, we’ve seen in our inspection findings that we’ve improved in those areas where we could get a big bang for our buck and now the findings tend to be more nuanced,” Burgess says. “They are issues where it takes a lot more to make a big move. Now we’re dealing with precision.”

Inspection reports among the annually inspected firms the past few years have devoted plenty of attention to problems with the audit of internal control over financial reporting. Within that area, management review controls seem to be especially problematic, says Tom Ray, lecturer at Baruch College and a former chief auditor at the PCAOB.

“There are a number of things under management review controls where auditors are not doing a very good job,” says Ray. “This is a fairly complex area, so it makes me wonder if it’s possible that the people being assigned to do that work are not sufficiently skilled or experienced. Or is it not being supervised sufficiently?”

Another common pain point in inspection reports involves auditor response to the risks of misstatement. Auditors need to identify risks of misstatement, identify controls that mitigate those risks, then assure those controls operate effectively so as to prevent misstatement. “Some of the findings suggest to me that there’s not the proper level of critical thinking” in this area, says Ray. Inspection reports seem to suggest engagement teams sometimes struggle to understand how management controls are working, how they’re designed, and how to obtain evidence about how the control actually operated, he says.

Dan Goelzer, a partner at law firm Baker McKenzie and a founding member of the PCAOB when it was formed in 2002, says firms have come a long way in taking seriously the inspections process. “They’ve gone from regarding reports as reflections of matters of professional disagreements to taking in good faith how to improve their quality control and drive down the number of deficiencies,” he says.

Given the way the PCAOB selects audits for inspection, looking specifically for audits that are most likely to have problems, it’s unrealistic to believe deficiencies will ever drop to zero, says Goelzer. Inspections are meant to serve as a teaching tool for the firms, he says.

Goelzer also expects continued evolution in technology to have an effect on audit quality over time. “We’re on the doorstep of an artificial intelligence revolution that’s not going to eliminate deficiencies but it’s going to change the conversation about where they come from and what they mean,” he says.

Greg Wilson, a consultant retired from the PCAOB, echoes the sentiment that deficiency rates will never get to zero, but he wonders what level will be deemed acceptable. “I can’t help but stand back a bit and say, like any good internal control, there has to be a cost-benefit relationship,” he says. “While some might shoot me for saying this, I wonder if we are at the point of diminishing returns.”

Firms and regulators can do plenty to analyze the root cause of continued deficiencies, but the onus remains on audit firms to dig deeper and address those deficiencies, says Wilson. “It’s time for the firms to clear their heads,” he says. “They’re doing all these traditional things to enhance their quality control, but what can they do to think differently?”